Summary

• Tier 1 (Feat: shadow-aware subtree watcher (#164 Tier 1) #165) made the subtree watcher and selector dispatch reach into open shadow roots. Tier 2 does the same for the text-walk path that the injection-defense rules depend on: prompt-injection-redact, pii-redact, secrets-redact, encoded-payload-redact, unicode-invisibles-strip.
• Without this, an attacker could plant an injection payload inside a <div>.attachShadow({mode:"open"}) and every one of these rules would walk right past it — the entire point the rules exist (asymmetry between what the user sees and what an agent reads) was bypassable with one line of page JS.

Part of #164 Tier 2.

What changed

• extension/src/lib/dom-utils.ts
  • New collectTextNodesShadowPiercing shared collector — recursive walk that descends through element.shadowRoot for open hosts.
  • walkTextNodes now delegates to it (same public contract; same filter; just sees shadow content too).
  • visibleTextContent rewritten as a recursive concat that descends into open shadows; closed shadows stay opaque.
• extension/src/lib/yielding-text-walk.ts — the chunked walker now uses the shared collector for phase 1 and iterates by index in phase 2. Drops the walker.currentNode resume dance the original needed because the consumer detaches nodes mid-chunk; pre-collection makes that problem disappear (the array holds direct refs) and unlocks shadow piercing in one move. Chunking + scheduler-yield + abort semantics are unchanged.
• extension/src/lib/__tests__/text-walk-shadow.property.test.ts (new) — fast-check property tests for:
  • Coverage: walkTextNodes returns exactly the text nodes reachable through light + open-shadow boundaries for any random tree.
  • Eager / chunked equivalence: union of walkTextNodesChunked chunks equals walkTextNodes across nested shadows, in both sync and async paths.
  • visibleTextContent concatenates the same reachable set in pre-order across nested shadows.
  • Closed-shadow exclusion: text the builder places into a closed shadow root never surfaces (non-vacuous — the builder captures the shadow root at attach time so it can actually place content there).
• demo-site/src/components/ShadowDomEmbed.tsx — adds an injection-shaped paragraph inside the existing demo shadow root. Fixture reused from product detail (already base64 in source — no new plaintext payload shipped).

Closed shadow roots stay opaque by design. Tier 3 (adoptedStyleSheets for EasyList + placeholder styles inside shadows) is the remaining piece tracked in #164.

Test plan

• bun jest — 1322 / 1322 pass (6 new property tests; existing yielding-text-walk.property.test.ts equivalence tests continue to pass unchanged across the rewrite).
• bun run check — biome + eslint clean (extension + demo-site).
• bun run build — both bundles build clean.
• Manual: load the unpacked extension, open the demo home page, confirm the prompt-injection paragraph inside the shadow root is replaced with a reveal placeholder.

🤖 Generated with Claude Code