@trusty-squire/mcp 1.0.0 → 1.0.1-rc.1

package/README.md

@@ -60,14 +60,12 @@ The agent drives the browser step by step; the key lands in your vault, never in
 
 ## Tools
 
-| Tool | What it does |
-|---|---|
-| `operate_start` / `observe` / `act` | Open a scoped browser session, read the page, take one action at a time. |
-| `operate_extract` | Reveal and capture credentials from the current page. |
-| `operate_remember` / `operate_use` | Save a successful run as a skill; replay it by name in ~30s. |
-| `operate_finish_task` / `operate_finish` | Close with an outcome (store credentials) or just release the browser. |
-| `grant_app_access` | Mint a scoped, revocable key for a deployed app (egress grant). |
-| `list_credentials` / `use_credential` | Browse the vault; call an API through it without exposing the raw secret. |
+- `operate_start` / `operate_observe` / `operate_act` — open a scoped browser session, read the page, act one step at a time.
+- `operate_extract` — reveal and capture credentials from the current page.
+- `operate_remember` / `operate_use` — save a successful run as a skill; replay it by name in ~30s.
+- `operate_finish_task` / `operate_finish` — finish with an outcome (store credentials) or just release the browser.
+- `grant_app_access` — mint a scoped, revocable key for a deployed app (egress grant).
+- `list_credentials` / `use_credential` — browse the vault; call an API through it without exposing the raw secret.
 
 ## How it works
 
@@ -86,13 +84,9 @@ A thin local MCP server that drives a real browser on your machine:
 
 ## Configuration
 
-| Env var | Default | Purpose |
-|---|---|---|
-| `TRUSTY_SQUIRE_API_BASE` | `https://trusty-squire-api.fly.dev` | API gateway URL |
-| `UNIVERSAL_BOT_PREFER_CHEAP` | `true` | Cheap-tier vision planning; premium fallback only on parse failure |
-| `UNIVERSAL_BOT_MAX_LLM_CALLS` | `15` | Per-run circuit breaker |
-| `UNIVERSAL_BOT_PROXY_URL` | — | Residential proxy (`socks5://…`); datacenter egress only unless `UNIVERSAL_BOT_PROXY_ALWAYS=true` |
-| `UNIVERSAL_BOT_HEADLESS` | `false` | Force Chromium-headless (only when you want no display surface) |
+No setup needed for normal use — `connect` wires everything up. Advanced bot
+knobs (residential proxy, LLM tier, per-run call cap, API gateway override) are
+documented in [the repo](https://github.com/Trusty-Squire/trusty-squire).
 
 ## Security & privacy
 

package/dist/bot/credential-text.d.ts

@@ -0,0 +1,4 @@
+export declare function isTruncatedCapture(sourceText: string, capturedKey: string): boolean;
+export declare function extractApiKeyFromText(text: string): string | null;
+export declare function isCredentialNoiseCandidate(candidate: string): boolean;
+//# sourceMappingURL=credential-text.d.ts.map

package/dist/bot/credential-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-text.d.ts","sourceRoot":"","sources":["../../src/bot/credential-text.ts"],"names":[],"mappings":"AAwDA,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAYnF;AAeD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkJjE;AAkED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAKrE"}

