@opencode/browse 0.0.6-dev.25 → 0.0.6-dev.28

package/dist/{relay-qqjvahw5.mjs → relay-epeqzmcr.mjs}

@@ -1,12 +1,13 @@
 import {
   opencodeBrowserVersion2,
   opencodeBrowserBuildId2
-} from "./main-sdmv8gfv.mjs";
+} from "./main-4t3a1fw9.mjs";
 import {
   dataRoot,
   oldStoreMarker,
   fromCheckout,
   cliCommand,
+  PUBLIC_STORE_ID,
   storeConfig,
   devExtension,
   storeUrl,
@@ -18,7 +19,7 @@ import {
   setStoredMode,
   autoUpdateStatus,
   createAutoUpdater
-} from "./main-hh2mneh8.mjs";
+} from "./main-8ncff5jp.mjs";
 import {
   extensionProtocolVersion,
   minExtensionProtocolVersion,
@@ -42,7 +43,7 @@ import {
   relayToken,
   secretsEqual,
   ensurePrivateDirectory
-} from "./main-tf22ynec.mjs";
+} from "./main-x8w3s3rv.mjs";
 import {
   ExecuteRequest,
   SessionAdoptRequest,
@@ -56,7 +57,6 @@ import {
   NetworkStartRequest,
   NetworkSessionRequest,
   NetworkStopRequest,
-  DeadboltLoginsRequest,
   AuthProfileRequest,
   AuthRefreshRequest,
   AuthRunRequest,
@@ -92,7 +92,7 @@ import {
   isRestrictedTarget2,
   isRestrictedUrl2,
   dataUrlDocument2
-} from "./main-7pxrvrp0.mjs";
+} from "./main-8h1nwn45.mjs";
 import {
   relayHostname,
   isLocalPeer,
@@ -114,7 +114,7 @@ import {
   wrapToken,
   installedDevExtension,
   syncDevExtension
-} from "./main-e83a20ce.mjs";
+} from "./main-xg3r1ze3.mjs";
 import {
   SettingsInputError,
   parseSettingChanges,
@@ -122,17 +122,6 @@ import {
   settingsToExtension,
   describeSettings,
   describeChanges,
-  DeadboltError,
-  readClient,
-  connect,
-  parseDeadboltName,
-  originOnSite,
-  pickLogin,
-  originsFromPatterns,
-  listLogins,
-  pickPasskey,
-  isBase64Url,
-  randomName,
   terminateChildProcess,
   SecretCollector,
   looksLikeTokenSegment,
@@ -152,16 +141,16 @@ import {
   checkNavigationUrl,
   readSecret,
   secretText
-} from "./main-xj8td7qw.mjs";
+} from "./main-rsqahh12.mjs";
 import {
   defaultJournalBaseDir,
   makeJournalEntry,
   appendJournalEntry,
   startJournalRetention
-} from "./main-mm82qqzb.mjs";
+} from "./main-tfkqwwrb.mjs";
 import {
   createUpdateWatcher2
-} from "./main-spqvtmdy.mjs";
+} from "./main-scyv26xb.mjs";
 
 // src/relay.ts
 import crypto10 from "node:crypto";
@@ -4220,15 +4209,6 @@ async function detectChallenge(page, options) {
     recommendation: current.kind === "block" ? "stop" : "handoff"
   };
 }
-var requestEvents = new Set(["request", "requestfinished", "requestfailed", "response", "websocket", "route"]);
-function pageHookCall(fn, args) {
-  const name = typeof fn.name === "string" ? fn.name.replace(/^bound /, "") : "";
-  if (["route", "routeFromHAR", "routeWebSocket", "addInitScript", "exposeBinding", "exposeFunction", "newCDPSession", "waitForRequest", "waitForResponse"].includes(name))
-    return `${name}()`;
-  if (["on", "once", "addListener", "prependListener", "waitForEvent"].includes(name) && typeof args[0] === "string" && requestEvents.has(args[0]))
-    return `${name}("${args[0]}")`;
-  return;
-}
 function pageVisibleApiSourceWarnings(code) {
   const warnings = [];
   for (const name of ["addInitScript", "exposeFunction", "exposeBinding"]) {
@@ -8738,9 +8718,7 @@ function buildSandboxGlobals(deps) {
       stop: (target) => stop(target ?? page)
     },
     secrets: {
-      type: (target, name, typeOptions) => deps.secrets.typeSecret(page, target, name, typeOptions),
-      signIn: (signInOptions) => deps.secrets.signIn(page, signInOptions),
-      usePasskey: (passkeyOptions) => deps.secrets.usePasskey(passkeyOptions?.page ?? page, passkeyOptions)
+      type: (target, name, typeOptions) => deps.secrets.typeSecret(page, target, name, typeOptions)
     },
     handoffTracker
   };
@@ -8748,554 +8726,6 @@ function buildSandboxGlobals(deps) {
 
 // src/execute/secrets-bridge.ts
 import { Effect as Effect10 } from "effect";
-
-// src/auth/sign-in.ts
-var googleSite = "accounts.google.com";
-var handoffHint = 'Hand it to the user with handoff("Finish signing in, then click Continue"), then check the page.';
-var readPageScript = () => {
-  const limit = 20000;
-  const all = [];
-  const walk = (root) => {
-    for (const element of Array.from(root.querySelectorAll("*"))) {
-      if (all.length >= limit)
-        return;
-      all.push(element);
-      if (element.shadowRoot)
-        walk(element.shadowRoot);
-    }
-  };
-  walk(document);
-  const visible = (element) => {
-    const rect = element.getBoundingClientRect();
-    if (rect.width < 2 || rect.height < 2)
-      return false;
-    const style = getComputedStyle(element);
-    if (style.visibility === "hidden" || style.display === "none" || Number(style.opacity) < 0.05)
-      return false;
-    return !element.closest("[hidden], [inert], [aria-hidden='true']");
-  };
-  const describe = (element) => {
-    const input = element;
-    const labelled = (element.getAttribute("aria-labelledby") ?? "").split(/\s+/).filter(Boolean).map((id) => element.ownerDocument.getElementById(id)?.textContent ?? "").join(" ");
-    return [
-      element.getAttribute("aria-label"),
-      labelled,
-      Array.from(input.labels ?? []).map((label) => label.textContent).join(" "),
-      input.placeholder,
-      input.name,
-      element.id,
-      element.getAttribute("autocomplete"),
-      element.getAttribute("data-testid")
-    ].filter(Boolean).join(" ").toLowerCase().replace(/\s+/g, " ");
-  };
-  const ownText = (element) => `${element.innerText ?? element.textContent ?? ""} ${element.getAttribute("aria-label") ?? ""} ${element.value && element.type === "submit" ? element.value : ""}`.trim().toLowerCase().replace(/\s+/g, " ");
-  const inputs = all.filter((element) => element instanceof HTMLInputElement && !element.disabled && !element.readOnly && visible(element) && !["hidden", "checkbox", "radio", "submit", "button", "image", "reset", "file", "range", "color", "search"].includes(element.type));
-  const autocomplete = (element) => (element.getAttribute("autocomplete") ?? "").toLowerCase();
-  const password = inputs.find((element) => element.type === "password" && !/new-password/.test(autocomplete(element)) && !/confirm|repeat|re-?enter|new password|retype/.test(describe(element)));
-  const codeWords = /one[- ]?time|\botp\b|totp|\b2fa\b|\bmfa\b|two[- ]factor|verification|security code|auth\w* code|passcode|\bpin\b|digit|\bcode\b/;
-  const singleBoxes = inputs.filter((element) => element.maxLength === 1 && element.type !== "password");
-  const otpSingle = inputs.find((element) => element !== password && element.maxLength !== 1 && (autocomplete(element).includes("one-time-code") || codeWords.test(describe(element)) && !/zip|postal|promo|coupon|country|area|referral|invite/.test(describe(element))));
-  const otp = singleBoxes.length >= 4 && singleBoxes.length <= 8 ? singleBoxes : otpSingle ? [otpSingle] : [];
-  const usernameCandidates = inputs.filter((element) => element !== password && !otp.includes(element) && ["text", "email", "tel", ""].includes(element.type) && (/username|email|webauthn/.test(autocomplete(element)) || element.type === "email" || /user|e-?mail|login|identifier|account|phone|handle/.test(describe(element))) && !/search|newsletter|subscribe|coupon|promo/.test(describe(element)));
-  const form = password?.form ?? null;
-  const username = usernameCandidates.find((element) => form && element.form === form) ?? usernameCandidates[0] ?? null;
-  const clickables = all.filter((element) => (element instanceof HTMLButtonElement || element instanceof HTMLAnchorElement || element.getAttribute("role") === "button" || element.getAttribute("role") === "link" || element instanceof HTMLInputElement && (element.type === "submit" || element.type === "button")) && visible(element) && !element.disabled);
-  const byText = (pattern) => clickables.find((element) => pattern.test(ownText(element)));
-  const field = otp[0] ?? password ?? username ?? null;
-  const submitFor = (target) => {
-    if (!target)
-      return null;
-    const owner = target.form;
-    if (owner) {
-      const inForm = clickables.filter((element) => element.form === owner || owner.contains(element));
-      const typed = inForm.find((element) => element instanceof HTMLButtonElement && element.type === "submit" || element instanceof HTMLInputElement && element.type === "submit");
