@trusty-squire/mcp 0.9.16 → 0.9.17-rc.2

package/dist/bot/browser.d.ts

@@ -56,6 +56,8 @@ export declare class BrowserController {
     private proxyServer;
     private readonly profileDir;
     private oauthProductPage;
+    private oauthNetLog;
+    private oauthNetListenerAttached;
     private xvfb;
     private launchedMode;
     get launchMode(): "display" | "xvfb" | "headless" | "unknown";
@@ -65,6 +67,7 @@ export declare class BrowserController {
     get proxied(): string | null;
     get stealthProfile(): StealthProfile;
     private launchSelfManagedContext;
+    private installResourceBlocking;
     start(): Promise<void>;
     private probeEgressGeo;
     private resolveProxy;
@@ -114,6 +117,7 @@ export declare class BrowserController {
     getState(): Promise<BrowserState>;
     private snapshotState;
     extractText(): Promise<string>;
+    extractVisibleText(): Promise<string>;
     readClipboard(): Promise<string>;
     extractAllInputValues(): Promise<string[]>;
     extractCredentialsNearCopyButtons(): Promise<string[]>;
@@ -144,6 +148,8 @@ export declare class BrowserController {
         name: string | null;
     }>;
     startOAuth(selector: string): Promise<void>;
+    private maybeAttachOAuthNetListener;
+    dumpOAuthDebug(service: string, label: string): Promise<void>;
     getMetaCsrfToken(): Promise<string | null>;
     getElementAttribute(selector: string, attr: string): Promise<string | null>;
     submitPostForm(action: string, fields: Record<string, string>): Promise<void>;
@@ -153,6 +159,8 @@ export declare class BrowserController {
         via: "fedcm" | "popup" | "none";
     }>;
     currentUrl(): string;
+    pressKey(key: string): Promise<void>;
+    expandLatentNav(): Promise<void>;
     fetchText(url: string): Promise<{
         finalUrl: string;
         status: number;
@@ -161,6 +169,7 @@ export declare class BrowserController {
     oauthPageClosed(): boolean;
     detectSessionProviders(): Promise<OAuthProviderId[]>;
     advanceOAuthConsent(provider: OAuthProviderId): Promise<boolean>;
+    waitForClerkSession(timeoutMs?: number): Promise<boolean>;
     settleAfterOAuth(): Promise<void>;
     close(): Promise<void>;
 }

package/dist/bot/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/bot/browser.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAS5D,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,cAAc,CAAC;AAoFzD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IAKvC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAInB,UAAU,CAAC,EAAE,MAAM,CAAC;IAMpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,CAAC;AAQjE,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GACtE,eAAe,EAAE,CAwBnB;AASD,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,cAAc,GACd,cAAc,GACd,UAAU,GACV,SAAS,CAAC;AAed,MAAM,MAAM,kBAAkB,GAC1B;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAChB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAChD;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AA+FtD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAe1E;AAsBD,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AA8CD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG;IACtD,cAAc,EAAE,OAAO,CAAC;IACxB,kBAAkB,EAAE,OAAO,CAAC;CAC7B,CAUA;AAYD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5E;AAED,qBAAa,iBAAiB;IAI5B,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,IAAI,CAAqB;IAIjC,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,UAAU,CAAwB;IAK1C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IAGnC,OAAO,CAAC,MAAM,CAAO;IACrB,OAAO,CAAC,MAAM,CAAO;IAMrB,OAAO,CAAC,eAAe,CAAuB;IAK9C,OAAO,CAAC,WAAW,CAAuB;IAE1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAMpC,OAAO,CAAC,gBAAgB,CAAqB;IAO7C,OAAO,CAAC,IAAI,CAAwB;IAKpC,OAAO,CAAC,YAAY,CACR;IAEZ,IAAI,UAAU,IAAI,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAE5D;gBAEW,IAAI,GAAE,wBAA6B;IAW/C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAM9C,IAAI,OAAO,IAAI,MAAM,GAAG,IAAI,CAK3B;IAKD,IAAI,OAAO,IAAI,MAAM,GAAG,IAAI,CAK3B;IAOD,IAAI,cAAc,IAAI,cAAc,CAKnC;YAaa,wBAAwB;IAoDhC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAsZd,cAAc;YA4Cd,YAAY;IAsDpB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IASvB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0EhC,OAAO,CACX,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,MAAM,GAAG,gBAAyB,GACvC,OAAO,CAAC,IAAI,CAAC;YA6BF,uBAAuB;IAgE/B,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YA+C3C,oBAAoB;IAmE5B,qBAAqB,CAAC,QAAQ,SAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA0DtD,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoFtC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA6BjE,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwE5C,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAmD9B,oBAAoB;IAyC5B,2BAA2B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAiGhD,gBAAgB,CACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACT,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,MAAM,EAAE,IAAI,GAAG,cAAc,GAAG,mBAAmB,CAAC;KACrD,CAAC;IA2KI,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAuI7D,kBAAkB;YA2FlB,mBAAmB;YAuDnB,0BAA0B;YA0F1B,kBAAkB;YAkDlB,UAAU;YAoBV,iBAAiB;YA0GjB,aAAa;IA6DrB,mBAAmB,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAsL3D,iBAAiB;IAsJzB,oBAAoB,IAAI,OAAO,CAAC;QACpC,OAAO,EAAE,cAAc,CAAC;QACxB,iBAAiB,EAAE,OAAO,CAAC;KAC5B,CAAC;IA6EI,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA2CjD,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2DrD,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkDjD,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCrD,yBAAyB,CAAC,SAAS,SAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAsF7D,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA8BhD,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAqC5C,WAAW;IAazB,OAAO,CAAC,KAAK;IAIP,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAe7B,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC;YAgBzB,aAAa;IAUrB,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAyB9B,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAkBhC,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAqB1C,iCAAiC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA8DtD,kCAAkC,IAAI,OAAO,CACjD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,QAAQ,EAAE,OAAO,CAAC;QAClB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,CACH;IA6QK,uBAAuB,IAAI,OAAO,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IA2HI,2BAA2B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA4DhD,gBAAgB,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0DlD,0BAA0B,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD5D,qBAAqB,CACzB,WAAW,SAAI,EACf,SAAS,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC;IAyCV,oBAAoB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YA0EtC,iCAAiC;YA6CjC,8BAA8B;YAwB9B,iCAAiC;YAuBjC,2BAA2B;IAyCnC,0BAA0B,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA8b3D,eAAe,CACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAyBnF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3C,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgB1C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAa3E,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC;IAkCV,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC;IA4C1C,iBAAiB,CACrB,eAAe,EAAE,MAAM,EACvB,SAAS,SAAS,GACjB,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;IA0J5D,UAAU,IAAI,MAAM;IAmBd,SAAS,CACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAsBzE,eAAe,IAAI,OAAO;IAYpB,sBAAsB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAapD,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAsLhE,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAgE7B;AA0BD,wBAAgB,gBAAgB,CAAC,CAAC,SAAS;IAAE,KAAK,IAAI,CAAC,CAAA;CAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,CAEvF;AAWD,UAAU,cAAc;IACtB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;CAC9D;AACD,UAAU,YAAY;IAIpB,QAAQ,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,CAAC;CACxD;AACD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACvC,QAAQ,EAAE,MAAM,GACf,YAAY,EAAE,CAehB;AAID,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAa7E;AAuBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAOD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAiBD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,SAAO,GACf,OAAO,CAAC,OAAO,CAAC,CA8BlB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAYxD;AAQD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,OAAO,GACnB,OAAO,CAET;AAQD,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAgC7D;AASD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IAOzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAO1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAKtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAQvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAWzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAItB,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAMzB,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC9D,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAQnC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAU5B,cAAc,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzE;AAoBD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,GACD,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAkC/D;AAeD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,cAAc,CAAC,EAAE,SAAS,eAAe,EAAE,GAC1C,MAAM,CAyDR;AASD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,EACvC,SAAS,SAAK,EACd,cAAc,CAAC,EAAE,SAAS,eAAe,EAAE,GAC1C;IAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CA2B7D"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/bot/browser.