From 6fe45e03a13b04d51e99c02d90d6ef6079ce2a13 Mon Sep 17 00:00:00 2001
From: sbrooke <sbrooke@mozilla.com>
Date: Fri, 17 Jul 2026 16:24:15 -0400
Subject: [PATCH] fix(core): hide caller data from the model, fill by key at
 the sink (TAB-1104)

Caller data was JSON-rendered into the task prompt, so the model could read a secret and place it into a goto/tabstack URL or done(). Render only the data KEYS; add fill_user_data(ref, key) which substitutes the value at the browser sink and never returns or emits it (only a {{key}} mask). It runs the same assessFill gate as regular fill and records agentFilledRefs (never approvedRefs), so it cannot fill caller data into fields on untrusted hosts. The model never holds the value, so it cannot exfiltrate it regardless of domain or encoding. Keys-only prompt, hasUserData threaded into the tool list and step-error prompt, select/checkbox mapping.
---
 packages/core/src/prompts.ts                  |  29 +++-
 packages/core/src/tools/webActionTools.ts     | 116 +++++++++++++-
 packages/core/src/webAgent.ts                 |  14 +-
 packages/core/test/prompts.test.ts            | 113 +++-----------
 .../core/test/tools/webActionTools.test.ts    | 144 ++++++++++++++++++
 5 files changed, 318 insertions(+), 98 deletions(-)

diff --git a/packages/core/src/prompts.ts b/packages/core/src/prompts.ts
index 6e2a2b45..bbe424f6 100644
--- a/packages/core/src/prompts.ts
+++ b/packages/core/src/prompts.ts
@@ -90,6 +90,12 @@ export const TOOL_STRINGS = {
       formDescription:
         "Brief description of the form and its purpose (e.g., 'Shipping address form', 'Account registration')",
     },
+    fillUserData: {
+      description:
+        "Fill a field with one of the caller's Input Data values, by key. The value is inserted directly into the field and is NEVER shown to you. Use this for any field that should receive a caller-provided data value (personal info, credentials, etc.).",
+      ref: "Element reference from page snapshot (e.g., E###)",
+      key: "The Input Data key whose value to insert (see the Available keys list)",
+    },
     webSearch: {
       description:
         "Search the web for information. Returns the search results page as markdown. Use when you need to find websites or information but don't know the URL.",
@@ -176,6 +182,7 @@ function buildToolExamples(
   hasInteractive: boolean = false,
   hasFileUpload: boolean = false,
   advertisedUploadFiles: string[] = [],
+  hasUserData: boolean = false,
 ): string {
   const lines = [
     `- click({"ref": "${TOOL_STRINGS.webActions.common.elementRefExample}"}) - ${TOOL_STRINGS.webActions.click.description}`,
@@ -223,6 +230,12 @@ function buildToolExamples(
     );
   }
 
+  if (hasUserData) {
+    lines.push(
+      `- fill_user_data({"ref": "E###", "key": "membership_code"}) - ${TOOL_STRINGS.webActions.fillUserData.description}`,
+    );
+  }
+
   lines.push(
     `- done({"result": "your final answer"}) - ${TOOL_STRINGS.webActions.done.description}`,
     `- abort({"reason": "what was tried and why it failed"}) - ${TOOL_STRINGS.webActions.abort.description}`,
@@ -452,6 +465,7 @@ const buildActionLoopSystemPrompt = (
   hasInteractive: boolean = false,
   hasFileUpload: boolean = false,
   advertisedUploadFiles: string[] = [],
+  hasUserData: boolean = false,
 ) =>
   actionLoopSystemPromptTemplate({
     hasGuardrails,
@@ -465,6 +479,7 @@ const buildActionLoopSystemPrompt = (
       hasInteractive,
       hasFileUpload,
       advertisedUploadFiles,
+      hasUserData,
     ),
     currentDate: getCurrentFormattedDate(),
   });
@@ -481,11 +496,9 @@ Today's Date: {{ currentDate }}
 Task: {{ task }}
 Success Criteria: {{ successCriteria }}
 Plan: {{ plan }}
-{% if data %}
-Input Data:
-\`\`\`json
-{{ data }}
-\`\`\`
+{% if dataKeys %}
+Input Data available (values hidden for your security — you cannot see them). Available keys: {{ dataKeys }}
+To put one of these values into a field, call fill_user_data(ref, key). Never ask for or guess the values.
 {% endif %}
 {% if guardrails %}
 