package/dist/bot/credential-text.js

@@ -0,0 +1,297 @@
+// credential-text.ts — pull a credential VALUE out of a blob of visible page
+// text, and reject candidates that are truncated displays or password-manager
+// UI noise. Carved out of agent.ts (the retired universal-bot monolith); these
+// are the browser-free, regex-driven extraction predicates the provision
+// session + skill replay paths share.
+//
+// Distinct from credential-shape.ts: that module answers "is this string
+// shaped like a credential" (a tight host-side gate); this one answers "given a
+// page of text, WHICH substring is the credential" (service-prefix + labeled
+// regex library) plus the two candidate-rejection helpers replay uses.
+// Real API keys / bearer tokens are short (Stripe ~32, JWT ~hundreds
+// but our labeled patterns don't target JWTs). Captcha challenge
+// tokens are very long: g-recaptcha-response runs ~500-2000 chars and
+// cf-turnstile-response is similar. A 100-char ceiling cleanly admits
+// real keys and rejects every captcha token shape we've seen.
+const MAX_CREDENTIAL_LENGTH = 100;
+// Substrings that, if present in a candidate, mark it as a
+// challenge/cookie token rather than a credential. Cloudflare clearance
+// cookies (`__cf`, `cf_clearance`), CDN challenge paths (`cdn-cgi`),
+// and the visible field/param names of the two captcha widgets.
+const CAPTCHA_TOKEN_MARKERS = [
+    "__cf",
+    "cf_clearance",
+    "cdn-cgi",
+    "cf-turnstile-response",
+    "g-recaptcha-response",
+    "h-captcha-response",
+];
+// Distinctive service key prefixes. If a *labeled* match's value
+// embeds one of these NOT at its start, the regex straddled glued UI
+// text on a dense dashboard (e.g. Render's API-keys list rendered as
+// "...Name bot-key Menu Key rnd_xxxx" with no separators) — the real
+// key starts at the prefix, so the labeled match is contaminated and
+// must be rejected. A clean labeled key either starts with its prefix
+// (then the prefixed patterns above already caught it) or carries no
+// known prefix at all.
+const EMBEDDED_KEY_PREFIXES = [
+    "rnd_",
+    "phc_",
+    "sk_live_",
+    "sk_test_",
+    "pk_live_",
+    "pk_test_",
+];
+// True when `capturedKey` is followed by a truncation marker (`...`
+// or the Unicode ellipsis `…`) in `sourceText`. That marker is the
+// signal that the visible display masked the full secret — the
+// regex captured everything up to but not including the marker, so
+// the value LOOKS valid but is short. Used by F10's
+// extract-via-Copy-button recovery path; without this check, the
+// bot accepts the truncated value, stores it, and the user discovers
+// the failure only when their next API call returns 401.
+export function isTruncatedCapture(sourceText, capturedKey) {
+    const idx = sourceText.indexOf(capturedKey);
+    if (idx < 0)
+        return false;
+    const after = sourceText.slice(idx + capturedKey.length, idx + capturedKey.length + 10);
+    // Whitespace OK between key and ellipsis (some modals render as
+    // "sk-or-v1-xxxx ..."). Three OR MORE dots; two dots are ordinary
+    // punctuation and would false-positive on e.g. "key value.." in
+    // help text.
+    return /^\s*(?:\.{3,}|…)/.test(after);
+}
+// Pull an API key out of the *visible* page text.
+//
+// Two strategies, in priority order:
+//   1. Known service-specific prefixes (re_, sk_live_, …) — high
+//      confidence, the prefix itself is the proof.
+//   2. Labeled patterns ("api key: <value>") — lower confidence, so
+//      they carry guard rails: the value must sit IMMEDIATELY after
+//      the label (a small bounded gap of spaces/colon/equals, NOT
+//      arbitrary whitespace that could span unrelated page sections),
+//      must be under MAX_CREDENTIAL_LENGTH, and must not look like a
+//      captcha/cookie token. Without these, a `g-recaptcha-response`
+//      value or a session token elsewhere in the body could be
+//      mistaken for `credentials.api_key`.
+export function extractApiKeyFromText(text) {
+    const prefixed = [
+        /\bre_[a-zA-Z0-9_]{20,}\b/, // Resend (key body contains underscores)
