@proagentstore/cli 0.4.136 → 0.4.138

package/dist/browser-runner/local-apply/bridge.js

@@ -61,7 +61,8 @@ const CONSENT_NAME = /\b(agree|consent|terms|privacy|acknowledge|certify|accept|
  * A field that is a credential: a sign-in, never an application answer. It includes the box an emailed or texted
  * one-time code goes into (#1014) — "Enter the 6-digit code we emailed you", "Sign-in code" — which has no password
  * field beside it, so the page check never sees a sign-in: the CLI is stopped at the field and the owner takes the
- * exact session over (#1013). The Runner holds no mailbox access and never reads, asks for or types a code itself.
+ * exact session over (#1013). The CLI never reads, asks for or types a code; on SEEK, PAGS may enter one into the
+ * paused browser itself (`email-code.ts`, #1106).
  * Ordinary "code" answers (a postcode, a promo or referral code) are not credentials.
  */
 export const CREDENTIAL_NAME = /password|passcode|one[- ]?time|\botp\b|2fa|two[- ]factor|\b(?:verification|security|sign[- ]?in|log[- ]?in|login|access|authentication|confirmation) code\b|\b\d[- ]?digit code\b|\bcode (?:that )?we (?:sent|emailed|texted)\b|\bcode (?:sent|emailed|texted) to\b/i;

package/dist/browser-runner/local-apply/contract.js

@@ -37,6 +37,14 @@ export const LOCAL_APPLY_CANCEL_PATH = "/local-apply/cancel";
 export const LOCAL_APPLY_PREFLIGHT_PATH = "/local-apply/preflight";
 /** Delivers a cloud-persisted supervisory decision to one paused checkpoint. */
 export const LOCAL_APPLY_DIRECTIVE_PATH = "/local-apply/directive";
+/**
+ * The email-code sign-in (#1106), on a run paused `login_required`: `{runId, step: "request", email}` has the runner
+ * enter the sign-in email and ask the site for a code; `{runId, step: "enter", code}` types the code PAGS read from
+ * the owner's Gmail and, once the site lets the browser in, releases the pause. The code is never stored or traced.
+ */
+export const LOCAL_APPLY_EMAIL_CODE_PATH = "/local-apply/email-code";
+/** Sites whose sign-in is a code emailed to the account address. SEEK's page was read live for #1106. */
+export const EMAIL_CODE_SIGN_IN_SITES = ["seek.com", "seek.com.au", "seek.co.nz"];
 export const LOCAL_APPLY_ENGINES = ["claude", "codex"];
 export const LOCAL_APPLY_AUTH_MODES = ["machine", "subscription"];
 export const LOCAL_APPLY_MODES = ["fill_and_review", "auto_submit"];