@@ -501,7 +514,7 @@ export const buildTaskAndPlanPrompt = (
   task: string,
   successCriteria: string,
   plan: string,
-  data?: any,
+  dataKeys?: string[],
   guardrails?: string | null,
 ) =>
   taskAndPlanTemplate({
@@ -509,7 +522,7 @@ export const buildTaskAndPlanPrompt = (
     successCriteria,
     plan,
     currentDate: getCurrentFormattedDate(),
-    data: data ? JSON.stringify(data, null, 2) : null,
+    dataKeys: dataKeys && dataKeys.length ? dataKeys.join(", ") : null,
     guardrails,
   });
 
@@ -594,6 +607,7 @@ export const buildStepErrorFeedbackPrompt = (
   hasTabstack: boolean = false,
   hasFileUpload: boolean = false,
   advertisedUploadFiles: string[] = [],
+  hasUserData: boolean = false,
 ) =>
   stepErrorFeedbackTemplate({
     error,
@@ -604,6 +618,7 @@ export const buildStepErrorFeedbackPrompt = (
       false,
       hasFileUpload,
       advertisedUploadFiles,
+      hasUserData,
     ),
   });
 
diff --git a/packages/core/src/tools/webActionTools.ts b/packages/core/src/tools/webActionTools.ts
index 152e0cef..fb778b0c 100644
--- a/packages/core/src/tools/webActionTools.ts
+++ b/packages/core/src/tools/webActionTools.ts
@@ -9,6 +9,7 @@ import { tool, type ToolSet } from "ai";
 import { z } from "zod";
 import {
   AriaBrowser,
+  FieldMetadata,
   FileUploadConfig,
   PageAction,
   SCROLL_DIRECTIONS,
@@ -46,6 +47,12 @@ interface WebActionContext {
   allowFileUpload?: false | FileUploadConfig;
   /** Timeout for LLM provider calls in milliseconds (used by extract). */
   llmProviderTimeoutMs?: number;
+  /**
+   * Caller-supplied Input Data, keyed by name. When present with ≥1 key, the
+   * fill_user_data tool is exposed so the agent can fill fields by key without
+   * ever seeing the values — they are substituted directly at the browser sink.
+   */
+  data?: Record<string, unknown>;
 }
 
 /**
@@ -297,6 +304,18 @@ async function performActionWithValidation(
   );
 }
 
+/**
+ * Choose the browser action for filling a caller-data field based on its type:
+ * <select> uses Select, checkbox/radio inputs use Check, everything else Fill.
+ */
+function userDataFillAction(metadata: FieldMetadata): PageAction {
+  const tagName = metadata.tagName.toLowerCase();
+  if (tagName === "select") return PageAction.Select;
+  const inputType = metadata.inputType?.toLowerCase() ?? null;
+  if (inputType === "checkbox" || inputType === "radio") return PageAction.Check;
+  return PageAction.Fill;
+}
+
 export function createWebActionTools(context: WebActionContext): ToolSet {
   if (!context.agentFilledRefs || !context.operationalRefs) {
     throw new Error("Web action provenance tracking sets are required");
@@ -308,7 +327,7 @@ export function createWebActionTools(context: WebActionContext): ToolSet {
     throw new Error("interactive flag is required on WebActionContext");
   }
 
