Match hidden CAPTCHA evidence precisely

Author: esokullu

src/chrome/src/agent/agent.js

@@ -2827,6 +2827,21 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
         frameId: Number.isInteger(entry?.frameId) ? entry.frameId : 0,
         payload: entry?.result,
       }));
+      const hiddenChallenges = entries.flatMap(entry => {
+        const label = String(entry.payload?.hiddenChallenge?.label || '');
+        if (!label) return [];
+        const normalized = detectChallengeDialog(
+          `dialog ${JSON.stringify(label.slice(0, 200))}`,
+          { allowGenericFailure: options?.allowGenericFailure === true },
+        );
+        if (!normalized?.normalizedLabel) return [];
+        return [{
+          frameId: entry.frameId,
+          frameUrl: String(entry.payload?.frameContext?.frameUrl || ''),
+          label: normalized.label,
+          normalizedLabel: normalized.normalizedLabel,
+        }];
+      });
       const inspectedFrameIds = new Set(entries
         .filter(entry => entry.payload && typeof entry.payload === 'object')
         .map(entry => entry.frameId));
@@ -2836,9 +2851,8 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
       return includeStatus
         ? {
             challenge,
-            challengeHidden: entries.some(entry =>
-              entry.payload && typeof entry.payload === 'object' && entry.payload.hiddenChallenge?.label
-            ),
+            challengeHidden: hiddenChallenges.length > 0,
+            hiddenChallenges,
             // With no expected frame, "complete" still requires at least one
             // frame to have actually been inspected.
             inspectionComplete: expectedFrameId === null
@@ -2857,7 +2871,12 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
         return inspected(results);
       } catch {
         return includeStatus
-          ? { challenge: null, challengeHidden: false, inspectionComplete: false }
+          ? {
+              challenge: null,
+              challengeHidden: false,
+              hiddenChallenges: [],
+              inspectionComplete: false,
+            }
           : null;
       }
     }
@@ -2937,14 +2956,23 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
           ? recheck.challenge.frameId
           : null;
         observedChallengeFrameUrl = String(recheck.challenge.frameUrl || '');
-      } else if (recheck.inspectionComplete && recheck.challengeHidden) {
+      } else if (
+        recheck.inspectionComplete
+        && recheck.hiddenChallenges?.some(hidden => (
+          hidden.frameId === (
+            Number.isInteger(observedChallengeFrameId)
+              ? observedChallengeFrameId
+              : 0
+          )
+          && hidden.normalizedLabel === challenge.normalizedLabel
+        ))
+      ) {
         challenge = null;
       }
-      // Only a completed scan that positively found the dialog hidden clears
-      // the tree's observation. "Not found" is not disproof — the DOM scan
-      // cannot see closed shadow roots or unreachable frames the tree can —
-      // and an inconclusive scan proves nothing; keep the challenge rather
-      // than failing the gate open.
+      // Only a completed scan that found the same dialog hidden in the same
+      // frame clears the tree observation. An unrelated hidden challenge,
+      // "not found", or an inconclusive scan cannot disprove a dialog in a
+      // closed shadow root or unreachable frame; keep the gate fail-closed.
     }
     let pageUrl = String(toolResult.currentUrl || toolResult.pageUrl || '');
     if (!pageUrl) {

src/firefox/src/agent/agent.js

@@ -2507,6 +2507,21 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
     const successfulEntries = frameEntries.filter(entry =>
       entry?.payload && typeof entry.payload === 'object'
     );
+    const hiddenChallenges = successfulEntries.flatMap(entry => {
+      const label = String(entry.payload?.hiddenChallenge?.label || '');
+      if (!label) return [];
+      const normalized = detectChallengeDialog(
+        `dialog ${JSON.stringify(label.slice(0, 200))}`,
+        { allowGenericFailure: options?.allowGenericFailure === true },
+      );
+      if (!normalized?.normalizedLabel) return [];
+      return [{
+        frameId: entry.frameId,
+        frameUrl: String(entry.payload?.frameContext?.frameUrl || ''),
+        label: normalized.label,
+        normalizedLabel: normalized.normalizedLabel,
+      }];
+    });
     const challenge = this._visibleChallengeDialogFromFrames(
       successfulEntries,
       navigationFrames,
@@ -2517,7 +2532,8 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
       && navigationFrames.some(frame => frame?.frameId === expectedFrameId);
     return {
       challenge,
-      challengeHidden: successfulEntries.some(entry => entry.payload.hiddenChallenge?.label),
+      challengeHidden: hiddenChallenges.length > 0,
+      hiddenChallenges,
       // With no expected frame, "complete" still requires at least one frame
       // to have actually been inspected.
       inspectionComplete: expectedFrameId === null
@@ -2601,14 +2617,23 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
           ? recheck.challenge.frameId
           : null;
         observedChallengeFrameUrl = String(recheck.challenge.frameUrl || '');
-      } else if (recheck.inspectionComplete && recheck.challengeHidden) {
+      } else if (
+        recheck.inspectionComplete
+        && recheck.hiddenChallenges?.some(hidden => (
+          hidden.frameId === (
+            Number.isInteger(observedChallengeFrameId)
+              ? observedChallengeFrameId
+              : 0
+          )
+          && hidden.normalizedLabel === challenge.normalizedLabel
+        ))
+      ) {
         challenge = null;
       }
-      // Only a completed scan that positively found the dialog hidden clears
-      // the tree's observation. "Not found" is not disproof — the DOM scan
-      // cannot see closed shadow roots or unreachable frames the tree can —
-      // and an inconclusive scan proves nothing; keep the challenge rather
-      // than failing the gate open.
+      // Only a completed scan that found the same dialog hidden in the same
+      // frame clears the tree observation. An unrelated hidden challenge,
+      // "not found", or an inconclusive scan cannot disprove a dialog in a
+      // closed shadow root or unreachable frame; keep the gate fail-closed.
     }
     let pageUrl = String(toolResult.currentUrl || toolResult.pageUrl || '');
     if (!pageUrl) {

