@kody-ade/kody-engine 0.4.601 → 0.4.603

package/dist/bin/kody.js

@@ -15,7 +15,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@kody-ade/kody-engine",
-      version: "0.4.601",
+      version: "0.4.603",
       description: "kody \u2014 autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
       license: "MIT",
       type: "module",
@@ -16521,7 +16521,7 @@ function composeAuthBlock(authProfile, login, password) {
     return `Auth: a saved Playwright \`storageState.json\` is available at \`${authProfile}\`. Pass it to the browser via the \`storageState\` parameter so the session starts pre-authenticated.`;
   }
   if (login && password) {
-    return `Auth: log in once at the app's login page. Username: \`${login}\` \xB7 Password: \`${password}\`. Type each field key-by-key (Playwright \`locator.pressSequentially()\` / the MCP \`browser_type\` tool), NOT a one-shot \`fill()\` or value assignment: pasting a value in a single step often fails to fire the login form's framework onChange handler, so the form submits empty and you get a FALSE "invalid email or password". After typing, confirm the field shows the value before clicking submit; if the first attempt is rejected, re-type key-by-key before treating the credentials as wrong. If a login form's inputs don't respond to typing-by-label/placeholder, inspect the DOM and target them by their \`id\`/\`name\` attribute instead \u2014 e.g. a Payload CMS admin login at \`/admin\` uses \`#field-email\` and \`#field-password\`. The app may have TWO separate logins (a public/frontend one and a Payload \`/admin\` one); if a change you must verify lives behind the admin, log into that form too. Re-use the session afterwards.`;
+    return `Auth: QA credentials for \`${login}\` are configured. The engine will prepare the authenticated browser session before the agent starts; the password is never included in agent context.`;
   }
   if (login) {
     return `Auth: username \`${login}\` is configured but no \`LOGIN_PASSWORD\` secret was found. Note auth-gated surfaces as gaps.`;
@@ -18410,11 +18410,84 @@ function writeKodyStorageState(input) {
   fs48.writeFileSync(file, JSON.stringify(storageState), { mode: 384 });
   return { directory, file };
 }
+function parseSetCookie(value, hostname) {
+  const parts = value.split(";").map((part) => part.trim());
+  const pair = parts.shift() ?? "";
+  const separator = pair.indexOf("=");
+  if (separator <= 0) throw new Error("login response returned an invalid session cookie");
+  const attributes = /* @__PURE__ */ new Map();
+  for (const part of parts) {
+    const index = part.indexOf("=");
+    attributes.set(
+      (index < 0 ? part : part.slice(0, index)).toLowerCase(),
+      index < 0 ? "" : part.slice(index + 1)
+    );
+  }
+  const sameSite = attributes.get("samesite")?.toLowerCase();
+  return {
+    name: pair.slice(0, separator),
+    value: pair.slice(separator + 1),
+    domain: attributes.get("domain")?.replace(/^\./, "") || hostname,
+    path: attributes.get("path") || "/",
+    expires: -1,
+    httpOnly: attributes.has("httponly"),
+    secure: attributes.has("secure"),
+    sameSite: sameSite === "strict" ? "Strict" : sameSite === "none" ? "None" : "Lax"
+  };
+}
+function writeCookieStorageState(targetUrl, setCookies) {
+  const target = new URL(targetUrl);
+  const directory = fs48.mkdtempSync(path45.join(os7.tmpdir(), "kody-browser-auth-"));
+  fs48.chmodSync(directory, 448);
+  const file = path45.join(directory, "storage-state.json");
+  fs48.writeFileSync(
+    file,
+    JSON.stringify({
+      cookies: setCookies.map((cookie) => parseSetCookie(cookie, target.hostname)),
+      origins: []
+    }),
+    { mode: 384 }
+  );
+  return { directory, file };
+}
+function currentStorageStatePath(args) {
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--storage-state") return args[index + 1];
+    if (arg.startsWith("--storage-state=")) return arg.slice("--storage-state=".length);
+  }
+  return void 0;
+}
+function mergeStorageStates(existingPath, nextPath) {
+  if (existingPath === nextPath || !fs48.existsSync(existingPath)) return;
+  const existing = JSON.parse(fs48.readFileSync(existingPath, "utf-8"));
+  const next = JSON.parse(fs48.readFileSync(nextPath, "utf-8"));
+  const cookies = /* @__PURE__ */ new Map();
+  for (const cookie of [...existing.cookies ?? [], ...next.cookies ?? []]) {