-  return {
+  const tools: ToolSet = {
     click: tool({
       description: TOOL_STRINGS.webActions.click.description,
       inputSchema: z.object({
@@ -660,4 +679,99 @@ export function createWebActionTools(context: WebActionContext): ToolSet {
       },
     }),
   };
+
+  // Only expose fill_user_data when the caller supplied Input Data. It fills a
+  // field with one of those values by key: the resolved value goes straight to
+  // the browser sink and is NEVER returned or emitted (only the "{{key}}" mask
+  // or the key). It is routed through the SAME firewall gate as the regular fill
+  // tool and records provenance in agentFilledRefs (NEVER approvedRefs), so a
+  // prompt-injected model cannot exfiltrate caller data to an untrusted host.
+  if (context.data && Object.keys(context.data).length) {
+    tools.fill_user_data = tool({
+      description: TOOL_STRINGS.webActions.fillUserData.description,
+      inputSchema: z.object({
+        ref: z.string().describe(TOOL_STRINGS.webActions.fillUserData.ref),
+        key: z.string().describe(TOOL_STRINGS.webActions.fillUserData.key),
+      }),
+      execute: async ({ ref, key }) => {
+        const value = context.data?.[key];
+        if (
+          value == null ||
+          (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean")
+        ) {
+          return failedActionResult(
+            "fill_user_data",
+            "Unknown or non-fillable data key: " +
+              key +
+              ". Available keys: " +
+              Object.keys(context.data ?? {}).join(", "),
+            context,
+            ref,
+          );
+        }
+
+        try {
+          const [metadata, pageUrl] = await Promise.all([
+            context.browser.getFieldMetadata(ref),
+            context.browser.getUrl(),
+          ]);
+          const pageHostname = extractHostname(pageUrl);
+
+          // SAME firewall gate as the regular fill tool: filling caller data
+          // into a field on an untrusted host is blocked exactly like a
+          // freeform agent fill, so page-driven prompt injection cannot exfil.
+          const assessment = assessFill({
+            field: metadata,
+            source: "agent",
+            pageHostname,
+            firewall: context.firewall,
+          });
+          if (!assessment.allowed) {
+            emitNonInteractiveBlock(context, "freeform-fill", assessment.reason, pageHostname, []);
+            return failedActionResult("fill_user_data", assessment.reason, context, ref);
+          }
+
+          const action = userDataFillAction(metadata);
+
+          // Emit the KEY as a mask, never the literal value.
+          context.eventEmitter.emit(WebAgentEventType.AGENT_ACTION, {
+            action: "fill_user_data",
+            ref,
+            value: "{{" + key + "}}",
+          });
+          context.eventEmitter.emit(WebAgentEventType.BROWSER_ACTION_STARTED, {
+            action: "fill_user_data",
+            ref,
+            value: "{{" + key + "}}",
+          });
+
+          // The resolved value is passed straight to the browser sink. It is
+          // never returned or emitted — only the key/mask is surfaced.
+          await context.browser.performAction(ref, action, String(value));
+
+          context.eventEmitter.emit(WebAgentEventType.BROWSER_ACTION_COMPLETED, {
+            success: true,
+            action: "fill_user_data",
+          });
+
+          // Record provenance so a following submit check can gate on it. Use
+          // agentFilledRefs/operationalRefs, NEVER approvedRefs — caller data is
+          // not user-approved per-field and must not bypass the submit gate.
+          context.agentFilledRefs.add(ref);
+          if (assessment.allowed && "operational" in assessment && assessment.operational) {
+            context.operationalRefs.add(ref);
+          }
+
+          return { success: true, action: "fill_user_data", ref, key };
+        } catch (error) {
+          if (error instanceof BrowserException) {
+            return failedActionResult("fill_user_data", error.message, context, ref);
+          }
+          throw error;
+        }
+      },
+    });
+  }
+
+  return tools;
 }
diff --git a/packages/core/src/webAgent.ts b/packages/core/src/webAgent.ts
index 0a5552bc..375eb2b4 100644
--- a/packages/core/src/webAgent.ts
+++ b/packages/core/src/webAgent.ts
@@ -563,7 +563,9 @@ export class WebAgent {
       approvedRefs = result.approvedRefs;
     }
 
-    // Setup tools once
+    // Setup tools once. Passing `data` exposes fill_user_data (only when ≥1 key
+    // is present); it fills caller data by key through the same firewall gate as
+    // fill, so the model never sees the values and cannot exfiltrate them.
     const webActionTools = createWebActionTools({
       browser: this.browser,
       eventEmitter: this.eventEmitter,
@@ -576,6 +578,7 @@ export class WebAgent {
       interactive: Boolean(this.onUserDataRequired),
       allowFileUpload: this.allowFileUpload,
       llmProviderTimeoutMs: this.llmProviderTimeoutMs,
+      data: this.data ?? undefined,
     });
 
     // Only include search tools if a search service was created
@@ -890,6 +893,7 @@ export class WebAgent {
       Boolean(this.tabstackApiKey),
       this.hasFileUpload,
       this.advertisedUploadFiles,
+      this.hasUserData,
     );
     this.messages.push({ role: "user", content: errorFeedback });
   }
@@ -898,6 +902,10 @@ export class WebAgent {
     return this.allowFileUpload !== false && this.allowFileUpload.allowedPaths.length > 0;
   }
 
