@kody-ade/kody-engine 0.4.600 → 0.4.602

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.600",
+      version: "0.4.602",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -16521,7 +16521,7 @@ function composeAuthBlock(authProfile, login, password) {
     return `Auth: a saved Playwright \`storageState.json\` is available at \`${authProfile}\`. Pass it to the browser via the \`storageState\` parameter so the session starts pre-authenticated.`;
   }
   if (login && password) {
-    return `Auth: log in once at the app's login page. Username: \`${login}\` \xB7 Password: \`${password}\`. Type each field key-by-key (Playwright \`locator.pressSequentially()\` / the MCP \`browser_type\` tool), NOT a one-shot \`fill()\` or value assignment: pasting a value in a single step often fails to fire the login form's framework onChange handler, so the form submits empty and you get a FALSE "invalid email or password". After typing, confirm the field shows the value before clicking submit; if the first attempt is rejected, re-type key-by-key before treating the credentials as wrong. If a login form's inputs don't respond to typing-by-label/placeholder, inspect the DOM and target them by their \`id\`/\`name\` attribute instead \u2014 e.g. a Payload CMS admin login at \`/admin\` uses \`#field-email\` and \`#field-password\`. The app may have TWO separate logins (a public/frontend one and a Payload \`/admin\` one); if a change you must verify lives behind the admin, log into that form too. Re-use the session afterwards.`;
+    return `Auth: QA credentials for \`${login}\` are configured. The engine will prepare the authenticated browser session before the agent starts; the password is never included in agent context.`;
   }
   if (login) {
     return `Auth: username \`${login}\` is configured but no \`LOGIN_PASSWORD\` secret was found. Note auth-gated surfaces as gaps.`;
@@ -18385,15 +18385,15 @@ function writeKodyStorageState(input) {
     repo: input.repo,
     token: input.token,
     addedAt: now,
-    isLogin: true,
-    user: input.user
+    isLogin: true
   };
+  const unresolvedUser = { login: "", avatar_url: "", id: 0 };
   const auth = {
     repoUrl: input.repoUrl,
     owner: input.owner,
     repo: input.repo,
     token: input.token,
-    user: input.user,
+    user: unresolvedUser,
     loggedInAt: now,
     repos: [repoEntry],
     currentRepoIndex: 0
@@ -18410,6 +18410,46 @@ function writeKodyStorageState(input) {
   fs48.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
   return { directory, file };
 }
+function parseSetCookie(value, hostname) {
+  const parts = value.split(";").map((part) => part.trim());
+  const pair = parts.shift() ?? "";
+  const separator = pair.indexOf("=");
+  if (separator <= 0) throw new Error("login response returned an invalid session cookie");
+  const attributes = /* @__PURE__ */ new Map();
+  for (const part of parts) {
+    const index = part.indexOf("=");
+    attributes.set(
+      (index < 0 ? part : part.slice(0, index)).toLowerCase(),
+      index < 0 ? "" : part.slice(index + 1)
+    );
+  }
+  const sameSite = attributes.get("samesite")?.toLowerCase();
+  return {
+    name: pair.slice(0, separator),
+    value: pair.slice(separator + 1),
+    domain: attributes.get("domain")?.replace(/^\./, "") || hostname,
+    path: attributes.get("path") || "/",
+    expires: -1,
+    httpOnly: attributes.has("httponly"),
+    secure: attributes.has("secure"),
+    sameSite: sameSite === "strict" ? "Strict" : sameSite === "none" ? "None" : "Lax"
+  };
+}
+function writeCookieStorageState(targetUrl, setCookies) {
+  const target = new URL(targetUrl);
+  const directory = fs48.mkdtempSync(path45.join(os7.tmpdir(), "kody-browser-auth-"));
+  fs48.chmodSync(directory, 448);
+  const file = path45.join(directory, "storage-state.json");
+  fs48.writeFileSync(
+    file,
+    JSON.stringify({
+      cookies: setCookies.map((cookie) => parseSetCookie(cookie, target.hostname)),
+      origins: []
+    }),
+    { mode: 384 }
+  );
+  return { directory, file };
+}
 function configurePlaywright(profile, storageStatePath) {
   const playwright = profile.claudeCode.mcpServers.find((server) => server.name === "playwright");
   if (!playwright) throw new Error("Playwright MCP server is not configured");