+        /\bsk_(?:live|test)_[a-zA-Z0-9]{20,}\b/, // Stripe secret
+        // NOTE: client-embedded PUBLIC keys are deliberately NOT matched —
+        // Stripe publishable (pk_live_/pk_test_) and PostHog project
+        // (phc_) keys ship in the client-side JS of every site that uses
+        // those vendors, so finding one on a page means "this service
+        // embeds Stripe/PostHog", not "here is the user's credential".
+        // Each produced a false success on Mistral (its billing pk_live_,
+        // then its analytics phc_, surfaced as the api_key).
+        // Plunk is the EXCEPTION: its API key is `pk_<hex>` (e.g.
+        // pk_e063df9b5…) and IS the user's credential, shown in plaintext on
+        // the dashboard under an "API Key" label. The pure-hex body after the
+        // prefix distinguishes it from Stripe publishable keys (pk_live_/
+        // pk_test_ — a "live"/"test" segment, not hex), so this can't re-open
+        // the embedded-public-key false-positive the note above warns about.
+        /\bpk_[a-f0-9]{24,}\b/, // Plunk (hex public/API key — NOT Stripe pk_live_/pk_test_)
+        /\bkey-[a-f0-9]{32}\b/, // Mailgun
+        /\bSG\.[a-zA-Z0-9_\-]{20,}\.[a-zA-Z0-9_\-]{20,}\b/, // SendGrid
+        /\brnd_[a-zA-Z0-9]{20,}\b/, // Render
+        /\bsntry[su]_[A-Za-z0-9_=\-]{20,}/, // Sentry org/user auth token
+        // Neon serverless Postgres. Modal renders `napi_<48-char-alnum>` and
+        // also shows a truncated `napi_xxx…` in the visible text below the
+        // input field. Without the prefix here, the bot saw the truncated
+        // display, isTruncatedCapture rejected the partial value, every
+        // pass returned null, and the planner gave up despite the full key
+        // being in the input field's `value` attribute. rc.14 — surfaced
+        // during the harvester rc.13 pass on Neon.
+        /\bnapi_[a-zA-Z0-9]{30,80}\b/, // Neon
+        // 0.8.3-rc.1 — typeform personal access tokens. Shape
+        // `tfp_<alnum-with-underscore>` length 40-80. Surfaced during the
+        // 2026-05-29 retest where the planner SAW the token (quoted in
+        // reason) but no regex matched, so extractCredentials returned
+        // null and the bot bailed `oauth_onboarding_failed`.
+        /\btfp_[A-Za-z0-9_]{40,80}\b/, // Typeform
+        // Replicate API tokens. `r8_<40-char alnum>` per their docs. Shown
+        // in the table row after Create. The post-verify loop iterates,
+        // adds rows, but extractCredentials returned null every round
+        // until rc.20 because no regex matched. Added defensively after
+        // the rc.13 verification pass showed Replicate burning the full
+        // 12-round budget filling-creating tokens nobody could extract.
+        /\br8_[a-zA-Z0-9]{30,60}\b/, // Replicate
+        // rc.23 — added after the post-rc.22 registry-snapshot review of
+        // 200 failed signups. Each pattern matches a token shape the
+        // bot's planner had already QUOTED in its `reason` field (i.e.
+        // the credential was visible on the page, just not in a shape
+        // any prior regex recognised). The redact.{ts,mjs} pattern set
+        // stays in lockstep with these.
+        /\bpscale_tkn_[A-Za-z0-9]{30,60}\b/, // PlanetScale Service Token
+        /\bsbp_[a-zA-Z0-9]{30,80}\b/, // Supabase Personal Access Token
+        // Baseten: `<6-12 alnum>.<30+ alnum>`. The dot separator + length
+        // bounds on both sides distinguish it from version strings (too
+        // short on either side). rc.35 — relaxed the prefix to mixed-case
+        // after the rc.33 broad sweep showed a Baseten key whose prefix
+        // had uppercase letters: `HP9tFTtm.txDl4vv7ayYsTwx9dQea47ylRdN4Brk3`.
+        /\b[A-Za-z0-9]{6,12}\.[A-Za-z0-9]{30,50}\b/, // Baseten
+        // Qdrant Cloud: `<UUID>|<55-char opaque>` — a literal pipe between
+        // a key id and the secret body. Unique enough that no false-
+        // positive guard is needed.
+        //
+        // rc.34/rc.36 — extended the secret-body character class to
+        // include underscore + hyphen. rc.35 broad sweep surfaced
