@gleapai/kai-bridge 0.9.0 → 0.10.0

package/src/preview-login.mjs

@@ -1,610 +0,0 @@
-// Kai Code Verify — seamless preview sign-in (kai-bridge 0.4.0).
-//
-// The verifier must not ask the user for credentials. Instead the user
-// signs in ONCE, in a headed Chrome window this daemon opens at the
-// running preview (`bridge.verify.login.start`); the daemon detects the
-// sign-in, exports the browser's storage state (cookies + localStorage +
-// IndexedDB), FILTERS it to the preview's own origins, and uploads it —
-// the Server encrypts it as a `KaiPreviewLogin` record. Every later verify
-// turn fetches the record, rewrites its origins onto the ports the preview
-// runs on right now, PROBES it headless (still signed in?), and hands the
-// Playwright MCP the state via `--isolated --storage-state`. After the run
-// the agent's final `browser_storage_state` export refreshes the record.
-//
-// Everything that decides is a pure function here (testable without a
-// browser); the two browser flows (`captureLogin`, `probeLogin`) take the
-// Playwright module as a parameter so tests can inject a fake.
-//
-// Playwright itself is REQUIRED FROM THE MCP's DIRECTORY (the bridge has no
-// direct dependency), and launched on the `chrome` channel whenever system
-// Chrome exists — the bundled Chromium revision is usually not installed.
-
-import { createHash } from "node:crypto";
-import { existsSync } from "node:fs";
-import { createRequire } from "node:module";
-import { join } from "node:path";
-
-import { resolvePreviewBrowser } from "./preview.mjs";
-
-/** Cookie domains the Server accepts — anything else is not the preview's. */
-export const LOCAL_COOKIE_DOMAINS = new Set(["localhost", "127.0.0.1"]);
-/** Stable preview ports: hash(repoKey + service) into this window. */
-export const STABLE_PORT_MIN = 43000;
-export const STABLE_PORT_SPAN = 1000;
-/** Values this long or longer count as secrets for redaction. */
-export const REDACT_MIN_LENGTH = 16;
-export const REDACTED = "[redacted]";
-export const LOGIN_CAPTURE_TIMEOUT_MS = 10 * 60_000;
-export const PROBE_TIMEOUT_MS = 15_000;
-const SETTLE_MS = 1_500;
-const DETECTED_GRACE_MS = 3_000;
-
-/** The `playwright` the bundled MCP ships — `null` when it is not installed. */
-export function loadPlaywright(runnerDir) {
-  try {
-    const req = createRequire(join(runnerDir, "..", "node_modules", "@playwright", "mcp", "package.json"));
-    return req("playwright");
-  } catch {
-    return null;
-  }
-}
-
-/** `chrome` when the user's Chrome exists (no download, familiar pages), else the bundled build. */
-export function launchOptionsFor({ headless, browser = resolvePreviewBrowser() } = {}) {
-  const opts = { headless: !!headless };
-  if (browser) opts.channel = browser;
-  // Headed capture: without the automation banner Google & co. are a bit
-  // less hostile, and the window looks like a normal (extension-less) Chrome.
-  if (!headless) opts.ignoreDefaultArgs = ["--enable-automation"];
-  return opts;
-}
-
-/** Can this machine open a window? darwin/win32 always; linux needs a DISPLAY. */
-export function displayAvailable({ platform = process.platform, env = process.env } = {}) {
-  if (platform === "darwin" || platform === "win32") return true;
-  return !!(env.DISPLAY || env.WAYLAND_DISPLAY);
-}
-
-/** `http://Localhost:3000/x?y` → `http://localhost:3000`; null for junk. */
-export function normalizeOrigin(url) {
-  try {
-    const o = new URL(String(url)).origin;
-    return o && o !== "null" ? o.toLowerCase() : null;
-  } catch {
-    return null;
-  }
-}
-
-export function pathOf(url) {
-  try {
-    return new URL(String(url)).pathname || "/";
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Keep only what belongs to the preview: cookies scoped to localhost /
- * 127.0.0.1 and `origins[]` entries whose origin is one of the preview
- * services'. IdP cookies (accounts.google.com, github.com) never travel.
