@validate.qa/runner 1.0.92 → 1.0.93

package/dist/cli.js

@@ -8555,6 +8555,127 @@ var require_scrub_credentials = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/google-signin.js
+var require_google_signin = __commonJS({
+  "../runner-core/dist/services/google-signin.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.GOOGLE_SIGNIN_ENV_KEYS = exports2.GOOGLE_SIGNIN_PASSWORD_KEY = void 0;
+    exports2.loadGoogleSignInConfig = loadGoogleSignInConfig;
+    exports2.mergeGoogleSignInSecrets = mergeGoogleSignInSecrets;
+    exports2.googleSignInGuidanceOpts = googleSignInGuidanceOpts;
+    exports2.googleSignInAllowedEmails = googleSignInAllowedEmails;
+    exports2.collectGoogleSignInEnv = collectGoogleSignInEnv;
+    exports2.generateTotp = generateTotp;
+    exports2.buildGoogleSignInPromptSection = buildGoogleSignInPromptSection;
+    var node_crypto_1 = require("crypto");
+    exports2.GOOGLE_SIGNIN_PASSWORD_KEY = "GOOGLE_SIGNIN_PASSWORD";
+    exports2.GOOGLE_SIGNIN_ENV_KEYS = [
+      "GOOGLE_SIGNIN_PASSWORD",
+      "GOOGLE_SIGNIN_EMAIL",
+      "GOOGLE_SIGNIN_TOTP_SECRET"
+    ];
+    function trimEnv(env, name) {
+      const value = env[name]?.trim();
+      return value ? value : void 0;
+    }
+    function loadGoogleSignInConfig(env = process.env) {
+      const password = trimEnv(env, "GOOGLE_SIGNIN_PASSWORD");
+      if (!password)
+        return null;
+      const email = (trimEnv(env, "GOOGLE_SIGNIN_EMAIL") ?? trimEnv(env, "VERIFICATION_INBOX_ADDRESS"))?.toLowerCase();
+      if (!email || !email.includes("@"))
+        return null;
+      const totpSecret = trimEnv(env, "GOOGLE_SIGNIN_TOTP_SECRET");
+      return {
+        email,
+        password,
+        passwordKey: exports2.GOOGLE_SIGNIN_PASSWORD_KEY,
+        totpSecret,
+        totpAvailable: !!totpSecret
+      };
+    }
+    function mergeGoogleSignInSecrets(credentials, env = process.env) {
+      const cfg = loadGoogleSignInConfig(env);
+      if (!cfg)
+        return credentials;
+      if (credentials[exports2.GOOGLE_SIGNIN_PASSWORD_KEY])
+        return credentials;
+      return { ...credentials, [exports2.GOOGLE_SIGNIN_PASSWORD_KEY]: cfg.password };
+    }
+    function googleSignInGuidanceOpts(env = process.env) {
+      const cfg = loadGoogleSignInConfig(env);
+      if (!cfg)
+        return void 0;
+      return {
+        googleEmail: cfg.email,
+        googlePasswordKey: cfg.passwordKey,
+        googleTotpAvailable: cfg.totpAvailable
+      };
+    }
+    function googleSignInAllowedEmails(env = process.env) {
+      const cfg = loadGoogleSignInConfig(env);
+      return cfg ? [cfg.email] : [];
+    }
+    function collectGoogleSignInEnv(env = process.env) {
+      const out = {};
+      for (const key of exports2.GOOGLE_SIGNIN_ENV_KEYS) {
+        const value = env[key]?.trim();
+        if (value)
+          out[key] = value;
+      }
+      return out;
+    }
+    function generateTotp(secret, atMs = Date.now(), stepSeconds = 30, digits = 6) {
+      const key = decodeBase32(secret);
+      const counter = Math.floor(atMs / 1e3 / stepSeconds);
+      const buf = Buffer.alloc(8);
+      buf.writeUInt32BE(Math.floor(counter / 4294967296), 0);
+      buf.writeUInt32BE(counter >>> 0, 4);
+      const hmac = (0, node_crypto_1.createHmac)("sha1", key).update(buf).digest();
+      const offset = hmac[hmac.length - 1] & 15;
+      const bin = (hmac[offset] & 127) << 24 | hmac[offset + 1] << 16 | hmac[offset + 2] << 8 | hmac[offset + 3];
+      const otp = bin % 10 ** digits;
+      return String(otp).padStart(digits, "0");
+    }
+    function decodeBase32(input) {
+      const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+      const cleaned = input.toUpperCase().replace(/[\s=-]+/g, "");
+      let bits = 0;
+      let value = 0;
+      const out = [];
+      for (const ch of cleaned) {
+        const idx = alphabet.indexOf(ch);
+        if (idx < 0)
+          continue;
+        value = value << 5 | idx;
+        bits += 5;
+        if (bits >= 8) {
+          bits -= 8;
+          out.push(value >>> bits & 255);
+        }
+      }
+      return Buffer.from(out);
+    }
+    function buildGoogleSignInPromptSection(opts, variant) {
+      const totpNative = opts.googleTotpAvailable ? " If Google asks for a 2-step / Authenticator code, call `provision_google_totp` and type the 6-digit `code` it returns (do not invent a code)." : " If Google asks for 2-step verification and you have no authenticator code tool, STOP and report Google SSO as BLOCKED (2FA not configured on this runner).";
+      const totpCli = opts.googleTotpAvailable ? " If Google asks for a 2-step / Authenticator code, call `inbox_google_totp` and type the 6-digit `code` it returns." : " If Google asks for 2-step verification, STOP and report Google SSO as BLOCKED (2FA not configured on this runner).";
+      const totp = variant === "cli" ? totpCli : totpNative;
+      const fill = variant === "cli" ? `fill_credential with credentialKey \`${opts.googlePasswordKey}\`` : `\`fill_credential\` (credentialKey \`${opts.googlePasswordKey}\`)`;
+      const plainProvision = variant === "cli" ? "`inbox_provision_identity` with `plain: true`" : "`provision_identity` with `plain: true`";
+      return `
+Google / Gmail SSO fallback (SECOND choice \u2014 email+password signup is FIRST):
+- FIRST follow the email-field playbook above whenever a signup form has an email / username / password field (including after clicking "Sign up with email"). Do NOT click Google if that form exists.
