feat: session-scoped echo protection for parameterized recorded inputs (#2013)

* feat: session-scoped echo protection for parameterized recorded inputs

Extends ADR 0017's fill-step-scoped guarantee to the whole recording
session (#1398). After #1349, a later read-only action (`wait`, `is`,
`get`) can independently observe and record an app-rendered echo of an
already-parameterized `fill --record-as` value in its own result or
target-v1 identity evidence, re-leaking the literal even though the
originating fill was protected.

- SessionState gains a small, ephemeral, never-serialized
  literal->placeholder registry populated only from explicit
  `--record-as` pairs, owned by session-action-recorder.ts.
- Result/event payload fields get content-aware substring redaction
  (reusing the fill boundary's recursive scrub) for every literal
  registered so far in the session, longest-literal-first.
- target-v1/targets-v1 identity evidence is never silently
  text-substituted while still claiming a trustworthy identity (replay
  compares against the live tree, which re-renders the real value).
  A landmark-mode (wait) echo is dropped to no annotation, exactly like
  #1349's existing identity-empty case, so an echoing landmark can no
  longer serve as an ADR 0016 destination guard. Action-mode evidence
  (get/is/mutating actions) redacts the label and downgrades
  verification to "unverifiable" instead, since ADR 0012/0016 forbid
  dropping required identity evidence.
- Amends ADR 0017 (new mechanism), ADR 0012 (#1349/writer-invariant
  cross-references), and ADR 0016 (destination guard cross-reference).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RarRVX34ZW25TJejBZJ2Ui

* fix: placeholder-safe single-pass multi-literal redaction

Addresses review feedback on #2013: sequential single-literal
replacement (register somethinglong -> ${ABC}, then ABC -> ${OTHER})
could rewrite a placeholder produced by an earlier pass, corrupting it
to ${${OTHER}}.

Replaces the per-pair sequential loop with one placeholder-safe
left-to-right multi-literal pass (parameterizeAgainstLiteralMap): it
never re-scans text it has already emitted, so no literal can be
matched inside another pair's placeholder token in either direction.
A registered literal is matched before checking for an existing
placeholder token, so a value that itself happens to look like
${SOMETHING} is still redacted correctly. The scan uses a sticky regex
instead of slicing per character, and literal pairs are sorted once
per payload/evidence walk instead of once per string leaf.

parameterizeRecordedFillPayload/parameterizeBackendOutput are
generalized to take injected leaf-transform/carries callbacks so the
single-pair fill-boundary path (with its existing whitespace-collapse
behavior) and the new multi-pair session-wide path share one
structural traversal.

Adds regression coverage for both result payloads and action-mode
target evidence, plus the placeholder-shaped-literal edge case.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RarRVX34ZW25TJejBZJ2Ui

* fix: unexport parameterizeAgainstLiteralMap (CI: fallow dead-code gate)

Only used internally within this file (by parameterizeRecordedResultEcho
and parameterizeTargetEvidenceEcho); the export had no consumer outside
the module, which the fallow audit correctly flags as dead code.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RarRVX34ZW25TJejBZJ2Ui

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: thymikee

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+- Parameterized `fill --record-as` protection is now recording-session-scoped instead of
+  fill-step-scoped (ADR 0017 amendment): a later, unrelated recorded action (`wait`, `is`, `get`) can no
+  longer re-serialize an app-rendered echo of an already-parameterized value into its own result or
+  `target-v1` identity evidence. An echoing `wait` landmark no longer qualifies as an ADR 0016
+  destination guard, so `session save-script` refuses it and directs the author to a stable landmark
+  instead of silently publishing the secret. The protection uses one small, explicit, ephemeral,
+  never-serialized per-session map populated only from values the author already opted to parameterize;
+  ordinary non-parameterized recordings are unaffected (#1398).
 - Android covered-state publication now has one owner: same-window surfaces remain visible for
   diagnosis, while the daemon marks exactly ordered covered controls non-actionable with
   `interactionBlocked: "covered"`. Helper-only `drawing-order` stays private rather than entering

docs/adr/0012-interactive-replay.md

@@ -188,6 +188,13 @@ in force, a parent-only payload fits arithmetically, so the downgrade branch is
 not an expected path. The record-time self-check (step 5 below) runs against the reduced tuple, so a
 `verified` claim is always honest for exactly what was written.
 