- * Returns the filtered state plus COUNTS — the only thing ever logged.
- */
-export function filterStorageState(state, previewOrigins) {
-  const allowed = new Set((previewOrigins || []).map(normalizeOrigin).filter(Boolean));
-  const cookiesIn = Array.isArray(state?.cookies) ? state.cookies : [];
-  const originsIn = Array.isArray(state?.origins) ? state.origins : [];
-  const cookies = cookiesIn.filter((c) => c && LOCAL_COOKIE_DOMAINS.has(String(c.domain || "").toLowerCase().replace(/^\./, "")));
-  const origins = originsIn
-    .filter((o) => o && allowed.has(normalizeOrigin(o.origin)))
-    .map((o) => ({ ...o, origin: normalizeOrigin(o.origin) }));
-  const counts = {
-    cookies: cookies.length,
-    droppedCookies: cookiesIn.length - cookies.length,
-    origins: origins.length,
-    droppedOrigins: originsIn.length - origins.length,
-    localStorage: origins.reduce((n, o) => n + (Array.isArray(o.localStorage) ? o.localStorage.length : 0), 0),
-    indexedDB: origins.reduce((n, o) => n + (Array.isArray(o.indexedDB) ? o.indexedDB.length : 0), 0),
-  };
-  return { state: { cookies, origins }, counts };
-}
-
-/** Anything at all in the state? (An empty export is not a sign-in.) */
-export function storageStateIsEmpty(state) {
-  return !(state?.cookies?.length || (state?.origins || []).some((o) => o?.localStorage?.length || o?.indexedDB?.length));
-}
-
-/** Content hash of a state — "did storage change since the window opened". */
-export function storageFingerprint(state) {
-  const cookies = (state?.cookies || []).map((c) => `${c.domain}|${c.name}|${c.value}`).sort();
-  const origins = (state?.origins || [])
-    .map((o) => `${normalizeOrigin(o.origin)}|${JSON.stringify(o.localStorage || [])}|${(o.indexedDB || []).length}`)
-    .sort();
-  return createHash("sha256").update(JSON.stringify([cookies, origins])).digest("hex");
-}
-
-/**
- * Captured service origins → the origins the same services run on NOW,
- * matched by service NAME (the preview picks free ports per session).
- * Services that are not running are dropped from the map — their state
- * has nowhere to go. `Map<capturedOrigin, currentOrigin>`.
- */
-export function buildOriginMap(recordServices, runningServices) {
-  const running = new Map();
-  for (const s of runningServices || []) {
-    const origin = normalizeOrigin(s?.url ?? s?.origin);
-    if (s?.name && origin) running.set(String(s.name), origin);
-  }
-  const map = new Map();
-  for (const s of recordServices || []) {
-    const from = normalizeOrigin(s?.origin);
-    const to = s?.name ? running.get(String(s.name)) : null;
-    if (from && to) map.set(from, to);
-  }
-  return map;
-}
-
-/** Inverse map (current → captured) for writing a refreshed state back onto the record's origins. */
-export function invertOriginMap(map) {
-  const out = new Map();
-  for (const [from, to] of map || []) out.set(to, from);
-  return out;
-}
-
-const rewriteString = (value, map) => {
-  if (typeof value !== "string") return value;
-  for (const [from, to] of map) {
-    if (from !== to && value.startsWith(from)) return to + value.slice(from.length);
-  }
-  return value;
-};
-
-const rewriteDeep = (value, map) => {
-  if (typeof value === "string") return rewriteString(value, map);
-  if (Array.isArray(value)) return value.map((v) => rewriteDeep(v, map));
-  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, rewriteDeep(v, map)]));
-  return value;
-};
-
-/**
- * Move a state onto the current ports: `origins[].origin` is mapped (an
- * origin with no mapping is DROPPED), and string VALUES that start with a
- * captured origin (apps persist `apiBase`, redirect URLs, …) follow.
- * Cookies stay as they are — localhost cookies are port-agnostic.