+- ONLY if there is no email+password signup field and the only path is "Continue with Google" / "Sign up with Gmail" / "Sign in with Google": click that button. If a Google popup opens, switch to it (browser tabs).
+- On accounts.google.com, type the BARE Google account email \`${opts.googleEmail}\` (no plus-tag \u2014 Google account login rejects plus-addresses) with browser_type, click Next, then fill the Google password with ${fill}. NEVER type the Google password as text and NEVER use the IMAP app password here.
+- Click Next.${totp}
+- Click Continue / Allow on any consent screen, then return to the app tab.
+- If the app then emails a verification code/link, first call ${plainProvision} (Google SSO uses the bare inbox address, not the +tag), then complete it with the inbox tools as usual.
+- Register / Google-sign-in ONCE per run. If Google says the account is already used on this app, that is success \u2014 continue as the logged-in user.`;
+    }
+  }
+});
+
 // ../runner-core/dist/services/credential-tools.js
 var require_credential_tools = __commonJS({
   "../runner-core/dist/services/credential-tools.js"(exports2) {
@@ -8573,6 +8694,7 @@ var require_credential_tools = __commonJS({
     exports2.mcpResultIsError = mcpResultIsError;
     exports2.aggressiveScrubCredentials = aggressiveScrubCredentials;
     var scrub_credentials_js_1 = require_scrub_credentials();
+    var google_signin_js_1 = require_google_signin();
     exports2.FILL_CREDENTIAL_TOOL = {
       type: "function",
       function: {
@@ -8583,7 +8705,7 @@ var require_credential_tools = __commonJS({
           properties: {
             credentialKey: {
               type: "string",
-              description: 'The credential variable name (e.g. "TEST_USER_EMAIL", "TEST_USER_PASSWORD", "TEST_ADMIN_EMAIL"). Must be one of the keys listed in the Test Credentials section of the prompt.'
+              description: 'The credential variable name (e.g. "TEST_USER_EMAIL", "TEST_USER_PASSWORD", "GOOGLE_SIGNIN_PASSWORD"). Must be one of the keys listed in the Test Credentials section of the prompt.'
             },
             element: {
               type: "string",
@@ -8849,6 +8971,14 @@ CREDENTIAL ROTATION (required when the STORED user's secret changes \u2014 read
           didMutate: false
         };
       }
+      if (key === google_signin_js_1.GOOGLE_SIGNIN_PASSWORD_KEY) {
+        return {
+          content: JSON.stringify({
+            error: "set_credential: GOOGLE_SIGNIN_PASSWORD is a runner-operator secret and cannot be persisted to project Test Data"
+          }),
+          didMutate: false
+        };
+      }
       if (!(key in ctx.credentials)) {
         const available = Object.keys(ctx.credentials).filter((k) => ctx.credentials[k]).join(", ") || "(none configured)";
         return {
@@ -74110,7 +74240,7 @@ var require_inbox_tools = __commonJS({
   "../runner-core/dist/services/inbox-tools.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = exports2.INBOX_TOOL_NAMES = exports2.INBOX_TOOLS = exports2.OPEN_VERIFICATION_LINK_TOOL = exports2.GET_VERIFICATION_LINK_TOOL = exports2.EXTRACT_VERIFICATION_CODE_TOOL = exports2.READ_VERIFICATION_EMAIL_TOOL = exports2.WAIT_FOR_VERIFICATION_TOOL = exports2.CHECK_INBOX_TOOL = exports2.PROVISION_IDENTITY_TOOL = void 0;
+    exports2.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = exports2.INBOX_TOOL_NAMES = exports2.INBOX_TOOLS = exports2.PROVISION_GOOGLE_TOTP_TOOL = exports2.OPEN_VERIFICATION_LINK_TOOL = exports2.GET_VERIFICATION_LINK_TOOL = exports2.EXTRACT_VERIFICATION_CODE_TOOL = exports2.READ_VERIFICATION_EMAIL_TOOL = exports2.WAIT_FOR_VERIFICATION_TOOL = exports2.CHECK_INBOX_TOOL = exports2.PROVISION_IDENTITY_TOOL = void 0;
     exports2.createInboxRunState = createInboxRunState;
     exports2.dispatchInboxTool = dispatchInboxTool;