-      if (typed)
-        return typed;
-    }
-    const words = /^(sign ?in|log ?in|login|next|continue|verify|submit|confirm|done|weiter|suivant)\b/;
-    const following = clickables.filter((element) => target.compareDocumentPosition(element) & Node.DOCUMENT_POSITION_FOLLOWING);
-    return following.find((element) => words.test(ownText(element))) ?? clickables.find((element) => words.test(ownText(element))) ?? null;
-  };
-  const frames = Array.from(document.querySelectorAll("iframe")).filter(visible);
-  const captchaFrame = frames.find((frame) => {
-    const src = frame.src;
-    if (/size=invisible/.test(src) || frame.closest(".grecaptcha-badge"))
-      return false;
-    if (/challenges\.cloudflare\.com/.test(src)) {
-      const response = frame.ownerDocument.querySelector("input[name='cf-turnstile-response']");
-      return !response?.value;
-    }
-    return /\/recaptcha\/(api2|enterprise)\/(anchor|bframe)|hcaptcha\.com|arkoselabs|funcaptcha|geo\.captcha-delivery|captcha/.test(src);
-  });
-  const captchaWidget = all.find((element) => /^(px-captcha|sec-cpt-if|ddv1-captcha-container)$/.test(element.id) && visible(element));
-  const errors = all.filter((element) => (element.getAttribute("role") === "alert" || element.getAttribute("aria-live") === "assertive" || /(^|[\s_-])(error|alert|invalid)([\s_-]|$)/i.test(typeof element.className === "string" ? element.className : "")) && visible(element));
-  const handles = {
-    password: password ?? null,
-    username,
-    otp,
-    submit: submitFor(field),
-    passwordToggle: byText(/use (your )?password|(sign|log) ?in with (a |your )?password|enter (your )?password( instead)?|password instead|try another way/) ?? null,
-    google: byText(/(sign ?in|log ?in|continue|sign ?up) (with|using|via) google|^google$/) ?? null,
-    signInLink: byText(/^(sign ?in|log ?in|login)$/) ?? null,
-    passkeyButton: byText(/(sign ?in|log ?in|continue) (with|using) (a |your )?passkey|use (a |your )?passkey|^passkey$/) ?? null
-  };
-  const state = {
-    captcha: captchaFrame ? captchaFrame.src.slice(0, 120) : captchaWidget ? `#${captchaWidget.id}` : null,
-    hasPassword: Boolean(password),
-    hasUsername: Boolean(username),
-    usernameFilled: username?.value ?? "",
-    otpCount: otp.length,
-    hasPasswordToggle: Boolean(handles.passwordToggle),
-    hasGoogle: Boolean(handles.google),
-    hasSignInLink: Boolean(handles.signInLink),
-    hasPasskeyButton: Boolean(handles.passkeyButton),
-    text: `${document.title}
-${document.body?.innerText ?? ""}`.slice(0, 4000).toLowerCase(),
-    errorText: errors.map((element) => element.innerText ?? "").join(" ").replace(/\s+/g, " ").trim().slice(0, 120)
-  };
-  return { state, handles };
-};
-async function element(read, name) {
-  const property = await read.handles.getProperty(name);
-  return property.asElement() ?? undefined;
-}
-async function otpElements(read) {
-  const list = await read.handles.getProperty("otp");
-  const properties = await list.getProperties();
-  const elements = [];
-  for (const [key, value] of properties) {
-    if (!/^\d+$/.test(key))
-      continue;
-    const handle = value.asElement();
-    if (handle)
-      elements.push(handle);
-  }
-  return elements;
-}
-async function readFrame(frame) {
-  try {
-    const handles = await frame.evaluateHandle(readPageScript);
-    const state = await (await handles.getProperty("state")).jsonValue();
-    return { frame, state, handles: await handles.getProperty("handles") };
-  } catch {
-    return;
-  }
-}
-var actionable = (state) => Boolean(state.captcha || state.otpCount || state.hasPassword || state.hasUsername || state.hasPasswordToggle || state.hasGoogle || state.hasPasskeyButton);
-async function readPage(page, site) {
-  const main = await readFrame(page.mainFrame());
-  if (main && actionable(main.state))
-    return main;
-  for (const frame of page.frames()) {
-    if (frame === page.mainFrame())
-      continue;
-    let origin;
-    try {
-      origin = new URL(frame.url()).origin;
-    } catch {
-      continue;
-    }
-    if (!originOnSite(origin, site))
-      continue;
-    const read = await readFrame(frame);
-    if (read && actionable(read.state))
-      return read;
-  }
-  return main;
-}
-var delay3 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-function defaultSite(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return;
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:")
-    return;
-  const host = parsed.hostname.toLowerCase();
-  if (parsed.protocol === "http:" || /^[\d.]+$/.test(host) || host.includes(":") || host === "localhost" || host.endsWith(".localhost"))
-    return parsed.origin;
-  const labels = host.split(".");
-  const twoLevel = labels.length >= 3 && /^(co|com|org|net|gov|ac|edu|ne|or)$/.test(labels.at(-2)) && labels.at(-1).length === 2;
-  return labels.slice(twoLevel ? -3 : -2).join(".");
-}
-function codeKind(text) {
-  if (/authenticator|authentication app|auth app|google authenticator|\btotp\b|one-time password app|security key app|2fa app|your app/.test(text))
-    return "totp";
-  if (/\bsms\b|text message|texted|we (just )?sent|sent (a|the|you a) code|sent to|check your (email|inbox|phone)|by email|via email|phone call|call you|ending in|whatsapp/.test(text))
-    return "sent";
-  return "unknown";
-}
-function verificationKind(text) {
-  if (/approve (the|this|your) (sign|log)|check your phone|tap yes|duo push|push notification|approve (it|the request)|waiting for (your )?approval|open the .{0,20} app on your/.test(text))
-    return "push_approval";
-  if (/new device|unrecognized device|unfamiliar device|verify (it'?s|that it'?s) you|confirm (it'?s|your identity|that it'?s you)|verify your identity|security check/.test(text))
-    return "new_device";
-  if (/security question/.test(text))
-    return "security_question";
-  return;
-}
-function needsUser(step, why) {
-  return { status: "needs_user", step, reason: `${why} ${handoffHint}` };
-}
-async function clickHandle(handle) {
-  await handle.scrollIntoViewIfNeeded().catch(() => {});
-  await handle.click({ timeout: 5000 }).catch(async () => {
-    await handle.evaluate((node) => node.click());
-  });
-}
-async function domSignature(frame) {
-  return await frame.evaluate(() => `${document.querySelectorAll("input, iframe, [role='alert']").length}:${document.body?.innerText.length ?? 0}`).catch(() => "");
-}
-async function waitForProgress(page, field, timeoutMs) {
-  const url = page.url();
-  const until = Date.now() + timeoutMs;
-  const frame = await field?.ownerFrame().catch(() => null) ?? page.mainFrame();
-  const before = await domSignature(frame);
-  while (Date.now() < until) {
-    await delay3(250);
-    if (page.isClosed())
-      return true;
-    if (page.url() !== url) {
-      await page.waitForLoadState("domcontentloaded", { timeout: Math.max(1, until - Date.now()) }).catch(() => {});
-      return true;
-    }
-    if (field && !await field.isVisible().catch(() => false))
-      return true;
-    const now = await domSignature(frame);
-    if (before && now && now !== before) {
-      await delay3(400);
-      return true;
-    }
-  }
-  return false;
-}
-async function clearSecretInputs(frames, fields = []) {
-  const clearScript = () => {
-    const own = (element) => {
-      const input = element;
-      if (!(input instanceof HTMLInputElement) || !input.value)
-        return;
-      const setter = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, "value")?.set;
-      if (setter)
-        setter.call(input, "");
-      else
-        input.value = "";
-      input.dispatchEvent(new Event("input", { bubbles: true }));
-      input.dispatchEvent(new Event("change", { bubbles: true }));
-    };
-    const all = [];
-    const walk = (root) => {
-      for (const element of Array.from(root.querySelectorAll("input"))) {
-        const input = element;
-        if (input.type === "password" || /one-time-code/i.test(input.autocomplete) || input.maxLength === 1 && input.type !== "checkbox" && input.type !== "radio")
-          all.push(input);
-      }
-      for (const host of Array.from(root.querySelectorAll("*")))
-        if (host.shadowRoot)
-          walk(host.shadowRoot);
