@trusty-squire/mcp 0.9.4 → 0.9.6

package/dist/bot/agent.js

@@ -431,6 +431,13 @@ export function pickStuckLoopFallbackUrl(currentUrl, alreadyTried, service) {
     catch {
         return null;
     }
+    // about:blank / data: / chrome-error pages have an opaque origin that
+    // serializes to the literal string "null" — building "${origin}${path}"
+    // then yields an unnavigable "null/settings/keys". Only compose
+    // fallbacks against a real http(s) origin.
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return null;
+    }
     const origin = parsed.origin;
     // Skip a candidate when the current URL's path ALREADY matches it
     // (case-insensitive, trailing-slash tolerant). The planner is stuck
@@ -2519,6 +2526,13 @@ export function extractAllLabeledTokensFromReason(reason, pageText) {
         const value = m[2];
         if (canonical === undefined || value === undefined)
             continue;
+        // Email local-part guard. The value class stops at '@', so an email
+        // ("giselle703@gmail.com") is captured as its local-part ("giselle703")
+        // — a digit-bearing string that passes credential-shape. An email is
+        // never a credential; reject when the captured value is immediately
+        // followed by '@' in the source. (Cloudinary email-settings page.)
+        if (reason.includes(value + "@") || pageText.includes(value + "@"))
+            continue;
         if (!pageText.includes(value))
             continue;
         if (out[canonical] === undefined)
@@ -2564,6 +2578,9 @@ export function extractAllLabeledTokensFromReason(reason, pageText) {
             continue; // quoted-form already won
         if (PROSE_BLACKLIST.has(value.toLowerCase()))
             continue;
+        // Email local-part guard — see the quoted loop above.
+        if (reason.includes(value + "@") || pageText.includes(value + "@"))
+            continue;
         if (!looksCredentialShape(value))
             continue;
         if (!pageText.includes(value))
@@ -2612,6 +2629,46 @@ export function isMultiCredBundle(creds) {
     }
     return false;
 }
+// DOM-label phrase → canonical credential key. Shared by
+// extractFromDomProximity (which harvests VALUES) and
+// countPresentedCredentialLabels (which counts how many distinct
+// credentials a page PRESENTS, masked included). Kept in lockstep with
+// the Phase E LABEL_ALIASES vocabulary.
+const DOM_LABEL_TO_KEY = {
+    "api key": "api_key",
+    "api token": "api_key",
+    "api secret": "api_secret",
+    "secret key": "secret_key",
+    "publishable key": "publishable_key",
+    "access key": "access_key_id",
+    "access key id": "access_key_id",
+    "access token": "access_token",
+    "bearer token": "access_token",
+    "personal access token": "access_token",
+    "auth token": "auth_token",
+    "client id": "client_id",
+    "client secret": "client_secret",
+    "client key": "client_id",
+    "cloud name": "cloud_name",
+    cloudname: "cloud_name",
+    "application id": "application_id",
+    "app id": "application_id",
+    "admin api key": "admin_api_key",
+    "search api key": "search_api_key",
+    "search-only api key": "search_api_key",
+    "monitoring api key": "monitoring_api_key",
+    "account sid": "account_sid",
+    "secret access key": "secret_access_key",
+    "consumer key": "consumer_key",
+    "consumer secret": "consumer_secret",
+    "access token secret": "access_token_secret",
+    "project api key": "project_api_key",
+    "personal api key": "personal_api_key",
+    "organization id": "org_id",
+    "org id": "org_id",
+    "app key": "app_key",
+    "app secret": "app_secret",
+};
 export function extractApiKeyFromText(text) {
     const prefixed = [
         /\bre_[a-zA-Z0-9_]{20,}\b/, // Resend (key body contains underscores)
@@ -2872,6 +2929,60 @@ export function pickVerificationLinkFromHtml(bodyHtml) {
     }
     return best !== null && best.score > 0 ? best.url : null;
 }
+// Last-resort verification-CODE extraction from an email body, for the
+// passwordless "we emailed you a code" flow (axiom: "Axiom sign-in
+// verification code") when the inbox parser's parsed_codes came back empty.