+        // another Qdrant shape with mid-body hyphens:
+        // `<UUID>|e8L7oyi-5fHa327u7x-IQN6WivtPlpIVjT-giIsrXDZW7P-8i2G9Pw`.
+        // [A-Za-z0-9_-] covers both observed shapes; the {30,80} length
+        // bound + UUID prefix keep false-positive risk near zero.
+        /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\|[A-Za-z0-9_\-]{30,80}\b/i, // Qdrant
+        // JWT (eyJ...eyJ...sig) — Convex's API "token" is a JWT. Other
+        // services may emit JWTs as bearer secrets too. Three-segment
+        // base64url with literal dots. Conservative bounds — under 20
+        // chars per segment is almost never a real JWT.
+        /\beyJ[A-Za-z0-9_\-]{20,}\.eyJ[A-Za-z0-9_\-]{20,}\.[A-Za-z0-9_\-]{20,}\b/, // JWT
+        // Zeabur's API key — `sk-<28-40 lowercase alnum>`. Shorter than
+        // OpenAI legacy (which is 40+ mixed-case). The lowercase-only
+        // character class differentiates from OpenAI legacy so this
+        // pattern only fires on Zeabur-style keys. Surfaced from the
+        // rc.23 snapshot review.
+        /\bsk-[a-z0-9]{28,38}\b/, // Zeabur
+        // PostHog PERSONAL API key — `phx_<43+ alnum>`. MEASURED 2026-06-24: the
+        // post-OAuth create-personal-api-key flow mints a `phx_`-prefixed secret —
+        // the planner SAW it (and even OCR-transcribed it with errors), but no regex
+        // matched so the DOM extractor stored nothing and the run bailed
+        // oauth_onboarding_failed while a real key sat on the page. The {40,60}
+        // bound keeps it clear of short prefixed noise. Deliberately NOT matching
+        // the `phc_` PROJECT key —
+        // that's a PUBLIC analytics key embedded in client JS on every PostHog site
+        // (see extract-credentials.test "ignores a PostHog project key").
+        /\bphx_[A-Za-z0-9]{40,60}\b/, // PostHog personal API key
+        // OpenRouter, Anthropic, OpenAI — these are the dominant
+        // OAuth-completed-then-copy-needed services. Specific-prefix
+        // patterns first so a labeled-pattern fallback isn't load-
+        // bearing for them. Putting `sk-or-v1-` before `sk-` so it wins
+        // when both could match (cosmetic; both capture the same value).
+        // 0.6.15-rc.8 — character-class anchored so the greedy match
+        // doesn't glue trailing modal text. extractText() returns body
+        // as one concatenated string, so a key followed by "Please copy
+        // this" with no separator looked like `sk-or-v1-<64hex>Please…`.
+        // The hex-only class terminates at the first non-hex char.
+        /\bsk-or-v1-[a-f0-9]{40,80}/i, // OpenRouter (sk-or-v1-<64hex>)
+        /\bsk-ant-[a-zA-Z0-9_-]{40,120}/, // Anthropic (sk-ant-<urlsafe-b64>)
+        /\bsk-proj-[a-zA-Z0-9_-]{40,200}/, // OpenAI project key
+        /\bsk-[a-zA-Z0-9]{40,60}/, // OpenAI legacy (`sk-` + ~48 chars, no dashes)
+    ];
+    for (const pattern of prefixed) {
+        const match = text.match(pattern);
+        if (match !== null)
+            return match[0];
+    }
+    // Labeled patterns. The label and value MUST be separated by a real
+    // separator — a colon/equals, or whitespace — `(?:[ \t]*[:=][ \t]*|[ \t]+)`,
+    // never a newline. A MANDATORY separator is what keeps the regex from
+    // latching the label onto glued dashboard nav text: a sidebar
+    // rendering "API Keys" "Webhooks" "Settings" as adjacent links
+    // concatenates in textContent to "API KeysWebhooksSettings…", and an
+    // optional-gap regex would capture "sWebhooksSettings…" as the key
+    // (Resend false-positive). Requiring `:`/`=`/space means "API Key"
+    // followed immediately by a letter does not match.
+    const labeled = [
+        /(?:api[_\s-]?key|access[_\s-]?token|secret[_\s-]?key)(?:[ \t]*[:=][ \t]*|[ \t]+)([a-zA-Z0-9_\-]{20,})/i,
+        /\b[Bb]earer[ \t]+([a-zA-Z0-9_\-.]{30,})/,
+        // UUID-style tokens (Railway uses bare UUIDs for API tokens; some
+        // smaller services do too). MUST be labeled — bare UUIDs appear all
+        // over dashboards as trace IDs, project IDs, and request IDs, so an