-    };
-    walk(document);
-    for (const element of all)
-      own(element);
-  };
-  for (const field of fields) {
-    await field.evaluate((node) => {
-      const input = node;
-      if (!(input instanceof HTMLInputElement) || !input.value)
-        return;
-      Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, "value")?.set?.call(input, "");
-      input.dispatchEvent(new Event("input", { bubbles: true }));
-      input.dispatchEvent(new Event("change", { bubbles: true }));
-    }).catch(() => {});
-  }
-  for (const frame of new Set(frames)) {
-    if (frame.isDetached())
-      continue;
-    await frame.evaluate(clearScript).catch(() => {});
-  }
-}
-async function submit(read, field) {
-  const button = await element(read, "submit");
-  if (button)
-    await clickHandle(button);
-  else
-    await field.press("Enter");
-}
-async function signIn(deps, options = {}) {
-  const timeoutMs = options.timeoutMs ?? 90000;
-  const deadline = Date.now() + timeoutMs;
-  let page = deps.page;
-  if (options.site !== undefined && (typeof options.site !== "string" || !options.site))
-    return { status: "failed", step: "start", reason: "site must be a host like example.com or an origin" };
-  const startSite = options.site?.toLowerCase() ?? defaultSite(page.url());
-  if (!startSite)
-    return { status: "failed", step: "start", reason: "The page isn't on a website; navigate to the site's sign-in page first, or pass {site}." };
-  const siteSpec = { site: startSite, ...options.username ? { username: options.username } : {} };
-  const typedFrames = new Set;
-  const typedFields = [];
-  const tracked = {
-    ...deps,
-    type: async (handles, spec, field) => {
-      for (const handle of handles) {
-        const frame = await handle.ownerFrame().catch(() => null);
-        if (frame)
-          typedFrames.add(frame);
-        if (field !== "username")
-          typedFields.push(handle);
-      }
-      return await deps.type(handles, spec, field);
-    }
-  };
-  let result;
-  try {
-    const onSite = (() => {
-      try {
-        return originOnSite(new URL(page.url()).origin, startSite);
-      } catch {
-        return false;
-      }
-    })();
-    if (!onSite) {
-      const start = /^https?:\/\//.test(startSite) ? startSite : `https://${startSite}/`;
-      await page.goto(start, { waitUntil: "domcontentloaded", timeout: Math.min(30000, timeoutMs) });
-    }
-    if (options.username && deps.passkeys)
-      await deps.passkeys.select(page, startSite, options.username).catch(() => {});
-    result = await run2(tracked, page, siteSpec, deadline, 0);
-    return result;
-  } catch (error) {
-    result = fromError(error, "start");
-    return result;
-  } finally {
-    if (result?.status !== "signed_in" && typedFrames.size > 0)
-      await clearSecretInputs(typedFrames, typedFields);
-    if (options.username && deps.passkeys && !page.isClosed())
-      await deps.passkeys.select(page, startSite, "").catch(() => {});
-  }
-}
-function fromError(error, step) {
-  if (error instanceof DeadboltError) {
-    if (error.code === "not_granted")
-      return { status: "not_granted", step, reason: error.message };
-    if (error.code === "locked")
-      return { status: "needs_user", step, reason: error.message };
-    return { status: "failed", step, reason: `${error.code}: ${error.message}` };
-  }
-  const message = error instanceof Error ? error.message : String(error);
-  if (/domain_not_allowed/.test(message))
-    return { status: "failed", step, reason: message.replace(/^secrets\.\w+: /, "") };
-  return { status: "failed", step, reason: message.slice(0, 300) };
-}
-async function run2(deps, startPage, siteSpec, deadline, depth) {
-  const page = startPage;
-  let step = "start";
-  let googleSpec;
-  let clickedSignInLink = false;
-  let toggles = 0;
-  let lastSignature = "";
-  let repeats = 0;
-  let passkeyClicks = 0;
-  const started = Date.now();
-  const needsChoice = async () => {
-    if (siteSpec.username || !deps.passkeys)
-      return;
-    const choices = await deps.passkeys.choiceSince(page, started).catch(() => {
-      return;
-    });
-    if (!choices || choices.length === 0)
-      return;
-    return { status: "needs_choice", step: "passkey", reason: `Several passkeys can sign in to ${siteSpec.site}; call again with { username } set to one of the choices.`, choices };
-  };
-  const specFor = (url) => {
-    let origin;
-    try {
-      origin = new URL(url).origin;
-    } catch {
-      return;
-    }
-    if (originOnSite(origin, siteSpec.site))
-      return siteSpec;
-    if (googleSpec && originOnSite(origin, googleSite))
-      return googleSpec;
-    return;
-  };
-  while (Date.now() < deadline) {
-    if (page.isClosed())
-      return step === "start" ? { status: "failed", step, reason: "The page closed." } : { status: "signed_in", step: "done", reason: "The sign-in window closed after the last step." };
-    await page.waitForLoadState("domcontentloaded", { timeout: Math.max(1, Math.min(15000, deadline - Date.now())) }).catch(() => {});
-    const url = page.url();
-    const spec = specFor(url);
-    if (!spec) {
-      if (step === "start")
-        return { status: "failed", step, reason: `The page is on ${safeOrigin(url)}, not ${siteSpec.site}.` };
-      return needsUser("provider", `The sign-in moved to ${safeOrigin(url)}, which isn't ${siteSpec.site}${googleSpec ? " or Google" : ""}.`);
-    }
-    const choice = await needsChoice();
-    if (choice)
-      return choice;
-    let read;
-    const settleUntil = Math.min(deadline, Date.now() + (step === "start" ? 8000 : 5000));
-    while (true) {
-      read = await readPage(page, spec.site);
-      if (read && actionable(read.state) || Date.now() >= settleUntil)
-        break;
-      await delay3(300);
-    }
-    if (!read) {
-      await delay3(300);
-      continue;
-    }
-    const state = read.state;
-    const signature = `${url}|${state.hasUsername}|${state.hasPassword}|${state.otpCount}|${state.usernameFilled.length}`;
-    repeats = signature === lastSignature ? repeats + 1 : 0;
-    lastSignature = signature;
-    if (repeats >= 2) {
-      return { status: "failed", step, reason: state.errorText ? `The site didn't accept the ${step === "code" ? "code" : step}: ${state.errorText}` : `The page didn't move on after the ${step} step.` };
-    }
-    if (state.captcha)
-      return needsUser(step, `A captcha is showing (${state.captcha}).`);
-    const challenge = await deps.challenge(page).catch(() => {
-      return;
-    });
-    if (challenge && challenge.kind !== "non-interactive") {
-      return challenge.kind === "block" ? { status: "failed", step, reason: `The site blocked the visit (${challenge.vendor}).` } : needsUser(step, `A ${challenge.vendor} bot check is showing.`);
-    }
-    if (state.otpCount > 0) {
-      const kind = codeKind(state.text);
-      if (kind === "sent")
-        return needsUser("code", "The site sent a one-time code by SMS, email or call.");
-      const logins = await deps.logins(new URL(read.frame.url()).origin).catch(() => []);
-      const hasTotp = logins.some((login) => login.hasTotp && login.granted && (!login.fields || login.fields.includes("totp")) && (!spec.username || login.username?.toLowerCase() === spec.username.toLowerCase()));
-      if (!hasTotp)
-        return needsUser("code", kind === "totp" ? "The site asks for an authenticator code, and the granted login has no one-time password." : "The site asks for a one-time code.");
-      const boxes = await otpElements(read);
-      step = "code";
-      await deps.type(boxes, spec, "totp");
-      if (!await waitForProgress(page, boxes[0], 1500)) {
-        const stillThere = await boxes[0].isVisible().catch(() => false);
-        if (stillThere)
-          await submit(read, boxes.at(-1));
-        await waitForProgress(page, boxes[0], 15000);
-      }
-      continue;
-    }
-    if (state.hasPassword) {
-      const passwordField = await element(read, "password");
-      const usernameField = await element(read, "username");
-      if (usernameField && !state.usernameFilled)
-        await deps.type([usernameField], spec, "username");
-      step = "password";
-      await deps.type([passwordField], spec, "password");
