r-zakarya
72dcc3dd82
Residual new-entry trigger (1 in 6): password chars go out as KEYEVENTF_UNICODE (VK_PACKET, can't match a hotkey) — the real chord risk is the Ctrl+A clear-field, which sends a real VK_A. If the user re-presses Ctrl+Shift mid-sequence, that VK_A becomes physical Ctrl+Shift+A = our own new-entry hotkey. ForceReleaseModifiers now runs inside SendSelectAllAndDelete, at the risky instant, not just once up front. Balloon: was gated by "Show tray notifications" (OFF for this user) — now gated by its own synced setting "Tray alert when autofill is blocked" (autofillFailBalloon, Settings > Autofill, default ON), carried as notify=0 on cmd://autofill/execute. ShowBalloon no longer gates internally; each caller applies its own setting. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