package/dist/browser-runner/local-apply/email-code.js

@@ -0,0 +1,129 @@
+/**
+ * The email-code sign-in (#1106): a fill run paused `login_required` on SEEK signs itself in.
+ *
+ * SEEK signs a jobseeker in with a code emailed to the account address. The page was read live
+ * (2026-10-16): `au.seek.com/oauth/login?returnUrl=…` lands on `login.seek.com`, which offers
+ * `textbox "Email address"` and `button "Email me a sign in code"`. The runner does the page half:
+ * `request` enters the address the cloud names and asks for the code; `enter` types the code the
+ * cloud read from the owner's connected Gmail and waits for the site to let the browser in. The cloud
+ * does the mailbox half (`workers/api/src/lib/local-apply/email-code-sign-in.ts`); this machine never
+ * touches a mailbox.
+ *
+ * It drives the run's own browser while the run is paused, so the CLI — blocked in its pause — never
+ * sees the address or the code, and neither enters the trace: events carry the site and a reason.
+ * Anything the page does not offer (no email box, no code box, still on the sign-in page after the
+ * code) ends `failed`, and the pause stays for the owner: this is the default path, never the only one.
+ *
+ * Not verified live: the code-entry page (reaching it sends a real code to a real inbox). It is read
+ * by role and name — one code box, or one box per digit — the same way as the first page.
+ */
+import { RunnerInputError } from "../errors.js";
+import { evaluateResult } from "../local-browser/bridge.js";
+import { EMAIL_CODE_SIGN_IN_SITES } from "./contract.js";
+import { looksLikeSignIn, siteKeyOf } from "./site-session.js";
+const EMAIL_FIELD = /e-?mail/i;
+const SEND_BUTTON = /^(email|send) me an? (sign[- ]?in |log[- ]?in |verification )?code$|^send (an? )?(sign[- ]?in |verification )?code$/i;
+const CODE_FIELD = /code|one[- ]?time|verification|otp|passcode|digit/i;
+const CONFIRM_BUTTON = /^(verify|continue|sign in|log in|submit|confirm|next)\b/i;
+const LOOKS = 6;
+const LOOK_MS = 2000;
+/** Every `- role "name" [ref=…]` line of a snapshot. */
+export function controlsOf(snapshot) {
+    const out = [];
+    for (const line of snapshot.split("\n")) {
+        const m = line.match(/^\s*-\s*([a-z]+)(?:\s+"([^"]*)")?[^\n]*\[ref=([^\]\s]+)\]/i);
+        if (m)
+            out.push({ role: m[1].toLowerCase(), name: m[2] ?? "", ref: m[3] });
+    }
+    return out;
+}
+/** The box(es) a code goes in: one named for a code, or one box per digit (4–8 unnamed or "digit" boxes). */
+export function codeBoxes(controls) {
+    const boxes = controls.filter((c) => (c.role === "textbox" || c.role === "spinbutton") && !EMAIL_FIELD.test(c.name));
+    const named = boxes.find((c) => CODE_FIELD.test(c.name) && !/digit\s*\d/i.test(c.name));
+    if (named)
+        return [named];
+    const perDigit = boxes.filter((c) => !c.name || /digit/i.test(c.name));
+    return perDigit.length >= 4 && perDigit.length <= 8 ? perDigit : [];
+}
+const textOf = (r) => (r.content ?? []).map((c) => c.text ?? "").join("\n");
+async function snapshot(tools) {
+    return controlsOf(textOf(await tools.callTool("browser_snapshot", {}).catch(() => ({ content: [] }))));
+}
+async function pageUrl(tools) {
+    const res = await tools.callTool("browser_evaluate", { function: "() => location.href" }).catch(() => null);
+    const v = res && !res.isError ? evaluateResult(textOf(res)) : null;
+    return typeof v === "string" ? v : null;
+}
+/** Run one step on a run paused for a sign-in. Never throws for a page that is not as expected. */
+export async function runEmailCodeStep(target, raw) {
+    const o = raw && typeof raw === "object" ? raw : {};
+    const wait = target.wait ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const { tools } = target;
+    const url = await pageUrl(tools);
+    const host = url ? new URL(url).hostname : "";
+    const site = host ? siteKeyOf(host) : "";
+    const fail = (reason) => {
+        target.emit({ type: "policy.decision", ...(host ? { domain: host } : {}), detail: { tool: "email_code_sign_in", class: "session", decision: "failed", reason, ...(site ? { site } : {}) } });
+        return { state: "failed", reason };
+    };
+    if (!url || !EMAIL_CODE_SIGN_IN_SITES.includes(site))
+        return fail("unsupported_site");
+    if (o.step === "request") {
+        const email = typeof o.email === "string" ? o.email.trim() : "";
+        if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email) || email.length > 254)
+            throw new RunnerInputError("request needs the sign-in email");
+        // A pause before the press (#1094) is on the job page: open SEEK's sign-in, returning to that page.
+        if (!looksLikeSignIn(url, false)) {
+            const u = new URL(url);
+            await tools.callTool("browser_navigate", { url: `https://${u.host}/oauth/login?returnUrl=${encodeURIComponent(u.pathname + u.search)}` });
+            await wait(LOOK_MS);
+        }
+        const first = await snapshot(tools);
+        const box = first.find((c) => c.role === "textbox" && EMAIL_FIELD.test(c.name));
+        if (!box)
+            return fail("no_email_field");
+        const send = first.find((c) => c.role === "button" && SEND_BUTTON.test(c.name.trim()));
+        if (!send)
+            return fail("no_send_button");
+        await tools.callTool("browser_type", { element: box.name, target: box.ref, text: email });
+        await tools.callTool("browser_click", { element: send.name, target: send.ref });
+        for (let i = 0; i < LOOKS; i++) {
+            await wait(LOOK_MS);
+            if (codeBoxes(await snapshot(tools)).length) {
+                target.emit({ type: "policy.decision", domain: host, detail: { tool: "email_code_sign_in", class: "session", decision: "code_requested", site } });
+                return { state: "code_requested" };
+            }
+        }
+        return fail("no_code_field");
+    }
+    if (o.step === "enter") {
+        const code = typeof o.code === "string" ? o.code.trim() : "";
+        if (!/^[A-Za-z0-9]{4,10}$/.test(code))
+            throw new RunnerInputError("enter needs the code");
+        const controls = await snapshot(tools);
+        const boxes = codeBoxes(controls);
+        if (!boxes.length || (boxes.length > 1 && boxes.length !== code.length))
+            return fail("no_code_field");
+        if (boxes.length === 1)
+            await tools.callTool("browser_type", { element: boxes[0].name || "code", target: boxes[0].ref, text: code });
+        else
+            for (const [i, b] of boxes.entries())
+                await tools.callTool("browser_type", { element: b.name || `digit ${i + 1}`, target: b.ref, text: code[i] });
+        // Some code pages sign in as the last digit lands; the rest have a button.
+        const confirm = controls.find((c) => c.role === "button" && CONFIRM_BUTTON.test(c.name.trim()) && !/resend|email me|send/i.test(c.name));
+        if (confirm)
+            await tools.callTool("browser_click", { element: confirm.name, target: confirm.ref }).catch(() => undefined);
+        for (let i = 0; i < LOOKS; i++) {
+            await wait(LOOK_MS);
+            const now = await pageUrl(tools);
+            if (now && !looksLikeSignIn(now, false) && !codeBoxes(await snapshot(tools)).length) {
+                target.emit({ type: "policy.decision", domain: new URL(now).hostname, detail: { tool: "email_code_sign_in", class: "session", decision: "signed_in", site } });
+                target.resume();
+                return { state: "signed_in" };
+            }
+        }
+        return fail("code_rejected");
+    }
+    throw new RunnerInputError("step must be request or enter");
+}

