Merge pull request #515 from alectimison-maker/fix/firefox-duplicate-submit-guard

fix(firefox): block rapid duplicate submits

Author: esokullu

src/chrome/ARCHITECTURE.md

@@ -420,7 +420,7 @@ System prompt has a new "MODALS & DIALOGS" section that describes the intended f
 
 ### Duplicate-submit guard (v3.6.5+)
 
-Before any `click` whose resolved text matches `^(create|save|submit|add|post|publish|send|confirm|place order|pay|checkout|update|finish|done)\b` the agent checks a per-tab+URL 45-second window. Duplicate clicks in that window are blocked unless `_allowResubmit` is set. Prevents the "clicked Create three times → three products created" failure mode.
+Before any submit-like text `click`, the agent checks a per-tab+URL 45-second window. Duplicate clicks in that window are blocked unless `_allowResubmit` is set; an acknowledged retry re-arms the window, so a further rapid duplicate needs its own acknowledgement. The browser-free guard is byte-identical in Chrome and Firefox, preventing the "clicked Create three times → three products created" failure mode in both builds.
 
 ### API shortcut observer (v18.0.0)
 

src/chrome/src/agent/agent.js

@@ -4,6 +4,7 @@ import { LoopDetector } from './loop-detector.js';
 import { parseToolCallsFromText } from './tool-call-parser.js';
 import { IMAGE_BUDGET, estimateImageTokens, fitImageDimensions } from './image-budget.js';
 import { BROWSER_MUTATION_TOOLS, STATE_CHANGE_TOOLS as SHARED_STATE_CHANGE_TOOLS } from './mutation-tools.js';
+import { guardRecentSubmitClick } from './submit-click-guard.js';
 import { isCredentialField, CREDENTIAL_NOTE_STRICT, STRICT_SECRET_SYSTEM_NOTE } from './credential-fields.js';
 import { detectProgressAction, formatLedgerRow, formatLedgerSummary, isBlockedLedgerDowngrade, isTerminalLedgerStatus, isValidLedgerStatus, ledgerDoneBlock, ledgerRowKey, normalizeLedgerStatus, progressCounts, selectLedgerRows, unresolvedLedgerRows, upsertLedgerItems } from './progress-ledger.js';
 import { buildGithubStargazerProgressItems } from './observers/github-stargazers.js';
@@ -15824,41 +15825,16 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
 
         await cdpClient.attach(tabId);
 
-        // ── Duplicate submit-click guard ────────────────────────────────
-        // The model often mistakes the modal-open link and the in-modal
-        // submit button on Stripe-style UIs (both labeled "Create product",
-        // "Add product", etc.) — clicking twice creates duplicate records.
-        // Track clicks whose text matches a submit-like pattern and block
-        // a second one on the same tab+URL within a short window, UNLESS
-        // the URL has changed (real navigation) or the model explicitly
-        // acknowledges the duplicate via args._allowResubmit = true.
-        if (args.text && !args._allowResubmit) {
-          const rawText = String(args.text).trim();
-          const submitLikeRE = /^(create|save|submit|add|post|publish|send|confirm|sign up|sign in|log in|register|place order|pay|checkout|update|apply|finish|done)\b/i;
-          if (submitLikeRE.test(rawText)) {
-            let curUrl = '';
-            try { const t = await chrome.tabs.get(tabId); curUrl = t?.url || ''; } catch (e) {}
-            const buf = this._recentSubmitClicks.get(tabId) || [];
-            const key = `${rawText.toLowerCase()}|${curUrl}`;
-            const now = Date.now();
-            // Keep entries from the last 45 seconds
-            const fresh = buf.filter(e => now - e.ts < 45000);
-            const match = fresh.find(e => e.key === key);
-            if (match) {
-              return {
-                success: false,
-                dispatched: false,
-                blockedDuplicateSubmit: true,
-                error: `Blocked: you already clicked "${rawText}" on this page ${Math.round((now - match.ts) / 1000)}s ago and the URL has not changed since. Stripe-style UIs often reuse the same label for the modal-OPEN button and the SUBMIT button inside the modal — a second click typically creates a duplicate record. Before clicking "${rawText}" again, verify: (a) that all required fields are actually filled by reading the form/page, (b) that this click is intended as a FIRST submit and not a retry. If the previous click did nothing because a field was empty, fill the field first. If you genuinely need to retry, pass _allowResubmit: true in the args.`,
-                previousClickUrl: match.url,
-                currentUrl: curUrl,
-                secondsSincePrevious: Math.round((now - match.ts) / 1000),
-              };
-            }
-            fresh.push({ key, ts: now, url: curUrl, text: rawText });
-            this._recentSubmitClicks.set(tabId, fresh);
-          }
-        }
+        const duplicateSubmit = await guardRecentSubmitClick(
+          this._recentSubmitClicks,
+          tabId,
+          args,
+          async () => {
+            const tab = await chrome.tabs.get(tabId);
+            return tab?.url || '';
+          },
+        );
+        if (duplicateSubmit) return duplicateSubmit;
 