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAa,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAS5D,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,cAAc,CAAC;AAoFzD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IAKvC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAInB,UAAU,CAAC,EAAE,MAAM,CAAC;IAMpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,CAAC;AAQjE,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GACtE,eAAe,EAAE,CAwBnB;AASD,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,cAAc,GACd,cAAc,GACd,UAAU,GACV,SAAS,CAAC;AAed,MAAM,MAAM,kBAAkB,GAC1B;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAChB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAChD;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AA+FtD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAe1E;AAsBD,wBAAgB,iBAAiB,IAAI,OAAO,CAG3C;AA8CD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG;IACtD,cAAc,EAAE,OAAO,CAAC;IACxB,kBAAkB,EAAE,OAAO,CAAC;CAC7B,CAUA;AAYD,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5E;AAED,qBAAa,iBAAiB;IAI5B,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,IAAI,CAAqB;IAIjC,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,UAAU,CAAwB;IAK1C,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IAGnC,OAAO,CAAC,MAAM,CAAO;IACrB,OAAO,CAAC,MAAM,CAAO;IAMrB,OAAO,CAAC,eAAe,CAAuB;IAK9C,OAAO,CAAC,WAAW,CAAuB;IAE1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAMpC,OAAO,CAAC,gBAAgB,CAAqB;IAK7C,OAAO,CAAC,WAAW,CAA8E;IACjG,OAAO,CAAC,wBAAwB,CAAS;IAOzC,OAAO,CAAC,IAAI,CAAwB;IAKpC,OAAO,CAAC,YAAY,CACR;IAEZ,IAAI,UAAU,IAAI,SAAS,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAE5D;gBAEW,IAAI,GAAE,wBAA6B;IAW/C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAM9C,IAAI,OAAO,IAAI,MAAM,GAAG,IAAI,CAK3B;IAKD,IAAI,OAAO,IAAI,MAAM,GAAG,IAAI,CAK3B;IAOD,IAAI,cAAc,IAAI,cAAc,CAKnC;YAaa,wBAAwB;YAiExB,uBAAuB;IAyC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAwZd,cAAc;YA4Cd,YAAY;IAsDpB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IASvB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0EhC,OAAO,CACX,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,MAAM,GAAG,gBAAyB,GACvC,OAAO,CAAC,IAAI,CAAC;YA6BF,uBAAuB;IAgE/B,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YA+C3C,oBAAoB;IAmE5B,qBAAqB,CAAC,QAAQ,SAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA0DtD,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4GtC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA6BjE,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwE5C,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAmD9B,oBAAoB;IAyC5B,2BAA2B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAiGhD,gBAAgB,CACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACT,QAAQ,EAAE,OAAO,CAAC;QAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,MAAM,EAAE,IAAI,GAAG,cAAc,GAAG,mBAAmB,CAAC;KACrD,CAAC;IA2KI,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAuI7D,kBAAkB;YA2FlB,mBAAmB;YAuDnB,0BAA0B;YA0F1B,kBAAkB;YAkDlB,UAAU;YAoBV,iBAAiB;YA0GjB,aAAa;IA6DrB,mBAAmB,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAsL3D,iBAAiB;IAsJzB,oBAAoB,IAAI,OAAO,CAAC;QACpC,OAAO,EAAE,cAAc,CAAC;QACxB,iBAAiB,EAAE,OAAO,CAAC;KAC5B,CAAC;IA6EI,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA2CjD,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2DrD,uBAAuB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAkDjD,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiCrD,yBAAyB,CAAC,SAAS,SAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAsF7D,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA2ChD,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAqC5C,WAAW;IAazB,OAAO,CAAC,KAAK;IAIP,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAe7B,QAAQ,IAAI,OAAO,CAAC,YAAY,CAAC;YAgBzB,aAAa;IAUrB,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;IAe9B,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;IAyBrC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IAkBhC,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAqB1C,iCAAiC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA8DtD,kCAAkC,IAAI,OAAO,CACjD,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,QAAQ,EAAE,OAAO,CAAC;QAClB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,CACH;IA6QK,uBAAuB,IAAI,OAAO,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,EAAE,CAAC;KACtB,CAAC;IA2HI,2BAA2B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IA4DhD,gBAAgB,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0DlD,0BAA0B,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkD5D,qBAAqB,CACzB,WAAW,SAAI,EACf,SAAS,SAAS,GACjB,OAAO,CAAC,IAAI,CAAC;IAyCV,oBAAoB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YA0EtC,iCAAiC;YA6CjC,8BAA8B;YAwB9B,iCAAiC;YAuBjC,2BAA2B;IAyCnC,0BAA0B,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA8b3D,eAAe,CACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAyBnF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BjD,OAAO,CAAC,2BAA2B;IAmC7B,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiE7D,gBAAgB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAgB1C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAa3E,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC;IAkCV,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC;IA4C1C,iBAAiB,CACrB,eAAe,EAAE,MAAM,EACvB,SAAS,SAAS,GACjB,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;IA0J5D,UAAU,IAAI,MAAM;IAOd,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpC,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAiChC,SAAS,CACb,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAsBzE,eAAe,IAAI,OAAO;IAYpB,sBAAsB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAapD,mBAAmB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IAyLhE,mBAAmB,CAAC,SAAS,SAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBxD,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAgE7B;AA0BD,wBAAgB,gBAAgB,CAAC,CAAC,SAAS;IAAE,KAAK,IAAI,CAAC,CAAA;CAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,CAAC,CAEvF;AAWD,UAAU,cAAc;IACtB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;CAC9D;AACD,UAAU,YAAY;IAIpB,QAAQ,CAAC,UAAU,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,CAAC;CACxD;AACD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EACvC,QAAQ,EAAE,MAAM,GACf,YAAY,EAAE,CAehB;AAID,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAa7E;AAuBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAOD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAiBD,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,SAAO,GACf,OAAO,CAAC,OAAO,CAAC,CA8BlB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAYxD;AAQD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,OAAO,GACnB,OAAO,CAET;AAQD,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAgC7D;AASD,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;IAOzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAO1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAKtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAQvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAWzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAItB,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAMzB,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC9D,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAQnC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAU5B,cAAc,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACzE;AAoBD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;CACpB,CAAC,GACD,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAkC/D;AAeD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,cAAc,CAAC,EAAE,SAAS,eAAe,EAAE,GAC1C,MAAM,CAyDR;AASD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,EACvC,SAAS,SAAK,EACd,cAAc,CAAC,EAAE,SAAS,eAAe,EAAE,GAC1C;IAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CA2B7D"}

package/dist/bot/browser.js

@@ -390,6 +390,12 @@ export class BrowserController {
     // parked here so settleAfterOAuth() can switch back to it once the
     // Google handshake completes.
     oauthProductPage = null;
+    // Deep-investigation instrumentation (UNIVERSAL_BOT_OAUTH_DEBUG): a ring
+    // buffer of OAuth/SSO-relevant network responses, so we can see WHY a Clerk/
+    // Stytch SSO callback fails to persist a session (cookie not set, FAPI
+    // rejection, etc.) without guessing. Off by default; zero cost when unset.
+    oauthNetLog = [];
+    oauthNetListenerAttached = false;
     // F13 — on-demand Xvfb. Set when start() determined the host has no
     // display surface but Xvfb is available, so Chrome can run with
     // `headless: false` against a virtual display (Cloudflare/Stytch et
@@ -501,6 +507,60 @@ export class BrowserController {
         }
         return ctx;
     }
+    // Resource blocking for speed (BOT_BLOCK_RESOURCES, default OFF). Aborts
+    // image/media/font requests + known analytics/tracker hosts to cut page-load
+    // wall-clock (3-5x on byte-heavy pages; also stops trackers from holding the
+    // network "busy"). HARD ALLOW-GUARD first for captcha/challenge + payment
+    // scripts (blocking those breaks the Turnstile/hCaptcha token poll and the
+    // signup form). CSS + first-party JS are never blocked (not in BLOCK_TYPES) —
+    // the SPA form renders from them and the vision planner reads the styled
+    // render. DUAL RISK, hence default-OFF + an OF#2 A/B before flipping on:
+    //   (1) a browser that loads ZERO images is itself an anti-bot fingerprint;
+    //   (2) the screenshot the vision planner reads loses detail — mitigated
+    //       because the DOM inventory is the authoritative action space, but
+    //       still a regression risk on image-only affordances.
+    // Registered on the CONTEXT so it covers OAuth popups + iframes.