-      await submit(read, passwordField);
-      await waitForProgress(page, passwordField, 15000);
-      continue;
-    }
-    if (state.hasUsername) {
-      const usernameField = await element(read, "username");
-      await deps.type([usernameField], spec, "username");
-      step = "identifier";
-      await submit(read, usernameField);
-      await waitForProgress(page, usernameField, 15000);
-      continue;
-    }
-    if (state.hasPasswordToggle && toggles < 2) {
-      toggles += 1;
-      await clickHandle(await element(read, "passwordToggle"));
-      await waitForProgress(page, undefined, 2000);
-      continue;
-    }
-    if (state.hasGoogle && !googleSpec && depth === 0 && spec === siteSpec) {
-      const siteLogins = await deps.logins(new URL(read.frame.url()).origin).catch(() => []);
-      const viaGoogle = siteLogins.find((login) => login.signIn?.provider === "google");
-      const googleLogins = (await deps.logins(`https://${googleSite}`).catch(() => [])).filter((login) => login.granted);
-      const account = siteSpec.username ?? viaGoogle?.signIn?.account;
-      const googleLogin = googleLogins.find((login) => !account || login.username?.toLowerCase() === account.toLowerCase()) ?? (googleLogins.length === 1 ? googleLogins[0] : undefined);
-      if (googleLogin && (viaGoogle || !siteLogins.some((login) => login.granted && login.hasPassword))) {
-        if (!deps.allowed(`https://${googleSite}/`))
-          return needsUser("provider", `Signing in uses Google, but ${googleSite} isn't in this session's allowlist (add it with session_allowlist).`);
-        googleSpec = { site: googleSite, ...googleLogin.username ? { username: googleLogin.username } : {} };
-        step = "provider";
-        const popupPromise = deps.context.waitForEvent("page", { timeout: 5000 }).catch(() => {
-          return;
-        });
-        await clickHandle(await element(read, "google"));
-        const popup = await popupPromise;
-        if (popup) {
-          await popup.waitForLoadState("domcontentloaded").catch(() => {});
-          const result = await runProvider(deps, popup, googleSpec, deadline);
-          if (result.status !== "signed_in")
-            return result;
-          await waitForProgress(page, undefined, 5000);
-        } else {
-          await waitForProgress(page, undefined, 1e4);
-        }
-        continue;
-      }
-    }
-    if (state.hasPasskeyButton && passkeyClicks < 1) {
-      const origin = new URL(read.frame.url()).origin;
-      const passkeys = await deps.passkeyAccounts(origin).catch(() => []);
-      const granted = spec.username ? pickPasskey(passkeys, spec.username) !== undefined : passkeys.some((passkey) => passkey.granted);
-      if (granted) {
-        passkeyClicks += 1;
-        step = "passkey";
-        const before = page.url();
-        await clickHandle(await element(read, "passkeyButton"));
-        const until = Math.min(deadline, Date.now() + 1e4);
-        while (Date.now() < until && !page.isClosed() && page.url() === before) {
-          const picked = await needsChoice();
-          if (picked)
-            return picked;
-          await delay3(250);
-        }
-        await page.waitForLoadState("domcontentloaded").catch(() => {});
-        continue;
-      }
-    }
-    const verification = verificationKind(state.text);
-    if (verification)
-      return needsUser("verify", verification === "push_approval" ? "The site waits for a push approval on another device." : verification === "security_question" ? "The site asks a security question." : "The site wants to verify a new device or that it's really the user.");
-    if (step !== "start" && codeKind(state.text) === "sent")
-      return needsUser("code", "The site sent a one-time code by SMS, email or call.");
-    if (step === "start") {
-      if (state.hasSignInLink && !clickedSignInLink) {
-        clickedSignInLink = true;
-        await clickHandle(await element(read, "signInLink"));
-        await waitForProgress(page, undefined, 8000);
-        continue;
-      }
-      if (state.hasGoogle)
-        return needsUser("provider", "The page offers Sign in with Google, but Deadbolt grants no Google login for it.");
-      return { status: "failed", step, reason: "No sign-in form found on this page. Open the site's sign-in page first." };
-    }
-    if (state.errorText && /incorrect|wrong|invalid|doesn'?t match|not recognized|couldn'?t find|try again/i.test(state.errorText)) {
-      return { status: "failed", step, reason: `The site refused the sign-in: ${state.errorText}` };
-    }
-    if (spec === googleSpec && spec !== siteSpec)
-      return needsUser("provider", "Google shows a screen to choose an account or to give consent.");
-    return { status: "signed_in", step: "done", reason: `Signed in to ${spec.site}: no sign-in field is left after the ${step} step.` };
-  }
-  return { status: "failed", step: "start", reason: "The sign-in didn't finish in time." };
-}
-async function runProvider(deps, popup, spec, deadline) {
-  const result = await run2({ ...deps, page: popup }, popup, spec, deadline, 1);
-  if (result.status !== "signed_in")
-    return result;
-  if (!popup.isClosed())
-    await popup.waitForEvent("close", { timeout: Math.max(1, Math.min(20000, deadline - Date.now())) }).catch(() => {});
-  return popup.isClosed() ? result : needsUser("provider", "Google's sign-in window stayed open (an account choice or consent screen).");
-}
-function safeOrigin(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return url.slice(0, 80);
-  }
-}
-
-// src/execute/secrets-bridge.ts
 var isOpaqueDocumentUrl = (url) => /^(?:about|data|blob):/i.test(url);
 var frameOrigin = (url) => {
   try {
@@ -9312,8 +8742,6 @@ var elementHasFocus = (handle) => handle.evaluate((node) => {
 class ExecuteSecretsBridge {
   deps;
   typedSecrets = new Map;
-  deadboltConnection;
-  pageHooks = new Set;
   constructor(deps) {
     this.deps = deps;
   }
@@ -9371,9 +8799,6 @@ class ExecuteSecretsBridge {
   async typeSecret(page, target, name, options = {}) {
     if (typeof name !== "string" || !name)
       throw new Error("secrets.type(target, name): name must be the name of a stored secret");
-    const deadboltSpec = parseDeadboltName(name);
-    if (deadboltSpec)
-      return await this.typeDeadboltSecret(page, target, name, deadboltSpec, options);
     const secret = await Effect10.runPromise(readSecret(name)).catch((error) => {
       throw new Error(`secrets.type: ${error instanceof Error ? error.message : "could not read the secret"}`);
     });
@@ -9428,158 +8853,6 @@ class ExecuteSecretsBridge {
       await handle.dispose().catch(() => {});
     }
   }
-  refuseWithPageHooks(label) {
-    if (this.pageHooks.size === 0)
-      return;
-    throw new Error(`${label}: page_hooks: this session's code used ${[...this.pageHooks].sort().join(", ")}, which could capture what is typed, so Deadbolt passwords and codes aren't typed here. Reset the session (session_reset) and sign in before setting those up. Nothing was typed.`);
-  }
-  deadbolt() {
-    const client = readClient();
-    if (!this.deadboltConnection || !client || this.deadboltConnection.client.id !== client.id || this.deadboltConnection.client.token !== client.token) {
-      this.deadboltConnection = connect(client ? { client } : {});
-    }
-    return this.deadboltConnection;
-  }
-  sessionAllows(url) {
-    const patterns = this.deps.allowedOrigins();
-    return !patterns || patterns.length === 0 || checkUrl(url, parseOriginPatterns(patterns)).allowed;
-  }
-  async typeDeadbolt(handles, spec, field, label) {
-    if (!["username", "password", "totp"].includes(field))
-      throw new Error(`${label}: field must be "username", "password" or "totp"`);
-    if (handles.length === 0)
-      throw new Error(`${label}: target_not_editable: no field to type into`);
-    if (field !== "username")
-      this.refuseWithPageHooks(label);
-    const frame = await handles[0].ownerFrame();
-    if (!frame)
-      throw new Error(`${label}: target_not_editable: the field is not in a frame`);
-    for (const handle of handles.slice(1)) {
-      if (await handle.ownerFrame() !== frame)
