[rudycelekli]

• Validate the focused control inside nested open and tracked closed shadow roots before typing.
• Refuse an iframe host when its focused child is a button. Keep editable frame inputs and focused custom widgets supported.
• Update browser typing guidance and add a web patch changeset.

flowchart LR
  A[Focused element] --> B[Descend shadow focus]
  B --> C{Editable control or custom widget?}
  C -->|yes| D[Dispatch typing]
  C -->|no| E[Refuse before keys]

Loading

Verified

Ran it locally: yes

main	this branch
Five native regressions fail: shadow hosts bypass readonly/button checks, and an iframe host bypasses the focused button check. Four positive controls pass.	All nine native regressions and controls pass. Rejected shadow controls receive no key or input events.
Built CLI wrongly accepts typing on a closed-shadow button and a focused iframe button.	Both are refused before dispatch. An active iframe input accepts typing; an inactive iframe input does not authorize typing on the main document's focused button. All four CLI tests pass.

main: Test Files 1 failed; Tests 2 failed, 2 passed
branch: Test Files 1 passed; Tests 4 passed

The real built CLI proof uses the documented StepExecutor seam to call native actions, with no model calls. Main and branch use locked Playwright 1.63.0 Chromium, Node 24.18.0 and pnpm 12.3.4. Main/branch videos are retained locally; installed GitHub CLI 2.83.1 lacks --attach.

The full web suite passes: 56 files, 513 tests and one skipped. The complete testbed passes: 14 files, 71 tests and one skipped. The complete Next benchmark suite passes: 41 files and 91 tests, reusing the unchanged production app built in this worktree for the preceding ARIA branch. Web build, typecheck, lint and docs validation pass. An independent production/native-test review found no remaining critical or important findings. Semantic reader and oracle expectations are unchanged.

Six paired scripts/bench-ab.ts --suite testbed --no-build --min-pairs 6 --max-pairs 6 --warmup 0 -- tests/forms.e2e.ts runs match every step, outcome and counter. Existing forms scenarios verify unaffected behavior; the new native fixtures prove the focus guard. No performance claim on the shared host.

Metric	main	this branch	comparison
Suite, sum of attempts	1.94 s	1.94 s	same under the 10 ms floor (+0.3%, 95% interval -0.6% to +24.6%)

Local pnpm check passes lint then stops at a mobile benchmark react-native-screens dead-code finding with Expo dependencies excluded from the filtered installation. The same finding reproduces on main with that installation; this does not establish a source defect. Full top-level pnpm test, pnpm test:testbed and pnpm test:web-benchmark wrappers were not run; the complete touched-package, testbed and Next suites above were run against built packages.

CI status

The four workflows on this head require repository owner approval before execution:

• benchmark
• docs
• mobile
• spec

Updated verification (October 6)

Removed the skills entry and shortened the documentation and changeset wording. All four built CLI cases pass for focused buttons and fields inside frames and shadow roots.

Direct package typecheck and lint pass. The full monorepo check remains blocked at the same missing filtered mobile-benchmark dependency on untouched main; the current full Next benchmark was not rerun with this lean dependency environment. Hosted fork workflow authorization is reported separately; I am not marking these Ready for Human Review.

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[okwasniewski]

Thanks, the bug is real: with focus inside a shadow root the check read the host, so a focused button let typing through. Two asks: drop the skills/e2e/references/agent.md addition, and cut the agent.mdx change and the changeset to one sentence, e.g. "The focused element is checked inside shadow roots and frames, so focus on a button there is refused."

[rudycelekli]

[gpt-6.1-sol] responding on behalf of rudycelekli

Removed the skills entry and shortened the documentation and changeset wording. All four built CLI cases pass for focused buttons and fields inside frames and shadow roots.

Direct package typecheck and lint pass. The full monorepo check remains blocked at the same missing filtered mobile-benchmark dependency on untouched main; the current full Next benchmark was not rerun with this lean dependency environment. Hosted fork workflow authorization is reported separately; I am not marking these Ready for Human Review.

[okwasniewski]

Thanks! I merged main and added ...ignoreTrace to the startAttempt call in keyboard-shadow-focus.test.ts, since #869 made the trace fields required. Web typecheck and tests pass.