- */
-export function rewriteStorageState(state, originMap) {
-  const map = originMap instanceof Map ? originMap : new Map(Object.entries(originMap || {}));
-  const origins = [];
-  for (const o of Array.isArray(state?.origins) ? state.origins : []) {
-    const from = normalizeOrigin(o?.origin);
-    const to = from ? map.get(from) : null;
-    if (!to) continue;
-    origins.push({
-      ...o,
-      origin: to,
-      ...(o.localStorage ? { localStorage: o.localStorage.map((e) => ({ ...e, value: rewriteString(e?.value, map) })) } : {}),
-      ...(o.indexedDB ? { indexedDB: rewriteDeep(o.indexedDB, map) } : {}),
-    });
-  }
-  return { cookies: Array.isArray(state?.cookies) ? state.cookies.map((c) => ({ ...c })) : [], origins };
-}
-
-/**
- * Runs INSIDE the page: the raw material for `hasStrongLoginSignal`. Kept
- * as a plain function so Playwright serializes it and tests can call it
- * against a fake DOM-less object.
- */
-export function collectLoginSignals() {
-  const texts = [];
-  for (const el of document.querySelectorAll('button, input[type="submit"], a[role="button"], [role="button"]')) {
-    const t = (el.innerText || el.value || el.getAttribute("aria-label") || "").trim();
-    if (t) texts.push(t.slice(0, 80));
-    if (texts.length >= 60) break;
-  }
-  return {
-    password: document.querySelectorAll('input[type="password"]').length,
-    otp: document.querySelectorAll('input[autocomplete="one-time-code"]').length,
-    submits: texts,
-    bodyText: String(document.body?.innerText || "").slice(0, 3000),
-    title: String(document.title || "").slice(0, 200),
-  };
-}
-
-const LOGIN_SUBMIT_RE = /\b(sign\s?in|log\s?in|continue with|sign in with|log in with)\b/i;
-
-/** A password field, a one-time-code field, or a sign-in submit = a login wall. */
-export function hasStrongLoginSignal(signals) {
-  if (!signals || typeof signals !== "object") return false;
-  if (Number(signals.password) > 0 || Number(signals.otp) > 0) return true;
-  return (Array.isArray(signals.submits) ? signals.submits : []).some((t) => LOGIN_SUBMIT_RE.test(String(t)));
-}
-
-/** Google's "This browser or app may not be secure" interstitial — the IdP refused the automation window. */
-export function isIdpRefusedPage({ url, signals } = {}) {
-  const host = (() => {
-    try {
-      return new URL(String(url)).hostname;
-    } catch {
-      return "";
-    }
-  })();
-  const text = `${signals?.title || ""}\n${signals?.bodyText || ""}`;
-  return /(^|\.)accounts\.google\.com$/.test(host) && /(browser or app may not be secure|couldn.t sign you in|this browser may not be secure)/i.test(text);
-}
-
-/**
- * A recordable login path: a real segment (`/login`, `/auth/sign-in`) —
- * never `/` (a landing page with a "Sign in" button, or a login form
- * served at the root, would otherwise mark EVERY path as a wall).
- */
-export function isRecordableLoginPath(path) {
-  return typeof path === "string" && path.startsWith("/") && path.replace(/\/+$/, "").length > 0;
-}
-
-/** `path` equals the login path or lives under it (segment-wise); `/` never matches. */
-export function matchesLoginPath(path, loginPath) {
-  if (!isRecordableLoginPath(loginPath) || typeof path !== "string") return false;
-  const p = loginPath.replace(/\/+$/, "");
-  return path === p || path === `${p}/` || path.startsWith(`${p}/`);
-}
-
-/**
- * The probe's verdict for a page the injected state landed on:
- * `needs_login` when the final origin is not a preview origin (bounced to
- * an IdP), the path is a known login path, or a strong login signal is
- * visible; `ok` otherwise.