+// Without this the bot bailed "no usable verification link" on a code-only
+// email — treating a routine code flow as a dead end. Conservative: prefers a
+// 4-8 digit run next to a code/verify keyword, then a space/dash-grouped code,
+// then a standalone 6-digit number (the most common verification length).
+// Returns null when nothing code-shaped is found so the caller still bails
+// honestly rather than typing garbage. Exported for unit testing.
+export function extractCodeFromEmailBody(email) {
+    const text = [
+        email.subject ?? "",
+        email.body_text ?? "",
+        (email.body_html ?? "").replace(/<[^>]+>/g, " "),
+    ].join("\n");
+    // 1) A code sitting next to a verification keyword — the strongest signal.
+    const kw = text.match(/(?:verification code|sign[\s-]?in code|one[\s-]?time(?:\s+(?:code|password))?|security code|your code|confirmation code|code is|enter(?:\s+this)?\s+code)\b[^0-9]{0,40}([0-9]{4,8})\b/i);
+    if (kw?.[1] !== undefined)
+        return kw[1];
+    // 2) A grouped code ("123-456" / "1234 5678").
+    const grouped = text.match(/(?<![0-9])([0-9]{3,4}[ -][0-9]{3,4})(?![0-9])/);
+    if (grouped?.[1] !== undefined)
+        return grouped[1].replace(/[ -]/g, "");
+    // 3) A standalone 6-digit number (most verification codes).
+    const six = text.match(/(?<![0-9])([0-9]{6})(?![0-9])/);
+    if (six?.[1] !== undefined)
+        return six[1];
+    return null;
+}
+// True when the page is an email verification-CODE entry gate: a single
+// code-style input (name/id/placeholder/label ~ code/token/otp/verification),
+// NO email/password/tel field still to fill, and verify/code copy in the body.
+// axiom-class passwordless ("Send Code to Email" lands here). Distinct from the
+// no-fields verification WALL: this page HAS an input, but it's a CODE field,
+// so the form-fill planner would otherwise type an empty literal into it and
+// loop. The caller returns "submitted" to route to the inbox-poll + code-entry
+// path (the code was emailed to our alias). Exported for unit testing.
+export function isVerificationCodeGate(inventory, pageText) {
+    const inputs = inventory.filter((e) => e.tag === "input" && e.visible !== false);
+    // Any email/password/tel field still present → still a signup form, not a
+    // pure code gate.
+    if (inputs.some((e) => e.type === "email" || e.type === "password" || e.type === "tel")) {
+        return false;
+    }
+    const codeRe = /\b(?:code|token|otp|verification|verify|one[\s-]?time|2fa|mfa)\b/i;
+    const hasCodeInput = inputs.some((e) => {
+        const hay = `${e.name ?? ""} ${e.id ?? ""} ${e.placeholder ?? ""} ${e.ariaLabel ?? ""} ${e.labelText ?? ""}`;
+        return codeRe.test(hay);
+    });
+    if (!hasCodeInput)
+        return false;
+    const t = pageText.toLowerCase();
+    return /verification code|enter (?:the |your )?code|code is required|verify and continue|we (?:sent|emailed)|check your email|one[\s-]?time (?:code|password)|sign[\s-]?in code/.test(t);
+}
 // Discriminates LLMPair from LLMClient. LLMPair has `primary` (an
 // LLMClient); LLMClient has `createMessage`. They're mutually exclusive
 // shapes so a structural check is reliable.
@@ -3279,6 +3390,15 @@ export class SignupAgent {
         let progressReplans = 0;
         let emptyPlans = 0;
         let oauthScanRetries = 0;
+        // Bound upstream-proxy blips. The blip carve-out below deliberately
+        // does NOT tick errorReplans (a transient 502 isn't a logic failure),
+        // but with no cap a SUSTAINED LLM-proxy outage spins this loop until
+        // the 600s run deadline — meilisearch burned 177 planner calls this
+        // way on a degraded `trusty-squire-proxy:cheap` upstream. The
+        // post-verify loop already caps blips at 8; mirror that here so a
+        // sustained outage fails fast as planning_failed instead of timing out.