+  private get hasUserData(): boolean {
+    return Boolean(this.data && Object.keys(this.data).length > 0);
+  }
+
   /** Remove image parts from the most recent user message (fallback for AI SDK image crashes). */
   private stripImagesFromLastMessage(): void {
     for (let i = this.messages.length - 1; i >= 0; i--) {
@@ -1928,12 +1936,13 @@ export class WebAgent {
     const hasTabstack = Boolean(this.tabstackApiKey);
     const hasStartingUrl = Boolean(this.url && this.url !== "about:blank");
     const hasInteractive = Boolean(this.onUserDataRequired);
+    const hasUserData = this.hasUserData;
 
     const taskPromptContent = buildTaskAndPlanPrompt(
       task,
       this.successCriteria,
       this.plan,
-      this.data,
+      this.data ? Object.keys(this.data) : undefined,
       this.guardrails,
     );
 
@@ -1945,6 +1954,7 @@ export class WebAgent {
       hasInteractive,
       this.hasFileUpload,
       this.advertisedUploadFiles,
+      hasUserData,
     );
 
     this.messages = [
diff --git a/packages/core/test/prompts.test.ts b/packages/core/test/prompts.test.ts
index fe6b0322..025fe87a 100644
--- a/packages/core/test/prompts.test.ts
+++ b/packages/core/test/prompts.test.ts
@@ -355,119 +355,56 @@ describe("prompts", () => {
       expect(prompt).toContain("Today's Date: Jan 15, 2024");
     });
 
-    it("should include data when provided", () => {
+    it("shows data keys but never renders values (security)", () => {
       const task = "Book a flight";
       const successCriteria = "Reserve airline tickets";
       const plan = "1. Search flights\n2. Select flight\n3. Book";
-      const data = {
-        departure: "NYC",
-        destination: "LAX",
-        date: "2024-12-25",
-        passengers: 2,
-      };
 
-      const prompt = buildTaskAndPlanPrompt(task, successCriteria, plan, data);
+      const prompt = buildTaskAndPlanPrompt(task, successCriteria, plan, ["membership_code"]);
 
-      expect(prompt).toContain("Input Data:");
-      expect(prompt).toContain("```json");
-      expect(prompt).toContain('"departure": "NYC"');
-      expect(prompt).toContain('"destination": "LAX"');
-      expect(prompt).toContain('"date": "2024-12-25"');
-      expect(prompt).toContain('"passengers": 2');
-      expect(prompt).toContain("```");
+      // Keys are shown so the model knows what it can fill.
+      expect(prompt).toContain("membership_code");
+      expect(prompt).toContain("Available keys:");
+      expect(prompt).toContain("fill_user_data(ref, key)");
+      // Values are never rendered: no JSON fence, no old "Input Data:" block.
+      expect(prompt).not.toContain("```json");
+      expect(prompt).not.toContain("Input Data:");
+    });
+
+    it("joins multiple keys and does not leak values", () => {
+      const prompt = buildTaskAndPlanPrompt("t", "s", "p", ["membership_code", "email", "phone"]);
+
+      expect(prompt).toContain("membership_code, email, phone");
+      expect(prompt).not.toContain("```json");
     });
 
-    it("should not include data section when data is null", () => {
+    it("should not include data section when dataKeys is null", () => {
       const task = "Search for hotels";
       const explanation = "Find accommodation";
       const plan = "1. Search\n2. Compare\n3. Select";
 
-      const prompt = buildTaskAndPlanPrompt(task, explanation, plan, null);
+      const prompt = buildTaskAndPlanPrompt(task, explanation, plan, null as any);
 
-      expect(prompt).not.toContain("Input Data:");
+      expect(prompt).not.toContain("Available keys:");
       expect(prompt).not.toContain("```json");
     });
 
-    it("should not include data section when data is undefined", () => {
+    it("should not include data section when dataKeys is undefined", () => {
       const task = "Search for hotels";
       const explanation = "Find accommodation";
       const plan = "1. Search\n2. Compare\n3. Select";
 
       const prompt = buildTaskAndPlanPrompt(task, explanation, plan);
 
-      expect(prompt).not.toContain("Input Data:");
+      expect(prompt).not.toContain("Available keys:");
       expect(prompt).not.toContain("```json");
     });
 