test/run.js

@@ -4885,6 +4885,86 @@ test('CAPTCHA visibility recheck sees shadow-rooted dialogs and keeps the gate o
       assert.equal(agent._captchaGateStates.has(1), true, `${build}: shadow-rooted challenge did not persist a gate`);
     });
 
+    // A hidden challenge is disproof only for the same normalized label in
+    // the same frame. An unrelated hidden reCAPTCHA must not clear a visible
+    // tree-only challenge (for example one inside a closed shadow root).
+    await withCaptchaFakePage(build, [
+      captchaEl('div', {
+        role: 'dialog',
+        innerText: 'reCAPTCHA',
+        hidden: true,
+      }),
+    ], async () => {
+      const agent = new AgentClass({});
+      const recheck = await agent._detectChallengeDialogBeforeMutation(1, {
+        includeStatus: true,
+      });
+      assert.deepEqual(recheck.hiddenChallenges, [{
+        frameId: 0,
+        frameUrl: 'https://example.test/form',
+        label: 'reCAPTCHA',
+        normalizedLabel: 'recaptcha',
+      }], `${build}: hidden challenge evidence lost its frame or normalized label`);
+
+      const observation = await agent._observeCaptchaChallenge(
+        1,
+        'get_accessibility_tree',
+        {
+          pageContent: 'dialog "Security verification" [ref_1]\n button "Verify" [ref_2]',
+          pageUrl: 'https://example.test/form',
+        },
+        {},
+      );
+      assert.ok(observation.gate, `${build}: unrelated hidden challenge cleared the tree-only CAPTCHA gate`);
+      assert.equal(agent._captchaGateStates.has(1), true, `${build}: unrelated hidden challenge failed open`);
+
+      const matchingAgent = new AgentClass({});
+      const matchingObservation = await matchingAgent._observeCaptchaChallenge(
+        1,
+        'get_accessibility_tree',
+        {
+          pageContent: 'dialog "reCAPTCHA" [ref_1]\n button "Verify" [ref_2]',
+          pageUrl: 'https://example.test/form',
+        },
+        {},
+      );
+      assert.equal(
+        matchingObservation.gate,
+        null,
+        `${build}: matching hidden evidence did not clear the tree observation`,
+      );
+      assert.equal(
+        matchingAgent._captchaGateStates.has(1),
+        false,
+        `${build}: matching hidden evidence persisted a stale gate`,
+      );
+    });
+
+    const crossFrameAgent = new AgentClass({});
+    crossFrameAgent._detectChallengeDialogBeforeMutation = async () => ({
+      challenge: null,
+      challengeHidden: true,
+      hiddenChallenges: [{
+        frameId: 7,
+        frameUrl: 'https://challenge.example.test/hidden',
+        label: 'Security verification',
+        normalizedLabel: 'security verification',
+      }],
+      inspectionComplete: true,
+    });
+    const crossFrameObservation = await crossFrameAgent._observeCaptchaChallenge(
+      1,
+      'get_accessibility_tree',
+      {
+        pageContent: 'dialog "Security verification" [ref_1]\n button "Verify" [ref_2]',
+        pageUrl: 'https://example.test/form',
+        captchaChallengeFrameId: 0,
+      },
+      {},
+    );
+    assert.ok(crossFrameObservation.gate, `${build}: hidden challenge from another frame cleared the gate`);
+    assert.equal(crossFrameAgent._captchaGateStates.has(1), true, `${build}: cross-frame hidden challenge failed open`);
+
     // Hidden ancestry must still win even across the shadow boundary: a
     // challenge dialog inside the shadow root of a hidden host stays inert.
     await withCaptchaFakePage(build, [