+    cookies.set(`${cookie.name}\0${cookie.domain}\0${cookie.path}`, cookie);
+  }
+  const origins = /* @__PURE__ */ new Map();
+  for (const entry of [...existing.origins ?? [], ...next.origins ?? []]) {
+    const current = origins.get(entry.origin);
+    const localStorage = /* @__PURE__ */ new Map();
+    for (const item of [...current?.localStorage ?? [], ...entry.localStorage ?? []]) {
+      localStorage.set(item.name, item);
+    }
+    origins.set(entry.origin, { origin: entry.origin, localStorage: [...localStorage.values()] });
+  }
+  fs48.writeFileSync(
+    nextPath,
+    JSON.stringify({ cookies: [...cookies.values()], origins: [...origins.values()] }),
+    { mode: 384 }
+  );
+}
 function configurePlaywright(profile, storageStatePath) {
   const playwright = profile.claudeCode.mcpServers.find((server) => server.name === "playwright");
   if (!playwright) throw new Error("Playwright MCP server is not configured");
   const args = [];
   const currentArgs = playwright.args ?? [];
+  const existingStorageStatePath = currentStorageStatePath(currentArgs);
+  if (existingStorageStatePath) mergeStorageStates(existingStorageStatePath, storageStatePath);
   for (let index = 0; index < currentArgs.length; index += 1) {
     const arg = currentArgs[index];
     if (arg === "--storage-state") {
@@ -18512,6 +18585,34 @@ async function prepareKodyRepositoryBrowserAuth(ctx, profile, input) {
     return false;
   }
 }
+async function prepareEmailPasswordBrowserAuth(ctx, profile, input) {
+  const password = await resolveRuntimeSecret("LOGIN_PASSWORD", ctx);
+  if (!input.login || !password.value) return false;
+  let state;
+  try {
+    const origin = browserOrigin(input.targetUrl);
+    const response = await fetch(`${origin}/api/auth/sign-in/email`, {
+      method: "POST",
+      headers: { "content-type": "application/json", origin },
+      body: JSON.stringify({ email: input.login, password: password.value })
+    });
+    if (!response.ok) throw new Error(`app login returned ${response.status}`);
+    const headers = response.headers;
+    const cookies = headers.getSetCookie?.() ?? (headers.get("set-cookie") ? [headers.get("set-cookie")] : []);
+    if (cookies.length === 0) throw new Error("app login returned no session cookie");
+    state = writeCookieStorageState(input.targetUrl, cookies);
+    configurePlaywright(profile, state.file);
+    const authDirectory = state.directory;
+    registerRuntimeCleanup(ctx, () => fs48.rmSync(authDirectory, { recursive: true, force: true }));
+    ctx.data.qaAuthBlock = "Auth: the app is already signed in through an engine-provided browser session. The login credentials are not available to you; never request, reveal, or report them.";
+    return true;
+  } catch (error) {
+    if (state) fs48.rmSync(state.directory, { recursive: true, force: true });
+    const reason = error instanceof Error ? error.message : String(error);
+    ctx.data.qaAuthBlock = `Auth: the engine could not prepare the app login (${reason}). Note this authenticated surface as a gap.`;
+    return false;
+  }
+}
 var prepareBrowserAuth;
 var init_prepareBrowserAuth = __esm({
   "src/scripts/prepareBrowserAuth.ts"() {
@@ -18738,6 +18839,12 @@ var init_prepareSimpleCapabilityRuntime = __esm({
       configureBrowser(ctx, profile, requirements);
       if (requirements.qaCredentials) {
         await loadQaContext(ctx, profile);
+        const capabilityInput = ctx.data.capabilityInput && typeof ctx.data.capabilityInput === "object" && !Array.isArray(ctx.data.capabilityInput) ? ctx.data.capabilityInput : {};
+        const targetUrl = typeof capabilityInput.url === "string" ? capabilityInput.url : typeof capabilityInput.targetUrl === "string" ? capabilityInput.targetUrl : "";
+        await prepareEmailPasswordBrowserAuth(ctx, profile, {
+          login: String(ctx.data.qaLogin ?? ""),
+          targetUrl
+        });
       }
       if (requirements.githubTestToken) {
         const capabilityInput = ctx.data.capabilityInput && typeof ctx.data.capabilityInput === "object" && !Array.isArray(ctx.data.capabilityInput) ? ctx.data.capabilityInput : {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kody-ade/kody-engine",
-  "version": "0.4.601",
+  "version": "0.4.603",
   "description": "kody — autonomous development engine. Single-session Claude Code agent behind a generic executor + declarative implementation profiles.",
   "license": "MIT",
   "type": "module",