+        // unlabeled UUID regex would false-positive on the first error page
+        // the bot lands on. The label set is broader than the prefix-style
+        // labeled regex above because Railway specifically renders "Token"
+        // (not "API key") next to the value.
+        /(?:api[_\s-]?token|api[_\s-]?key|access[_\s-]?token|new[_\s-]?token|\btoken|\bsecret)(?:[ \t\n]*[:=][ \t\n]*|[ \t\n]+)([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b/i,
+    ];
+    for (const pattern of labeled) {
+        const match = text.match(pattern);
+        const candidate = match?.[1];
+        if (candidate === undefined)
+            continue;
+        // A captcha challenge token: too long for a real key, and/or
+        // carries a known cookie/widget marker.
+        if (candidate.length > MAX_CREDENTIAL_LENGTH)
+            continue;
+        const lower = candidate.toLowerCase();
+        if (CAPTCHA_TOKEN_MARKERS.some((marker) => lower.includes(marker)))
+            continue;
+        // Contaminated: the labeled match straddled glued dashboard text
+        // onto a real key (the key prefix sits mid-candidate, not at 0).
+        if (EMBEDDED_KEY_PREFIXES.some((p) => lower.indexOf(p) > 0))
+            continue;
+        return candidate;
+    }
+    return null;
+}
+// Password-manager / autofill UI affordances that render as short
+// word-tokens on credential pages. A render API-keys page ships a
+// "Save to 1Password" / "1Password" autofill button next to the real
+// `rnd_…` key; LastPass, Bitwarden, and Dashlane do the same. These
+// strings are alphanumeric, often carry a digit ("1Password"), and sit
+// EARLIER in DOM order than the credential — so the validator-blind
+// candidate-scan tiers (replay-skill.ts) used to return them as the
+// "credential" and the downstream length validator then rejected them
+// (the 0DTW2V66 render skill: `got="1Password" length 9 below min 32`).
+// They are never credentials; reject them at the candidate layer so the
+// scan moves on to the real key instead of the right key being shadowed
+// by a UI word. Matched case-insensitively as a whole token (the
+// candidates the scan tiers feed in are already whitespace-trimmed
+// single tokens).
+const CREDENTIAL_NOISE_TOKENS = [
+    "1password",
+    "lastpass",
+    "bitwarden",
+    "dashlane",
+    "keepass",
+    "keeper",
+    "nordpass",
+    "proton pass",
+    "protonpass",
+    "autofill",
+    "passwords",
+    // Cookie-consent widget vocabulary (CookieScript/OneTrust-class banners
+    // render these as checkbox values and category labels on EVERY page,
+    // earlier in DOM order than any credential — zilliz's banner fed
+    // "personalization" to the validator-shaped scan tier as the "key").
+    // Whole-token equality with a generic English word is never a real
+    // credential, so rejecting these costs nothing.
+    "necessary",
+    "analytics",
+    "personalization",
+    "personalisation",
+    "advertising",
+    "advertisement",
+    "marketing",
+    "functional",
+    "preferences",
+    "statistics",
+    "performance",
+    "targeting",
+    "unclassified",
+    "security",
+];
+// Verb-prefixed UI affordances ("Save to 1Password", "Copy to
+// clipboard", "Add to vault"). The candidate-scan tiers tokenize on
+// whitespace so a multi-word affordance rarely survives as one
+// candidate — but extractText()/innerText passes glue it together, so
+// guard the leading verbs too.
+const CREDENTIAL_NOISE_PREFIXES = [
+    "save to ",
+    "copy to ",
+    "add to ",
+    "store in ",
+];
+// True when a candidate string is a password-manager / autofill UI
+// affordance rather than a real credential value. Used by the replay
+// engine's raw-candidate scan tiers to keep "1Password"-class words
+// out of the credential slot.
+export function isCredentialNoiseCandidate(candidate) {
+    const lower = candidate.trim().toLowerCase();
+    if (lower.length === 0)
+        return false;
+    if (CREDENTIAL_NOISE_TOKENS.includes(lower))
+        return true;
+    return CREDENTIAL_NOISE_PREFIXES.some((p) => lower.startsWith(p));
+}
+//# sourceMappingURL=credential-text.js.map