-    it("should handle complex nested data objects", () => {
-      const task = "Complete booking";
-      const successCriteria = "Finalize reservation";
-      const plan = "1. Review\n2. Pay\n3. Confirm";
-      const data = {
-        booking: {
-          flight: {
-            departure: { city: "NYC", time: "9:00 AM" },
-            arrival: { city: "LAX", time: "12:00 PM" },
-          },
-          hotel: {
-            name: "Grand Hotel",
-            checkIn: "2024-12-25",
-            checkOut: "2024-12-27",
-          },
-        },
-        travelers: [
-          { name: "John Doe", age: 30 },
-          { name: "Jane Doe", age: 28 },
-        ],
-      };
-
-      const prompt = buildTaskAndPlanPrompt(task, successCriteria, plan, data);
-
-      expect(prompt).toContain("Input Data:");
-      expect(prompt).toContain("```json");
-      expect(prompt).toContain('"departure"');
-      expect(prompt).toContain('"NYC"');
-      expect(prompt).toContain('"Grand Hotel"');
-      expect(prompt).toContain('"John Doe"');
-      expect(prompt).toContain('"travelers"');
-    });
-
-    it("should format data with proper JSON indentation", () => {
-      const task = "Test task";
-      const successCriteria = "Test successCriteria";
-      const plan = "Test plan";
-      const data = {
-        level1: {
-          level2: {
-            value: "nested",
-          },
-        },
-      };
-
-      const prompt = buildTaskAndPlanPrompt(task, successCriteria, plan, data);
-
-      // Check that JSON is properly indented (2 spaces)
-      expect(prompt).toContain(
-        '{\n  "level1": {\n    "level2": {\n      "value": "nested"\n    }\n  }\n}',
-      );
-    });
+    it("should not include data section when dataKeys is empty", () => {
+      const prompt = buildTaskAndPlanPrompt("task", "criteria", "plan", []);
 
-    it("should handle data with special characters", () => {
-      const task = "Special chars test";
-      const successCriteria = "Test special characters";
-      const plan = "Handle special chars";
-      const data = {
-        message: 'Hello "world" & <test>',
-        symbols: "!@#$%^&*()",
-        unicode: "café naïve résumé",
-      };
-
-      const prompt = buildTaskAndPlanPrompt(task, successCriteria, plan, data);
-
-      expect(prompt).toContain("Input Data:");
-      expect(prompt).toContain('"Hello \\"world\\" & <test>"');
-      expect(prompt).toContain('"!@#$%^&*()"');
-      expect(prompt).toContain('"café naïve résumé"');
+      expect(prompt).not.toContain("Available keys:");
+      expect(prompt).not.toContain("```json");
     });
   });
 
diff --git a/packages/core/test/tools/webActionTools.test.ts b/packages/core/test/tools/webActionTools.test.ts
index ef6037c7..fc545c19 100644
--- a/packages/core/test/tools/webActionTools.test.ts
+++ b/packages/core/test/tools/webActionTools.test.ts
@@ -12,6 +12,7 @@ import { LanguageModel } from "ai";
 import { z } from "zod";
 import { InvalidRefException, BrowserActionException } from "../../src/errors.js";
 import { generateTextWithRetry } from "../../src/utils/retry.js";
+import { SECURITY_BLOCKED_UNAUTHORIZED_FILL } from "../../src/security/actionFirewall.js";
 