-        throw new Error(`${label}: target_not_editable: the code boxes are in different frames`);
-    }
-    const checkOrigin = () => {
-      const url = frame.url();
-      const origin = frameOrigin(url);
-      if (isOpaqueDocumentUrl(url) || !originOnSite(origin, spec.site)) {
-        throw new Error(`${label}: domain_not_allowed: the field's frame is ${origin}, which is not on ${spec.site}. Nothing was typed.`);
-      }
-      if (!this.sessionAllows(url)) {
-        throw new Error(`${label}: domain_not_allowed: the field's frame is ${origin}, which is outside this session's domain allowlist. Nothing was typed.`);
-      }
-      return origin;
-    };
-    const origin = checkOrigin();
-    for (const handle of handles) {
-      if (!await handle.isEditable().catch(() => false))
-        throw new Error(`${label}: target_not_editable: the target is not an editable field. Nothing was typed.`);
-    }
-    const connection = this.deadbolt();
-    const login = pickLogin(await connection.logins(origin), spec.site, spec.username, field);
-    const values = await connection.fill(origin, login, [field]);
-    const value = values[field];
-    if (!value)
-      throw new DeadboltError("not_found", `The Deadbolt login for ${spec.site} has no ${field}.`);
-    const name = `deadbolt:${spec.site}${login.username ? `/${login.username}` : ""} ${field}`;
-    if (field !== "username") {
-      this.typedSecrets.set(value, name);
-      this.deps.networkCapture.addRedaction(value);
-    }
-    const characters = handles.length === 1 ? [value] : Array.from(value);
-    if (handles.length > 1 && characters.length !== handles.length) {
-      throw new Error(`${label}: target_not_editable: ${handles.length} code boxes for a ${characters.length}-character code. Nothing was typed.`);
-    }
-    for (const [index, handle] of handles.entries()) {
-      await handle.fill("");
-      await handle.focus();
-      if (!await elementHasFocus(handle)) {
-        throw new Error(`${label}: target_not_editable: the field did not keep focus.`);
-      }
-      checkOrigin();
-      await frame.page().keyboard.insertText(characters[index]);
-    }
-    if (!this.deps.allowedOrigins()?.length) {
-      this.deps.addWarningOnce(`A Deadbolt login was typed in a session without a domain allowlist. A prompt-injected page could steer this session elsewhere after the value is in the page: set one with session_allowlist (or \`session allow\`) before signing in.`);
-    }
-    return { origin, login };
-  }
-  async typeDeadboltSecret(page, target, name, spec, options) {
-    const field = options.field ?? "password";
-    if (field !== "username" && options.submit !== true) {
-      throw new Error(`secrets.type: submit_required: a Deadbolt ${field} is typed only with { submit: true }, which submits the form in the same call and clears the field afterwards. Prefer secrets.signIn(). Nothing was typed.`);
-    }
-    const locator = typeof target === "string" ? page.locator(target) : target;
-    if (!locator || typeof locator.elementHandle !== "function") {
-      throw new Error("secrets.type(target, name): target must be a selector string or a Locator");
-    }
-    const handle = await locator.elementHandle({ timeout: options.timeout ?? 1e4 });
-    const frame = await handle.ownerFrame();
-    let typed = false;
-    try {
-      const { origin } = await this.typeDeadbolt([handle], spec, field, "secrets.type").catch((error) => {
-        if (error instanceof DeadboltError)
-          throw new Error(`secrets.type: ${error.code}: ${error.message} Nothing was typed.`);
-        throw error;
-      });
-      typed = true;
-      if (options.submit !== true)
-        return { typed: true, name, origin, field };
-      const submitControl = await handle.evaluateHandle((node) => {
-        const form = node.form;
-        if (!form)
-          return null;
-        return form.querySelector("button[type=submit], input[type=submit], button:not([type])");
-      });
-      const button = submitControl.asElement();
-      if (button)
-        await button.click({ timeout: 5000 }).catch(() => handle.press("Enter"));
-      else
-        await handle.press("Enter");
-      const progressed = await waitForProgress(frame?.page() ?? page, handle, 15000);
-      return { typed: true, name, origin, field, submitted: true, progressed };
-    } finally {
-      if (typed && field !== "username")
-        await clearSecretInputs(frame ? [frame] : [], [handle]);
-      await handle.dispose().catch(() => {});
-    }
-  }
-  async usePasskey(page, options) {
-    const site = typeof options?.site === "string" ? options.site.trim().toLowerCase() : "";
-    const username = typeof options?.username === "string" ? options.username.trim() : "";
-    if (!site || !username)
-      throw new Error("secrets.usePasskey({ site, username }): site and username are required");
-    if (!this.deps.passkeys)
-      throw new Error("secrets.usePasskey: passkeys aren't available in this relay");
-    this.deps.passkeys.select(await pageTargetId(page), site, username);
-    return { selected: true, site, username };
-  }
-  async signIn(page, options = {}) {
-    if (options !== null && typeof options !== "object")
-      throw new Error("secrets.signIn(options): options must be an object like { site, username }");
-    const site = typeof options?.site === "string" ? options.site : undefined;
-    const username = typeof options?.username === "string" ? options.username : undefined;
-    const timeoutMs = typeof options?.timeoutMs === "number" && options.timeoutMs > 0 ? Math.min(options.timeoutMs, 300000) : undefined;
-    return await signIn({
-      page,
-      context: page.context(),
-      type: async (handles, spec, field) => (await this.typeDeadbolt(handles, spec, field, "secrets.signIn")).login,
-      logins: (origin) => this.deadbolt().logins(origin),
-      passkeyAccounts: async (origin) => (await this.deadbolt().site(origin)).passkeys,
-      challenge: async (target) => {
-        const outcome = await detectChallenge(target, { waitMs: challengeWaitMs() }).catch(() => {
-          return;
-        });
-        return outcome && outcome.status === "blocked" ? outcome : undefined;
-      },
-      allowed: (url) => this.sessionAllows(url),
-      ...this.deps.passkeys ? {
-        passkeys: {
-          select: async (target, passkeySite, passkeyUsername) => this.deps.passkeys.select(await pageTargetId(target), passkeySite, passkeyUsername),
-          choiceSince: async (target, since) => this.deps.passkeys.choiceSince(await pageTargetId(target), since)
-        }
-      } : {}
-    }, { ...site ? { site } : {}, ...username ? { username } : {}, ...timeoutMs ? { timeoutMs } : {} });
-  }
 }
 
 // src/network-capture.ts
@@ -10475,7 +9748,6 @@ class ExecuteSandbox extends DefaultPageHost {
     this.secrets = new ExecuteSecretsBridge({
       networkCapture: this.networkCapture,
       allowedOrigins: () => this.options.allowedOrigins?.(),
-      ...this.options.passkeys ? { passkeys: this.options.passkeys } : {},
       addWarningOnce: (warning) => this.addWarningOnce(warning)
     });
     this.realm = this.allowNode ? undefined : this.createRealm();
@@ -10488,9 +9760,6 @@ class ExecuteSandbox extends DefaultPageHost {
     return new ExecuteRealm({
       onHostCall: (fn, receiver, args) => {
         this.addWarningOnce(pageVisibleApiWarning(fn, receiver, args));
-        const hook = pageHookCall(fn, args);
-        if (hook)
-          this.secrets.pageHooks.add(hook);
       }
     });
   }
@@ -10640,7 +9909,6 @@ class ExecuteSandbox extends DefaultPageHost {
       sandbox.realm?.dispose();
       sandbox.realm = sandbox.allowNode ? undefined : sandbox.createRealm();
       sandbox.state = sandbox.realm?.state ?? {};
-      sandbox.secrets.pageHooks.clear();
       const browser = sandbox.browser;
       sandbox.browser = undefined;
       sandbox.unbindDefaultPage(sandbox.defaultPageTargetId, {
@@ -10946,36 +10214,36 @@ function unsignedInteger(value) {
   }
   return Buffer.from(bytes);
 }
-function element2(id, payload) {
+function element(id, payload) {
   return Buffer.concat([id, variableInteger(payload.length), payload]);
 }
 function mjpegMatroskaHeader(width, height) {