+    async installResourceBlocking() {
+        const ctx = this.context;
+        if (ctx === null)
+            return;
+        if (!/^(1|true|on)$/i.test(process.env.BOT_BLOCK_RESOURCES ?? ""))
+            return;
+        const BLOCK_TYPES = new Set(["image", "media", "font"]);
+        const BLOCK_HOSTS = [
+            "google-analytics.com", "googletagmanager.com", "analytics.google.com",
+            "doubleclick.net", "static.hotjar.com", "script.hotjar.com",
+            "segment.com", "segment.io", "cdn.segment.com", "fullstory.com",
+            "mixpanel.com", "bugsnag.com", "intercom.io", "intercomcdn.com",
+            "widget.intercom.io", "connect.facebook.net", "analytics.tiktok.com",
+            "clarity.ms", "cdn.heapanalytics.com", "wistia.com",
+        ];
+        // NEVER block — these break signup (captcha/challenge widgets + payment SDK).
+        const ALWAYS_ALLOW = [
+            "challenges.cloudflare.com", "turnstile", "hcaptcha.com",
+            "newassets.hcaptcha.com", "recaptcha", "gstatic.com/recaptcha",
+            "js.stripe.com",
+        ];
+        await ctx.route("**/*", async (route) => {
+            try {
+                const url = route.request().url();
+                if (ALWAYS_ALLOW.some((h) => url.includes(h))) {
+                    await route.continue();
+                    return;
+                }
+                const type = route.request().resourceType();
+                if (BLOCK_TYPES.has(type) || BLOCK_HOSTS.some((h) => url.includes(h))) {
+                    await route.abort();
+                    return;
+                }
+                await route.continue();
+            }
+            catch {
+                // Routing race / already-handled — never let a decision crash nav.
+            }
+        });
+        console.error("[universal-bot] resource blocking ON (image/media/font + analytics aborted; captcha/CSS/JS allowed)");
+    }
     async start() {
         const channel = await detectChromiumChannel();
         this.launchedChannel = channel;
@@ -715,6 +775,8 @@ export class BrowserController {
         this.context = context;
         // We own the profile now — close() may reap a leaked Chrome.
         this.launchedContext = true;
+        // Speed: optionally abort heavy/irrelevant requests before any navigation.
+        await this.installResourceBlocking();
         // Patch navigator.webdriver — BASELINE ONLY. Measured against the
         // rebrowser bot-detector, this manual `defineProperty` is
         // COUNTERPRODUCTIVE under patchright: it re-adds `webdriver` as an own
@@ -1341,27 +1403,48 @@ export class BrowserController {
                 .$eval(selector, (el) => {
                 const t = el;
                 const inputKind = t.tagName === "INPUT" && (t.type === "radio" || t.type === "checkbox") ? t.type : "";
+                // The planner's selector often resolves to a CHILD of the real option
+                // (the inner <span> with the visible text, or a positional wrapper), not
+                // the role=option element itself. Walk up to the nearest combobox-option
+                // ancestor so the role-based re-resolution below fires. cmdk items carry
+                // role=option but the `[cmdk-item]` attribute is the most stable tell.
+                // MEASURED 2026-06-16 (meilisearch /welcome-informations cmdk multi-
+                // select): a plain getByRole("option",{name}).click() COMMITS the value
+                // — the trigger updates + Next un-gates — but only when we target the
+                // option element, not its child span (which a raw coordinate click drops).
+                const optEl = el.closest('[role="option"],[role="menuitem"],[role="menuitemradio"],[cmdk-item]');
+                const optRole = optEl !== null ? optEl.getAttribute("role") ?? "option" : "";
+                const optText = optEl !== null ? (optEl.textContent ?? "").trim().slice(0, 80) : "";
                 return {
                     inputKind,
                     role: el.getAttribute("role") ?? "",
                     text: (el.textContent ?? "").trim().slice(0, 80),
+                    optRole,
+                    optText,
                 };
             })
-                .catch(() => ({ inputKind: "", role: "", text: "" }));
+                .catch(() => ({ inputKind: "", role: "", text: "", optRole: "", optText: "" }));
             const inputKind = probe.inputKind;
             // Custom-combobox / listbox options (role=option|menuitem) — react-select,
-            // Radix, downshift, MUI. Two failure modes the humanized RAW-COORDINATE
+            // Radix, downshift, cmdk, MUI. Two failure modes the humanized RAW-COORDINATE
             // click hits: (1) the menu is a PORTAL that re-renders/repositions, so the
             // captured POSITIONAL selector (e.g. `div…>> nth=42`) resolves to the wrong
             // element at click time — nothing selects, planner loops (MEASURED
             // 2026-06-11, meilisearch Radix combobox); (2) options bind pointer/select
             // handlers a raw coordinate click misses. Fix: re-resolve by role+accessible
-            // name (robust to portal/positional drift), and use the actionability-checked
-            // locator click. Options are post-load, NOT the anti-bot-scored gate.
-            if (probe.role === "option" || probe.role === "menuitem" || probe.role === "menuitemradio") {
-                const role = probe.role;
-                if (probe.text.length > 0) {
-                    const byName = this.page.getByRole(role, { name: probe.text, exact: false }).first();
+            // name (robust to portal/positional drift + the planner targeting a child),
+            // and use the actionability-checked locator click. Options are post-load,
+            // NOT the anti-bot-scored gate.
+            const optRole = probe.role === "option" || probe.role === "menuitem" || probe.role === "menuitemradio"
+                ? probe.role
+                : probe.optRole === "option" || probe.optRole === "menuitem" || probe.optRole === "menuitemradio"
+                    ? probe.optRole
+                    : "";
+            const optName = probe.role !== "" ? probe.text : probe.optText;
+            if (optRole !== "") {
+                const role = optRole;
+                if (optName.length > 0) {
+                    const byName = this.page.getByRole(role, { name: optName, exact: false }).first();
                     if ((await byName.count().catch(() => 0)) > 0) {
                         await byName.click({ timeout: 8000 });
                         return;
@@ -3111,6 +3194,18 @@ export class BrowserController {
                     if (k !== null && k.length > 10)
                         return k;
                 }
+                // INVISIBLE hCaptcha (huggingface, 2026-06-17): no .h-captcha div, no
+                // rendered iframe — the sitekey lives in the page's JS config
+                // (`captchaApiKey:"<uuid>"`, `sitekey:"<uuid>"`). Scan the HTML for a
+                // UUID-shaped key next to a sitekey/captcha hint, but ONLY when an
+                // hCaptcha script is present (so an unrelated config UUID can't match).
+                // UUID shape excludes reCAPTCHA `6L…` and Turnstile `0x…` keys.
+                const html = document.documentElement.outerHTML;
+                if (/hcaptcha\.com|h-captcha|hcaptcha/i.test(html)) {
+                    const m = html.match(/(?:sitekey|captchaApiKey|data-(?:hcaptcha-)?sitekey)["'\s]*[:=]\s*["']([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})["']/i);
+                    if (m !== null && m[1] !== undefined)
+                        return m[1];
+                }
                 return null;
             });
         }
@@ -3226,6 +3321,21 @@ export class BrowserController {
             throw new Error("Browser not started");
         return await this.page.textContent("body") || "";
     }
+    // RENDERED, visibility-respecting body text. extractText() reads
+    // textContent("body"), which includes display:none / visibility:hidden /
+    // off-screen nodes — so a fully-rendered dashboard whose DOM merely
+    // CONTAINS a hidden skeleton / "Loading…" / "Please wait 30 seconds…"
+    // string (Next.js RSC inline payloads, lazy placeholders, aria-hidden
+    // spinners) reads as still-loading and false-trips the loading-shell gate.
+    // innerText is layout-aware: it omits hidden text and reflects what a user
+    // would actually see. Use this for the SHELL decision ONLY — credential/key
+    // extraction and wall-text checks deliberately read RAW text via
+    // extractText() and must stay byte-identical, so this is purely additive.
+    async extractVisibleText() {
+        if (!this.page)
+            throw new Error("Browser not started");
+        return await this.page.evaluate(() => document.body?.innerText ?? "");
+    }
     // Discrete strings an API key might occupy — for credential
     // extraction. Gathered so a key is read WHOLE and un-glued from its
     // neighbours: extractText() concatenates the whole <body>, which
@@ -4629,6 +4739,7 @@ export class BrowserController {
     async startOAuth(selector) {
         if (!this.page || !this.context)
             throw new Error("Browser not started");
+        this.maybeAttachOAuthNetListener();
         this.oauthProductPage = this.page;
         // Race a popup `page` event against the click. context-level
         // "page" fires for both window.open popups and target=_blank.
@@ -4647,6 +4758,109 @@ export class BrowserController {
             // best-effort — the agent's consent loop re-reads state regardless
         }
     }
+    // ── OAuth/SSO debug instrumentation (UNIVERSAL_BOT_OAUTH_DEBUG) ──
+    // Attach a context-level response recorder ONCE. Records SSO-relevant
+    // responses (the service host + Clerk/Stytch/WorkOS FAPI hosts) with their
+    // status + whether they set a cookie — the signal for "did the callback's
+    // session-establish request succeed and set the session cookie?"
+    maybeAttachOAuthNetListener() {
+        if (this.oauthNetListenerAttached)
+            return;
+        if (!/^(1|true|on)$/i.test(process.env.UNIVERSAL_BOT_OAUTH_DEBUG ?? ""))
+            return;
+        if (!this.context)
+            return;
+        this.oauthNetListenerAttached = true;
+        const RELEVANT = /clerk|stytch|workos|accounts\.|\/sso|\/oauth|\/session|\/sign|callback|\/v1\/client/i;
+        this.context.on("response", (res) => {
+            void (async () => {
+                try {
+                    const url = res.url();
+                    if (!RELEVANT.test(url))
+                        return;
+                    const headers = res.headers();
+                    if (this.oauthNetLog.length >= 200)
+                        return;
+                    const entry = {
+                        url: url.slice(0, 200),
+                        status: res.status(),
+                        setCookie: "set-cookie" in headers || "Set-Cookie" in headers,
+                        ct: (headers["content-type"] ?? "").slice(0, 40),
+                    };
+                    // Capture the body of a Clerk/Stytch/WorkOS sign-in/up/callback error
+                    // (>=400) — its error code is the definitive tell (captcha_invalid vs
+                    // transfer vs identifier_*). JSON only, bounded.
+                    if (res.status() >= 400 && /\/v1\/client\/(sign_ins|sign_ups)|oauth_callback|\/session/i.test(url)) {
+                        entry.body = (await res.text().catch(() => "")).slice(0, 800);
+                    }
+                    this.oauthNetLog.push(entry);
+                }
+                catch {
+                    // best-effort observability — never perturb the run
+                }
+            })();
+        });
+    }
+    // Dump cookies + the SSO network log to a file for post-mortem. Called at the
+    // oauth_session_not_persisted decision point when UNIVERSAL_BOT_OAUTH_DEBUG.
+    async dumpOAuthDebug(service, label) {
+        if (!/^(1|true|on)$/i.test(process.env.UNIVERSAL_BOT_OAUTH_DEBUG ?? ""))
+            return;
+        if (!this.context)
+            return;
+        try {
+            const cookies = await this.context.cookies();
+            const cookieSummary = cookies.map((c) => ({
+                name: c.name,
+                domain: c.domain,
+                path: c.path,
+                len: c.value.length,
+                httpOnly: c.httpOnly,
+                secure: c.secure,
+                sameSite: c.sameSite,
+            }));
+            const url = this.page ? this.page.url() : "(no page)";
+            // Capture the live Clerk SDK state — the definitive read on whether a
+            // sign-up transfer is available (the new-user-OAuth fix hinges on this).
+            const clerkState = this.page
+                ? await this.page
+                    .evaluate(() => {
+                    const w = window;
+                    const c = w.Clerk;
+                    if (c === undefined)
+                        return { present: false };
+                    const client = c.client;
+                    const si = client?.["signIn"];
+                    const su = client?.["signUp"];
+                    const ffv = si?.["firstFactorVerification"];
+                    return {
+                        present: true,
+                        loaded: c.loaded ?? null,
+                        signInStatus: si?.["status"] ?? null,
+                        signInFFVStatus: ffv?.["status"] ?? null,
+                        signInFFVError: ffv?.["error"] ?? null,
+                        signUpStatus: su?.["status"] ?? null,
+                        signUpMissingFields: su?.["missingFields"] ?? null,
+                        hasSignUpCreate: typeof su?.create === "function",
+                    };
+                })
+                    .catch((e) => ({ present: "evalError", err: String(e).slice(0, 120) }))
+                : { present: false };
+            const consoleText = await this.extractText().catch(() => "");
+            const { writeFileSync, mkdirSync } = await import("node:fs");
+            const { join } = await import("node:path");
+            const { homedir } = await import("node:os");
+            const dir = join(homedir(), ".trusty-squire", "oauth-debug");
+            mkdirSync(dir, { recursive: true });
+            const ts = process.env.OAUTH_DEBUG_TS ?? String(this.oauthNetLog.length);
+            const path = join(dir, `${service}-${label}-${ts}.json`);
+            writeFileSync(path, JSON.stringify({ service, label, finalUrl: url, clerkState, cookies: cookieSummary, netLog: this.oauthNetLog, pageText: consoleText.slice(0, 600) }, null, 2));
+            console.error(`[oauth-debug] wrote ${path} (${cookieSummary.length} cookies, ${this.oauthNetLog.length} net entries)`);
+        }
+        catch (err) {
+            console.error(`[oauth-debug] dump failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     // Read the page's Rails/OmniAuth CSRF token (<meta name="csrf-token">).