     exports2.isPublicHttpUrl = isPublicHttpUrl;
@@ -74125,6 +74255,7 @@ var require_inbox_tools = __commonJS({
     exports2.clearThrowawayRegisterSeed = clearThrowawayRegisterSeed;
     exports2.buildInboxAgentsGuidance = buildInboxAgentsGuidance;
     var verification_inbox_js_1 = require_verification_inbox();
+    var google_signin_js_1 = require_google_signin();
     function createInboxRunState(config, opts = {}) {
       const baseEmail = config.address;
       const tag = opts.tag !== void 0 ? opts.tag : opts.tagSeed ? (0, verification_inbox_js_1.deriveProjectInboxTag)(opts.tagSeed, opts.projectScope) : null;
@@ -74246,6 +74377,14 @@ var require_inbox_tools = __commonJS({
         }
       }
     };
+    exports2.PROVISION_GOOGLE_TOTP_TOOL = {
+      type: "function",
+      function: {
+        name: "provision_google_totp",
+        description: "Return a one-time 6-digit Authenticator code for the operator Google account. Call this ONLY when Google Sign-In shows a 2-step / Authenticator challenge after you submitted the Google password. Type the returned code into the Google prompt. Do not invent a code.",
+        parameters: { type: "object", properties: {} }
+      }
+    };
     exports2.INBOX_TOOLS = [
       exports2.PROVISION_IDENTITY_TOOL,
       exports2.CHECK_INBOX_TOOL,
@@ -74253,7 +74392,8 @@ var require_inbox_tools = __commonJS({
       exports2.READ_VERIFICATION_EMAIL_TOOL,
       exports2.EXTRACT_VERIFICATION_CODE_TOOL,
       exports2.GET_VERIFICATION_LINK_TOOL,
-      exports2.OPEN_VERIFICATION_LINK_TOOL
+      exports2.OPEN_VERIFICATION_LINK_TOOL,
+      exports2.PROVISION_GOOGLE_TOTP_TOOL
     ];
     exports2.INBOX_TOOL_NAMES = new Set(exports2.INBOX_TOOLS.map((t) => t.function.name));
     var DEFAULT_MAX_RESULT_CHARS = 8e3;
@@ -74265,7 +74405,7 @@ var require_inbox_tools = __commonJS({
     }
     var INBOX_AUTH_DEAD_GUIDANCE = "the inbox authentication is PERMANENTLY rejected (revoked/wrong app password) \u2014 STOP calling inbox tools; none of them can succeed this run. Treat email verification as UNAVAILABLE: hard-stop at any emailed code/link wall, NEVER type a guessed code, and report verification-gated flows as BLOCKED (blockedReason: inbox authentication failed). Continue with publicly reachable coverage.";
     async function dispatchInboxTool(toolName, toolArgs, ctx) {
-      if (ctx.state.authDead) {
+      if (ctx.state.authDead && toolName !== "provision_google_totp") {
         return err(`${toolName} skipped: ${INBOX_AUTH_DEAD_GUIDANCE}`);
       }
       try {
@@ -74284,6 +74424,8 @@ var require_inbox_tools = __commonJS({
             return await handleGetLink(toolArgs, ctx);
           case "open_verification_link":
             return await handleOpenLink(toolArgs, ctx);
+          case "provision_google_totp":
+            return handleProvisionGoogleTotp();
           default:
             return err(`inbox dispatch: unknown tool "${toolName}"`);
         }
@@ -74459,6 +74601,20 @@ var require_inbox_tools = __commonJS({
         didMutate: !failed
       };
     }
+    function handleProvisionGoogleTotp(env = process.env) {
+      const cfg = (0, google_signin_js_1.loadGoogleSignInConfig)(env);
+      if (!cfg) {
+        return err("Google SSO is not configured on this runner (GOOGLE_SIGNIN_PASSWORD unset). Prefer email-field signup, or report Google SSO as BLOCKED.");
+      }
+      if (!cfg.totpSecret) {
+        return err("Google Authenticator 2FA is not configured on this runner (GOOGLE_SIGNIN_TOTP_SECRET unset). STOP and report Google SSO as BLOCKED (2FA not configured).");
+      }
+      return ok({
+        code: (0, google_signin_js_1.generateTotp)(cfg.totpSecret),
+        digits: 6,
+        instructions: "Type this 6-digit code into the Google 2-step / Authenticator prompt. Do not reuse it later \u2014 call this tool again if Google asks for another code."