-  const ebmlHeader = element2(ebml, Buffer.concat([
-    element2(ebmlVersion, unsignedInteger(1)),
-    element2(ebmlReadVersion, unsignedInteger(1)),
-    element2(ebmlMaxIdLength, unsignedInteger(4)),
-    element2(ebmlMaxSizeLength, unsignedInteger(8)),
-    element2(docType, Buffer.from("matroska")),
-    element2(docTypeVersion, unsignedInteger(4)),
-    element2(docTypeReadVersion, unsignedInteger(2))
+  const ebmlHeader = element(ebml, Buffer.concat([
+    element(ebmlVersion, unsignedInteger(1)),
+    element(ebmlReadVersion, unsignedInteger(1)),
+    element(ebmlMaxIdLength, unsignedInteger(4)),
+    element(ebmlMaxSizeLength, unsignedInteger(8)),
+    element(docType, Buffer.from("matroska")),
+    element(docTypeVersion, unsignedInteger(4)),
+    element(docTypeReadVersion, unsignedInteger(2))
   ]));
-  const streamInfo = element2(info, Buffer.concat([
-    element2(timestampScale, unsignedInteger(1e6)),
-    element2(muxingApp, Buffer.from("opencode-browser")),
-    element2(writingApp, Buffer.from("opencode-browser"))
+  const streamInfo = element(info, Buffer.concat([
+    element(timestampScale, unsignedInteger(1e6)),
+    element(muxingApp, Buffer.from("opencode-browser")),
+    element(writingApp, Buffer.from("opencode-browser"))
   ]));
-  const track = element2(trackEntry, Buffer.concat([
-    element2(trackNumber, unsignedInteger(1)),
-    element2(trackUid, unsignedInteger(1)),
-    element2(trackType, unsignedInteger(1)),
-    element2(flagLacing, unsignedInteger(0)),
-    element2(codecId, Buffer.from("V_MJPEG")),
-    element2(video, Buffer.concat([
-      element2(pixelWidth, unsignedInteger(width)),
-      element2(pixelHeight, unsignedInteger(height))
+  const track = element(trackEntry, Buffer.concat([
+    element(trackNumber, unsignedInteger(1)),
+    element(trackUid, unsignedInteger(1)),
+    element(trackType, unsignedInteger(1)),
+    element(flagLacing, unsignedInteger(0)),
+    element(codecId, Buffer.from("V_MJPEG")),
+    element(video, Buffer.concat([
+      element(pixelWidth, unsignedInteger(width)),
+      element(pixelHeight, unsignedInteger(height))
     ]))
   ]));
-  return Buffer.concat([ebmlHeader, segment, unknownSize, streamInfo, element2(tracks, track)]);
+  return Buffer.concat([ebmlHeader, segment, unknownSize, streamInfo, element(tracks, track)]);
 }
 function mjpegMatroskaFrame(timestampMs, durationMs, frameLength) {
   const blockHeader = Buffer.concat([
@@ -10985,8 +10253,8 @@ function mjpegMatroskaFrame(timestampMs, durationMs, frameLength) {
     Buffer.from([0, 0]),
     Buffer.from([0])
   ]);
-  const clusterTimestamp = element2(timestamp, unsignedInteger(timestampMs));
-  const duration = element2(blockDuration, unsignedInteger(Math.max(1, durationMs)));
+  const clusterTimestamp = element(timestamp, unsignedInteger(timestampMs));
+  const duration = element(blockDuration, unsignedInteger(Math.max(1, durationMs)));
   const groupHeader = Buffer.concat([
     blockGroup,
     variableInteger(blockHeader.length + frameLength + duration.length),
@@ -14330,28 +13598,6 @@ function handleAuthRequest(options) {
 }
 function handleCliRequest(options) {
   return Effect22.gen(function* () {
-    if (options.pathname === "/cli/deadbolt/logins" && options.request.method === "POST") {
-      const request = yield* decodeRequest(DeadboltLoginsRequest, yield* readJsonBody2(options.request), "deadbolt logins");
-      const sessionId = request.sessionId;
-      const patterns = sessionId ? options.sessions.allowedOrigins(sessionId) : undefined;
-      const pageOrigins = options.registry.listRootTargets().filter((target) => sessionId !== undefined && target.opencodeBrowserSessionId === sessionId).flatMap((target) => {
-        try {
-          const url = new URL(target.targetInfo.url);
-          const allowed = !patterns || patterns.length === 0 || checkUrl(url.href, parseOriginPatterns(patterns)).allowed;
-          return (url.protocol === "https:" || url.protocol === "http:") && allowed ? [url.origin] : [];
-        } catch {
-          return [];
-        }
-      });
-      const origins = Array.from(new Set([...patterns && patterns.length > 0 ? originsFromPatterns(patterns) : [], ...pageOrigins]));
-      const listing = yield* Effect22.promise(() => listLogins(origins));
-      sendJson2(options.response, {
-        ...listing,
-        origins,
-        ...patterns && patterns.length > 0 ? {} : { note: "This session has no domain allowlist, so only the sites of its open pages were checked. Set one with session_allowlist to see the logins for the sites it may visit." }
-      });
-      return;
-    }
     if (options.pathname === "/cli/sessions" && options.request.method === "GET") {
       sendJson2(options.response, { sessions: options.sessions.listSummaries() });
       return;
@@ -14831,285 +14077,6 @@ async function paceKey(tab, params) {
   tab.lastKeyAt = Date.now();
 }
 
-// src/auth/passkey-bridge.ts
-var selectionTtlMs = 2 * 60000;
-var maxPayloadBytes = 64 * 1024;
-function hookSource(binding, reply) {
-  return `(() => {
-  const BINDING = ${JSON.stringify(binding)};
-  const REPLY = ${JSON.stringify(reply)};
-  // Chrome adds a binding only to the documents that exist when it is added (without Runtime.enable, which pages can
-  // detect), so the relay adds it again after every navigation. Take it off the global object as soon as it shows up.
-  let send = null;
-  const capture = () => {
-    if (send) return send;
-    const binding = globalThis[BINDING];
-    if (typeof binding === "function") {
-      send = binding;
-      try { delete globalThis[BINDING]; } catch {}
-    }
-    return send;
-  };
-  capture();
-  document.addEventListener("readystatechange", capture);
-  if (window !== window.top) return;
-  const container = globalThis.CredentialsContainer && CredentialsContainer.prototype;
-  if (!container || typeof container.get !== "function" || globalThis[REPLY]) return;
-  const originalGet = container.get;
-  const pending = new Map();
-  let nextId = 1;
-  const toBytes = (value) => value instanceof ArrayBuffer ? new Uint8Array(value) : ArrayBuffer.isView(value) ? new Uint8Array(value.buffer, value.byteOffset, value.byteLength) : null;
-  const encode = (value) => {
-    const bytes = toBytes(value);
-    if (!bytes) return null;
-    let text = "";
-    for (const byte of bytes) text += String.fromCharCode(byte);
-    return btoa(text).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
-  };
-  const decode = (text) => {
-    const binary = atob(text.replace(/-/g, "+").replace(/_/g, "/") + "===".slice((text.length + 3) % 4));
-    const bytes = new Uint8Array(binary.length);
-    for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index);
-    return bytes.buffer;
-  };
-  const assertion = (result) => {
-    const value = (v) => ({ value: v, enumerable: true });
-    const response = Object.create(AuthenticatorAssertionResponse.prototype, {
-      clientDataJSON: value(decode(result.client_data_json)),
-      authenticatorData: value(decode(result.authenticator_data)),
-      signature: value(decode(result.signature)),
-      userHandle: value(result.user_handle ? decode(result.user_handle) : null),
-    });
-    const json = {
-      id: result.credential_id, rawId: result.credential_id, type: "public-key", authenticatorAttachment: "platform",
-      response: { clientDataJSON: result.client_data_json, authenticatorData: result.authenticator_data, signature: result.signature, ...(result.user_handle ? { userHandle: result.user_handle } : {}) },
-      clientExtensionResults: {},
-    };
-    return Object.create(PublicKeyCredential.prototype, {
-      id: value(result.credential_id),
-      rawId: value(decode(result.credential_id)),
-      type: value("public-key"),
-      authenticatorAttachment: value("platform"),
-      response: value(response),
-      getClientExtensionResults: { value: () => ({}) },
-      toJSON: { value: () => json },
-    });
-  };
-  Object.defineProperty(globalThis, REPLY, {
-    value: (id, result) => {
-      const entry = pending.get(id);
-      if (!entry) return;
-      pending.delete(id);
-      if (result && result.ok) {
-        try { entry.resolve(assertion(result.assertion)); } catch (error) { entry.reject(new DOMException("The passkey answer was malformed.", "NotAllowedError")); }