         // ── Global SELECT guard ─────────────────────────────────────────
         // Inject a capture-phase mousedown+click listener that prevents

src/chrome/src/agent/submit-click-guard.js

@@ -0,0 +1,61 @@
+// Browser-free duplicate-submit guard. This file is mirrored in the Firefox
+// tree; keep both copies byte-identical.
+
+export const SUBMIT_CLICK_WINDOW_MS = 45_000;
+
+const SUBMIT_LIKE_CLICK_RE = /^(create|save|submit|add|post|publish|send|confirm|sign up|sign in|log in|register|place order|pay|checkout|update|apply|finish|done)\b/i;
+
+/**
+ * Record the first submit-like text click and reject a rapid duplicate on the
+ * same tab and URL. Returns the tool result to emit when blocked, otherwise
+ * null. The URL callback is lazy so ordinary clicks do not perform a tab
+ * lookup. An `_allowResubmit` retry is allowed through but re-recorded, so a
+ * further rapid duplicate needs its own acknowledgement.
+ */
+export async function guardRecentSubmitClick(
+  recentSubmitClicks,
+  tabId,
+  args,
+  getCurrentUrl,
+  now = Date.now,
+) {
+  if (!args?.text) return null;
+
+  const rawText = String(args.text).trim();
+  if (!SUBMIT_LIKE_CLICK_RE.test(rawText)) return null;
+
+  let currentUrl = '';
+  try {
+    currentUrl = await getCurrentUrl() || '';
+  } catch { /* preserve empty-URL fallback */ }
+
+  const entries = recentSubmitClicks.get(tabId) || [];
+  const key = `${rawText.toLowerCase()}|${currentUrl}`;
+  const timestamp = now();
+  const fresh = entries.filter(entry => timestamp - entry.ts < SUBMIT_CLICK_WINDOW_MS);
+  const match = fresh.find(entry => entry.key === key);
+
+  if (match && args._allowResubmit) {
+    match.ts = timestamp;
+    match.url = currentUrl;
+    match.text = rawText;
+    recentSubmitClicks.set(tabId, fresh);
+    return null;
+  }
+
+  if (match) {
+    return {
+      success: false,
+      dispatched: false,
+      blockedDuplicateSubmit: true,
+      error: `Blocked: you already clicked "${rawText}" on this page ${Math.round((timestamp - match.ts) / 1000)}s ago and the URL has not changed since. Stripe-style UIs often reuse the same label for the modal-OPEN button and the SUBMIT button inside the modal — a second click typically creates a duplicate record. Before clicking "${rawText}" again, verify: (a) that all required fields are actually filled by reading the form/page, (b) that this click is intended as a FIRST submit and not a retry. If the previous click did nothing because a field was empty, fill the field first. If you genuinely need to retry, pass _allowResubmit: true in the args.`,
+      previousClickUrl: match.url,
+      currentUrl,
+      secondsSincePrevious: Math.round((timestamp - match.ts) / 1000),
+    };
+  }
+
+  fresh.push({ key, ts: timestamp, url: currentUrl, text: rawText });
+  recentSubmitClicks.set(tabId, fresh);
+  return null;
+}

