Fix: defend cleared checkout checkboxes against programmatic re-checks (#203)

[twschiller]

Summary

Closes audit item #13 from #203. checkout-checkbox-sanitize previously
cleared pre-checked boxes once at scan time but never defended against
the page re-checking them: a React controlled input re-renders
node.checked = true from component state on every reconcile, and a
single setState({ optIn: true }) after our pass would silently re-check
every pre-selected add-on.

Architecture

The defense is a wrap on HTMLInputElement.prototype.checked plus a
capture-phase change listener that releases the lock on trusted user
gestures. Both pieces MUST live in the page world: page scripts
(React/Vue reconciles) hit the page world's own copy of the prototype,
which is a distinct object from the isolated-world copy a content script
sees. An isolated-world wrap is a no-op for the threat model.

The page-world bundle follows the established webdriver-probe
pattern — dynamic chrome.scripting.registerContentScripts({ world: "MAIN", runAt: "document_start", allFrames: true }) for navigations
after the rule is toggled on, plus a chrome.scripting.executeScript
fallback driven by the rule's apply to cover the tab the user was
already viewing.

Page-world wrap

When value === true is written to a checked setter whose target
bears [data-abs-cleared] while the URL matches the checkout regex,
the wrap forwards false to the native setter instead. The marker is
the source of truth; the rule (in the isolated world) stamps it on
every box it unchecks, the wrap defends it, and the capture-phase
change listener removes it on the first trusted user gesture so a
controlled framework reconcile of .checked = true doesn't visibly
flicker a real-user click off the screen. Synthetic dispatches from
page scripts (isTrusted === false, including the rule's own change
event) do not release the lock.

Escape hatches for legitimate re-checks

• A real user click, keyboard Space, or <label> click — dispatches
  a trusted change and releases the marker.
• checkbox.click() from a Playwright / CDP / WebDriver session — same
  trusted-event path.
• checkbox.removeAttribute("data-abs-cleared") then .checked = true
  as an explicit out-of-band escape.

Files

• extension/src/lib/checkout-checkbox-defense-source.ts —
  dependency-free installCheckoutCheckboxDefense(this: Window).
  Hard-codes the data-abs-cleared literal (the one principled
  exception to the no-restricted-syntax rule, since page-world code
  has no module imports) with a parity test asserting it tracks the
  registry constant. The URL gate is a regex parallel to
  isCheckoutUrl, also parity-tested.
• extension/src/checkout-checkbox-defense.ts — tiny build entry that
  calls installCheckoutCheckboxDefense.call(globalThis).
• extension/build.ts — bundles the new entry alongside
  webdriver-probe.ts.
• extension/src/lib/checkout-checkbox-defense-registration.ts —
  registration/unregistration lifecycle, mirroring
  webdriver-probe-registration.ts.
• extension/src/background.ts — wires the registration into SW
  startup and handles inject-checkout-checkbox-defense for the
  current-tab fallback via executeScript.
• extension/src/rules/checkout-checkbox-sanitize.ts — apply now
  sends the inject message and keeps only the scan/uncheck/marker
  logic; the page-world wrap is no longer inline.
• extension/knip.json — declares the new build entry.
• docs/src/content/docs/rules.md — notes that the cleared state is
  held against framework re-renders but yields to real user / WebDriver
  clicks.
• skills/agent-browser-shield/SKILL.md item ci: package and upload extension zip artifact #3 — tells agents to
  drive the toggle through a click (the standard Playwright / CDP /
  .click() path) rather than input.checked = true.

Test plan

• bun jest src/rules/__tests__/checkout-checkbox-sanitize src/lib/__tests__/checkout-checkbox-defense — 60 tests pass
  across the four files, covering: scan/uncheck/marker logic, lazy
  subtree insertion, teardown, sendMessage fallback (including
  rejection handling), prototype-wrap revert/escape/marker-removal/
  URL-gate paths, listener untrusted-ignore, idempotency, parity
  assertions (CLEARED_ATTR literal + URL gate), and chrome.scripting
  registration lifecycle.
• bun jest full suite — 1792 / 1792 pass (no regression in any
  other rule that touches HTMLInputElement).
• bun run check (Biome + ESLint) clean.
• bun run typecheck clean.
• bun run knip clean.
• bun run build — background-purity guard reports ok (39 canaries, no leaks). The page-world bundle ships as
  checkout-checkbox-defense.js and is invoked only via
  chrome.scripting.executeScript / registerContentScripts.
• bun run test:coverage — statements 87.5%, branches 79.3%,
  functions 91.3%, lines 87.5% (above thresholds).
• pre-commit run --files … clean on all changed files.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agent-browser-shield-demo-site	Ready	Preview, Comment	Jun 7, 2026 8:35pm