+      });
+    }
     function requireProvisioned(ctx) {
       if (ctx.state.provisioned)
         return null;
@@ -74593,7 +74749,7 @@ var require_inbox_tools = __commonJS({
 ${where} You register using ONE real, monitored email (\`${opts.email}\`) and can complete email-verification (OTP code or confirmation link) end-to-end. This OVERRIDES the general "do not submit forms" rule for the signup/registration form ONLY.
 
 Steps:
-1. Navigate to the Sign Up / Register page (click the link in the UI).
+1. Navigate to the Sign Up / Register page (click the link in the UI). FIRST look for an email+password signup form (including after "Sign up with email"). Use Google / Gmail SSO ONLY if that form does not exist.
 2. Call \`provision_identity\` \u2192 it returns the email to register with (\`${opts.email}\`). The \`+\` part is a normal sub-address that still lands in our inbox.
 3. Fill the signup form: type that email into the email field with \`browser_type\` (this generated inbox email is intentionally visible and is allowed for registration); fill the password field with single-field \`fill_credential\` (credentialKey \`${opts.passwordKey}\`); fill any name/other required fields with simple test values. Do NOT use \`fill_credential_form\` for registration.
    - If the form REJECTS the email (says "invalid email" / will not accept the "+"), call \`provision_identity\` again with \`plain: true\` and use the bare address it returns instead.
@@ -74611,6 +74767,11 @@ Rules:
 - The provisioned email is reused for this project; if signup says it is ALREADY registered, the account already exists \u2014 log in with that email + the \`${opts.passwordKey}\` password instead of registering again.
 - You register ONCE per run. After you submit the signup form in step 4, NEVER submit it again and NEVER create a second account \u2014 even if verification is slow, even if a later login attempt fails. Recover by re-polling \`wait_for_verification\` (and at most one "Resend"), not by re-registering.
 - Only call the verification tools AFTER submitting the signup form, and pass the site as \`senderMatch\` so you read YOUR verification email (the inbox is shared).
+${opts.googleEmail && opts.googlePasswordKey ? (0, google_signin_js_1.buildGoogleSignInPromptSection)({
+        googleEmail: opts.googleEmail,
+        googlePasswordKey: opts.googlePasswordKey,
+        googleTotpAvailable: opts.googleTotpAvailable
+      }, "native") : ""}
 `;
     }
     exports2.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = `## EMAIL VERIFICATION UNAVAILABLE \u2014 FINAL OVERRIDE (supersedes any instruction above)
@@ -74765,11 +74926,12 @@ This project asked to REGISTER a new account, but this runner CANNOT receive ema
       }
       return false;
     }
-    function buildInboxAgentsGuidance(email, passwordKey) {
+    function buildInboxAgentsGuidance(email, passwordKey, google) {
+      const googleBlock = google ? (0, google_signin_js_1.buildGoogleSignInPromptSection)(google, "cli") : "";
       return `## Account registration & email verification (ENABLED)
 This run registers a new account using our ONE real, monitored inbox (the address \`${email}\` \u2014 the "+" part is a normal sub-address that still lands in our inbox) and can complete email verification end-to-end. This overrides any "do not submit forms" guidance for the signup form only.
 
-1. Go to the Sign Up / Register page.
+1. Go to the Sign Up / Register page. FIRST look for an email+password signup form (including after "Sign up with email"). Use Google / Gmail SSO ONLY if that form does not exist.
 2. Call \`inbox_provision_identity\` \u2192 it returns the email to register with (\`${email}\`). Type that email into the email field.
    - If the form REJECTS the email (says "invalid email" / will not accept the "+"), call \`inbox_provision_identity\` with \`plain: true\` and use the bare address it returns instead.
 3. Fill the password with the \`${passwordKey}\` credential (use fill_credential). Submit the signup form.
@@ -74780,6 +74942,7 @@ This run registers a new account using our ONE real, monitored inbox (the addres
    - If it returns BOTH, try the code first; if the app insists on the link, open it, then enter the code if the page it lands on asks for one.
    - Otherwise call \`inbox_read_email\` to read the body.
 5. NEVER invent an email address \u2014 always use exactly what \`inbox_provision_identity\` returns. The address is reused for this project; if signup says it is already registered, log in with it + \`${passwordKey}\` instead. Register ONCE per run \u2014 never submit signup twice or make a second account; if verification is slow, re-poll \`inbox_wait_for_verification\` (at most one Resend) instead of re-registering.