+        let upstreamBlipRetries = 0;
+        const MAX_UPSTREAM_BLIP_RETRIES = 8;
         // Bounded click-throughs of a generic "Sign In to Continue"
         // interstitial that gates the provider buttons (Qdrant). Capped so
         // an SSO-only page that keeps re-showing a sign-in button (or a
@@ -3355,9 +3475,20 @@ export class SignupAgent {
                 const aliasPollable = wallAlias === null ||
                     wallAlias.slice(wallAlias.indexOf("@") + 1).toLowerCase() ===
                         ourInboxDomain;
+                // A no-input page that offers an OAuth signup affordance
+                // ("SIGN UP WITH GOOGLE/GITHUB") is a signup-METHOD chooser, not
+                // a post-submit verification wall — nothing has been submitted
+                // yet, so there's no mail to poll. Cloudinary's register page is
+                // exactly this: no fields, three "SIGN UP WITH …" links, and
+                // marketing copy that trips expectsVerificationEmail. Skipping the
+                // wall here lets control fall through to the OAuth-first scan
+                // below, which clicks Google.
+                const offersOAuthSignup = oauthCandidates.length > 0 &&
+                    findFirstOAuthButton(inventory, oauthCandidates) !== null;
                 if (!hasFillableInput &&
                     expectsVerificationEmail(wallText) &&
-                    aliasPollable) {
+                    aliasPollable &&
+                    !offersOAuthSignup) {
                     const alias = wallAlias;
                     this.pendingVerificationAlias = alias;
                     steps.push(`Form: email-verification wall (no fields to fill${alias !== null ? `, check ${alias}` : ""}) — ` +
@@ -3383,6 +3514,19 @@ export class SignupAgent {
                     return { kind: "submitted" };
                 }
             }
+            // Email verification-CODE gate (axiom-class passwordless). The no-fields
+            // wall above misses it because this page HAS an input — but it's a CODE
+            // field, not email/password, and the code was emailed to our alias.
+            // Return "submitted" so the post-submit inbox-poll + code-entry path
+            // (extractCodeFromEmailBody → enterEmailVerificationCode) handles it,
+            // instead of the planner typing an empty literal into the code field and
+            // looping. Gated on committedToEmailPath — a code gate only appears after
+            // the email was submitted.
+            if (committedToEmailPath && isVerificationCodeGate(inventory, state.html)) {
+                this.pendingVerificationAlias = this.pendingVerificationAlias ?? task.email;
+                steps.push("Form: email verification-CODE gate detected — routing to the inbox-poll + code-entry flow.");
+                return { kind: "submitted" };
+            }
             // OAuth-first (T6/T13 + auto-prefer): when the page carries a
             // "Sign in with <provider>" affordance for a provider the bot can
             // use, that button unconditionally outranks any form field — hand
@@ -3561,13 +3705,25 @@ export class SignupAgent {
                 if (!isUpstreamBlip && ++errorReplans > MAX_ERROR_REPLANS) {
                     return { kind: "planning_failed", reason: `planner output never validated: ${reason}` };
                 }
+                if (isUpstreamBlip && ++upstreamBlipRetries > MAX_UPSTREAM_BLIP_RETRIES) {
+                    return {
+                        kind: "planning_failed",
+                        reason: `llm_proxy_unavailable: planner request failed ${upstreamBlipRetries}x on upstream proxy errors (${reason}) — sustained LLM-proxy/upstream outage, not a page problem`,
+                    };
+                }
                 steps.push(isUpstreamBlip
-                    ? `⚠ planner request hit a transient upstream blip (${reason}) — retrying`
+                    ? `⚠ planner request hit a transient upstream blip (${reason}) — retrying (${upstreamBlipRetries}/${MAX_UPSTREAM_BLIP_RETRIES})`
                     : `⚠ plan rejected (${reason}) — re-planning`);
                 if (!isUpstreamBlip) {
                     hint =
                         "Your previous plan used a selector not in the inventory. Use ONLY selectors copied verbatim from a `selector=` field.";
                 }
+                else {
+                    // Brief backoff so a genuinely transient blip can recover
+                    // before the next attempt, instead of hammering a degraded
+                    // upstream as fast as the proxy can 502.
