Reviewer findings on #107585:
- build_otp_fills split any >=4 code-like controls into digits. A page with
promo/zip/referral 'code' inputs next to the real OTP box would have had a
digit sprayed across unrelated fields. Split now requires exactly len(code)
controls that are all maxlength=1, same form, adjacent in DOM order
(inspection JS exports maxLength); anything else fills ONE field, the
best-scoring one. Verified on the real Browser Use stack: 6-box widget gets
one digit each; scattered page fills only the one-time-code input.
- normalize_otp_secret dropped digits/period/algorithm from otpauth:// URIs,
so an 8-digit or SHA-256 authenticator would get wrong codes. Non-default
parameters are now stored as seed|digits|period|algo and honoured (RFC 6238
SHA-256 8-digit vector added); hotp:// is rejected explicitly.
- rebase on main (prompts.ts conflict) + prettier.
f98cb00a8b