+${googleBlock}
 `;
     }
   }
@@ -88614,6 +88777,7 @@ var require_browser_config = __commonJS({
     var path_1 = require("path");
     var os_1 = require("os");
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
+    var google_signin_js_1 = require_google_signin();
     exports2.IS_CLOUD = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD);
     exports2.CLOUD_ARGS = [
       "--no-sandbox",
@@ -88719,6 +88883,10 @@ var require_browser_config = __commonJS({
       (document.head || document.documentElement).appendChild(style);
 
       // Layer 2: Web Animations API - make instant (preserves completion callbacks)
+      try {
+        Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
+      } catch {}
+
       const origAnimate = Element.prototype.animate;
       Element.prototype.animate = function(keyframes, options) {
         if (typeof options === 'object' && options !== null) {
@@ -88825,6 +88993,20 @@ var require_browser_config = __commonJS({
         return null;
       }
     }
+    function googleSsoCloudLaunch(env = process.env) {
+      if (!(0, shared_1.parseBoolFlag)(env.RUNNER_CLOUD))
+        return null;
+      if (!(0, google_signin_js_1.loadGoogleSignInConfig)(env))
+        return null;
+      const executablePath = getFullChromiumPath();
+      if (!executablePath)
+        return null;
+      return {
+        executablePath,
+        extraArgs: ["--headless=new"],
+        ignoreDefaultArgs: ["--enable-automation"]
+      };
+    }
     function getMCPBrowserConfig2(opts) {
       const userDataDir = opts?.forceIsolated ? null : getTestUserDataDir2();
       const headless = isHeadless2();
@@ -88848,15 +89030,21 @@ var require_browser_config = __commonJS({
         };
       }
       const headlessShellPath = getHeadlessShellPath();
-      const useHeadlessShell = headless && headlessShellPath && !opts?.harPath;
+      const googleLaunch = googleSsoCloudLaunch();
+      const useHeadlessShell = headless && headlessShellPath && !opts?.harPath && !googleLaunch;
+      const cloud = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD);
+      const args = [
+        ...cloud ? exports2.CLOUD_ARGS : ["--disable-blink-features=AutomationControlled"],
+        ...googleLaunch?.extraArgs ?? []
+      ];
       return {
         browserName: "chromium",
         isolated: true,
         launchOptions: {
-          headless,
-          ...useHeadlessShell ? { executablePath: headlessShellPath } : {},
+          headless: googleLaunch ? false : headless,
+          ...googleLaunch ? { executablePath: googleLaunch.executablePath, ignoreDefaultArgs: googleLaunch.ignoreDefaultArgs } : useHeadlessShell ? { executablePath: headlessShellPath } : {},
           channel: "",
-          args: exports2.IS_CLOUD ? exports2.CLOUD_ARGS : ["--disable-blink-features=AutomationControlled"],
+          args,
           ...slowMo > 0 ? { slowMo } : {}
         },
         contextOptions: {
@@ -88869,15 +89057,21 @@ var require_browser_config = __commonJS({
     function getPlaywrightLaunchOptions2(withProfile = false, extraArgs) {
       const headless = isHeadless2();
       const slowMo = getSlowMoMs();
+      const googleLaunch = googleSsoCloudLaunch();
       const baseArgs = exports2.IS_CLOUD ? exports2.CLOUD_ARGS : [
         "--disable-blink-features=AutomationControlled"
       ];
-      const mergedArgs = extraArgs && extraArgs.length > 0 ? [...baseArgs, ...extraArgs] : [...baseArgs];
+      const mergedArgs = [
+        ...baseArgs,
+        ...googleLaunch?.extraArgs ?? [],
+        ...extraArgs && extraArgs.length > 0 ? extraArgs : []
+      ];
       return {
-        headless,
+        headless: googleLaunch ? false : headless,
         // Use Chrome channel only when a real Chrome user profile is being loaded.
         // In isolated mode, bundled Chromium avoids hard dependency on Chrome installation.
         ...exports2.IS_CLOUD || !withProfile ? {} : { channel: "chrome" },
+        ...googleLaunch ? { executablePath: googleLaunch.executablePath, ignoreDefaultArgs: googleLaunch.ignoreDefaultArgs } : {},
         args: mergedArgs,
         ...slowMo > 0 ? { slowMo } : {}
       };
@@ -320219,6 +320413,7 @@ var require_playwright_mcp_config = __commonJS({
     var promises_1 = require("fs/promises");
     var node_path_1 = require("path");
     var browser_config_js_1 = require_browser_config();
+    var google_signin_js_1 = require_google_signin();
     var PLAYWRIGHT_MCP_VERSION = "0.0.68";
     var INBOX_SECRET_ENV_KEYS = [
       "VERIFICATION_INBOX_HOST",
@@ -320228,7 +320423,10 @@ var require_playwright_mcp_config = __commonJS({
       "VERIFICATION_INBOX_PASSWORD",
       "VERIFICATION_INBOX_ADDRESS",
       "VERIFICATION_INBOX_MAILBOX",
-      "VERIFICATION_INBOX_EXTRA_MAILBOXES"
+      "VERIFICATION_INBOX_EXTRA_MAILBOXES",
+      "GOOGLE_SIGNIN_PASSWORD",
+      "GOOGLE_SIGNIN_EMAIL",
+      "GOOGLE_SIGNIN_TOTP_SECRET"
     ];
     function collectInboxSecretEnv() {
       const out = {};