+                    await this.browser.wait(2);
+                }
                 continue;
             }
             steps.push(`Plan: ${plan.actions.length} action(s), confidence=${plan.confidence}` +
@@ -4829,7 +4985,17 @@ export class SignupAgent {
                                 credentials = await this.enterEmailVerificationCode(email.parsed_codes[0] ?? "", task, password, steps);
                             }
                             else {
-                                steps.push("Email had no usable verification link.");
+                                // No link and the inbox parser found no code — last-resort
+                                // scan the email body ourselves for a verification code
+                                // (passwordless "we emailed you a code" flow, e.g. axiom).
+                                const bodyCode = extractCodeFromEmailBody(email);
+                                if (bodyCode !== null) {
+                                    steps.push(`Email had no link but carried a verification code (…${bodyCode.slice(-2)}) — entering it.`);
+                                    credentials = await this.enterEmailVerificationCode(bodyCode, task, password, steps);
+                                }
+                                else {
+                                    steps.push("Email had no usable verification link or code.");
+                                }
                             }
                         }
                         else if (email.parsed_codes.length > 0) {
@@ -4980,6 +5146,21 @@ export class SignupAgent {
             steps.push(`OAuth: Google Identity Services / FedCM widget — resolved via ${gsi.via}` +
                 (gsi.ok ? "" : " (no FedCM dialog or popup appeared — the widget may need a different trigger)"));
         }
+        // OmniAuth POST-only recovery prep. Capture the affordance's href + the
+        // page's CSRF token NOW, while we're still on the signin page — the
+        // "Authentication passthru" page a GET-click lands on is bare (no token).
+        // See the typesense root-cause (2026-06-07): Rails/OmniAuth 2.0 is
+        // POST-only; the GitHub button is a GET <a href="/users/auth/github">
+        // upgraded to POST by page JS, and the bot's GET-click hit the passthru.
+        const omniauthHref = typeof this.browser.getElementAttribute === "function"
+            ? await this.browser
+                .getElementAttribute(oauthSelector, "href")
+                .catch(() => null)
+            : null;
+        const omniauthToken = typeof this.browser.getMetaCsrfToken === "function"
+            ? await this.browser.getMetaCsrfToken().catch(() => null)
+            : null;
+        let omniauthPostTried = false;
         if (!gsiHandled) {
             await this.browser.startOAuth(oauthSelector);
         }
@@ -4994,6 +5175,15 @@ export class SignupAgent {
         // /consent, etc.) get the soft-advance path instead of an abort —
         // because the scope-grant decision was already made and validated.
         let consentAlreadyApproved = false;
+        // Bounded soft-waits for a consent page whose approve control hasn't
+        // rendered yet. Google's gaia consent SPA paints "Loading" then
+        // hydrates the Allow/Continue button a few seconds later (and for an
+        // already-authorized app it may auto-redirect with no button at all).
+        // Rather than aborting the instant advanceOAuthConsent finds nothing,
+        // wait + re-loop a few times so a slow hydrate / auto-redirect can
+        // complete first.
+        let consentAdvanceWaits = 0;
+        const MAX_CONSENT_ADVANCE_WAITS = 3;
         for (let i = 0; i < MAX_OAUTH_NAV; i++) {
             if (this.browser.oauthPageClosed()) {
                 steps.push(`OAuth: the ${provider.label} window closed — handshake returned to the service`);
@@ -5026,8 +5216,37 @@ export class SignupAgent {
             }
             const authState = provider.classifyAuthState(url, body);
             steps.push(`OAuth: ${provider.label} auth state = ${authState} (url=${url.slice(0, 120)})`);
-            if (authState === "not_provider")
+            if (authState === "not_provider") {
+                // OmniAuth 2.0 POST-only recovery. The provider button can be a GET
+                // <a href="/.../auth/<provider>"> that page-JS upgrades to a POST; if
+                // the bot's click hit the default GET, Rails/OmniAuth answers
+                // "Not found. Authentication passthru." and OAuth never started — the
+                // bot then misreads it as "signed in" and bails. Detect that bare
+                // passthru page and re-initiate via POST with the signin page's CSRF
+                // token (proven to 302 to the provider). MEASURED 2026-06-07: typesense.
