fix(extension): do not fill a 2FA code into a form with empty credentials

[vineethkrishnan]

Follow-up to #328. Fixes a regression that shipped in 1.26.0.

The bug

On a single-step login page the 2FA code could be filled while the username and password were still empty. It looks broken, and it puts a code on screen that cannot be submitted yet.

Two causes:

Ordering. maybeAutofillOtp ran immediately from refreshMatches, while the credential autofill waits 500ms and then polls for its form. Even when both were going to fire, the code arrived first.

Disagreeing conditions. The credential fill requires matches.length === 1; the code fill only required totpMatches().length === 1. On a host with two saved logins where only one carries a TOTP, the credential fill correctly stood down as ambiguous and the code fill went ahead regardless, so the credentials were never filled at all. This is the more likely path to what was reported.

The fix

The standalone pass now stands down whenever a visible login form still has an empty password box. That fill owns the code and writes username, password and code in one pass, which removes the ordering race outright rather than papering over it with a longer delay.

Gating on an empty password rather than on the mere presence of a form keeps a real case working: an SPA that fills credentials in one step and only then reveals its code box still gets filled, because by that point nothing is pending.

The ambiguity rule now matches the credential path exactly: exactly one matching login, and that login carries the secret.

Resulting behaviour

Situation	Result
Pick a login from the picker	username + password + code together
Autofill on load, single-step form	username + password + code together
Autofill on load, 2FA-only second page	code filled (nothing else to fill)
Autofill off	code only when you click the emblem
Login form with empty credentials	no code fill

Tests

The decision moved out of content.ts into a pure predicate in extension/utils/otp-autofill.ts, alongside the existing one-time-code detector and field classifier. The policy was previously trapped inside defineContentScript and could not be tested at all.

Nine cases cover the table above, including the regression itself (hasPendingCredentialForm: true must not fill), which returns true under the old logic and false now.

Verification

• npm run typecheck clean
• npm test 74/74 passing (65 before, 9 new)
• npm run build succeeds

Not exercised against a live 2FA page in a browser.