+> **Amendment (#1398, ADR 0017):** action-mode evidence gains a second, independent cause for this same
+> `"unverifiable"` downgrade — a matched node whose label carries an app-rendered echo of a literal the
+> recording session already parameterized. Unlike the size-overflow case, the label is also redacted to
+> its placeholder before the downgrade, so the literal itself never reaches the payload either. Landmark
+> mode (`wait`) does not use this downgrade; it drops the annotation entirely (see the #1349 amendment
+> above). See ADR 0017's session-scoped echo protection amendment for the full mechanism.
+
 **Local identity.** Two nodes share local identity when both carry `id` and the normalized ids are equal;
 or, when the recording carries no `id`, when their normalized roles are equal and their normalized labels
 are equal (label absent on both sides counts as equal; label present on exactly one side is a mismatch).
@@ -266,6 +273,11 @@ A recorded `id` never matches a node without that id.
 >   identity is near-vacuous, and an unannotated wait keeps its existing selector-existence semantics
 >   instead of failing closed on evidence that never discriminated anything. ADR 0016's destination
 >   guard consumes exactly this: a qualifying guard is a selector wait with a `verified` annotation.
+>   **Amendment (#1398, ADR 0017):** the same no-annotation outcome now also fires when the matched
+>   node's identity carries an app-rendered echo of a literal the recording session already
+>   parameterized via `fill --record-as` — a placeholder written into a recorded label could never
+>   verify against the live tree's real value at replay time, so the evidence is dropped rather than
+>   published unverified. See ADR 0017's session-scoped echo protection amendment for the mechanism.
 > - **`get` — unchanged**; already covered by the pre-dispatch path and the post-resolution guard.
 > - **`is` (all predicates except `exists`) — covered, `pre-dispatch`, the `get` pattern end-to-end.**
 >   `is` resolves a unique node immediately, so pre-action verification is semantically valid; the

docs/adr/0016-active-session-script-publication.md

@@ -26,7 +26,9 @@ Normative summary; the binding contracts and refusal cases are in [Decision](#de
   what lets a one-shot client keep the daemon alive on a close-less handoff.
 - Sensitive `fill` inputs must be recorded as placeholders via `fill --record-as <VAR>`
   (ADR 0017, shipped for #1348); unparameterized `fill`/`type` values persist literally into the
-  artifact, so a secret entered without `--record-as` is published.
+  artifact, so a secret entered without `--record-as` is published. The protection is
+  recording-session-scoped (ADR 0017's #1398 amendment): a later action's own recorded evidence can
+  never re-serialize an app-rendered echo of an already-parameterized value either.
 
 ## Context
 
@@ -186,6 +188,13 @@ record one. V1 does not infer a screen identity from a snapshot or synthesize an
 > `identity-mismatch` `REPLAY_DIVERGENCE` before the wait reports success. The reshuffled-screen
 > false-pass below is covered by a provider-scenario regression (record → publish → replay against a
 > reshuffled tree whose same-label node sits under a different id/ancestry).
+>
+> **Amendment (#1398, ADR 0017).** An identity-empty landmark is not the only case that fails to
+> qualify: a selector wait whose only identity is an app-rendered echo of a literal the recording
+> session already parameterized via `fill --record-as` also records no annotation (ADR 0017's
+> session-scoped echo protection), so it does not qualify as a destination guard either. Publication
+> refuses it with the same recovery hint, directing the author to a stable, non-value-bearing landmark
+> — an enforced version of exactly the fix issue #1398's motivating scenario applied by hand.
 
 The original selector-level caveat, retained as context: the guard proved that an element matching its
 selector exists, not that it is the same landmark element observed while authoring, so a reshuffled
@@ -229,6 +238,11 @@ This is opt-in and fill-only. Unparameterized fill/type inputs remain literal ar
 authors must use ADR 0017 for each sensitive fill and avoid secret-bearing `type` steps. CLI help states
 both the safe workflow and the remaining literal-input warning next to publication guidance.
 