+                const onOmniAuthPassthru = /authentication passthru|not found/i.test(body) &&
+                    /\/auth\/[a-z0-9_-]+\/?$/i.test(url);
+                if (onOmniAuthPassthru &&
+                    !omniauthPostTried &&
+                    omniauthToken !== null &&
+                    omniauthHref !== null) {
+                    omniauthPostTried = true;
+                    const action = new URL(omniauthHref, url).toString();
+                    steps.push(`OAuth: ${provider.label} endpoint is POST-only (OmniAuth GET passthru) — ` +
+                        `re-initiating via POST with the page CSRF token`);
+                    try {
+                        await this.browser.submitPostForm(action, {
+                            authenticity_token: omniauthToken,
+                        });
+                        await this.browser.wait(3);
+                        continue; // re-read state — should now be on the provider's page
+                    }
+                    catch (err) {
+                        steps.push(`OAuth: OmniAuth POST recovery failed (${err instanceof Error ? err.message : String(err)})`);
+                    }
+                }
                 break; // flow left the provider — back on the service
+            }
             if (authState === "challenge") {
                 // rc.26 — always capture forensic state at the moment the
                 // challenge is detected. Before this, snapshots fired only at
@@ -5318,8 +5537,18 @@ export class SignupAgent {
                         `no scope-grant verb phrases detected in page DOM)`);
                     const advanced = await this.browser.advanceOAuthConsent(provider.id);
                     if (!advanced) {
+                        // The approve button may not have hydrated yet, or Google is
+                        // auto-redirecting an already-authorized app. Wait + re-loop a
+                        // bounded number of times before giving up.
+                        if (consentAdvanceWaits < MAX_CONSENT_ADVANCE_WAITS) {
+                            consentAdvanceWaits += 1;
+                            steps.push(`OAuth: consent approve control not present yet — waiting for hydrate/redirect ` +
+                                `(${consentAdvanceWaits}/${MAX_CONSENT_ADVANCE_WAITS})`);
+                            await this.browser.wait(4);
+                            continue;
+                        }
                         return this.oauthAbort("oauth_consent_needs_review", `blind-consent approved but no approve control found on the ` +
-                            `${provider.label} consent page — sign up manually.`, steps);
+                            `${provider.label} consent page after ${consentAdvanceWaits} waits — sign up manually.`, steps);
                     }
                     consentAlreadyApproved = true;
                     await this.browser.wait(3);
@@ -6175,41 +6404,7 @@ ${formatInventory(input.inventory)}`,
     async extractFromDomProximity() {
         // Vocabulary matches the LABEL_ALIASES used by Phase E so the
         // canonical keys stay consistent across paths.
-        const LABEL_TO_KEY = {
-            "api key": "api_key",
-            "api token": "api_key",
-            "api secret": "api_secret",
-            "secret key": "secret_key",
-            "publishable key": "publishable_key",
-            "access key": "access_key_id",
-            "access key id": "access_key_id",
-            "access token": "access_token",
-            "bearer token": "access_token",
-            "personal access token": "access_token",
-            "auth token": "auth_token",
-            "client id": "client_id",
-            "client secret": "client_secret",
-            "client key": "client_id",
-            "cloud name": "cloud_name",
-            "cloudname": "cloud_name",
-            "application id": "application_id",
-            "app id": "application_id",
-            "admin api key": "admin_api_key",
-            "search api key": "search_api_key",
-            "search-only api key": "search_api_key",
-            "monitoring api key": "monitoring_api_key",
-            "account sid": "account_sid",
-            "secret access key": "secret_access_key",
-            "consumer key": "consumer_key",
-            "consumer secret": "consumer_secret",
-            "access token secret": "access_token_secret",
-            "project api key": "project_api_key",
-            "personal api key": "personal_api_key",
-            "organization id": "org_id",
-            "org id": "org_id",
-            "app key": "app_key",
-            "app secret": "app_secret",
-        };
+        const LABEL_TO_KEY = DOM_LABEL_TO_KEY;
         let labeled = [];
         try {
             labeled = await this.browser.extractLabeledCredentialCandidates();
@@ -6236,6 +6431,30 @@ ${formatInventory(input.inventory)}`,
         }
         return out;
     }
+    // Count the DISTINCT credentials the current page PRESENTS — masked
+    // ones included. This detects a multi-cred page BEFORE every value is
+    // captured, so the post-verify loop can stay open to harvest the 2nd/
+    // 3rd key instead of exiting the moment the first surfaces ("stops at
+    // one"). Uses the DOM-proximity harvester's labels (which fire even on
+    // masked/bullet'd values) mapped to canonical keys; values are NOT read
+    // here, only the label set. Best-effort → 0 on any browser error.