src/firefox/ARCHITECTURE.md

@@ -10,7 +10,6 @@ Firefox uses Manifest V2 (background page, not service worker) and has **no acce
 - **No pixel-perfect / full-page screenshots** — uses `browser.tabs.captureVisibleTab()` instead of CDP `Page.captureScreenshot`.
 - **No shadow DOM piercing** — content script can read open shadow roots via `element.shadowRoot`, but cannot pierce closed roots.
 - **No offscreen document** — no HTTP fetch proxy for localhost LLM servers with Private Network Access / CORS issues. User must ensure their local LLM server sends permissive CORS headers.
-- **No duplicate-submit guard** — the per-tab submit-throttle (Chrome v3.6.5+) is still Chrome-only. Firefox's agent loop does not block rapid duplicate Create/Submit clicks. `blockedDone` and the ambiguous-click candidate payload were ported to Firefox in v4.0.1 (see "Overlay defenses" below).
 - **Some Chrome-only tools/features remain absent** — no CDP full-page screenshot, CDP upload automation, tab recording, offscreen fetch proxy, Chrome-only `shadow_dom_query`, or closed-shadow-root traversal.
 
 Everything else — the agent loop, LLM providers, site adapters, Ask/Act/Dev mode routing, Plan before Act, loop detection, API shortcut observer, trace recorder, scheduler, context management — is architecturally identical to Chrome unless noted below.
@@ -173,10 +172,9 @@ Firefox's AX tools use synthetic events only — there is no trusted-event path.
 
 ### What was intentionally skipped in the Firefox port
 
-These Chrome v3.6.x features depend on CDP or agent-level state and were not ported — they can be re-evaluated later:
+These Chrome v3.6.x features depend on CDP and were not ported — they can be re-evaluated later:
 
 - **CDP-enriched `click_ax` frontmost resolution** — when `click_ax` lands on a node that overlaps many candidates, Chrome re-queries via CDP to pick the frontmost hit. Firefox relies on the initial ref_id resolution plus the v4.0.1 occlusion hit-test (see below).
-- **Duplicate-submit guard** — Chrome's agent.js tracks recent submit tool calls and blocks duplicates within a short window. Not in Firefox's agent loop.
 - **Offscreen fetch fallback** — Chrome falls through to an offscreen-document proxy when direct fetch fails (common for localhost LLM servers and private-network destinations). Firefox has no offscreen API; local servers must handle CORS themselves.
 
 ### Overlay defenses (v4.0.1+)
@@ -191,6 +189,16 @@ Brought to Chrome parity in v4.0.1 — same three layers, synthetic-event-safe s
 
 System prompt has a new "MODALS & DIALOGS" section describing the intended flow and the "dialog still open" failure pattern.
 
+### Duplicate-submit guard
+
+Submit-like text clicks use the same browser-free guard as Chrome. The first
+click is recorded by tab, normalized label, and current URL; another matching
+click within 45 seconds is blocked unless `_allowResubmit` explicitly
+acknowledges the retry. An acknowledged retry re-arms the window, so a further
+rapid duplicate needs its own acknowledgement. Navigation, expired entries,
+ordinary labels, and validation-rejected submits remain eligible for a fresh
+click.
+
 ---
 
 ## Skills and Dynamic Skill Tools
@@ -547,7 +555,6 @@ when the tab conversation already has `/allow-api`.
 | No full-page screenshot | Only visible viewport | Scroll + multiple captures |
 | No shadow-root piercing (closed) | Can't read closed shadow roots | Dev-mode `execute_js` with manual traversal |
 | No arbitrary-path/CDP upload | Cannot attach an arbitrary local path silently | Use a prior `downloadId` re-fetch or WebBrain's user file picker |
-| No duplicate-submit guard | Agent may submit twice if LLM loops | Rely on site-level idempotence / user watches |
 | No ambiguous-click CDP enrichment | Overlapping hit-target ambiguity resolved by ref_id only | Prompting / adapter guidance |
 | MV2 background page | Less efficient than MV3 service worker | `persistent: false` helps |
 

