@mjasnikovs/pi-task 0.40.34 → 0.40.36

package/dist/task/deep-render-check.d.ts

@@ -113,9 +113,9 @@ export interface DeepSessionFacts {
  * The three request-shaped facts, computed from the log and from nothing else. The
  * driver records `sessionRequests` and calls this; the values are exactly what the
  * pre-log driver computed by filtering the same map (the sign-in request is the
- * first same-origin non-GET issued at or after the submit; the data requests are the
- * same-origin
- * XHR/fetch issued at or after the submit, the sign-in request itself excluded).
+ * first same-origin non-GET issued at or after the submit; the data requests are
+ * the same-origin XHR/fetch issued at or after the sign-in request, that request
+ * itself excluded).
  */
 export declare function deriveLegacyFacts(log: SessionRequest[]): Pick<DeepSessionFacts, 'authRequest' | 'postAuthDataAttempted' | 'postAuthData2xx'>;
 /**

package/dist/task/deep-render-check.js

@@ -202,9 +202,9 @@ export function pinnedLocalPort(vars) {
  * The three request-shaped facts, computed from the log and from nothing else. The
  * driver records `sessionRequests` and calls this; the values are exactly what the
  * pre-log driver computed by filtering the same map (the sign-in request is the
- * first same-origin non-GET issued at or after the submit; the data requests are the
- * same-origin
- * XHR/fetch issued at or after the submit, the sign-in request itself excluded).
+ * first same-origin non-GET issued at or after the submit; the data requests are
+ * the same-origin XHR/fetch issued at or after the sign-in request, that request
+ * itself excluded).
  */
 export function deriveLegacyFacts(log) {
     const auth = log.find(r => r.phase === 'auth') ?? null;
@@ -291,8 +291,12 @@ export function judgeDeepSession(f) {
     // `GET /*` → index.html fallback returns 200 for a route it does not have, so
     // the status is healthy and the body is the app shell. A document navigation
     // answered with HTML is normal; an XHR asking for data and getting HTML is a
-    // call that reached nothing.
-    const swallowed = (f.sessionRequests ?? []).find(r => r.initiator === 'xhr' && (r.mimeType ?? '').startsWith('text/html'));
+    // call that reached nothing. The sign-in request is exempt: it keeps the first
+    // hop but carries the LAST hop's mime, so a fetch login that 302s to a page
+    // reads as HTML here while being a sign-in that worked.
+    const swallowed = (f.sessionRequests ?? []).find(r => r.initiator === 'xhr'
+        && r.phase !== 'auth'
+        && (r.mimeType ?? '').startsWith('text/html'));
     if (swallowed) {
         return {
             outcome: 'fail',
@@ -655,10 +659,15 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
         // judges it is the chain's last, so the first hop stays and the eventual
         // response lands on it. Overwriting reads a POST that 302s as a GET, and
         // then no sign-in request is ever found.
-        if (p.redirectResponse === undefined || !requests.has(id)) {
-            const req = p.request;
+        const req = p.request;
+        const existing = requests.get(id);
+        if (p.redirectResponse !== undefined && existing) {
+            existing.finalUrl = String(req?.url ?? existing.finalUrl);
+        }
+        else {
             requests.set(id, {
                 url: String(req?.url ?? ''),
+                finalUrl: String(req?.url ?? ''),
                 method: String(req?.method ?? 'GET'),
                 type: String(p.type ?? ''),
                 status: null,
@@ -702,15 +711,15 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
     const before = await evaluate(INSPECT_EXPR);
     if (!before)
         throw new Error('the page could not be inspected');
-    const sameOrigin = (r) => r.url.startsWith(`${origin}/`) || r.url === origin;
+    const sameOrigin = (r) => r.finalUrl.startsWith(`${origin}/`) || r.finalUrl === origin;
     const isData = (r) => r.type === 'XHR' || r.type === 'Fetch';
     const foreignOriginFailures = () => {
         const out = new Set();
         for (const r of requests.values()) {
-            if (sameOrigin(r) || !r.failed || !r.url.startsWith('http'))
+            if (sameOrigin(r) || !r.failed || !r.finalUrl.startsWith('http'))
                 continue;
             try {
-                out.add(new URL(r.url).origin);
+                out.add(new URL(r.finalUrl).origin);
             }
             catch {
                 // unparseable url — nothing to name
@@ -721,10 +730,11 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
     const initiatorOf = (r) => isData(r) ? 'xhr'
         : r.type === 'Document' ? 'document'
             : 'other';
-    /** The same-origin request log, phased against the submit. `postSeq` is the
-     *  first `seq` the submit could issue — Infinity while no submit has happened —
-     *  so before a submit every request so far is 'pre'; the sign-in request sits at
-     *  or after the boundary but is 'auth', not 'post'. */
+    /** The same-origin request log. `postSeq` is where the authenticated half
+     *  begins — Infinity while no submit has happened — so everything before it is
+     *  'pre'; the sign-in request itself is 'auth', not 'post'. The boundary is the
+     *  sign-in request, not the submit: a CSRF token or a beacon the submit fires
+     *  BEFORE the login is not evidence about the authenticated client. */
     const sessionLog = (authId, postSeq) => [...requests]
         .filter(([, r]) => sameOrigin(r))
         .map(([id, r]) => ({
@@ -755,6 +765,7 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
     const unsubmitted = (over) => facts(sessionLog(null, Number.POSITIVE_INFINITY), over);
     if (!before.hasPassword || credentials === null)
         return judge(unsubmitted({}));
+    const fillSeq = nextSeq;
     const filled = await evaluate(fillExpr(credentials.identifier, credentials.password));
     if (!filled?.ok)
         return judge(unsubmitted({ submitted: false }));
@@ -780,6 +791,18 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
             break;
         }
     }
+    // Nothing after the submit: a form that submits from the fill's own input
+    // events already sent it. Only a NAVIGATION qualifies here — a form submission
+    // is one, and the background traffic the fill races (beacons, telemetry) is
+    // XHR or fetch, never a document.
+    if (authId === null) {
+        for (const [id, r] of requests) {
+            if (r.seq >= fillSeq && sameOrigin(r) && r.method !== 'GET' && r.type === 'Document') {
+                authId = id;
+                break;
+            }
+        }
+    }
     const authReq = authId === null ? null : requests.get(authId);
     const now = await evaluate(INSPECT_EXPR);
     const domJudgment = judgeRenderedDom(now?.html ?? '');
@@ -801,7 +824,7 @@ export async function driveSession(cdp, { url, credentials, judge, quietMs }) {
         lastActivity = Date.now();
         await settle(() => lastActivity, RE_NAV_CAP_MS, quietMs);
     }
-    return judge(facts(sessionLog(authId, submitSeq), {
+    return judge(facts(sessionLog(authId, authReq?.seq ?? submitSeq), {
         submitted: true,
         foreignOriginFailures: foreignOriginFailures(),
         leftAuthWall,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.40.34",
+    "version": "0.40.36",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",