+    async countPresentedCredentialLabels() {
+        try {
+            const cands = await this.browser.extractLabeledCredentialCandidates();
+            const canon = new Set();
+            for (const c of cands) {
+                if (c.label === null)
+                    continue;
+                const key = DOM_LABEL_TO_KEY[c.label];
+                if (key !== undefined)
+                    canon.add(key);
+            }
+            return canon.size;
+        }
+        catch {
+            return 0;
+        }
+    }
     // Run every visible-credential extraction tier the post-verify loop
     // uses (legacy regex/clipboard/hidden-input + DOM-proximity labeled),
     // merging first-wins into a single bundle. Used by attemptMintNewKey
@@ -6527,6 +6746,16 @@ ${formatInventory(input.inventory)}`,
         // and inject a forced "no-progress" hint on the second repeat.
         let prevSignature = null;
         let prevInventorySize = -1;
+        // Selectors the planner has CLICKED while the inventory count has held
+        // steady. A multi-step onboarding wizard (axiom: role → company-size →
+        // plan) advances by clicking distinct radio-style cards that flip an
+        // aria-checked but add/remove no elements, so inventory.length never
+        // moves — and the kind-level stuck detector below would false-positive
+        // on the 2nd DISTINCT selection. We exempt a brand-new selector (wizard
+        // progress) and only call it stuck once a selector REPEATS (the Railway
+        // Create→Focus→Create cycle). Reset whenever the inventory count changes
+        // (genuine page mutation → fresh wizard step / new page).
+        let clickSelectorsSinceInventoryChange = new Set();
         // rc.39 — wait-loop tracker. Turso's GitHub OAuth handshake
         // succeeds, then the SSO-callback page stays empty (0 elements)
         // while a Cloudflare verification widget runs that never clears
@@ -6573,6 +6802,13 @@ ${formatInventory(input.inventory)}`,
         let stuckFiresAtUrl = 0;
         let lastStuckFireUrl = null;
         const triedFallbackUrls = new Set();
+        // Premature-done guard budget. When the planner gives up (`done`)
+        // with zero credentials captured, we navigate to an unvisited
+        // canonical keys URL and re-plan — bounded so a service that
+        // genuinely has no self-serve key doesn't burn the whole run budget
+        // walking every fallback path.
+        let prematureDoneFallbacks = 0;
+        const MAX_PREMATURE_DONE_FALLBACKS = 3;
         // Dead-URL memory. The planner guesses credential-page URLs
         // (e.g. /user/personal_access_tokens/new) that 404; without memory it
         // re-guesses the same dead URL round after round — xata and fly each
@@ -6617,6 +6853,15 @@ ${formatInventory(input.inventory)}`,
         // surveyed the labeled credentials surface.
         const seedHadCredential = credentials.api_key !== undefined || credentials.username !== undefined;
         let plannerExtractEmitted = false;
+        // 2026-06-07 — "stops at one" fix. The legacy loop-exit treated a run
+        // as single-cred based on what was ALREADY captured (isMultiCredBundle),
+        // so a page with 3 credentials whose 1st surfaced first — siblings still
+        // masked or missed on the first harvest pass — exited before the rest
+        // were caught. Set once the page is observed to PRESENT >=2 distinct
+        // credentials (masked included); the loop-exit then holds open (bounded
+        // by roundsSinceLastNewCredential) so the reveal pass + DOM harvest get
+        // more rounds to capture the siblings.
