Prevent env autofill from overwriting OKX API keys when saving hedge settings.

Co-authored-by: Cursor <cursoragent@cursor.com>

lib/common/static/instance_settings_prefs.js

@@ -202,8 +202,21 @@
       input = document.createElement("input");
       input.id = "env-f-" + field.key;
       input.type = "password";
-      input.autocomplete = "off";
+      // 防止浏览器把登录密码自动填进 API Key/Secret(保存对冲开关时曾误写入密钥)
+      input.autocomplete = "new-password";
+      input.setAttribute("data-lpignore", "true");
+      input.setAttribute("data-1p-ignore", "true");
+      input.setAttribute("data-form-type", "other");
+      input.readOnly = true;
+      input.addEventListener("focus", function () {
+        input.readOnly = false;
+      });
       if (field.sensitive) {
+        input.dataset.envSensitive = "1";
+        input.dataset.envDirty = "0";
+        input.addEventListener("input", function () {
+          input.dataset.envDirty = "1";
+        });
         if (field.has_value) {
           const cur = document.createElement("div");
           cur.className = "env-sensitive-current muted";
@@ -219,6 +232,7 @@
         input.placeholder = field.has_value ? "修改时填写新值,留空不修改" : "请输入";
       } else {
         input.type = "text";
+        input.autocomplete = "off";
         input.value = field.current || field.default || "";
       }
     }
@@ -309,6 +323,10 @@
     const values = {};
     const scope = root || document;
     scope.querySelectorAll(".env-field-input[data-env-key]").forEach((el) => {
+      if (el.dataset.envSensitive === "1" && el.dataset.envDirty !== "1") {
+        // 未改动过的敏感项不提交,避免浏览器自动填充覆盖已有密钥
+        return;
+      }
       values[el.dataset.envKey] = el.value;
     });
     return values;