@beryl-so/cli 0.46.0 → 0.46.1

package/dist/beryl-test-skill.js

@@ -159,7 +159,17 @@ An empty \`accounts list\` means nothing is set up. In order of preference:
 1. **The user has a dedicated test account** → bank it:
    \`beryl accounts create --email <email> --password <password>\`. A DEDICATED test
    account only — never a real user's.
-2. **No credentials, but the app has a signup form** → let Beryl make one.
+2. **Only Google (or another SSO) sign-in, no email+password form** → the same path:
+   ask for a DEDICATED Google test account and bank it with \`accounts create --email
+   --password\`. Its sign-in plan runs through Google's own pages — click the app's
+   Google button, fill \`#identifierId\` with \`{{login_email}}\`, click
+   \`#identifierNext\`, fill \`input[name=Passwd]\` with \`{{login_password}}\`, click
+   \`#passwordNext\`, then assert the app's signed-in shell. Store it with \`accounts
+   set-login\`, prove it with \`accounts check\`. Author its tests with \`auth_mode:
+   "session"\` only, so Google is signed in once per run, never per test. Google may
+   still challenge a scripted sign-in now and then ("Verify it's you"); the captured
+   session (end of §1) is the fallback for that, not the default.
+3. **No credentials, but the app has a signup form** → let Beryl make one.
    \`beryl accounts create --type beryl\`, then sign it up with
    \`beryl accounts signup <id> --file <signup-plan.json>\`. The plan is the app's own
    signup form as an ActionPlan, ending LOGGED IN, filling \`{{mailbox_address}}\` and
@@ -168,7 +178,7 @@ An empty \`accounts list\` means nothing is set up. In order of preference:
    or the record was lost) skips signup: store its sign-in with \`accounts set-login\`.
    No password sign-in? Pass \`--login-method otp\` (or \`magic_link\`) and let the plan
    \`await_email\` through; later sign-ins read the same mailbox.
-3. **Neither** → the flow is not testable authenticated. Say so rather than guessing.
+4. **Neither** → the flow is not testable authenticated. Say so rather than guessing.
 
 A project with no accounts falls back to the \`LOGIN_EMAIL\` variable +
 \`LOGIN_PASSWORD\` secret with the same handle resolution, so existing tests are
@@ -222,11 +232,13 @@ pending", "the share link is issued") — a real, strong outcome. While AUTHORIN
 drive the full handshake live: a second account (\`accounts create --label member\`), or
 a second mailbox (\`mailbox create --label invitee\`, read with \`mailbox read\`).
 
-SSO-only sites (no email+password form at all) ride a captured session instead: a human
-signs in once through a live browser view in the Beryl webapp, Beryl stores the session
-encrypted server-side and injects it into cloud runs — \`tests create\` verifies such
-plans server-side, \`runs trigger\` runs them, \`runs local\` skips them (the session
-never leaves Beryl's cloud).
+SSO-only sites are not a dead end: with a dedicated Google test account they follow §1
+item 2 like any password account. The captured session is the FALLBACK — no test account
+can be provided, or Google challenges the scripted sign-in: a human signs in once
+through a live browser view in the Beryl webapp, Beryl stores the session encrypted
+server-side and injects it into cloud runs — \`tests create\` verifies such plans
+server-side, \`runs trigger\` runs them, \`runs local\` skips them (the session never
+leaves Beryl's cloud).
 
 ## 2. Author locally over the Playwright MCP
 
@@ -349,14 +361,19 @@ Every one of these has produced a wrong plan or a red \`tests create\`. Check th
    \`text=X\` to a case-insensitive SUBSTRING — \`text=Continue\` is ambiguous. Use
    something unique (\`button[type=submit]\`, \`input[name=email]\`,
    \`input[autocomplete=one-time-code]\`).
-4. **A single-page app can redirect after the first \`goto\`.** If \`/dashboard\`
+4. **Google's sign-in pages carry decoys.** The identifier page already holds a hidden
+   \`input[type=password]\`, so a \`wait_for\` on it fires before the real field exists —
+   target \`input[name=Passwd]\`. Responsive layouts often render the app's "Continue
+   with Google" button twice (mobile + desktop); add \`:visible\` or use a structural
+   selector so the click is not ambiguous.
+5. **A single-page app can redirect after the first \`goto\`.** If \`/dashboard\`
    client-side redirects to \`/dashboard/<id>\`, a click fired straight after the goto
    lands on the pre-redirect render and is discarded on re-render. Put a \`wait_for\`
    on something that exists only AFTER the redirect, then act.
-5. **Never bake an id into a URL.** \`goto /projects/8ab46d63-.../settings\` breaks for
+6. **Never bake an id into a URL.** \`goto /projects/8ab46d63-.../settings\` breaks for
    any other account. Navigate to the stable entry point and click through
    (\`a[href$='/settings']\`) — the plan is about the app, not your row.
-6. **Assert durable content, not the empty state.** "No tests yet" is true today and
+7. **Assert durable content, not the empty state.** "No tests yet" is true today and
    false the moment anything exists. Prefer what is structural — a section heading, a
    permanent explainer, an always-present control.
 

package/dist/commands/accounts.js

@@ -65,6 +65,8 @@ export const testAccountCommands = [
             "the site: pass --email and --password, and it is usable immediately. `--type beryl` " +
             "reserves one Beryl will sign up itself, addressed at the project mailbox. It starts " +
             "`pending` and becomes usable after `beryl accounts signup`. " +
+            "Works for Google-only apps too: bank a dedicated Google test account as user_provided " +
+            "and author its sign-in plan through Google's form. " +
             "The first account an environment gets is its default whatever you pass.",
         scope: "project",
         flags: [
@@ -98,6 +100,7 @@ export const testAccountCommands = [
             "beryl accounts create --email qa@acme.test --password 'hunter2'",
             "beryl accounts create --type beryl --login-method otp",
             "beryl accounts create --email admin@acme.test --password 'hunter2' --label admin",
+            "beryl accounts create --email qa@gmail.com --password 'hunter2'  # Google-only app",
         ],
         async run(ctx, input) {
             const { workspaceId, projectId } = await ctx.requireProject(input);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beryl-so/cli",
-  "version": "0.46.0",
+  "version": "0.46.1",
   "description": "Beryl on the command line — projects, runs, the exploring agent, and an MCP server over the same commands.",
   "license": "MIT",
   "type": "module",
@@ -40,9 +40,11 @@
     "@types/node": "^26.1.1",
     "tsx": "^4.23.1",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "overrides": {
-    "@hono/node-server": "2.0.11"
+    "@hono/node-server": "2.0.11",
+    "hono": "^4.13.5",
+    "@vitest/mocker": "^4.1.11"
   }
 }