@@ -320269,12 +320467,13 @@ var require_playwright_mcp_config = __commonJS({
       const body = cfg.format === "json" ? buildJsonConfig(cfg) : buildTomlConfig(cfg);
       await (0, promises_1.writeFile)(cfg.configPath, body, { encoding: "utf8", mode: 384 });
       if (!cfg.cdpEndpoint && browser_config_js_1.IS_CLOUD) {
+        const launchOptions = (0, browser_config_js_1.getMCPBrowserConfig)({ forceIsolated: true }).launchOptions ?? {
+          headless: true,
+          args: [...browser_config_js_1.CLOUD_ARGS]
+        };
         const browserConfig = {
           browser: {
-            launchOptions: {
-              headless: true,
-              args: [...browser_config_js_1.CLOUD_ARGS]
-            }
+            launchOptions
           }
         };
         await (0, promises_1.writeFile)(mcpBrowserConfigPath(cfg.configPath), JSON.stringify(browserConfig, null, 2) + "\n", { encoding: "utf8", mode: 384 });
@@ -320298,7 +320497,11 @@ var require_playwright_mcp_config = __commonJS({
       ];
       if (cfg.includeCredentialServer && cfg.cdpEndpoint) {
         const serverJs = (0, node_path_1.join)(__dirname, "credential-mcp-server.js");
-        blocks.push("[mcp_servers.validateqa_credentials]", 'command = "node"', `args = ["${tomlEscape(serverJs)}"]`, "enabled = true", "startup_timeout_sec = 30", "tool_timeout_sec = 60", "", "[mcp_servers.validateqa_credentials.env]", `CDP_ENDPOINT = "${tomlEscape(cfg.cdpEndpoint)}"`, "");
+        blocks.push("[mcp_servers.validateqa_credentials]", 'command = "node"', `args = ["${tomlEscape(serverJs)}"]`, "enabled = true", "startup_timeout_sec = 30", "tool_timeout_sec = 60", "", "[mcp_servers.validateqa_credentials.env]", `CDP_ENDPOINT = "${tomlEscape(cfg.cdpEndpoint)}"`);
+        for (const [k, v] of Object.entries((0, google_signin_js_1.collectGoogleSignInEnv)())) {
+          blocks.push(`${k} = "${tomlEscape(v)}"`);
+        }
+        blocks.push("");
       }
       if (cfg.includeDiscoveryServer) {
         if (!cfg.runDir) {
@@ -320346,7 +320549,7 @@ var require_playwright_mcp_config = __commonJS({
           type: "stdio",
           command: "node",
           args: [serverJs],
-          env: { CDP_ENDPOINT: cfg.cdpEndpoint }
+          env: { CDP_ENDPOINT: cfg.cdpEndpoint, ...(0, google_signin_js_1.collectGoogleSignInEnv)() }
         };
       }
       if (cfg.includeDiscoveryServer) {
@@ -328553,6 +328756,7 @@ var require_discover_explorer = __commonJS({
     var credential_tools_js_1 = require_credential_tools();
     var inbox_tools_js_1 = require_inbox_tools();
     var verification_inbox_js_1 = require_verification_inbox();
+    var google_signin_js_1 = require_google_signin();
     var discover_planner_js_1 = require_discover_planner();
     var exploration_prompt_builder_js_1 = require_exploration_prompt_builder();
     var ai_queue_js_1 = require_ai_queue();
@@ -328957,7 +329161,8 @@ NEVER assert: user-specific text (names, emails), counts/numbers, timestamps, ma
     };
     function buildSystemPrompt(baseUrl, variableContext, existingSiteMap, existingTestNames, options) {
       const browserCredentials = variableContext.allTestVariables ?? variableContext.publicTestVariables;
-      const { secrets: explorerSecretVars, publics: explorerPublicVarsRaw } = (0, credential_tools_js_1.partitionTestVariables)(browserCredentials);
+      const { secrets: explorerSecretVarsRaw, publics: explorerPublicVarsRaw } = (0, credential_tools_js_1.partitionTestVariables)(browserCredentials);
+      const explorerSecretVars = options?.inboxPrompt ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(explorerSecretVarsRaw) : explorerSecretVarsRaw;
       const hasCredentials = Object.keys(explorerSecretVars).length > 0;
       const { DISCOVERY_SHOULD_REGISTER: _omitRegisterFlag, ...explorerPublicVars } = explorerPublicVarsRaw;
       const explorerPublicLines = (0, credential_tools_js_1.renderPublicVariablesBlock)(explorerPublicVars);
@@ -329574,10 +329779,12 @@ ${inbox_tools_js_1.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK}` : ""}`;
       if (emailVerificationUnavailable) {
         logs2.push("Email verification unavailable \u2014 the agent will ATTEMPT registration once; any flow requiring an emailed code/link will be reported BLOCKED.");
       }
+      const googleGuidance = (0, google_signin_js_1.googleSignInGuidanceOpts)();
       const inboxPromptBlock = inboxState ? (0, inbox_tools_js_1.buildInboxPromptBlock)({
         email: inboxState.email,
         passwordKey: inboxState.passwordKey ?? "TEST_USER_PASSWORD",
-        context: options?.mode
+        context: options?.mode,
+        ...googleGuidance
       }) : "";
       try {
         const { tools: mcpTools } = await mcpClient.listTools();
@@ -329598,7 +329805,8 @@ ${inbox_tools_js_1.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK}` : ""}`;
         }
         const browserCredsForTools = variableContext.allTestVariables ?? variableContext.publicTestVariables;