- */
-export function classifyProbe({ finalUrl, previewOrigins, loginPaths, signals }) {
-  const allowed = new Set((previewOrigins || []).map(normalizeOrigin).filter(Boolean));
-  const origin = normalizeOrigin(finalUrl);
-  const path = pathOf(finalUrl);
-  if (!origin || !allowed.has(origin)) return { result: "needs_login", why: "off_origin", loginPath: path };
-  if ((loginPaths || []).some((p) => matchesLoginPath(path, p))) {
-    return { result: "needs_login", why: "login_path", loginPath: path };
-  }
-  if (hasStrongLoginSignal(signals)) return { result: "needs_login", why: "login_signal", loginPath: path };
-  return { result: "ok", why: null, loginPath: null };
-}
-
-const stringLeaves = (value, out, depth = 0) => {
-  if (depth > 6) return;
-  if (typeof value === "string") {
-    out.push(value);
-    // Persisted auth blobs are usually JSON-in-a-string: the token is a leaf.
-    if (value.length >= REDACT_MIN_LENGTH && /^[[{]/.test(value.trim())) {
-      try {
-        stringLeaves(JSON.parse(value), out, depth + 1);
-      } catch {
-        /* not JSON */
-      }
-    }
-    return;
-  }
-  if (Array.isArray(value)) for (const v of value) stringLeaves(v, out, depth + 1);
-  else if (value && typeof value === "object") for (const v of Object.values(value)) stringLeaves(v, out, depth + 1);
-};
-
-const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
-const NUMERIC_RE = /^[+-]?\d+(?:\.\d+)?(?:e[+-]?\d+)?$/i;
-const EMAIL_RE = /^[^\s@"'<>]+@[^\s@"'<>]+\.[^\s@"'<>]+$/;
-
-/**
- * Is this stored value plausibly a secret? Apps persist their API base
- * (`http://localhost:43000`), timestamps, numbers and the user's e-mail
- * next to the token — scrubbing those would blank every navigate URL and
- * the evidence timeline. URLs, ISO-8601 dates, numerics, booleans/null and
- * e-mail addresses are never secrets; everything else ≥ 16 chars is.
- */
-export function isRedactableValue(value) {
-  if (typeof value !== "string" || value.length < REDACT_MIN_LENGTH) return false;
-  const text = value.trim();
-  if (!text) return false;
-  if (/^(true|false|null|undefined)$/i.test(text) || NUMERIC_RE.test(text) || ISO_DATE_RE.test(text) || EMAIL_RE.test(text)) return false;
-  if (/^https?:\/\//i.test(text)) {
-    try {
-      const u = new URL(text);
-      if (u.protocol === "http:" || u.protocol === "https:") return false;
-    } catch {
-      /* not a URL after all — a token that merely starts like one */
-    }
-  }
-  return true;
-}
-
-/**
- * Every cookie / localStorage value (and the string leaves of JSON values)
- * of length ≥ 16 from the injected state — what must never reach the
- * Server in an event, result or report — minus what is plainly not a
- * secret (`isRedactableValue`). Longest first so overlapping secrets
- * redact fully.
- */
-export function redactionSet(state) {
-  const values = [];
-  for (const c of state?.cookies || []) if (typeof c?.value === "string") values.push(c.value);
-  for (const o of state?.origins || []) for (const e of o?.localStorage || []) stringLeaves(e?.value, values);
-  const set = new Set(values.filter(isRedactableValue));
-  return new Set([...set].sort((a, b) => b.length - a.length));
-}
-
-/** Deep-copy `value` with every secret occurrence replaced (JSON-escaped forms included). */
-export function redactDeep(value, secrets) {
-  if (!secrets || secrets.size === 0) return value;
-  const scrub = (s) => {
-    let out = s;
-    for (const secret of secrets) {
-      if (out.includes(secret)) out = out.split(secret).join(REDACTED);
-      const escaped = JSON.stringify(secret).slice(1, -1);
-      if (escaped !== secret && out.includes(escaped)) out = out.split(escaped).join(REDACTED);
-    }
-    return out;
-  };
-  const walk = (v) => {
-    if (typeof v === "string") return scrub(v);
-    if (Array.isArray(v)) return v.map(walk);
-    if (v && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk(x)]));
-    return v;
-  };
-  return walk(value);
-}
-
-/** Deterministic port in [43000, 43999] for a repo's service — the same across sessions. */
-export function preferredStablePort(repoKey, serviceName) {
-  const h = createHash("sha1").update(`${String(repoKey || "").toLowerCase()}${String(serviceName || "")}`).digest();
-  return STABLE_PORT_MIN + (h.readUInt32BE(0) % STABLE_PORT_SPAN);
-}
-
-/**
- * The agent's final export (cookies + localStorage, what the app may have
- * rotated) merged over the probe's export (which alone carried IndexedDB
- * — the MCP's `browser_storage_state` does not). Per origin.