 // Mock the ai module
 vi.mock("ai", () => ({
@@ -1343,4 +1344,147 @@ describe("Web Action Tools", () => {
       expect(result.error).not.toMatch(/unsafe_mode|trusted_hostnames|untrusted\.com/);
     });
   });
+
+  describe("fill_user_data Action", () => {
+    const SECRET = "super-secret-membership-42";
+    const DATA = { membership_code: SECRET, age: 30, subscribed: true };
+    // A sensitive (non-operational) field: agent fills are blocked on untrusted
+    // hosts, so it exercises the firewall gate rather than the operational path.
+    const emailField: FieldMetadata = {
+      ref: "E12",
+      tagName: "input",
+      inputType: "email",
+      role: "textbox",
+      name: "email",
+      label: "Email",
+      placeholder: null,
+      autocomplete: "email",
+      isContentEditable: false,
+      formId: "signup",
+      formAction: "https://example.com/signup",
+      formMethod: "post",
+    };
+    let udTools: any;
+
+    beforeEach(() => {
+      context.data = DATA;
+      context.approvedRefs = new Set<string>();
+      udTools = createWebActionTools(context);
+    });
+
+    it("is only exposed when data has at least one key", () => {
+      expect(udTools.fill_user_data).toBeDefined();
+      expect(createWebActionTools({ ...context, data: {} }).fill_user_data).toBeUndefined();
+      expect(createWebActionTools({ ...context, data: undefined }).fill_user_data).toBeUndefined();
+    });
+
+    it("is blocked on an untrusted host and neither fills nor leaks the value (security fix)", async () => {
+      mockBrowser.url = "https://untrusted.com/signup";
+      mockBrowser.fieldMetadata.set("E12", emailField);
+      const performActionSpy = vi.spyOn(mockBrowser, "performAction");
+
+      const result = await udTools.fill_user_data.execute({ ref: "E12", key: "membership_code" });
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBe(SECURITY_BLOCKED_UNAUTHORIZED_FILL);
+      expect(performActionSpy).not.toHaveBeenCalled();
+      expect(context.agentFilledRefs.has("E12")).toBe(false);
+      expect(JSON.stringify(result)).not.toContain(SECRET);
+    });
+
+    it("fills on a trusted host, masks the value, and records provenance not approval", async () => {
+      mockBrowser.url = "https://example.com/signup";
+      mockBrowser.fieldMetadata.set("E12", emailField);
+      context.firewall = { trustedHostnames: new Set(["example.com"]), unsafeMode: false };
+      udTools = createWebActionTools(context);
+      const performActionSpy = vi.spyOn(mockBrowser, "performAction");
+      const emitSpy = vi.spyOn(eventEmitter, "emit");
+
+      const result = await udTools.fill_user_data.execute({ ref: "E12", key: "membership_code" });
+
+      // The resolved value goes to the browser sink...
+      expect(performActionSpy).toHaveBeenCalledWith("E12", PageAction.Fill, SECRET);
+      // ...but is never returned to the model.
+      expect(result).toEqual({
+        success: true,
+        action: "fill_user_data",
+        ref: "E12",
+        key: "membership_code",
+      });
+      expect(JSON.stringify(result)).not.toContain(SECRET);
+
+      // AGENT_ACTION carries the masked key, never the literal value.
+      expect(emitSpy).toHaveBeenCalledWith(WebAgentEventType.AGENT_ACTION, {
+        action: "fill_user_data",
+        ref: "E12",
+        value: "{{membership_code}}",
+      });
+      // No emitted event payload contains the literal value.
+      for (const call of emitSpy.mock.calls) {
+        expect(JSON.stringify(call)).not.toContain(SECRET);
+      }
+
+      // Provenance recorded for the submit gate; approval NEVER granted.
+      expect(context.agentFilledRefs.has("E12")).toBe(true);
+      expect(context.approvedRefs.has("E12")).toBe(false);
+    });
+
+    it("returns a failure listing available keys for an unknown key without filling", async () => {
+      const performActionSpy = vi.spyOn(mockBrowser, "performAction");
+
+      const result = await udTools.fill_user_data.execute({ ref: "E1", key: "not_a_real_key" });
+
+      expect(performActionSpy).not.toHaveBeenCalled();
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("not_a_real_key");
+      expect(result.error).toContain("membership_code");
+      expect(context.agentFilledRefs.has("E1")).toBe(false);
+    });
+
+    it("uses PageAction.Select for a <select> field", async () => {
+      mockBrowser.url = "https://example.com";
+      mockBrowser.fieldMetadata.set("E9", {
+        ref: "E9",
+        tagName: "select",
+        inputType: null,
+        role: "combobox",
+        name: "country",
+        label: "Country",
+        placeholder: null,
+        autocomplete: null,
+        isContentEditable: false,
+        formId: "signup",
+        formAction: "https://example.com/signup",
+        formMethod: "post",
+      });
+      context.firewall = { trustedHostnames: new Set(["example.com"]), unsafeMode: false };
+      udTools = createWebActionTools(context);
+      const performActionSpy = vi.spyOn(mockBrowser, "performAction");
+
+      await udTools.fill_user_data.execute({ ref: "E9", key: "membership_code" });
+
+      expect(performActionSpy).toHaveBeenCalledWith("E9", PageAction.Select, SECRET);
+    });
+
+    it("returns a recoverable failure when performAction throws BrowserException", async () => {
+      mockBrowser.url = "https://example.com";
+      context.firewall = { trustedHostnames: new Set(["example.com"]), unsafeMode: false };
+      udTools = createWebActionTools(context);
+      vi.spyOn(mockBrowser, "performAction").mockRejectedValueOnce(
+        new BrowserActionException("fill", "element is not editable"),
+      );
+
+      const result = await udTools.fill_user_data.execute({ ref: "E12", key: "membership_code" });
+
+      expect(result).toEqual({
+        success: false,
+        action: "fill_user_data",
+        ref: "E12",
+        error: "element is not editable",
+        isRecoverable: true,
+      });
+      expect(context.agentFilledRefs.has("E12")).toBe(false);
+      expect(JSON.stringify(result)).not.toContain(SECRET);
+    });
+  });
 });