         const { secrets: explorerToolSecrets } = (0, credential_tools_js_1.partitionTestVariables)(browserCredsForTools);
-        if (Object.keys(explorerToolSecrets).length > 0) {
+        const explorerToolSecretsWithGoogle = inboxState ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(explorerToolSecrets) : explorerToolSecrets;
+        if (Object.keys(explorerToolSecretsWithGoogle).length > 0) {
           openaiTools.push(credential_tools_js_1.FILL_CREDENTIAL_TOOL, credential_tools_js_1.FILL_CREDENTIAL_FORM_TOOL);
           if (options?.onCredentialUpdate) {
             openaiTools.push(credential_tools_js_1.SET_CREDENTIAL_TOOL);
@@ -330238,8 +330446,12 @@ ${currentSummary}`;
           let finishBouncedThisBatch = false;
           let finishStreakCountedThisBatch = false;
           const fullVarMapForGuard = variableContext.allTestVariables ?? variableContext.publicTestVariables;
-          const { secrets: secretsOnlyForGuard } = (0, credential_tools_js_1.partitionTestVariables)(fullVarMapForGuard);
-          const allowedCredentialValues = inboxState ? [inboxState.email] : [];
+          const { secrets: partitionedSecretsForGuard } = (0, credential_tools_js_1.partitionTestVariables)(fullVarMapForGuard);
+          const secretsOnlyForGuard = inboxState ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(partitionedSecretsForGuard) : partitionedSecretsForGuard;
+          const allowedCredentialValues = [...new Set([
+            ...inboxState ? [inboxState.email, inboxState.baseEmail] : [],
+            ...inboxState ? (0, google_signin_js_1.googleSignInAllowedEmails)() : []
+          ].filter((value) => !!value))];
           const secretsForLogging = Object.fromEntries(Object.entries(secretsOnlyForGuard).filter(([, value]) => !allowedCredentialValues.includes(value)));
           for (const toolCall of assistantMessage.tool_calls) {
             const toolName = toolCall.function.name;
@@ -331090,8 +331302,9 @@ Exploration complete: ${summary}`);
               }
               const fullVarMap = variableContext.allTestVariables ?? variableContext.publicTestVariables;
               const { secrets: dispatchSecrets } = (0, credential_tools_js_1.partitionTestVariables)(fullVarMap);
+              const fillSecrets = inboxState ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(dispatchSecrets) : dispatchSecrets;
               try {
-                const result = toolName === "fill_credential" ? await (0, credential_tools_js_1.handleFillCredential)(toolArgs, { mcpClient, credentials: dispatchSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS }) : await (0, credential_tools_js_1.handleFillCredentialForm)(toolArgs, { mcpClient, credentials: dispatchSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS });
+                const result = toolName === "fill_credential" ? await (0, credential_tools_js_1.handleFillCredential)(toolArgs, { mcpClient, credentials: fillSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS }) : await (0, credential_tools_js_1.handleFillCredentialForm)(toolArgs, { mcpClient, credentials: fillSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS });
                 if (result.didMutate) {
                   lastSnapshotText = null;
                   const codeLines = (0, exploration_parser_js_1.extractCodeLines)(result.content);
@@ -333131,7 +333344,7 @@ ${keyLines || "- (none provided)"}
 ## EXACTLY what to do
 1. Navigate to ${baseUrl} and take a \`browser_snapshot\`.
 2. Find the Sign Up / Register / Create account affordance (match by PURPOSE, in the app's own language) and open the signup form. If a reveal button hides the fields ("Sign up with Email"), click it first.
-3. Follow the "Account Registration (verification inbox is ENABLED)" steps below EXACTLY: call \`provision_identity\` for the email, type that email, fill the password with \`fill_credential\`, fill any other required fields with simple test values, and submit.
+3. Follow the "Account Registration (verification inbox is ENABLED)" steps below EXACTLY: call \`provision_identity\` for the email, type that email, fill the password with \`fill_credential\`, fill any other required fields with simple test values, and submit. If there is NO email+password signup field and only "Continue with Google" / "Sign up with Gmail", follow the Google / Gmail SSO fallback in that section (bare Google account email, \`fill_credential\` with \`GOOGLE_SIGNIN_PASSWORD\`, never the IMAP app password).
 4. Complete email verification using the inbox tools (\`wait_for_verification\` \u2192 enter the code or \`open_verification_link\`). Re-poll if the email is slow; resend AT MOST once; NEVER register a second account.
 5. Confirm you are signed in \u2014 a redirect to an authenticated route, or an in-place change to authenticated content. Take a \`browser_snapshot\`.
 6. \`capture_page\` the authenticated landing page in its DEFAULT state, then call \`finish_exploration\`. Do this the MOMENT the account is verified and you are signed in.