+        let pageOffersMultiCred = false;
         // Gate URLs we've already polled the operator's gmail for, so a
         // multi-round wait on the same email-OTP page doesn't re-poll.
         const otpPolledUrls = new Set();
@@ -6641,7 +6886,7 @@ ${formatInventory(input.inventory)}`,
             // when the api_key came from the pre-loop seed and the
             // planner hasn't yet emitted an explicit extract step. In
             // that case we let the planner run until extract fires.
-            const inMultiCredMode = isMultiCredBundle(credentials);
+            const inMultiCredMode = isMultiCredBundle(credentials) || pageOffersMultiCred;
             const haveOnlySeedCredentials = seedHadCredential && !plannerExtractEmitted;
             if (!inMultiCredMode &&
                 (credentials.api_key !== undefined || credentials.username !== undefined) &&
@@ -6680,6 +6925,24 @@ ${formatInventory(input.inventory)}`,
             // widened (the "API Keys"/"Settings" links must survive ranking).
             // Reading state can still race a navigation — a transient throw
             // burns the round rather than crashing the whole run.
+            // Dismiss any cookie/consent banner BEFORE reading the page or
+            // planning a click. A consent overlay (Google "Accept all", GDPR
+            // banners) intercepts pointer events, so the planner's clicks land
+            // on the banner instead of the dashboard and the loop stalls / loops /
+            // times out. MEASURED 2026-06-07: meilisearch reached /settings/keys
+            // but sat behind an Accept-All overlay and ran out the 600s clock.
+            // The form-fill loop already dismisses banners every round; the
+            // post-verify loop never did. Best-effort — a dismiss failure must
+            // not burn the round.
+            try {
+                const dismissed = await this.browser.dismissConsentBanner();
+                if (dismissed !== null) {
+                    args.steps.push(`Post-verify round ${round}: dismissed consent banner ("${dismissed}")`);
+                }
+            }
+            catch {
+                // best-effort
+            }
             let state;
             let inventory;
             try {
@@ -7046,6 +7309,13 @@ ${formatInventory(input.inventory)}`,
             // the same selector AND the inventory size matches the prior
             // round's — strong evidence the previous step did nothing.
             const repeatableKinds = new Set(["click", "fill", "select", "check", "scroll"]);
+            // An inventory-count change means the page genuinely mutated — a fresh
+            // wizard step or a new page. Reset the per-stable-run click-selector
+            // memory so distinct clicks on the NEW state aren't judged against the
+            // old one.
+            if (inventory.length !== prevInventorySize) {
+                clickSelectorsSinceInventoryChange = new Set();
+            }
             if (repeatableKinds.has(nextStep.kind)) {
                 const sel = "selector" in nextStep ? (nextStep.selector ?? "<none>") : "<none>";
                 const signature = `${nextStep.kind}|${sel}`;
@@ -7056,10 +7326,21 @@ ${formatInventory(input.inventory)}`,
                 // (planner cycles through Create, Focus-input, Create again,
                 // …). When that happens, force a non-click action.
                 const sameSelector = signature === prevSignature && inventory.length === prevInventorySize;
+                // A brand-new click selector (never clicked since the inventory last
+                // changed) is wizard PROGRESS, not a cycle — selecting role, then
+                // company-size, then a plan flips aria-checked without moving the
+                // element count (axiom). Only treat repeated clicks as stuck: the
+                // selector has already been clicked in this stable-inventory run.
+                const clickSelectorIsRepeat = nextStep.kind === "click" &&
+                    clickSelectorsSinceInventoryChange.has(sel);
                 const stuckOnKind = nextStep.kind === "click" &&
                     prevSignature !== null &&
                     prevSignature.startsWith("click|") &&
-                    inventory.length === prevInventorySize;
+                    inventory.length === prevInventorySize &&
+                    clickSelectorIsRepeat;
+                if (nextStep.kind === "click") {
+                    clickSelectorsSinceInventoryChange.add(sel);
+                }
                 if (sameSelector || stuckOnKind) {
                     const emptyInputs = inventory
                         .filter((e) => (e.tag === "input" || e.tag === "textarea") &&
@@ -7138,8 +7419,16 @@ ${formatInventory(input.inventory)}`,
                     // Mistral's TOS, GitHub-app sign-up, many onboarding forms
                     // gate submit on a checkbox that isn't yet ticked.