-      } else {
-        entry.reject(new DOMException("The operation either timed out or was not allowed.", "NotAllowedError"));
-      }
-    },
-  });
-  const get = { get(options) {
-    const publicKey = options && options.publicKey;
-    if (!publicKey || options.mediation === "conditional" || options.password || options.federated || options.identity || options.otp) return originalGet.call(this, options);
-    const challenge = encode(publicKey.challenge);
-    if (!challenge) return Promise.reject(new TypeError("publicKey.challenge must be a BufferSource"));
-    const allowCredentials = Array.isArray(publicKey.allowCredentials) ? publicKey.allowCredentials.map((credential) => encode(credential && credential.id)).filter(Boolean) : [];
-    const signal = options.signal;
-    if (signal && signal.aborted) return Promise.reject(signal.reason ?? new DOMException("The operation was aborted.", "AbortError"));
-    return new Promise(async (resolve, reject) => {
-      const id = nextId++;
-      pending.set(id, { resolve, reject });
-      if (signal) signal.addEventListener("abort", () => { if (pending.delete(id)) reject(signal.reason ?? new DOMException("The operation was aborted.", "AbortError")); }, { once: true });
-      for (let tries = 0; tries < 60 && !capture(); tries++) await new Promise((wake) => setTimeout(wake, 50));
-      if (!send) {
-        pending.delete(id);
-        return reject(new DOMException("The operation either timed out or was not allowed.", "NotAllowedError"));
-      }
-      send(JSON.stringify({ id, challenge, rpId: typeof publicKey.rpId === "string" ? publicKey.rpId : undefined, allowCredentials, userVerification: typeof publicKey.userVerification === "string" ? publicKey.userVerification : "preferred" }));
-    });
-  } }.get;
-  Object.defineProperty(container, "get", { value: get, writable: true, configurable: true, enumerable: true });
-})();`;
-}
-function parsePasskeyRequest(payload) {
-  if (typeof payload !== "string" || payload.length > maxPayloadBytes)
-    return;
-  let value;
-  try {
-    value = JSON.parse(payload);
-  } catch {
-    return;
-  }
-  if (!value || typeof value !== "object")
-    return;
-  const { id, challenge, rpId, allowCredentials, userVerification } = value;
-  if (typeof id !== "number" || !Number.isSafeInteger(id) || id < 1)
-    return;
-  if (!isBase64Url(challenge, 1024) || challenge.length < 16)
-    return;
-  if (rpId !== undefined && (typeof rpId !== "string" || rpId.length > 253 || !/^[a-z0-9.-]+$/i.test(rpId)))
-    return;
-  if (!Array.isArray(allowCredentials) || allowCredentials.length > 64 || !allowCredentials.every((entry) => isBase64Url(entry, 1400)))
-    return;
-  const verification = typeof userVerification === "string" && ["required", "preferred", "discouraged"].includes(userVerification) ? userVerification : "preferred";
-  return { id, challenge, ...rpId ? { rpId: rpId.toLowerCase() } : {}, allowCredentials, userVerification: verification };
-}
-function rpIdAllowed(origin, rpId) {
-  let url;
-  try {
-    url = new URL(origin);
-  } catch {
-    return false;
-  }
-  const host = url.hostname.toLowerCase();
-  const secure = url.protocol === "https:" || url.protocol === "http:" && (host === "localhost" || host.endsWith(".localhost") || /^127\.\d+\.\d+\.\d+$/.test(host) || host === "[::1]");
-  if (!secure)
-    return false;
-  if (rpId === undefined)
-    return true;
-  return host === rpId || rpId.includes(".") && host.endsWith(`.${rpId}`);
-}
-
-class PasskeyBridge {
-  installs = new Map;
-  selections = new Map;
-  choices = new Map;
-  options;
-  constructor(options) {
-    this.options = options;
-  }
-  async install(tabId) {
-    const connected = this.options.connected ?? (() => readClient() !== undefined);
-    if (!connected())
-      return false;
-    const install = { binding: randomName("__b"), reply: randomName("__r") };
-    this.installs.set(tabId, install);
-    try {
-      await this.options.send(tabId, "Runtime.addBinding", { name: install.binding });
-      await this.options.send(tabId, "Page.addScriptToEvaluateOnNewDocument", { source: hookSource(install.binding, install.reply), runImmediately: true });
-      this.options.log?.("passkey.install", { tabId });
-      return true;
-    } catch (error) {
-      this.installs.delete(tabId);
-      this.options.log?.("passkey.install.failed", { tabId, error: error instanceof Error ? error.message : String(error) });
-      return false;
-    }
-  }
-  navigated(tabId) {
-    const install = this.installs.get(tabId);
-    if (!install)
-      return;
-    this.options.send(tabId, "Runtime.addBinding", { name: install.binding }).catch(() => {});
-  }
-  select(tabId, site, username, now = Date.now()) {
-    this.selections.set(tabId, { site, username, expiresAt: now + selectionTtlMs });
-  }
-  clearSelection(tabId) {
-    this.selections.delete(tabId);
-  }
-  choiceSince(tabId, since) {
-    const event = this.choices.get(tabId);
-    return event && event.at >= since ? event.choices : undefined;
-  }
-  forget(tabId) {
-    this.installs.delete(tabId);
-    this.selections.delete(tabId);
-    this.choices.delete(tabId);
-  }
-  handleEvent(tabId, method, params, fromRoot) {
-    if (method !== "Runtime.bindingCalled")
-      return false;
-    const install = this.installs.get(tabId);
-    if (!install || params?.name !== install.binding)
-      return false;
-    this.options.log?.("passkey.request", { tabId, fromRoot });
-    if (!fromRoot)
-      return true;
-    const contextId = params.executionContextId;
-    if (typeof contextId !== "number")
-      return true;
-    this.answer(tabId, install, contextId, params.payload);
-    return true;
-  }
-  async answer(tabId, install, contextId, payload) {
-    const request = parsePasskeyRequest(payload);
-    if (!request) {
-      this.options.log?.("passkey.refused", { tabId, reason: "malformed request" });
-      return;
-    }
-    let result;
-    try {
-      result = { ok: true, assertion: await this.assert(tabId, contextId, request) };
-      this.options.log?.("passkey.signed", { tabId });
-    } catch (error) {
-      result = { ok: false };
-      this.options.log?.("passkey.refused", { tabId, reason: error instanceof DeadboltError ? error.code : error instanceof Error ? error.message : "failed" });
-    }
-    await this.options.send(tabId, "Runtime.evaluate", {
-      expression: `globalThis[${JSON.stringify(install.reply)}]?.(${request.id}, ${JSON.stringify(result)})`,
-      contextId,
-      returnByValue: true
-    }).catch(() => {});
-  }
-  async assert(tabId, contextId, request) {
-    const top = await this.options.send(tabId, "Runtime.evaluate", { expression: "window === top", contextId, returnByValue: true });
-    if (top.result?.value !== true)
-      throw new Error("not the top frame");
-    const tree = await this.options.send(tabId, "Page.getFrameTree", {});
-    const frame = tree.frameTree?.frame;
-    const url = typeof frame?.url === "string" ? frame.url : "";
-    let origin = typeof frame?.securityOrigin === "string" ? frame.securityOrigin : "";
-    try {
-      if (!origin || origin === "null")
-        origin = new URL(url).origin;
-    } catch {
-      throw new Error("no origin");
-    }
-    if (!rpIdAllowed(origin, request.rpId))
-      throw new Error("rpId not allowed for the origin");
-    const patterns = this.options.allowedOrigins(tabId);
-    if (patterns && patterns.length > 0 && !checkUrl(url, parseOriginPatterns(patterns)).allowed)
-      throw new Error("outside the session allowlist");
-    const deadbolt = (this.options.deadbolt ?? (() => connect()))();
-    const selection = this.selections.get(tabId);
-    this.selections.delete(tabId);
-    let login;
-    if (selection && selection.expiresAt >= Date.now() && originOnSite(origin, selection.site)) {
-      const passkey = pickPasskey((await deadbolt.site(origin)).passkeys, selection.username);
-      if (!passkey)
-        throw new DeadboltError("not_granted", `No granted passkey for ${selection.username} on ${selection.site}`);
-      login = passkey.ref;
-    }
-    const assertion = await deadbolt.passkeyGet({
-      origin,
