Inspiration
AI can automate entire workflows, yet "Check your email" still breaks mine. A sign-in, account confirmation, or flight lookup means leaving the current page, finding the right message, deciding whether it is legitimate, and carrying a code, link, or booking detail back.
I built ContextFill to remove that context switch without removing the security decision.
What it does
When a page asks for temporary information, ContextFill finds a recent candidate from the selected message source and shows why it belongs to that site. It can:
- fill a fresh verification code;
- open a verified magic link in the same tab; or
- transfer a small Context Capsule, such as a booking reference and passenger surname.
Depending on the exact-site setting, ContextFill waits for approval or displays a visible, cancellable three-second countdown. It revalidates the page and message immediately before acting, and it never submits the final form.
The extension works with a bundled offline judge inbox, a locally imported .eml file, or read-only Gmail and Outlook access through the optional loopback companion.
The demo shows three real workflows:
- Substack: a fresh Gmail-backed OTP completes through popup-free Auto-Continue.
- Medium: a verified magic link opens in the same initiating tab.
- Airline check-in: a two-fact Capsule shows masked evidence, transfers both fields atomically, offers Undo, and leaves the final action to the user.
A bundled judge lab also includes deterministic allow, lookalike, mismatch, expired, ambiguous, conflict, decoy-field, cancellation, and replay scenarios without requiring an email account or API key.
Why it is different
ContextFill is not another OTP extractor. It treats codes, verified links, and temporary references as forms of the same primitive: verified context transfer.
The system moves only the minimum required facts from one recent message to one matching page, with an inspectable decision at the boundary. Every new site starts in Manual mode. Assisted and Auto-Continue require an explicit, revocable exact-origin grant. Any uncertainty fails closed.
Potential impact
ContextFill is for people who repeatedly move temporary information between mail and browser: signing into services, confirming accounts, checking travel, onboarding, recruiting, and support.
The immediate value is fewer flow-breaking inbox visits. The broader opportunity is a reusable trust layer between message sources and web applications—without turning the browser into an autonomous agent.
How GPT-5.6 is used
Email templates are messy and constantly changing. GPT-5.6 handles that semantic variability by turning one prefiltered, bounded message into source-grounded facts under a strict schema.
It cannot choose a page target, select an automation mode, authorize filling, navigate, or submit. The local companion sends at most one truncated message with store: false, validates the structured response with Zod, verifies that every value and supporting excerpt occurs in the source message, and falls back to deterministic extraction on any timeout, malformed response, unsupported intent, or invented evidence.
GPT-5.6 extracts facts. Deterministic code decides.
How Codex was used
Codex took ContextFill from an empty repository through architecture, implementation, real Gmail integration, security review, automated testing, packaging, releases, demo production, and submission preparation.
Real acceptance testing shaped the product. A live Vialto OTP page exposed exact-origin permission and split-input gaps. Medium revealed ambiguity between multiple recent messages. Codex diagnosed those failures from browser and service evidence, then helped add stricter ranking, dynamic SPA detection, action-time revalidation, revocation, replay protection, and privacy-safe activity records.
Parallel, isolated Codex workstreams explored differentiation and implemented Verified Auto-Continue and Context Capsules while preserving the same authorization boundary.
The beta.9 release gate covered formatting, lint, types, 134 unit/integration tests, 10 packaged-extension scenarios, 12 installed-Chrome scenarios, clean-install companion smoke tests, archive and secret scans, and a production dependency audit with zero known vulnerabilities.
Architecture and privacy
The extension owns the page experience; a loopback companion keeps mailbox tokens and the OpenAI API key out of browser code; the shared deterministic core owns every trust and mutation decision.
The Manifest V3 extension owns page inspection, exact-site rules, visible UX, and short-lived candidate state. The optional Node/Hono companion binds only to 127.0.0.1, keeps OAuth refresh tokens in the operating-system keychain, and never exposes the OpenAI key to the extension.
The shared TypeScript core owns Zod schemas, extraction, domain parsing, ranking, trust policy, conservative field mapping, atomic mutation, rollback, replay protection, and presentation data.
ContextFill never prefollows one-time links, copies secrets to the clipboard, persists temporary values, clicks Submit or Login, presses Enter, or lets the model authorize an action. No personal mailbox, paid service, or API key is required for the five-minute judge path.
Challenges and lessons
The hard part was not extracting six digits. It was proving that a particular message belongs to the page in front of the user, handling ambiguity safely, and making automation visible enough to cancel and revoke.
During real Medium testing, multiple recent valid-looking messages competed for the same page. ContextFill stopped instead of guessing. That failure led to stricter ambiguity handling and became one of the clearest demonstrations of why extraction and authorization must remain separate.
The project reinforced a design principle I want to keep: models are valuable at fuzzy interpretation boundaries, but authorization should stay small, deterministic, testable, and explainable.
What's next
This is a hackathon prototype, not a production security product. Next steps include stronger sender-authentication evidence, more reviewed Capsule shapes, signed extension distribution, broader framework-controlled input support, and an independently audited threat model.
The long-term vision is an open protocol for verified context transfer across browsers, mail providers, and web applications.
Built With
- chrome
- codex
- gmail-api
- gpt-5.6
- hono
- microsoft-graph
- node.js
- playwright
- typescript
- vite
- zod