- */
-export function mergeFinalState(probeState, finalState) {
-  if (!finalState || typeof finalState !== "object") return probeState || { cookies: [], origins: [] };
-  const byOrigin = new Map();
-  for (const o of probeState?.origins || []) if (o?.origin) byOrigin.set(normalizeOrigin(o.origin), { ...o, origin: normalizeOrigin(o.origin) });
-  for (const o of finalState.origins || []) {
-    const key = normalizeOrigin(o?.origin);
-    if (!key) continue;
-    const prev = byOrigin.get(key);
-    byOrigin.set(key, { ...(prev || {}), origin: key, localStorage: Array.isArray(o.localStorage) ? o.localStorage : prev?.localStorage || [], ...(prev?.indexedDB ? { indexedDB: prev.indexedDB } : {}) });
-  }
-  return { cookies: Array.isArray(finalState.cookies) ? finalState.cookies : probeState?.cookies || [], origins: [...byOrigin.values()] };
-}
-
-/** Parse a dev.yaml `auth.storageState` command's output: JSON on stdout, or a path to a JSON file. */
-export function parseStorageStateOutput(stdout, { exists = existsSync, read } = {}) {
-  const text = String(stdout || "").trim();
-  if (!text) return null;
-  try {
-    const parsed = JSON.parse(text);
-    if (parsed && typeof parsed === "object") return parsed;
-  } catch {
-    /* not inline JSON */
-  }
-  const path = text.split("\n").at(-1).trim();
-  if (path && exists(path) && read) {
-    try {
-      const parsed = JSON.parse(read(path));
-      if (parsed && typeof parsed === "object") return parsed;
-    } catch {
-      /* unreadable */
-    }
-  }
-  return null;
-}
-
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-
-/**
- * Headless probe: does the (rewritten) state still sign the preview in?
- * Resolves `{ result: 'ok'|'needs_login'|'unknown', finalUrl, loginPath,
- * storageState }` — `storageState` is the probe context's own export
- * (with IndexedDB) on `ok`, the file the MCP gets. `unknown` (timeout,
- * launch error) lets the turn proceed: the agent reports a wall itself.
- * `loginCheck` (`{ path, selector }` from dev.yaml) replaces the heuristic.
- */
-export async function probeLogin({ pw, launchOptions, storageState, url, previewOrigins, loginPaths = [], loginCheck = null, timeoutMs = PROBE_TIMEOUT_MS, log = () => {} }) {
-  if (!pw?.chromium) return { result: "unknown", error: "playwright unavailable", finalUrl: null, loginPath: null, storageState: null };
-  let browser = null;
-  let timer = null;
-  let settled = false;
-  const timeout = new Promise((resolveP) => {
-    timer = setTimeout(() => resolveP({ result: "unknown", error: `probe timed out after ${Math.round(timeoutMs / 1000)}s`, finalUrl: null, loginPath: null, storageState: null }), timeoutMs);
-  });
-  // The browser is closed HERE, in run's own finally — whoever wins the
-  // race. A cold Chrome launch that outlives the cap would otherwise leave
-  // a headless Chrome behind (the caller only saw `browser === null`).