+ADR 0017's #1398 amendment extends this protection to the whole recording session: a later, unrelated
+recorded action can no longer re-serialize an app-rendered echo of an already-parameterized literal into
+its own result or `target-v1` evidence, so a value protected once by `--record-as` stays protected for
+every action recorded after it in the same session, not only its own originating fill.
+
 ### Artifact contract
 
 The published `.ad`:

docs/adr/0017-parameterized-recorded-inputs.md

@@ -86,11 +86,99 @@ or whitespace. If the replay is itself being recorded or repaired, the recorder
 original placeholder rather than serializing the expanded value. Embedded interpolation remains
 ordinary script input; safe authoring emits one complete placeholder token.
 
+### Session-scoped echo protection (amendment, #1398)
+
+> **Status: accepted.** Amends the data-flow boundary above from fill-step-scoped to
+> recording-session-scoped, per issue [#1398](https://github.com/callstack/agent-device/issues/1398).
+
+The boundary above protects only the originating fill's own request/recording path. After
+[#1349](https://github.com/callstack/agent-device/issues/1349), a later read-only action —
+`wait`'s landmark-mode evidence, `is`, `get` — records `target-v1` identity evidence and a result
+payload independently, computed from whatever the app renders at that later step. That capture has no
+memory of an earlier fill's literal, so an app-rendered echo of it (the filled field's own displayed
+value; a search result, validation message, or confirmation label containing it; a destination landmark
+whose accessible label includes it) can re-enter session state and publication through a completely
+different, unparameterized action — even though the originating fill was parameterized.
+
+**The guarantee is now recording-session-scoped, not fill-step-scoped.** For the lifetime of one
+recording session, no later recorded action's own result payload or `target-v1`/`targets-v1` identity
+evidence may re-serialize an app-rendered echo of a literal the session already parameterized.
+
+The mechanism is the smallest explicit, ephemeral state that can recognize a later echo:
+`SessionState.recordedFillLiterals`, an in-memory `Map<literal, placeholder>` populated only by the SAME
+(literal, placeholder) pair a `fill --record-as` entry already computes for its own boundary above — one
+entry per parameterized fill, added only after that fill's own entry has been recorded. It is never
+serialized (not to the script, the session event log, or diagnostics), has no read API beyond the
+recorder that owns it, and disappears with the session.
+
+This is not a reversal of the "no secret-to-name table" rule in the Mapping contract above. That rule
+rejects retaining state to influence a *naming* decision — comparing a new `--record-as` value against
+prior ones to infer or deduplicate a variable name. `recordedFillLiterals` never informs a naming
+decision: every entry's placeholder is exactly the name the author already chose, and the map is
+consulted only to recognize that same, already-named value reappearing in unrelated later evidence — a
+redaction lookup, not a secret registry with a naming or comparison API.
+
+**Two treatments, by data class:**
+
+- **Result/event/backend-output fields** (display data, never compared at replay): content-aware
+  substring redaction, reusing the same recursive backend-output scrub the fill boundary already applies
+  to its own entry, generalized over every literal registered so far in the session. The substitution
+  itself is one placeholder-safe left-to-right pass over each string, not N sequential full-string passes
+  — a naive sequential pass over the same value can corrupt an EARLIER pair's just-inserted placeholder
+  when a LATER pair's literal happens to be a substring of it (register `somethinglong -> ${ABC}`, then
+  `ABC -> ${OTHER}`, and a second pass over a value already rewritten to `${ABC}` matches "ABC" *inside*
+  that token, producing `${${OTHER}}`). The single pass tries every registered literal longest-first at
+  each position — so one registered value that is a substring of another (a username that is a prefix of
+  a password) is never partially consumed by the shorter pair — and never re-scans text it has already
+  emitted, so no literal can ever be matched inside another pair's placeholder token in either direction.
+- **`target-v1`/`targets-v1` identity evidence** (`label`, `ancestry[].label`, `scrollRegion.label` — the
+  fields replay's own classification compares): never silently text-substituted while still claiming a
+  trustworthy identity. Replay compares recorded identity against the *live* tree, which legitimately
+  re-renders the real value again at replay time; a placeholder written into a recorded identity field
+  could therefore never verify correctly. Instead:
+  - **Landmark mode (`wait`).** An echo is treated exactly like #1349's existing identity-empty case: no
+    annotation is recorded, and the wait keeps its selector-existence semantics. Because ADR 0016's
+    destination guard requires `verification: "verified"`, a landmark whose only identity is a
+    parameterized-value echo simply stops qualifying as a guard — `session save-script` refuses it with
+    the existing "record a selector-targeted wait on a labeled or id-bearing landmark" recovery,
+    reproducing the motivating scenario's real resolution (switching the guard to the stable `Apps`
+    landmark) as an enforced outcome rather than an authoring convention.
+  - **Action mode (`get`, `is`, mutating element-targeting actions).** ADR 0012/0016 require identity
+    evidence for every element-targeting recorded action and forbid silently dropping it, so an echo here
+    is never dropped. The literal-bearing label(s) are redacted to the placeholder (content-aware,
+    substring-based — unlike the exact-match fill-boundary redaction, because a cross-step echo is
+    typically surrounded by app-authored text such as "Welcome, `<value>`") and `verification` is
+    downgraded to `"unverifiable"` — the same fail-closed downgrade decision 3's writer-parser invariant
+    already uses for an oversized payload. That fails the action's replay loudly
+    (`identity-unverifiable`) rather than silently weakening it to selector-only matching or publishing a
+    label that could never match again.
+
+**Explicit scope limits:**
+
+- A whitespace-only or empty resolved fill value is excluded from the session-wide registry; it keeps
+  only the existing fill-step-scoped protection above. Collapsing arbitrary later strings on a value with
+  no discriminating content is a disproportionate readability cost for a value that reveals nothing
+  distinctive if echoed, and would corrupt unrelated short incidental substrings throughout the rest of
+  the recording.
+- The originating fill's own recorded entry is protected only by the existing exact-match fill-boundary
+  pass; it is never passed through the coarser, substring-based session-wide pass using the pair it just
+  contributed. The session-wide guarantee is for later, distinct actions, exactly as #1398 frames it.
+- An author's own explicitly typed selector or positional text is not scanned — only derived, resolved
+  evidence and result payloads are. An author who types the secret directly into a new selector is making
+  the same choice as an unparameterized fill/type value; that remains literal script content.
+- The registry is keyed by literal, so two distinct `--record-as` names that happen to share the same
+  typed value (a password/confirm-password pair, say) are genuinely indistinguishable from a later
+  echo's perspective — the literal alone cannot say which fill produced it. The first-registered name
+  wins deterministically; the literal is redacted either way, so this only affects which placeholder
+  name a later echo is attributed to, never whether the value is protected.
+
 ## Consequences
 
