Fill password fields: from the Keychain by reference, or agent-supplied text with approval
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 25/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- macos, swift
调研方向
Start with the live spike while the screen is unlocked: test typed input and AXValue against native NSSecureTextField and a Chrome password field, then test whether SecurityAgent accepts synthetic input. Also verify System Keychain Wi-Fi password access and identify a secure readback signal such as character count. Completion requires a decision on the Keychain-reference and approved-text fill routes, including URL-host matching, approval, logging restrictions, and explicit Touch Touch ID exclusion.
由索引模型根据 Issue 内容生成。
描述
Decision (user, 2026-10-17). Closes #75's gap 2, which unblocks gaps 3 and 4.
Primary: fill from the Keychain by reference.
- The agent names a Keychain item and never sees the secret.
- The host reads the item with SecItemCopyMatching, so macOS's own Keychain prompt gates each item.
- The host fills the item only into an
AXSecureTextFieldin the snapshot. For an internet password, the field's web area URL host must match the item's server.
Fallback: agent-supplied text, with explicit approval.
- The menu bar app shows a confirmation for each fill, naming the caller, the app and the site.
- A setting, "Always allow agent-supplied passwords", skips that confirmation. It is off by default.
For both routes:
- The caller must be approved under #24.
- The secret is never logged, echoed in results, or kept in Recent Activity. Activity records only that a fill happened, with the caller and the target.
- A fill is completed only on a readback that doesn't reveal the secret, such as the character count. Otherwise it is unknown.
Live spike first (the screen is unlocked now):
- Does typed input or an AXValue set reach a secure field while secure keyboard entry is on? Test in a native NSSecureTextField and in a Chrome password input.
- Does SecurityAgent (the admin prompt) accept synthetic input? Type a dummy value, then cancel. Never submit.
- Are Wi-Fi passwords reachable, given they're in the System keychain?
- What readback does a secure field expose?
Touch ID stays unsupported.
- 主要语言
- Swift
- 星标
- 0
- 派生
- 0
- 平均合并
- 19 分钟
- 30 天内合并 PR
- 107
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
githubnext/desktop-tools 的其他 Issue
-
ace documentation
难度 2/5 1-3 小时 新手友好度 79/100
githubnext/desktop-tools#104 ·
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 25/100
githubnext/desktop-tools#136 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 52/100
githubnext/desktop-tools#130 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 42/100
githubnext/desktop-tools#129 ·
维护者通常 1 天内回复
-
live-check-only
难度 4/5 3-5 天 新手友好度 25/100
githubnext/desktop-tools#23 · 1 条评论 ·
维护者通常 1 天内回复
查看 githubnext/desktop-tools 的全部 Issue
相似的 Issue
-
agent/sec-check help wanted security stage/010-actionable
难度 2/5 1-3 小时 新手友好度 65/100
hivecommons/hotshot#235 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
Emanuele-web04/remodex#203 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 92/100
维护者通常 1 天内回复
-
test(BrainBar): inject synthetic observabilityCadence in BackupsHealth/one-page fixtures (DCI-1)未关闭
难度 2/5 1-3 小时 新手友好度 74/100
EtanHey/brainlayer#1367 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
omlahore/RemoveMacAI#63 · 1 条评论 · 1 个 reaction ·
维护者通常 1 天内回复