-      ...request.rpId ? { rpId: request.rpId } : {},
-      challenge: request.challenge,
-      allowCredentials: request.allowCredentials,
-      userVerification: request.userVerification,
-      ...login !== undefined ? { login } : {}
-    }).catch((error) => {
-      if (error instanceof DeadboltError && error.code === "choose_passkey") {
-        const offered = (error.detail.choices ?? []).map((choice) => ({
-          ...choice.username ? { username: choice.username } : {},
-          ...choice.displayName ? { displayName: choice.displayName } : {}
-        }));
-        this.choices.set(tabId, { at: Date.now(), choices: offered });
-      }
-      throw error;
-    });
-    for (const value of [assertion.credentialId, assertion.clientDataJson, assertion.authenticatorData, assertion.signature, assertion.userHandle ?? ""]) {
-      if (!isBase64Url(value, 16384))
-        throw new Error("Deadbolt's assertion isn't base64url");
-    }
-    return {
-      credential_id: assertion.credentialId,
-      client_data_json: assertion.clientDataJson,
-      authenticator_data: assertion.authenticatorData,
-      signature: assertion.signature,
-      ...assertion.userHandle ? { user_handle: assertion.userHandle } : {}
-    };
-  }
-}
-
 // src/cdp/protected-frames.ts
 import { Predicate as Predicate18 } from "effect";
 var navigationIntentMethods = new Set(["Page.frameRequestedNavigation", "Page.frameScheduledNavigation", "Page.frameStartedNavigating"]);
@@ -15353,7 +14320,7 @@ function guardCdpMethod(context) {
     return `browse blocked ${context.method}: ${reason}. This command is always blocked by the relay.`;
   }
   if (context.method.startsWith("WebAuthn.")) {
-    return `browse blocked ${context.method}: agents can't drive WebAuthn or add virtual authenticators. Passkey sign-ins in agent tabs use the logins the user granted in Deadbolt. This command is always blocked by the relay.`;
+    return `browse blocked ${context.method}: agents can't drive WebAuthn or add virtual authenticators. This command is always blocked by the relay.`;
   }
   if (context.method === "Page.bringToFront" && !allowsForeground()) {
     return "browse blocked Page.bringToFront: it raises the user's browser window over their work. Use handoff() when the user needs to act in the tab, or set OPENCODE_BROWSER_ALLOW_FOREGROUND=1 on the relay to allow it.";
@@ -16006,7 +14973,6 @@ function createExtensionEventHandler(options) {
     handoffs,
     recordingRelay,
     flightRecorder,
-    passkeys,
     navigationGuard,
     ghostCursor,
     tabActivity,
@@ -16315,8 +15281,6 @@ function createExtensionEventHandler(options) {
     if (sourceSessionId && method !== "Target.attachedToTarget" && method !== "Target.detachedFromTarget" && method !== "Target.targetInfoChanged" && (suppressedChildSessions.has(sourceSessionId) || sourceChild && !shouldExposeChildTarget(sourceChild))) {
       return;
     }
-    if (passkeys.handleEvent(tabId, method, params, sourceSessionId === undefined || sourceSessionId === target.sessionId))
-      return;
     if (flightRecorder.handleDebuggerEvent({ tabId, method, params }) || recordingRelay.handleDebuggerEvent({ tabId, method, params }))
       return;
     if (sourceSessionId === undefined || sourceSessionId === target.sessionId)
@@ -16449,7 +15413,6 @@ function createExtensionEventHandler(options) {
         Effect27.runPromise(Effect27.ignore(ghostCursor.documentCreated(tabId))).catch(() => {});
         contextDebugLog?.(`main-frame-navigated frame=${boundedToken(frameId)} loader=${boundedToken(getString2(frame, "loaderId"))} ${targetDiagnosticIdentity(registry, target)} ${summarizeDiagnosticUrl(frameUrl)}`);
         registry.updateTargetUrl(tabId, frameUrl);
-        passkeys.navigated(tabId);
         blankNavigationWaiters.get(tabId)?.(frameUrl, getString2(frame, "loaderId"));
         Effect27.runPromise(Effect27.ignore(sendDebuggerCommand({ tabId, method: "Emulation.setFocusEmulationEnabled", params: { enabled: tabActivity.isFocused(tabId) } }))).catch(() => {});
       }
@@ -17156,7 +16119,6 @@ function createTabPresentation(options) {
     registry,
     browsers,
     handoffs,
-    passkeys,
     tabActivity,
     mainFrameIdsByTab,
     sendToExtension,
@@ -17379,9 +16341,6 @@ function createTabPresentation(options) {
     if (committedTarget.opencodeBrowserSessionId) {
       pruneInvisibleAnnouncementsForSession(committedTarget.opencodeBrowserSessionId);
     }
-    if (committedTarget.owner === "relay" && committedTarget.opencodeBrowserSessionId) {
-      passkeys.install(tabId);
-    }
     if (browsers.browserTab(tabId)?.link.rpc.connected) {
       refreshTabGrouping(tabId);
     }
@@ -18148,9 +17107,8 @@ var makeRelay = Effect34.fnUntraced(function* (options = {}) {
   const browserId = crypto10.randomUUID();
   const endpointUrl = `http://${formatHostForUrl2(host)}:${port}`;
   const additionalChromeExtensionOrigins = new Set(options.additionalExtensionOrigins ?? []);
-  const storeId = storeConfig().id;
-  if (storeId)
-    additionalChromeExtensionOrigins.add(`chrome-extension://${storeId}`);
+  const storeId = storeConfig().id ?? PUBLIC_STORE_ID;
+  additionalChromeExtensionOrigins.add(`chrome-extension://${storeId}`);
   const sessionCatalog = options.sessionCatalogPath === null ? undefined : new SessionCatalog(options.sessionCatalogPath ?? defaultSessionCatalogPath(port));
   let catalogWritesEnabled = false;
   const registry = new TargetRegistry;
@@ -18195,14 +17153,6 @@ var makeRelay = Effect34.fnUntraced(function* (options = {}) {
   const handoffs = new HandoffRegistry;
   const ownersAcrossReconnect = new Map;
   const sweptBrowsers = new Set;
-  const passkeys = new PasskeyBridge({
-    send: (tabId, method, params) => Effect34.runPromise(sendDebuggerCommand({ tabId, method, params })),
-    allowedOrigins: (tabId) => {
-      const sessionId = registry.tabTargets.get(tabId)?.opencodeBrowserSessionId;
-      return sessionId ? sessions.allowedOrigins(sessionId) : undefined;
-    },
-    log: (event, fields) => relayLog(event, fields)
-  });
   const recordingRelay = new RecordingRelay({
     sendToExtension: (command) => Effect34.runPromise(sendToExtension(command)),
     sendDebuggerCommand: (command) => Effect34.runPromise(sendDebuggerCommand(command)),
@@ -18237,7 +17187,6 @@ var makeRelay = Effect34.fnUntraced(function* (options = {}) {
     registry,
     browsers,
     handoffs,
-    passkeys,
     tabActivity,
     mainFrameIdsByTab,
     sendToExtension,
@@ -18304,22 +17253,6 @@ var makeRelay = Effect34.fnUntraced(function* (options = {}) {
     onDefaultTargetChange,
     allowedOrigins: () => sessions.allowedOrigins(id),
     drainGuardWarnings: () => navigationGuard.drainWarnings(id),
-    passkeys: {
-      select: (targetId, site, username) => {
-        const target = registry.targetsByTargetId.get(targetId);
-        if (!target || !("owner" in target) || target.owner !== "relay" || target.opencodeBrowserSessionId !== id) {
-          throw new Error("secrets.usePasskey: passkeys are answered only in tabs this session opened");
-        }
-        if (username)
-          passkeys.select(target.tabId, site, username);
-        else
-          passkeys.clearSelection(target.tabId);
-      },
-      choiceSince: (targetId, since) => {
-        const target = registry.targetsByTargetId.get(targetId);
-        return target && target.opencodeBrowserSessionId === id ? passkeys.choiceSince(target.tabId, since) : undefined;
-      }
-    },
     isRecordingTarget: (targetId) => {
       const target = registry.targetsByTargetId.get(targetId);
       return target !== undefined && isTabRecorded(target.tabId);
@@ -18515,7 +17448,6 @@ var makeRelay = Effect34.fnUntraced(function* (options = {}) {
     navigationGuard.forgetTab(tabId);
     ghostCursor.forget(tabId);
     forgetTab(tabId);
-    passkeys.forget(tabId);
     for (const [sessionId, childTabId] of suppressedChildSessions) {
       if (childTabId === tabId)
         suppressedChildSessions.delete(sessionId);
@@ -18596,7 +17528,6 @@ var makeRelay = Effect34.fnUntraced(function* (options = {}) {
     handoffs,
     recordingRelay,
     flightRecorder,
-    passkeys,
     navigationGuard,
     ghostCursor,
     tabActivity,