Focus Before Delete

2026-08-26

A browser agent clicked a LinkedIn profile editor, received a successful click result, and sent the ordinary replace-text sequence: select all, then delete. The click had not moved focus into the editor. Select all highlighted the page, delete closed the modal, and every command still returned success.

No individual operation was broken. The sequence was unsafe because the caller could not observe the state that made the next operation safe.

A screenshot arrives too late

The browser tools already recommended taking a screenshot after typing. That can detect text landing in the wrong place, but destructive shortcuts have no useful “after.” Once the editor closes, the screenshot only records the loss.

The practical workaround was to type a canary, take a screenshot, inspect it, then replace the canary. Two round trips and an image were being used to answer a synchronous DOM question: what has focus, and can it accept text?

Make the precondition observable

get_focused_element now returns bounded JSON for the active element: its tag, role, label, editable state, and a short value preview. Password values are always redacted. Focus is followed through open shadow roots; iframe and closed shadow-root boundaries stay opaque and therefore fail safe.

Observation alone still leaves every caller to remember the rule. So keyboard_press enforces it at the dangerous edge: select-all, Backspace, and Delete are refused when focus is not editable. An explicit override remains for intentional page-level shortcuts, making the exceptional intent visible in the call instead of inferred after damage.

Test the sequence, not only the methods

Unit tests cover shortcut classification, refusal, ordinary keys, and the override. Daemon tests prove that the new JSON query and boolean flag survive CLI serialization. A real installed browser then exercises password redaction, textarea and contenteditable focus, an open shadow root, detached focus, an iframe boundary, and the original page-wide select-all failure.

The full non-network regression gate passed 7,251 tests. More importantly, the incident's three individually successful commands can no longer compose into a silent destructive action: the boundary now checks the state the sequence depends on.