package/dist/browser-runner/local-apply/runtime.js

@@ -34,6 +34,7 @@ import { redactText, secretEnvValues } from "../local-browser/contract.js";
 import { finalText, missingLogin, signInHelp } from "../local-browser/engine.js";
 import { resolveWorkspacePath } from "../local-browser/runtime.js";
 import { ApplyBridge } from "./bridge.js";
+import { runEmailCodeStep } from "./email-code.js";
 import { APPLY_SHOT_CAP, ShotRecorder } from "../local-browser/replay.js";
 import { confirmationSignals } from "./confirmation.js";
 import { listingUnavailableReason } from "./unavailable.js";
@@ -225,7 +226,8 @@ export class LocalApplyRuntime {
                 return { state: "unavailable", jobUrl: parsed.toString(), reason: gone };
             // An accessible Apply control is an active path, unlike a generic careers/search URL.
             if (/(?:button|link)\s+"[^"]{0,80}\bapply(?: now| for| here)?\b|\bapply (?:now|for (?:this )?(?:job|role|position))\b|\bstart application\b/i.test(page)) {
-                return { state: "live", jobUrl: parsed.toString(), applyUrl: parsed.toString(), evidence: "apply_control_present" };
+                const title = page.match(/^\s*-?\s*Page Title:\s*(.+)$/m)?.[1]?.trim().slice(0, 300); // names a posting pasted with none (#1098)
+                return { state: "live", jobUrl: parsed.toString(), applyUrl: parsed.toString(), evidence: "apply_control_present", ...(title ? { title } : {}) };
             }
             return { state: "unverifiable", jobUrl: parsed.toString(), reason: "no_active_apply_path" };
         }
@@ -582,6 +584,13 @@ export class LocalApplyRuntime {
         for (const w of run.waiters.splice(0))
             w(outcome);
     }
+    /** The email-code sign-in (#1106) on a run paused for one: its own browser, its trace, and its release. */
+    emailCode(raw) {
+        const run = this.get(String(raw?.runId ?? ""));
+        if (run.state !== "paused" || run.pause?.reason !== "login_required" || !run.browser)
+            throw new RunnerInputError("The run is not paused for a sign-in", 409);
+        return runEmailCodeStep({ tools: run.browser.tools, emit: (ev) => this.emit(run, ev), resume: () => this.release(run, "resumed") }, raw);
+    }
     /** The owner acted: add their answers to what values may be grounded in, admit any site they allowed, release. */
     resume(raw) {
         const o = (raw && typeof raw === "object" ? raw : {});

package/dist/browser-runner/server.js

@@ -280,6 +280,8 @@ async function route(runner, req, res) {
     if (req.method === "POST" && path === "/local-apply/resume") {
         return json(res, 200, runner.localApply.resume(await readJson(req)));
     }
+    if (req.method === "POST" && path === "/local-apply/email-code")
+        return json(res, 200, await runner.localApply.emailCode(await readJson(req)));
     if (req.method === "POST" && path === "/local-apply/directive") {
         return json(res, 200, runner.localApply.directive(await readJson(req)));
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.136",
+  "version": "0.4.138",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",