-  const run = (async () => {
-    try {
-      browser = await pw.chromium.launch(launchOptions);
-      if (settled) return { result: "unknown", error: "probe timed out before the browser launched", finalUrl: null, loginPath: null, storageState: null };
-      const context = await browser.newContext(storageState ? { storageState } : {});
-      const page = await context.newPage();
-      const target = loginCheck?.path ? new URL(loginCheck.path, url).toString() : url;
-      await page.goto(target, { waitUntil: "load", timeout: Math.max(1_000, timeoutMs - 2_000) });
-      await sleep(SETTLE_MS);
-      const finalUrl = page.url();
-      let verdict;
-      if (loginCheck?.selector) {
-        const visible = await page.locator(loginCheck.selector).first().isVisible().catch(() => false);
-        verdict = visible ? { result: "ok", loginPath: null } : { result: "needs_login", why: "login_check", loginPath: pathOf(finalUrl) };
-      } else {
-        const signals = await page.evaluate(collectLoginSignals).catch(() => null);
-        verdict = classifyProbe({ finalUrl, previewOrigins, loginPaths, signals });
-      }
-      const exported = verdict.result === "ok" ? await context.storageState({ indexedDB: true }) : null;
-      return { ...verdict, finalUrl, storageState: exported };
-    } catch (err) {
-      return { result: "unknown", error: err?.message || String(err), finalUrl: null, loginPath: null, storageState: null };
-    } finally {
-      await browser?.close().catch(() => {});
-    }
-  })();
-  const res = await Promise.race([run, timeout]);
-  settled = true;
-  clearTimeout(timer);
-  // Timeout won with a browser already up: closing it aborts the page work
-  // and lets run's finally settle promptly (a second close is a no-op).
-  await browser?.close().catch(() => {});
-  log("info", "verify.login.probe", { result: res.result, why: res.why, error: res.error, finalUrl: res.finalUrl ? normalizeOrigin(res.finalUrl) : null });
-  return res;
-}
-
-/**
- * Headed capture: open Chrome at the preview, wait for the user to sign in,
- * export + filter, hand the filtered state to `onSaved`. Status transitions
- * go to `onStatus(status, extra)`: `waiting_signin` → `detected` → (upload)
- * → the caller posts `saved`; `failed` (`timed out`, `idp_refused`, launch
- * error) and `cancelled` (window closed) are terminal. Returns a handle:
- * `done()` (fallback "Mark done": export now), `cancel()`, `finished`
- * (resolves with the terminal outcome).
- *
- * `previewOrigins` decide what counts as "back on the app" (the detection
- * heuristic); `stateOrigins` decide what may be KEPT from storage — the
- * dev.yaml `external` origins are part of the app's own state without
- * being part of it. Cookies stay localhost-only either way.
- */
-export async function captureLogin({ pw, launchOptions, url, previewOrigins, stateOrigins = null, services, onStatus = () => {}, onSaved, timeoutMs = LOGIN_CAPTURE_TIMEOUT_MS, log = () => {} }) {
-  if (!pw?.chromium) throw new Error("Playwright is not installed next to kai-bridge — reinstall @gleapai/kai-bridge.");
-  const browser = await pw.chromium.launch(launchOptions);
-  const context = await browser.newContext();
-  const page = await context.newPage();
-  const startFp = storageFingerprint(await context.storageState({ indexedDB: true }).catch(() => ({})));
-  const loginPaths = new Set();
-  let lastPreviewPath = null;
-  let finished = false;
-  let resolveFinished;
-  const finished$ = new Promise((r) => (resolveFinished = r));
-  let settleTimer = null;
-  let deadline = null;
-  let checking = false;
-
-  const finish = async (outcome) => {
-    if (finished) return;
-    finished = true;
-    clearTimeout(settleTimer);
-    clearTimeout(deadline);
-    await browser.close().catch(() => {});
-    resolveFinished(outcome);
-  };
-
-  const keptOrigins = [...new Set([...(previewOrigins || []), ...(stateOrigins || [])])];
-  const exportFiltered = async () => {
-    const raw = await context.storageState({ indexedDB: true });
-    const { state, counts } = filterStorageState(raw, keptOrigins);
-    log("info", "verify.login.export", counts);
-    return { state, counts };
-  };
-
-  const save = async ({ forced }) => {
-    const { state, counts } = await exportFiltered();
-    const landingUrl = lastPreviewPath ? new URL(lastPreviewPath, url).toString() : url;
-    // Where the signed-in user landed is by definition not a wall.
-    loginPaths.delete(pathOf(landingUrl));
-    try {
-      await onSaved({ storageState: state, origins: keptOrigins, services, landingUrl, loginPaths: [...loginPaths].filter(isRecordableLoginPath), ...(forced ? { optional: false } : {}) }, counts);
-    } catch (err) {
-      // The upload is what makes the sign-in exist — without it the window
-      // must not sit there looking done.
