diff --git a/src/commands/schema/cli-help-topics.test.ts b/src/commands/schema/cli-help-topics.test.ts index cb87b4fec0..783a564486 100644 --- a/src/commands/schema/cli-help-topics.test.ts +++ b/src/commands/schema/cli-help-topics.test.ts @@ -293,6 +293,15 @@ test('usageForCommand resolves scripting help topic', async () => { assert.match(help, /agent-device fill 'id="password"' "\$AD_VAR_PASSWORD" --record-as PASSWORD/); assert.match(help, /published script contain only \$\{PASSWORD\}/); assert.match(help, /Do not record passwords\/tokens without --record-as/); + // #3261: the fill privacy controls stop at agent-device's own surfaces; XCTest's iOS + // diagnostics are outside that boundary on a simulator and on a physical device. + assert.match( + help, + /keep the literal out of agent-device's own responses, diagnostics, and recorded scripts/, + ); + assert.match(help, /on iOS, XCTest writes its own diagnostic logs and its \.xcresult bundle/); + assert.match(help, /typed text can appear in both, on a simulator or a physical device/); + assert.match(help, /use test-only credentials when they may be kept or shared/); assert.match(help, /test --json marks a failed test with infrastructure: true/); assert.match(help, /It remains a failed test/); assert.match(help, /REPLAY_DIVERGENCE with a bounded report/); diff --git a/src/commands/schema/cli-help.ts b/src/commands/schema/cli-help.ts index 32bf5dcab7..62fec6a4a6 100644 --- a/src/commands/schema/cli-help.ts +++ b/src/commands/schema/cli-help.ts @@ -168,6 +168,7 @@ Reusable open-to-destination scripts: To keep the value out of the CLI's argv as well, pipe it in with --text-stdin instead of a text argument: printf %s "$AD_VAR_PASSWORD" | agent-device fill 'id="password"' --text-stdin --record-as PASSWORD --text-stdin reads at most 64 KiB, removes exactly one trailing newline, and refuses a terminal, empty input, invalid UTF-8, or an extra text argument. While recording is armed, --record-as publishes \${VAR} and --no-record leaves the step out; passing neither is an error. Without an armed recording the step is not recorded. It is not available inside batch steps. + The privacy controls for typed input (--text-stdin and --record-as) keep the literal out of agent-device's own responses, diagnostics, and recorded scripts. They do not rewrite what the platform records: on iOS, XCTest writes its own diagnostic logs and its .xcresult bundle, and typed text can appear in both, on a simulator or a physical device. Treat those as sensitive, and use test-only credentials when they may be kept or shared. Replay divergence and repair: A failing replay/test step returns REPLAY_DIVERGENCE with a bounded report (screen digest, ranked selector suggestions, resume). Fix app state, then resume with replay --from --plan-digest (both from the report's resume field) to continue without re-running earlier steps; resume never re-executes skipped steps, so app state there is the caller's responsibility. --from is replay-only; test rejects it. The digest binds the script, includes, effective --platform/--target, and per-action runtime/identity; native .ad interpolation is late-bound so changing only its values keeps the digest, while Maestro environment substitution can change it. diff --git a/website/docs/docs/commands.md b/website/docs/docs/commands.md index 8eb1deea1e..f2099449d5 100644 --- a/website/docs/docs/commands.md +++ b/website/docs/docs/commands.md @@ -432,6 +432,7 @@ A `click` or `press` whose target the daemon resolves to a point (`@ref` or sele - `fill` clears then types. `type` appends to the focused field and accepts text only: use `fill @ref "text"` to target a field, or `press @ref` then `type "text"`. - Use plain `fill` or `type` first. Add `--delay-ms` only when a debounced or search-as-you-type field misses characters, or the app must receive each incremental update; delayed typing enters characters one at a time instead of using a clipboard-style fallback. - `fill --text-stdin` reads the text from stdin so a secret never appears in process arguments. Pipe it with `printf %s`. It reads at most 64 KiB, removes one trailing newline, and refuses a terminal, empty input, invalid UTF-8, or an extra text argument. Output shows the value as `${VAR}` with `--record-as ` and as `[REDACTED]` otherwise, including in error messages and details. While script recording is armed, pass `--record-as ` or `--no-record`; passing neither is an error. Batch steps don't accept it. +- The privacy controls for typed input (`--text-stdin` and `--record-as`) keep the literal out of agent-device's own responses, diagnostics, and recorded scripts. They do not rewrite what the platform records: on iOS, XCTest writes its own diagnostic logs and its `.xcresult` bundle, and typed text can appear in both, on a simulator or a physical device. Treat those as sensitive, and use test-only credentials when they may be kept or shared. See [Security & Trust](/docs/security-trust). - Android text entry is owned by `agent-device`. Don't fall back to raw `adb`, clipboard, or paste; if non-ASCII is unsupported on the current backend, report the gap. Android `fill` verifies the text and fails instead of retrying when the IME captures input. Text-entry errors and what to do: diff --git a/website/docs/docs/security-trust.md b/website/docs/docs/security-trust.md index ca6fdf310a..2b793d90a2 100644 --- a/website/docs/docs/security-trust.md +++ b/website/docs/docs/security-trust.md @@ -48,6 +48,8 @@ Screenshots, recordings, traces, logs, network dumps, audio probes, replay files Cloud provider artifact URLs returned by `artifacts`, `close --json`, or `disconnect --json` may be provider dashboard URLs, public share links, or pre-signed download URLs. Treat the URLs themselves as credentials until you know the provider's sharing and expiry policy. +The privacy controls for typed input (`fill --text-stdin` and `--record-as`) keep the literal out of agent-device's own responses, diagnostics, and recorded scripts. They do not rewrite what the platform records: on iOS, XCTest writes its own diagnostic logs and its `.xcresult` bundle under the Apple runner's derived directory, and typed text can appear in both, on a simulator or a physical device. Treat those as sensitive, and use test-only credentials when they may be kept or shared. + ## Permissions Some targets require local permissions or developer setup: