@trusty-squire/mcp 0.9.17 → 0.9.18-rc.2

package/dist/bot/replay-skill.d.ts

@@ -57,6 +57,20 @@ export interface ReplayInput {
     fetchEmailCode?: (input: {
         alias: string;
     }) => Promise<string | null>;
+    /**
+     * Drives an interactive provider sign-in when the OAuth walk lands on a
+     * login/identifier page instead of a chooser/consent. Replay otherwise bails
+     * `needs_login` here — but the full discover bot would just type the
+     * password, and a freshly-created robot account lands on the identifier page
+     * the first time a given relying party requests OAuth even with a live
+     * session. The verifier wires this to the robot's credentials
+     * (verify-passwords.json) + `browser.loginGoogleInline`; the live-user
+     * router omits it (no stored end-user password to drive). Resolves true when
+     * the sign-in progressed (walk continues), false to fall through to the
+     * existing needs_login bail. Same caller-injected-transport separation as
+     * `fetchEmailCode`.
+     */
+    driveOAuthLogin?: (provider: OAuthProviderId) => Promise<boolean>;
     /**
      * Chrome profile whose OAuth-session marker should be trusted for
      * replay-time provider checks. Fresh-identity verifier replays pass the
@@ -123,6 +137,7 @@ export type ReplayOutcome = {
     kind: "needs_login";
     provider: "google" | "github";
     stepIndex: number;
+    afterOAuth: boolean;
 } | {
     kind: "skill_demoted";
     reason: string;
@@ -154,5 +169,5 @@ export declare function normalizeKindeReplayNavigateUrl(url: string): string;
 export declare function settledOnProductPage(currentUrl: string, expectedHost: string): boolean;
 export declare function pathHasOpaqueResourceId(path: string): boolean;
 export declare function inferProviderFromUrl(url: string): "google" | "github" | null;
-export declare function walkOAuthConsent(browser: BrowserController, providerId: OAuthProviderId): Promise<"ok" | "needs_login">;
+export declare function walkOAuthConsent(browser: BrowserController, providerId: OAuthProviderId, driveOAuthLogin?: (provider: OAuthProviderId) => Promise<boolean>): Promise<"ok" | "needs_login">;
 //# sourceMappingURL=replay-skill.d.ts.map

package/dist/bot/replay-skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"replay-skill.d.ts","sourceRoot":"","sources":["../../src/bot/replay-skill.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EACV,KAAK,EACL,SAAS,EAEV,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAS1E,OAAO,EAAE,KAAK,eAAe,EAAuC,MAAM,sBAAsB,CAAC;AAUjG,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,KAAK,EAAE,KAAK,CAAC;IACb,+DAA+D;IAC/D,OAAO,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACrE;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAClC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,eAAe,CAAC;IACzC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,YAAY,EAAE,SAAS,CAAC;IACxB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACzC,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,KAAK,EAAE,KAAK,CAAC;CACd;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,aAAa,GAAG,OAAO,GAAG,aAAa,CAAA;CAAE,GAMhF;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;CAC1D,GACD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,CAAA;CAAE,GACnF;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ9C,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAID,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAugB5E;AAqbD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAgB5E;AAq4DD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAavD;AAMD,wBAAgB,cAAc,CAC5B,EAAE,EAAE,kBAAkB,EACtB,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACxF,OAAO,CAMT;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAuBjF;AAeD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAyBf;AAaD,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAYf;AAkRD,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,kBAAkB,EAAE,CAYtB;AAYD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,SAAS,kBAAkB,EAAE,EACxC,SAAS,CAAC,EAAE,MAAM,GACjB,kBAAkB,GAAG,IAAI,CAkB3B;AAmcD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAWlE;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAOtF;AAKD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAkCf;AAMD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI1D;AAUD,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAa5E;AAED,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAcnE;AASD,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAatF;AAMD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAU7D;AAmBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAS5E;AA0HD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC,CA0G/B"}
+{"version":3,"file":"replay-skill.d.ts","sourceRoot":"","sources":["../../src/bot/replay-skill.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EACV,KAAK,EACL,SAAS,EAEV,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAS1E,OAAO,EAAE,KAAK,eAAe,EAAuC,MAAM,sBAAsB,CAAC;AAUjG,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,KAAK,EAAE,KAAK,CAAC;IACb,+DAA+D;IAC/D,OAAO,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACrE;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAClC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,eAAe,CAAC;IACzC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,YAAY,EAAE,SAAS,CAAC;IACxB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACzC,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,KAAK,EAAE,KAAK,CAAC;CACd;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,aAAa,GAAG,OAAO,GAAG,aAAa,CAAA;CAAE,GAMhF;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC,CAAC;CAC1D,GACD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,SAAS,CAAA;CAAE,GACnF;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAQhE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GAC9F;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAQ9C,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAID,wBAAsB,WAAW,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAwgB5E;AA4cD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAgB5E;AAy6DD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAavD;AAMD,wBAAgB,cAAc,CAC5B,EAAE,EAAE,kBAAkB,EACtB,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACxF,OAAO,CAMT;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAuBjF;AAeD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAyBf;AAaD,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAYf;AAkRD,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,SAAS,kBAAkB,EAAE,GACvC,kBAAkB,EAAE,CAYtB;AAYD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,SAAS,kBAAkB,EAAE,EACxC,SAAS,CAAC,EAAE,MAAM,GACjB,kBAAkB,GAAG,IAAI,CAkB3B;AAmcD,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAWlE;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAOtF;AAKD,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,MAAM,GAAG,IAAI,CAkCf;AAMD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI1D;AAUD,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAa5E;AAED,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAcnE;AASD,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAatF;AAMD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAU7D;AAmBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAS5E;AA0HD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,eAAe,EAC3B,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,GAChE,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC,CA8H/B"}

package/dist/bot/replay-skill.js

@@ -248,7 +248,7 @@ export async function replaySkill(input) {
                 validation = await preValidateStep(step, browser, templateValues);
             }
             else if (recovered.kind === "needs_login") {
-                return { kind: "needs_login", provider: recovered.provider, stepIndex: i };
+                return { kind: "needs_login", provider: recovered.provider, stepIndex: i, afterOAuth: authedViaOAuth };
             }
         }
         let stepToExecute = step;
@@ -273,7 +273,7 @@ export async function replaySkill(input) {
                 stepToExecute = fallbackResult.substitute;
             }
             else if (fallbackResult.kind === "needs_login") {
-                return { kind: "needs_login", provider: fallbackResult.provider, stepIndex: i };
+                return { kind: "needs_login", provider: fallbackResult.provider, stepIndex: i, afterOAuth: authedViaOAuth };
             }
             else if (step.kind === "fill" &&
                 isSkippableAbsentFill(step, validation.reason, i, skill.steps)) {
@@ -342,9 +342,9 @@ export async function replaySkill(input) {
         // the router can decide whether to retry or fall through to the
         // universal bot.
         try {
-            const execOutcome = await executeStep(stepToExecute, browser, templateValues, skill, input.fetchEmailCode, input.profileDir, input.preferredOAuthProvider, skill.steps[i + 1]);
+            const execOutcome = await executeStep(stepToExecute, browser, templateValues, skill, input.fetchEmailCode, input.profileDir, input.preferredOAuthProvider, skill.steps[i + 1], input.driveOAuthLogin);
             if (execOutcome.kind === "needs_login") {
-                return { kind: "needs_login", provider: execOutcome.provider, stepIndex: i };
+                return { kind: "needs_login", provider: execOutcome.provider, stepIndex: i, afterOAuth: authedViaOAuth };
             }
             // OAuth click succeeded (needs_login already returned above) → we're in
             // an authenticated returning-user session for the rest of the replay.
@@ -541,12 +541,32 @@ async function preValidateStep(step, browser, templateValues) {
             return { ok: true };
         }
         case "click_oauth_button": {
-            const inventory = await browser.extractInteractiveElements();
-            const matches = preferNonConsentClickMatches(inventory.filter((el) => matchesClickHint(el, step.text_match)), step.text_match);
+            let inventory = await browser.extractInteractiveElements();
+            let matches = preferNonConsentClickMatches(inventory.filter((el) => matchesClickHint(el, step.text_match)), step.text_match);
+            // Hardening (MEASURED 2026-06-24, the verifier sweep): the synthesizer
+            // hardcodes step.text_match to "Google"/"GitHub", but the OAuth button
+            // often (a) renders only after the SPA hydrates, or (b) is an icon /
+            // "Continue with Google" affordance the literal-word match misses — and a
+            // step-1 OAuth miss kills the WHOLE replay (the dominant verifier-hold
+            // mode). So when text_match finds nothing: re-read after a hydration
+            // settle, then fall back to the bot's provider-based finder
+            // (findOAuthButton matches by provider keyword in text/aria/href + OAuth
+            // scoring — the SAME logic discover used to find this button to begin
+            // with). The button identity is the provider, not a literal string.
             if (matches.length === 0) {
+                await browser.wait(2);
+                await browser.waitForInteractiveDom().catch(() => undefined);
+                inventory = await browser.extractInteractiveElements().catch(() => inventory);
+                matches = preferNonConsentClickMatches(inventory.filter((el) => matchesClickHint(el, step.text_match)), step.text_match);
+            }
+            if (matches.length === 0) {
+                const byProvider = findOAuthButton(inventory, step.provider);
+                if (byProvider !== null) {
+                    return { ok: true, match: byProvider };
+                }
                 return {
                     ok: false,
-                    reason: `No element matches text_match=${JSON.stringify(step.text_match)} for ${step.provider} OAuth button.`,
+                    reason: `No ${step.provider} OAuth button found (text_match=${JSON.stringify(step.text_match)} + provider scan).`,
                 };
             }
             // Multiple matches — the disambiguator (C3) picks by role first,
@@ -1255,7 +1275,7 @@ async function attemptSimpleProjectOnboarding(browser, templateValues) {
     await browser.waitForInteractiveDom().catch(() => undefined);
     return true;
 }
-async function executeStep(step, browser, templateValues, skill, fetchEmailCode, profileDir, preferredOAuthProvider, nextStep) {
+async function executeStep(step, browser, templateValues, skill, fetchEmailCode, profileDir, preferredOAuthProvider, nextStep, driveOAuthLogin) {
     switch (step.kind) {
         case "navigate": {
             // Rebase a captured per-account subdomain onto the live session's
@@ -1264,7 +1284,19 @@ async function executeStep(step, browser, templateValues, skill, fetchEmailCode,
             // gets rewritten to the current one. No-op for same-host / cross-product
             // / first-navigate (about:blank) cases.
             const targetUrl = normalizeKindeReplayNavigateUrl(rebaseSubdomain(step.url, browser.currentUrl()));
-            await browser.goto(targetUrl);
+            try {
+                await browser.goto(targetUrl);
+            }
+            catch (err) {
+                // A goto can crash transiently ("Target page, context or browser has
+                // been closed") under heavy concurrency or a redirect race. Retry once
+                // before failing — a genuinely-dead context throws again and surfaces a
+                // clean reason instead of a raw Playwright stack. (MEASURED 2026-06-24,
+                // verifier sweep: step-2 goto crashes under 2-wide concurrency.)
+                await browser.wait(1);
+                await browser.goto(targetUrl);
+                void err;
+            }
             // Settle for SPA-style apps that fire route handlers post-
             // DOMContentLoaded. A fixed 2s under-waits heavy authenticated
             // dashboards (pusher's App Keys, imagekit's onboarding step rendered
@@ -1346,17 +1378,39 @@ async function executeStep(step, browser, templateValues, skill, fetchEmailCode,
             // chooser + basic consent out of band so a one-account capture replays for
             // an N-account user. Fast no-op when the round-trip already auto-completed
             // (single account → first state is not_provider / popup-closed → "ok").
-            const walk = await walkOAuthConsent(browser, step.provider);
+            const walk = await walkOAuthConsent(browser, step.provider, driveOAuthLogin);
             if (walk === "needs_login") {
                 return { kind: "needs_login", provider: step.provider };
             }
+            // Restore the product page. Google Identity Services (meilisearch et al.)
+            // runs OAuth in a POPUP that closes once consent posts the credential back
+            // to the opener; without switching `this.page` off the now-closed popup,
+            // the next replay step (a navigate/extract) runs against a dead page and
+            // dies "Target page, context or browser has been closed". The OAuth
+            // RECOVERY path already settles; the primary click_oauth_button path did
+            // not — so popup-OAuth skills broke on the very next step the moment they
+            // finally cleared OAuth. No-op for the same-tab redirect transport.
+            await browser.settleAfterOAuth().catch(() => undefined);
             return { kind: "clicked" };
         }
         case "click": {
             let inventory = await browser.extractInteractiveElements();
             inventory = await maybeRefreshInventoryForHydratedClick(step, browser, inventory);
-            if (isLikelySubmitClick(step)) {
+            // Fill the preconditions of a disabled submit BEFORE clicking it. The
+            // text-gated isLikelySubmitClick only catches "create account / sign up"
+            // wording; a post-OAuth ONBOARDING SURVEY (meilisearch: a required
+            // role/use-case dropdown gating a "Continue") has a neutral button label,
+            // so detect the disabled-submit state directly. fillRequiredComboboxes is
+            // exactly what the discover bot runs here — the replay just never did, so
+            // every survey-gated skill died "target is disabled after 15s" the moment
+            // it cleared OAuth. Cheap DOM check; only fills when something is actually
+            // unselected.
+            if (isLikelySubmitClick(step) || (await browser.hasDisabledSubmit().catch(() => false))) {
                 await autofillCommonIdentityFieldsBeforeSubmit(browser, templateValues);
+                const picked = await browser.fillRequiredComboboxes().catch(() => []);
+                if (picked.length > 0) {
+                    console.error(`[replay] filled ${picked.length} required combobox(es) before submit: ${picked.join(", ")}`);
+                }
                 inventory = await browser.extractInteractiveElements().catch(() => inventory);
             }
             await checkRequiredAgreementBoxesBeforeSubmitClick(browser, step);
@@ -3773,9 +3827,25 @@ async function clickConsentAffordance(browser) {
 // operator already established via `mcp login` — it does NOT log in.
 // Aborts to needs_login on a real challenge (2FA / verify-it's-you) or a
 // sensitive (non-basic) scope grant — both genuinely need a human.
-export async function walkOAuthConsent(browser, providerId) {
+export async function walkOAuthConsent(browser, providerId, driveOAuthLogin) {
     const provider = OAUTH_PROVIDERS[providerId];
     const MAX_NAV = 6;
+    // Bound the inline-login drive to ONE attempt — a credential that doesn't
+    // clear the identifier/challenge after a full type-through is a real wall
+    // (wrong password, 2SV the verifier can't satisfy), and re-driving would just
+    // burn MAX_NAV iterations re-typing into the same dead form.
+    let loginDriven = false;
+    // When the provider supports an inline login drive, the identifier page is
+    // recoverable, not terminal: try the credential type-through before bailing.
+    const tryDriveLogin = async () => {
+        if (driveOAuthLogin === undefined || loginDriven)
+            return false;
+        loginDriven = true;
+        console.error(`[replay-oauth] ${providerId} login page — driving inline sign-in`);
+        const ok = await driveOAuthLogin(providerId).catch(() => false);
+        console.error(`[replay-oauth] inline sign-in ${ok ? "progressed" : "did not clear the login page"}`);
+        return ok;
+    };
     for (let i = 0; i < MAX_NAV; i++) {
         if (browser.oauthPageClosed())
             return "ok"; // popup closed → back on service
@@ -3807,6 +3877,8 @@ export async function walkOAuthConsent(browser, providerId) {
             continue;
         }
         if (providerId === "google" && /\/signin\/identifier\b/i.test(url)) {
+            if (await tryDriveLogin())
+                continue;
             console.error(`[replay-oauth] google identifier page — needs_login`);
             return "needs_login";
         }
@@ -3815,6 +3887,11 @@ export async function walkOAuthConsent(browser, providerId) {
         if (state === "not_provider")
             return "ok"; // flow left the provider
         if (state === "challenge" || state === "needs_login") {
+            // A password/identifier screen is recoverable when we hold the
+            // credential — drive the sign-in once before treating it as terminal.
+            // (A genuine 2SV/verify-it's-you challenge won't clear and falls through.)
+            if (await tryDriveLogin())
+                continue;
             if (process.env.REPLAY_DEBUG) {
                 try {
                     writeFileSync(`/tmp/replay-oauth-${providerId}-${state}.txt`, `url=${url}\n\n${body}`);