-      onStatus("failed", { error: `upload failed: ${err?.message || err}` });
-      await finish({ status: "failed", error: err?.message || String(err) });
-      return;
-    }
-    await finish({ status: "saved", counts });
-  };
-
-  const check = async () => {
-    if (finished || checking) return;
-    checking = true;
-    try {
-      const current = page.url();
-      const origin = normalizeOrigin(current);
-      const onPreview = origin && (previewOrigins || []).map(normalizeOrigin).includes(origin);
-      const signals = await page.evaluate(collectLoginSignals).catch(() => null);
-      if (!onPreview) {
-        // IdP hop: the page we left is the login entry (unless it was the root).
-        if (isRecordableLoginPath(lastPreviewPath)) loginPaths.add(lastPreviewPath);
-        if (isIdpRefusedPage({ url: current, signals })) {
-          onStatus("failed", { error: "idp_refused" });
-          await finish({ status: "failed", error: "idp_refused" });
-        }
-        return;
-      }
-      const path = pathOf(current);
-      if (hasStrongLoginSignal(signals)) {
-        // A path is remembered as a WALL only on a credential field — a
-        // "Sign in" button alone (landing pages, marketing headers) still
-        // blocks detection here but must not teach the probe a false wall.
-        if (isRecordableLoginPath(path) && (Number(signals?.password) > 0 || Number(signals?.otp) > 0)) loginPaths.add(path);
-        lastPreviewPath = path;
-        return;
-      }
-      lastPreviewPath = path;
-      const fp = storageFingerprint(await context.storageState({ indexedDB: true }).catch(() => ({})));
-      if (fp === startFp) return;
-      onStatus("detected");
-      await sleep(DETECTED_GRACE_MS);
-      if (finished) return;
-      await save({ forced: false });
-    } catch (err) {
-      if (!finished) log("warn", "verify.login.check.failed", { error: err?.message });
-    } finally {
-      checking = false;
-    }
-  };
-  const scheduleCheck = () => {
-    if (finished) return;
-    clearTimeout(settleTimer);
-    settleTimer = setTimeout(() => void check(), SETTLE_MS);
-  };
-
-  page.on("framenavigated", (frame) => {
-    if (frame === page.mainFrame()) scheduleCheck();
-  });
-  const onGone = () => {
-    if (finished) return;
-    onStatus("cancelled");
-    void finish({ status: "cancelled" });
-  };
-  page.on("close", onGone);
-  browser.on("disconnected", onGone);
-  deadline = setTimeout(() => {
-    if (finished) return;
-    onStatus("failed", { error: "timed out" });
-    void finish({ status: "failed", error: "timed out" });
-  }, timeoutMs);
-  deadline.unref?.();
-
-  // The window is up — hand the handle back now (the caller acks the
-  // command) and let the first navigation settle in the background.
-  void page
-    .goto(url, { waitUntil: "load", timeout: 30_000 })
-    .catch((err) => log("warn", "verify.login.open.failed", { error: err?.message }))
-    .then(async () => {
-      if (finished) return;
-      await page.bringToFront().catch(() => {});
-      onStatus("waiting_signin");
-      scheduleCheck();
-    });
-
-  return {
-    finished: finished$,
-    /** "Mark done": export whatever is there now (uploaded even when the heuristic disagrees). */
-    async done() {
-      if (finished) return;
-      clearTimeout(settleTimer);
-      try {
-        const signals = await page.evaluate(collectLoginSignals).catch(() => null);
-        const stillWall = hasStrongLoginSignal(signals) || !(previewOrigins || []).map(normalizeOrigin).includes(normalizeOrigin(page.url()));
-        await save({ forced: stillWall });
-      } catch (err) {
-        onStatus("failed", { error: err?.message || String(err) });
-        await finish({ status: "failed", error: err?.message || String(err) });
-      }
-    },
-    async cancel() {
-      if (finished) return;
-      onStatus("cancelled");
-      await finish({ status: "cancelled" });
-    },
-  };
-}