package/dist/bot/credential-text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-text.js","sourceRoot":"","sources":["../../src/bot/credential-text.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,yEAAyE;AACzE,sCAAsC;AACtC,EAAE;AACF,yEAAyE;AACzE,gFAAgF;AAChF,6EAA6E;AAC7E,uEAAuE;AAEvE,qEAAqE;AACrE,iEAAiE;AACjE,sEAAsE;AACtE,sEAAsE;AACtE,8DAA8D;AAC9D,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,2DAA2D;AAC3D,wEAAwE;AACxE,qEAAqE;AACrE,gEAAgE;AAChE,MAAM,qBAAqB,GAAsB;IAC/C,MAAM;IACN,cAAc;IACd,SAAS;IACT,uBAAuB;IACvB,sBAAsB;IACtB,oBAAoB;CACrB,CAAC;AAEF,iEAAiE;AACjE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,sEAAsE;AACtE,qEAAqE;AACrE,uBAAuB;AACvB,MAAM,qBAAqB,GAAsB;IAC/C,MAAM;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;CACX,CAAC;AAEF,oEAAoE;AACpE,mEAAmE;AACnE,+DAA+D;AAC/D,mEAAmE;AACnE,oDAAoD;AACpD,iEAAiE;AACjE,qEAAqE;AACrE,yDAAyD;AACzD,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;IACxE,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAC5B,GAAG,GAAG,WAAW,CAAC,MAAM,EACxB,GAAG,GAAG,WAAW,CAAC,MAAM,GAAG,EAAE,CAC9B,CAAC;IACF,gEAAgE;IAChE,kEAAkE;IAClE,gEAAgE;IAChE,aAAa;IACb,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,kDAAkD;AAClD,EAAE;AACF,qCAAqC;AACrC,iEAAiE;AACjE,mDAAmD;AACnD,oEAAoE;AACpE,oEAAoE;AACpE,kEAAkE;AAClE,sEAAsE;AACtE,qEAAqE;AACrE,qEAAqE;AACrE,+DAA+D;AAC/D,2CAA2C;AAC3C,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,QAAQ,GAAsB;QAClC,0BAA0B,EAAE,yCAAyC;QACrE,uCAAuC,EAAE,gBAAgB;QACzD,mEAAmE;QACnE,6DAA6D;QAC7D,iEAAiE;QACjE,8DAA8D;QAC9D,+DAA+D;QAC/D,kEAAkE;QAClE,qDAAqD;QACrD,0DAA0D;QAC1D,qEAAqE;QACrE,sEAAsE;QACtE,kEAAkE;QAClE,sEAAsE;QACtE,qEAAqE;QACrE,sBAAsB,EAAE,4DAA4D;QACpF,sBAAsB,EAAE,UAAU;QAClC,kDAAkD,EAAE,WAAW;QAC/D,0BAA0B,EAAE,SAAS;QACrC,kCAAkC,EAAE,6BAA6B;QACjE,qEAAqE;QACrE,mEAAmE;QACnE,kEAAkE;QAClE,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,2CAA2C;QAC3C,6BAA6B,EAAE,OAAO;QACtC,sDAAsD;QACtD,kEAAkE;QAClE,+DAA+D;QAC/D,+DAA+D;QAC/D,qDAAqD;QACrD,6BAA6B,EAAE,WAAW;QAC1C,mEAAmE;QACnE,gEAAgE;QAChE,8DAA8D;QAC9D,gEAAgE;QAChE,gEAAgE;QAChE,gEAAgE;QAChE,2BAA2B,EAAE,YAAY;QACzC,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,gCAAgC;QAChC,mCAAmC,EAAE,4BAA4B;QACjE,4BAA4B,EAAE,iCAAiC;QAC/D,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,sEAAsE;QACtE,2CAA2C,EAAE,UAAU;QACvD,mEAAmE;QACnE,6DAA6D;QAC7D,4BAA4B;QAC5B,EAAE;QACF,4DAA4D;QAC5D,0DAA0D;QAC1D,8CAA8C;QAC9C,mEAAmE;QACnE,gEAAgE;QAChE,0DAA0D;QAC1D,0FAA0F,EAAE,SAAS;QACrG,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,gDAAgD;QAChD,yEAAyE,EAAE,MAAM;QACjF,gEAAgE;QAChE,8DAA8D;QAC9D,4DAA4D;QAC5D,6DAA6D;QAC7D,yBAAyB;QACzB,wBAAwB,EAAE,SAAS;QACnC,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,iEAAiE;QACjE,wEAAwE;QACxE,0EAA0E;QAC1E,2BAA2B;QAC3B,4EAA4E;QAC5E,kEAAkE;QAClE,4BAA4B,EAAE,2BAA2B;QACzD,yDAAyD;QACzD,6DAA6D;QAC7D,2DAA2D;QAC3D,gEAAgE;QAChE,iEAAiE;QACjE,6DAA6D;QAC7D,+DAA+D;QAC/D,gEAAgE;QAChE,iEAAiE;QACjE,2DAA2D;QAC3D,6BAA6B,EAAE,gCAAgC;QAC/D,gCAAgC,EAAE,mCAAmC;QACrE,iCAAiC,EAAE,qBAAqB;QACxD,yBAAyB,EAAE,+CAA+C;KAC3E,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,oEAAoE;IACpE,6EAA6E;IAC7E,sEAAsE;IACtE,8DAA8D;IAC9D,+DAA+D;IAC/D,qEAAqE;IACrE,mEAAmE;IACnE,mEAAmE;IACnE,mDAAmD;IACnD,MAAM,OAAO,GAAsB;QACjC,wGAAwG;QACxG,yCAAyC;QACzC,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,mEAAmE;QACnE,mEAAmE;QACnE,qCAAqC;QACrC,yLAAyL;KAC1L,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,6DAA6D;QAC7D,wCAAwC;QACxC,IAAI,SAAS,CAAC,MAAM,GAAG,qBAAqB;YAAE,SAAS;QACvD,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACtC,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAAE,SAAS;QAC7E,iEAAiE;QACjE,iEAAiE;QACjE,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,SAAS;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,kEAAkE;AAClE,qEAAqE;AACrE,oEAAoE;AACpE,uEAAuE;AACvE,oEAAoE;AACpE,oEAAoE;AACpE,sEAAsE;AACtE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,iEAAiE;AACjE,mEAAmE;AACnE,kBAAkB;AAClB,MAAM,uBAAuB,GAAsB;IACjD,WAAW;IACX,UAAU;IACV,WAAW;IACX,UAAU;IACV,SAAS;IACT,QAAQ;IACR,UAAU;IACV,aAAa;IACb,YAAY;IACZ,UAAU;IACV,WAAW;IACX,wEAAwE;IACxE,qEAAqE;IACrE,iEAAiE;IACjE,qEAAqE;IACrE,mEAAmE;IACnE,gDAAgD;IAChD,WAAW;IACX,WAAW;IACX,iBAAiB;IACjB,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,WAAW;IACX,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,aAAa;IACb,WAAW;IACX,cAAc;IACd,UAAU;CACX,CAAC;AAEF,8DAA8D;AAC9D,oEAAoE;AACpE,+DAA+D;AAC/D,sEAAsE;AACtE,+BAA+B;AAC/B,MAAM,yBAAyB,GAAsB;IACnD,UAAU;IACV,UAAU;IACV,SAAS;IACT,WAAW;CACZ,CAAC;AAEF,mEAAmE;AACnE,qEAAqE;AACrE,oEAAoE;AACpE,8BAA8B;AAC9B,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC1D,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/bot/email-verification.d.ts