     // Needed to recover OmniAuth 2.0 POST-only OAuth when the provider button is
     // a GET <a> that page-JS upgrades to a POST.
@@ -4896,6 +5110,39 @@ export class BrowserController {
     currentUrl() {
         return this.page !== null ? this.page.url() : "";
     }
+    // Press a keyboard key (e.g. "Escape" to dismiss a focus-trapped modal that
+    // exposes no in-DOM close control). Best-effort. Used by the nav-search
+    // overlay handler's dismiss fallback.
+    async pressKey(key) {
+        if (!this.page)
+            return;
+        await this.page.keyboard.press(key).catch(() => { });
+    }
+    // Open obvious collapsed menus (hamburger / avatar / account / "Settings"
+    // toggles) so nav links hidden behind them mount in the DOM before the
+    // nav-search enumerates candidates (outside-voice #1: the keys link is often
+    // behind a menu, not in the rendered top nav). CONSERVATIVE: only clicks
+    // elements that ADVERTISE a popup menu (aria-haspopup=menu/true), capped at 3,
+    // short timeouts, best-effort — never a plain link, so it can't wander.
+    async expandLatentNav() {
+        if (!this.page)
+            return;
+        try {
+            const n = await this.page
+                .$$eval('[aria-haspopup="menu"], [aria-haspopup="true"]', (els) => {
+                const slice = els.slice(0, 3);
+                slice.forEach((e, i) => e.setAttribute("data-navsearch-toggle", String(i)));
+                return slice.length;
+            })
+                .catch(() => 0);
+            for (let i = 0; i < n; i++) {
+                await this.page.click(`[data-navsearch-toggle="${i}"]`, { timeout: 1200 }).catch(() => { });
+            }
+        }
+        catch {
+            // best-effort — never fail the search over menu expansion
+        }
+    }
     // Fetch a URL's final response (following redirects) and return its
     // status, final URL, and body text — or null on any failure.
     //
@@ -5133,6 +5380,32 @@ export class BrowserController {
             `${seen.length === 0 ? "<none>" : seen.map((s) => JSON.stringify(s)).join(", ")}`);
         return false;
     }
+    // Wait on a Clerk callback for a session to establish, polling COOKIES (which
+    // are world-agnostic — unlike window.Clerk, invisible to our isolated-world
+    // page.evaluate under patchright). Clerk's main-world JS, if left alone on the
+    // /sso-callback page (not navigated away), completes the new-user sign-up
+    // transfer and sets a session; this detects that. Returns true once a Clerk
+    // session indicator appears (`__session` cookie, or `__client_uat` flips off
+    // "0"), false on timeout. Cheap + safe: only the bot's own context cookies.
+    async waitForClerkSession(timeoutMs = 12000) {
+        if (!this.context)
+            return false;
+        const deadline = Date.now() + timeoutMs;
+        while (Date.now() < deadline) {
+            try {
+                const cookies = await this.context.cookies();
+                const signedIn = cookies.some((c) => (c.name === "__session" && c.value.length > 0) ||
+                    (c.name.startsWith("__client_uat") && c.value.length > 0 && c.value !== "0"));
+                if (signedIn)
+                    return true;
+            }
+            catch {
+                // transient — keep polling
+            }
+            await this.sleep(1000);
+        }
+        return false;
+    }
     // Restore the product page once the OAuth handshake completes. A
     // no-op for the same-tab redirect flow (the active page already IS
     // the product page); for the popup flow, waits briefly for the popup