                     const uncheckedBoxes = inventory
-                        .filter((e) => e.tag === "input" &&
-                        e.type === "checkbox" &&
+                        .filter((e) => 
+                    // Native <input type=checkbox> OR a custom ARIA checkbox
+                    // (<button role="checkbox">, <div role="checkbox">). The
+                    // input-only filter missed meilisearch's required agreement,
+                    // which renders as <button role="checkbox"> — so the planner
+                    // was never told to tick it and "Next" stayed disabled. The
+                    // check() executor already handles role=checkbox (it clicks +
+                    // verifies aria-checked).
+                    ((e.tag === "input" && e.type === "checkbox") ||
+                        e.role === "checkbox") &&
                         // We can't read the actual `checked` from the inventory
                         // shape, but interactedThisRun is set after a successful
                         // `check` step. Show checkboxes the bot hasn't touched.
@@ -7323,6 +7612,34 @@ ${formatInventory(input.inventory)}`,
                     // read see the post-challenge dashboard.
                     continue;
                 }
+                // Premature-done guard. The planner sometimes concludes "nothing
+                // to extract" on an authenticated dashboard whose API keys live on
+                // a settings/API-keys page it never visited — render's case: an
+                // empty SERVICES list ("no services created yet") is NOT the same
+                // as "no API keys", which sit under Account Settings. Before
+                // accepting `done` with zero credentials captured, navigate to an
+                // unvisited canonical keys URL (same fallback list the stuck-loop
+                // escalation uses). Bounded by triedFallbackUrls — once every
+                // candidate is exhausted, `done` is honored.
+                const capturedCredCount = Object.keys(credentials).filter((k) => !NON_CREDENTIAL_KEYS.has(k)).length;
+                if (capturedCredCount === 0 && prematureDoneFallbacks < MAX_PREMATURE_DONE_FALLBACKS) {
+                    const fallback = pickStuckLoopFallbackUrl(state.url, triedFallbackUrls, args.service);
+                    if (fallback !== null) {
+                        prematureDoneFallbacks += 1;
+                        triedFallbackUrls.add(fallback);
+                        args.steps.push(`Post-verify: planner emitted done with no credential captured — ` +
+                            `navigating to an unvisited API-keys URL before giving up: ${fallback}`);
+                        try {
+                            await this.browser.goto(fallback);
+                            await this.browser.waitForInteractiveDom(5, 15_000);
+                        }
+                        catch (err) {
+                            args.steps.push(`Post-verify: premature-done fallback navigate failed (${err instanceof Error ? err.message : String(err)}) — continuing.`);
+                        }
+                        hint = undefined;
+                        continue;
+                    }
+                }
                 this.lastPostVerifyDoneReason = nextStep.reason;
                 break;
             }
@@ -7452,6 +7769,18 @@ ${formatInventory(input.inventory)}`,
                         // best-effort; never abort an extract pass on DOM-proximity
                         // failure (page mid-navigation etc).
                     }
+                    // "Stops at one" guard: does THIS page present >=2 distinct
+                    // credentials (masked included)? If so, hold the loop open past
+                    // the first key so the reveal pass + DOM harvest get more rounds
+                    // to capture the siblings — even when only one value is in hand
+                    // right now. Bounded downstream by roundsSinceLastNewCredential.
+                    if (!pageOffersMultiCred) {
+                        const presented = await this.countPresentedCredentialLabels();
+                        if (presented >= 2) {
+                            pageOffersMultiCred = true;
+                            args.steps.push(`Post-verify ${round + 1}/${args.maxRounds}: page presents ${presented} distinct credentials — holding the loop open to harvest all (not just the first).`);
+                        }
+                    }
                     // Anything found across all tiers? hasMultiCredCredentials
                     // also catches non-api_key labels (cloud_name, application_id).
                     if (hasAnyExtractedCredential(credentials)) {