@@ -18478,25 +18518,19 @@ async function prepareKodyRepositoryBrowserAuth(ctx, profile, input) {
   let state;
   try {
     const requested = githubRepositoryParts(repositoryUrl);
-    const [user, repository] = await Promise.all([
-      githubJson("https://api.github.com/user", credential.value, "user"),
-      githubJson(
-        `https://api.github.com/repos/${encodeURIComponent(requested.owner)}/${encodeURIComponent(requested.repo)}`,
-        credential.value,
-        "repository"
-      )
-    ]);
+    const repository = await githubJson(
+      `https://api.github.com/repos/${encodeURIComponent(requested.owner)}/${encodeURIComponent(requested.repo)}`,
+      credential.value,
+      "repository"
+    );
     const [owner, repo] = repository.full_name.split("/");
-    if (!owner || !repo || !user.login || !user.avatar_url || typeof user.id !== "number") {
-      throw new Error("GitHub returned incomplete identity data");
-    }
+    if (!owner || !repo) throw new Error("GitHub returned incomplete repository data");
     state = writeKodyStorageState({
       origin: browserOrigin(input.targetUrl),
       repoUrl: `https://github.com/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`,
       owner,
       repo,
-      token: credential.value,
-      user
+      token: credential.value
     });
     configurePlaywright(profile, state.file);
     const authDirectory = state.directory;
@@ -18518,6 +18552,34 @@ async function prepareKodyRepositoryBrowserAuth(ctx, profile, input) {
     return false;
   }
 }
+async function prepareEmailPasswordBrowserAuth(ctx, profile, input) {
+  const password = await resolveRuntimeSecret("LOGIN_PASSWORD", ctx);
+  if (!input.login || !password.value) return false;
+  let state;
+  try {
+    const origin = browserOrigin(input.targetUrl);
+    const response = await fetch(`${origin}/api/auth/sign-in/email`, {
+      method: "POST",
+      headers: { "content-type": "application/json", origin },
+      body: JSON.stringify({ email: input.login, password: password.value })
+    });
+    if (!response.ok) throw new Error(`app login returned ${response.status}`);
+    const headers = response.headers;
+    const cookies = headers.getSetCookie?.() ?? (headers.get("set-cookie") ? [headers.get("set-cookie")] : []);
+    if (cookies.length === 0) throw new Error("app login returned no session cookie");
+    state = writeCookieStorageState(input.targetUrl, cookies);
+    configurePlaywright(profile, state.file);
+    const authDirectory = state.directory;
+    registerRuntimeCleanup(ctx, () => fs48.rmSync(authDirectory, { recursive: true, force: true }));
+    ctx.data.qaAuthBlock = "Auth: the app is already signed in through an engine-provided browser session. The login credentials are not available to you; never request, reveal, or report them.";
+    return true;
+  } catch (error) {
+    if (state) fs48.rmSync(state.directory, { recursive: true, force: true });
+    const reason = error instanceof Error ? error.message : String(error);
+    ctx.data.qaAuthBlock = `Auth: the engine could not prepare the app login (${reason}). Note this authenticated surface as a gap.`;
+    return false;
+  }
+}
 var prepareBrowserAuth;
 var init_prepareBrowserAuth = __esm({
   "src/scripts/prepareBrowserAuth.ts"() {
@@ -18744,6 +18806,12 @@ var init_prepareSimpleCapabilityRuntime = __esm({
       configureBrowser(ctx, profile, requirements);
       if (requirements.qaCredentials) {
         await loadQaContext(ctx, profile);
+        const capabilityInput = ctx.data.capabilityInput && typeof ctx.data.capabilityInput === "object" && !Array.isArray(ctx.data.capabilityInput) ? ctx.data.capabilityInput : {};
+        const targetUrl = typeof capabilityInput.url === "string" ? capabilityInput.url : typeof capabilityInput.targetUrl === "string" ? capabilityInput.targetUrl : "";
+        await prepareEmailPasswordBrowserAuth(ctx, profile, {
+          login: String(ctx.data.qaLogin ?? ""),
+          targetUrl
+        });
       }
       if (requirements.githubTestToken) {
         const capabilityInput = ctx.data.capabilityInput && typeof ctx.data.capabilityInput === "object" && !Array.isArray(ctx.data.capabilityInput) ? ctx.data.capabilityInput : {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.600",
+  "version": "0.4.602",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",