From 944943b7df0168581a261b0888f0c2b1a7c44fa8 Mon Sep 17 00:00:00 2001
From: iris <iris@hyperhive>
Date: Fri, 29 May 2026 18:40:54 +0200
Subject: [PATCH] agent: autocomplete='one-time-code' on OAuth input (argus
 #592 nit)

Browsers may silently ignore autocomplete='off' on type='password'
inputs (UA override to help users save credentials). For an OAuth
code, the semantic value is 'one-time-code' which is honoured + has
the side benefit of suppressing the 'save password?' prompt that
would otherwise fire on form submit.
---
 frontend/packages/agent/src/app.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/frontend/packages/agent/src/app.js b/frontend/packages/agent/src/app.js
index a6aa8c47..7889083f 100644
--- a/frontend/packages/agent/src/app.js
+++ b/frontend/packages/agent/src/app.js
@@ -360,7 +360,12 @@ window.marked = marked;
         type: 'password',
         placeholder: 'paste OAuth code here (hidden)',
         required: '',
-        autocomplete: 'off',
+        // `one-time-code` is the semantic value for OAuth codes (per
+        // WHATWG / argus #592 review): browsers may silently ignore
+        // `autocomplete="off"` on `type="password"` inputs, but
+        // `one-time-code` is honoured + suppresses the "save password
+        // for this site?" prompt that would otherwise fire on submit.
+        autocomplete: 'one-time-code',
         spellcheck: 'false',
       });
       const reveal = el('button', {