@@ -0,0 +1,2 @@
+export declare function pickVerificationLink(links: readonly string[]): string | null;
+//# sourceMappingURL=email-verification.d.ts.map

package/dist/bot/email-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.d.ts","sourceRoot":"","sources":["../../src/bot/email-verification.ts"],"names":[],"mappings":"AAYA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAgB5E"}

package/dist/bot/email-verification.js

@@ -0,0 +1,47 @@
+// email-verification.ts — choose which link in a verification email to click.
+// Carved out of agent.ts (the retired universal-bot monolith); the provision
+// session uses this to follow the confirm/activate link without navigating to
+// an unsubscribe or asset URL.
+// Choose which link in a verification email to click. Scores each URL
+// by keyword and picks the best — but only if it scored positive.
+//
+// The all-negative case is the bug this guards: an email whose only
+// links are unsubscribe/preferences scores <= 0 everywhere, and an
+// earlier version returned links[0] anyway, navigating the bot straight
+// to an unsubscribe URL.
+export function pickVerificationLink(links) {
+    const scored = links.map((url) => {
+        const lower = url.toLowerCase();
+        let score = 0;
+        if (isEmailAssetLink(lower))
+            score -= 50;
+        if (lower.includes("verify") || lower.includes("confirm"))
+            score += 10;
+        if (lower.includes("activate"))
+            score += 8;
+        if (lower.includes("welcome"))
+            score += 3;
+        if (lower.includes("unsubscribe") || lower.includes("preferences"))
+            score -= 10;
+        return { url, score };
+    });
+    scored.sort((a, b) => b.score - a.score);
+    const top = scored[0];
+    return top !== undefined && top.score > 0
+        ? top.url.replace(/&amp;/gi, "&")
+        : null;
+}
+function isEmailAssetLink(rawUrl) {
+    try {
+        const u = new URL(rawUrl.replace(/&amp;/g, "&"));
+        const host = u.hostname.toLowerCase();
+        const path = u.pathname.toLowerCase();
+        return (/\.(?:png|jpe?g|gif|webp|svg|ico|css|woff2?|ttf|otf)(?:$|[?#])/.test(path) ||
+            /^(?:static|cdn|assets|images|img|media)\./.test(host) ||
+            /\/(?:static|assets|images|img|media)\//.test(path));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=email-verification.js.map

package/dist/bot/email-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.js","sourceRoot":"","sources":["../../src/bot/email-verification.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,+BAA+B;AAE/B,sEAAsE;AACtE,kEAAkE;AAClE,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,wEAAwE;AACxE,yBAAyB;AACzB,MAAM,UAAU,oBAAoB,CAAC,KAAwB;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,gBAAgB,CAAC,KAAK,CAAC;YAAE,KAAK,IAAI,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,KAAK,IAAI,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,KAAK,IAAI,EAAE,CAAC;QAChF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO,CACL,+DAA+D,CAAC,IAAI,CAAC,IAAI,CAAC;YAC1E,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC;YACtD,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/bot/google-login.d.ts

@@ -34,6 +34,7 @@ export declare function ensureOAuthSession(opts?: {
     apiBaseUrl?: string;
     forceOpen?: boolean;
 }): Promise<LoginResult>;
+export declare function extractGoogleAccountEmail(pageText: string): string | null;
 export declare function openInstallConfirmInBotChrome(opts: {
     confirmUrl: string;
     pollUntilClaimed: (context: BrowserContext) => Promise<boolean>;

package/dist/bot/google-login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-login.d.ts","sourceRoot":"","sources":["../../src/bot/google-login.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAsG5D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,OAAO,CAAC;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAmDD,wBAAsB,4BAA4B,CAChD,UAAU,GAAE,MAA2B,GACtC,OAAO,CAAC,eAAe,EAAE,CAAC,CAyB5B;AAUD,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,aAAa,GACb,WAAW,GACX,YAAY,CAAC;AAEjB,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAwCtF;AA+BD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CA2BlE;AAMD,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEjE;AAaD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB/D;AAUD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBpE;AAGD,wBAAgB,UAAU,IAAI,OAAO,CAsBpC;AAWD,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAe9C;AAaD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGjD;AAiJD,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IAGjB,aAAa,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAG7D,WAAW,EAAE,MAAM,CAAC;IAIpB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAO1D,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,GAAG,qBAAqB,GAAG,SAAS,CAAA;CAAE,CAAC,CAsBtE;AAuRD,wBAAsB,kBAAkB,CAAC,IAAI,CAAC,EAAE;IAC9C,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IAQpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,OAAO,CAAC,WAAW,CAAC,CA8DvB;AASD,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,UAAU,EAAE,MAAM,CAAC;IAOnB,gBAAgB,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IAIxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoDxE"}
+{"version":3,"file":"google-login.d.ts","sourceRoot":"","sources":["../../src/bot/google-login.ts"],"names":[],"mappings":"AA6CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAsG5D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,SAAS,GAAG,OAAO,CAAC;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAmDD,wBAAsB,4BAA4B,CAChD,UAAU,GAAE,MAA2B,GACtC,OAAO,CAAC,eAAe,EAAE,CAAC,CAyB5B;AAUD,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,aAAa,GACb,WAAW,GACX,YAAY,CAAC;AAEjB,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,CAwCtF;AA+BD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CA2BlE;AAMD,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEjE;AAaD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB/D;AAUD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBpE;AAGD,wBAAgB,UAAU,IAAI,OAAO,CAsBpC;AAWD,wBAAgB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAe9C;AAaD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGjD;AAiJD,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IAGjB,aAAa,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAG7D,WAAW,EAAE,MAAM,CAAC;IAIpB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAO1D,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKvD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC;IAAE,MAAM,EAAE,WAAW,GAAG,qBAAqB,GAAG,SAAS,CAAA;CAAE,CAAC,CAsBtE;AAuRD,wBAAsB,kBAAkB,CAAC,IAAI,CAAC,EAAE;IAC9C,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IAQpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GAAG,OAAO,CAAC,WAAW,CAAC,CA8DvB;AASD,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQzE;AAgCD,wBAAsB,6BAA6B,CAAC,IAAI,EAAE;IACxD,UAAU,EAAE,MAAM,CAAC;IAOnB,gBAAgB,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IAIxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyDxE"}