src/firefox/src/agent/agent.js

@@ -4,6 +4,7 @@ import { LoopDetector } from './loop-detector.js';
 import { parseToolCallsFromText } from './tool-call-parser.js';
 import { IMAGE_BUDGET, estimateImageTokens, fitImageDimensions } from './image-budget.js';
 import { BROWSER_MUTATION_TOOLS, STATE_CHANGE_TOOLS as SHARED_STATE_CHANGE_TOOLS } from './mutation-tools.js';
+import { guardRecentSubmitClick } from './submit-click-guard.js';
 import { isCredentialField, CREDENTIAL_NOTE_STRICT, STRICT_SECRET_SYSTEM_NOTE } from './credential-fields.js';
 import { detectProgressAction, formatLedgerRow, formatLedgerSummary, isBlockedLedgerDowngrade, isTerminalLedgerStatus, isValidLedgerStatus, ledgerDoneBlock, ledgerRowKey, normalizeLedgerStatus, progressCounts, selectLedgerRows, unresolvedLedgerRows, upsertLedgerItems } from './progress-ledger.js';
 import { buildGithubStargazerProgressItems } from './observers/github-stargazers.js';
@@ -13820,6 +13821,19 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
       }
     } catch { /* tab lookup failures are non-fatal — fall through */ }
 
+    if (name === 'click') {
+      const duplicateSubmit = await guardRecentSubmitClick(
+        this._recentSubmitClicks,
+        tabId,
+        args,
+        async () => {
+          const tab = await browser.tabs.get(tabId);
+          return tab?.url || '';
+        },
+      );
+      if (duplicateSubmit) return duplicateSubmit;
+    }
+
     const axScope = this._lastAxScopes.get(tabId);
     const contentArgs = (name === 'click_ax' || name === 'set_checked') && axScope?.documentToken
       ? {

src/firefox/src/agent/submit-click-guard.js

@@ -0,0 +1,61 @@
+// Browser-free duplicate-submit guard. This file is mirrored in the Firefox
+// tree; keep both copies byte-identical.
+
+export const SUBMIT_CLICK_WINDOW_MS = 45_000;
+
+const SUBMIT_LIKE_CLICK_RE = /^(create|save|submit|add|post|publish|send|confirm|sign up|sign in|log in|register|place order|pay|checkout|update|apply|finish|done)\b/i;
+
+/**
+ * Record the first submit-like text click and reject a rapid duplicate on the
+ * same tab and URL. Returns the tool result to emit when blocked, otherwise
+ * null. The URL callback is lazy so ordinary clicks do not perform a tab
+ * lookup. An `_allowResubmit` retry is allowed through but re-recorded, so a
+ * further rapid duplicate needs its own acknowledgement.
+ */
+export async function guardRecentSubmitClick(
+  recentSubmitClicks,
+  tabId,
+  args,
+  getCurrentUrl,
+  now = Date.now,
+) {
+  if (!args?.text) return null;
+
+  const rawText = String(args.text).trim();
+  if (!SUBMIT_LIKE_CLICK_RE.test(rawText)) return null;
+
+  let currentUrl = '';
+  try {
+    currentUrl = await getCurrentUrl() || '';
+  } catch { /* preserve empty-URL fallback */ }
+
+  const entries = recentSubmitClicks.get(tabId) || [];
+  const key = `${rawText.toLowerCase()}|${currentUrl}`;
+  const timestamp = now();
+  const fresh = entries.filter(entry => timestamp - entry.ts < SUBMIT_CLICK_WINDOW_MS);
+  const match = fresh.find(entry => entry.key === key);
+
+  if (match && args._allowResubmit) {
+    match.ts = timestamp;
+    match.url = currentUrl;
+    match.text = rawText;
+    recentSubmitClicks.set(tabId, fresh);
+    return null;
+  }
+
+  if (match) {
+    return {
+      success: false,
+      dispatched: false,
+      blockedDuplicateSubmit: true,
+      error: `Blocked: you already clicked "${rawText}" on this page ${Math.round((timestamp - match.ts) / 1000)}s ago and the URL has not changed since. Stripe-style UIs often reuse the same label for the modal-OPEN button and the SUBMIT button inside the modal — a second click typically creates a duplicate record. Before clicking "${rawText}" again, verify: (a) that all required fields are actually filled by reading the form/page, (b) that this click is intended as a FIRST submit and not a retry. If the previous click did nothing because a field was empty, fill the field first. If you genuinely need to retry, pass _allowResubmit: true in the args.`,
+      previousClickUrl: match.url,
+      currentUrl,
+      secondsSincePrevious: Math.round((timestamp - match.ts) / 1000),
+    };
+  }
+
+  fresh.push({ key, ts: timestamp, url: currentUrl, text: rawText });
+  recentSubmitClicks.set(tabId, fresh);
+  return null;
+}