 - Secret-bearing login/bootstrap scripts can use ADR 0016 active publication safely.
 - The caller must opt in for every sensitive fill; unparameterized fill/type values remain literal
   script content and help warns accordingly.
 - `type` and mutating `find ... fill|type` parameterization are not added by this decision. They require
   their own surface and provenance design if needed.
-- No new publication format, variable store, secret registry, or sensitivity heuristic is introduced.
+- No new publication format, variable store, or sensitivity heuristic is introduced. The #1398 amendment
+  adds one ephemeral, non-serialized, per-session redaction map with no naming or lookup-by-name API —
+  never a persistent secret registry.

scripts/layering/daemon-modularity.ts

@@ -14,8 +14,10 @@ const LARGEST_TYPE_CYCLE_ZONE_CEILINGS: Readonly<Record<string, number>> = {
 
 export const DAEMON_MODULARITY_BASELINE = {
   sessionState: {
-    writerOwnedFields: 21,
-    ownerFileClaims: 25,
+    // #1398: +1 field (`recordedFillLiterals`), +1 owner claim (its single owner,
+    // src/daemon/session-action-recorder.ts).
+    writerOwnedFields: 22,
+    ownerFileClaims: 26,
   },
   largestTypeCycle: {
     zoneMembers: LARGEST_TYPE_CYCLE_ZONE_CEILINGS,

scripts/layering/session-state.ts

@@ -85,6 +85,11 @@ export const SESSION_STATE_FIELD_OWNERS: Readonly<Record<string, readonly string
   // a second durable owner as the execution seam stays package-bound.
   lease: ['src/daemon/handlers/session-open-execution.ts'],
   deviceClaim: ['src/daemon/handlers/session-open-execution.ts'],
+
+  // #1398 (ADR 0017 session-scoped echo protection amendment): the ephemeral
+  // literal->placeholder registry is populated and consulted only at the
+  // recorder's single choke point.
+  recordedFillLiterals: ['src/daemon/session-action-recorder.ts'],
 };
 
 /**