package/dist/bot/google-login.js

@@ -32,7 +32,7 @@ import boxen from "boxen";
 import chalk from "chalk";
 import { shortenVncUrl } from "../api-client.js";
 import { CHROME_PROFILE_DIR, launchWithProfileGate, ProfileBusyError, waitForProfileFree } from "./profile.js";
-import { markProviderLoggedIn } from "./login-state.js";
+import { markProviderLoggedIn, recordProviderEmail } from "./login-state.js";
 import { randomBytes } from "node:crypto";
 const require = createRequire(import.meta.url);
 // Route the INTERACTIVE login through the same proxy the bot uses, so the
@@ -871,6 +871,46 @@ export async function ensureOAuthSession(opts) {
         return { status: "error", detail: err instanceof Error ? err.message : String(err) };
     }
 }
+// PR3 signin-vault: pull the signed-in Google address out of an account page's
+// text. The OneGoogle account chip carries an aria-label like
+// "Google Account: Ada Lovelace (ada@example.com)" on every Google surface, so
+// prefer that anchored match; fall back to the first email-shaped token (the
+// myaccount.google.com page renders the address prominently). Pure + exported
+// for unit tests — the live navigation that feeds it is captureGoogleEmail.
+const EMAIL_TOKEN_RE = /[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/i;
+export function extractGoogleAccountEmail(pageText) {
+    const chip = /Google Account:[^()]*\(([^)]+)\)/i.exec(pageText);
+    if (chip?.[1] !== undefined) {
+        const m = EMAIL_TOKEN_RE.exec(chip[1]);
+        if (m !== null)
+            return m[0].trim();
+    }
+    const any = EMAIL_TOKEN_RE.exec(pageText);
+    return any !== null ? any[0].trim() : null;
+}
+// Capture-at-login: with the profile's live Google session, read the account's
+// email once and persist it to the profile marker so provision can fill it as
+// the signup email (user-owned accounts) without a per-run scrape. Best-effort:
+// any failure leaves the marker unset and provision proceeds without a pre-known
+// email. Only meaningful for google (the inbox identity); github has no inbox.
+async function captureGoogleEmail(context, profileDir) {
+    let page = null;
+    try {
+        page = await context.newPage();
+        await page.goto("https://myaccount.google.com/", { waitUntil: "domcontentloaded", timeout: 15_000 });
+        const text = await page.evaluate(() => document.body.innerText).catch(() => "");
+        const email = extractGoogleAccountEmail(text);
+        if (email !== null)
+            recordProviderEmail("google", email, profileDir);
+    }
+    catch {
+        /* best-effort — no pre-known email this run */
+    }
+    finally {
+        if (page !== null)
+            await page.close().catch(() => undefined);
+    }
+}
 // Public entry for the install flow: opens the trustysquire /install
 // confirm URL in the bot's persistent Chrome profile, runs the
 // user-supplied check until the install is claimed (or the deadline
@@ -917,8 +957,13 @@ export async function openInstallConfirmInBotChrome(opts) {
                             break;
                         }
                     }
-                    if (hit)
+                    if (hit) {
                         markProviderLoggedIn(provider, profileDir);
+                        // Capture-at-login: store the Google email now (the one moment it's
+                        // certain) so provision fills it as the user-owned signup email.
+                        if (provider === "google")
+                            await captureGoogleEmail(context, profileDir);
+                    }
                 }
             },
         });