@@ -333685,6 +333898,7 @@ var require_grok_survey_runner = __commonJS({
     var grok_cli_js_1 = require_grok_cli();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var exploration_parser_js_1 = require_exploration_parser();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var agentic_survey_prompts_js_1 = require_agentic_survey_prompts();
@@ -334209,7 +334423,7 @@ var require_grok_survey_runner = __commonJS({
       };
       const surveyAgentsMd = inboxReg ? `${(0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)()}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)();
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)();
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), surveyAgentsMd, "utf8");
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_survey_prompts_js_1.buildSurveyBriefMd)(briefInput), "utf8");
       log2("Wrote AGENTS.md + BRIEF.md");
@@ -335616,6 +335830,7 @@ var require_grok_discovery_runner = __commonJS({
     var playwright_native_js_1 = require_playwright_native();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var grok_survey_runner_js_1 = require_grok_survey_runner();
     var agentic_discovery_prompts_js_1 = require_agentic_discovery_prompts();
@@ -335909,7 +336124,7 @@ var require_grok_discovery_runner = __commonJS({
         };
         const discoveryAgentsMd = inboxReg ? `${(0, agentic_discovery_prompts_js_1.buildDiscoveryAgentsMd)()}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_discovery_prompts_js_1.buildDiscoveryAgentsMd)();
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_discovery_prompts_js_1.buildDiscoveryAgentsMd)();
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), discoveryAgentsMd, "utf8");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_discovery_prompts_js_1.buildDiscoveryBriefMd)(briefInput), "utf8");
         await (0, promises_1.mkdir)(testsDirPath, { recursive: true });
@@ -336862,7 +337077,7 @@ ${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwo
 
 ---
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxRegV2.email, inboxRegV2.passwordKey)}` : "");
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxRegV2.email, inboxRegV2.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : "");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), agentsMd, "utf8");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_discovery_prompts_js_1.buildDiscoveryBriefMd)(briefInput), "utf8");
         await (0, promises_1.mkdir)(testsDirPath, { recursive: true });
@@ -337834,6 +338049,7 @@ var require_claude_survey_runner = __commonJS({
     var claude_stream_parser_js_1 = require_claude_stream_parser();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var agentic_cli_constants_js_1 = require_agentic_cli_constants();
     var grok_survey_runner_js_1 = require_grok_survey_runner();
@@ -337934,7 +338150,7 @@ ${preview}`);
       };
       const surveyAgentsMd = inboxReg ? `${(0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)({ canvasMode })}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)({ canvasMode });
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)({ canvasMode });
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), surveyAgentsMd, "utf8");
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_survey_prompts_js_1.buildSurveyBriefMd)(briefInput), "utf8");
       log2("Wrote AGENTS.md + BRIEF.md");
@@ -338644,6 +338860,7 @@ var require_claude_discovery_runner = __commonJS({
     var claude_cli_js_1 = require_claude_cli();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var coverage_examples_content_js_1 = require_coverage_examples_content();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var agentic_cli_constants_js_1 = require_agentic_cli_constants();
@@ -338812,7 +339029,7 @@ var require_claude_discovery_runner = __commonJS({
         };
         const explorerContractMd = inboxReg ? `${(0, agentic_discovery_prompts_js_1.buildExplorerContractMd)(contractInput)}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_discovery_prompts_js_1.buildExplorerContractMd)(contractInput);
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_discovery_prompts_js_1.buildExplorerContractMd)(contractInput);
         await (0, promises_1.writeFile)(claudeMdPath, explorerContractMd, "utf8");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_discovery_prompts_js_1.buildDiscoveryBriefMd)(briefInput), "utf8");
         await (0, promises_1.mkdir)(testsDirPath, { recursive: true });
@@ -356069,7 +356286,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.92",
+      version: "1.0.93",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/dist/cli.mjs

@@ -8560,6 +8560,127 @@ var require_scrub_credentials = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/google-signin.js
+var require_google_signin = __commonJS({
+  "../runner-core/dist/services/google-signin.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.GOOGLE_SIGNIN_ENV_KEYS = exports.GOOGLE_SIGNIN_PASSWORD_KEY = void 0;
+    exports.loadGoogleSignInConfig = loadGoogleSignInConfig;
+    exports.mergeGoogleSignInSecrets = mergeGoogleSignInSecrets;
+    exports.googleSignInGuidanceOpts = googleSignInGuidanceOpts;
+    exports.googleSignInAllowedEmails = googleSignInAllowedEmails;
+    exports.collectGoogleSignInEnv = collectGoogleSignInEnv;
+    exports.generateTotp = generateTotp;
+    exports.buildGoogleSignInPromptSection = buildGoogleSignInPromptSection;
+    var node_crypto_1 = __require("crypto");
+    exports.GOOGLE_SIGNIN_PASSWORD_KEY = "GOOGLE_SIGNIN_PASSWORD";
+    exports.GOOGLE_SIGNIN_ENV_KEYS = [
+      "GOOGLE_SIGNIN_PASSWORD",
+      "GOOGLE_SIGNIN_EMAIL",
+      "GOOGLE_SIGNIN_TOTP_SECRET"
+    ];
+    function trimEnv(env, name) {
+      const value = env[name]?.trim();
+      return value ? value : void 0;
+    }
+    function loadGoogleSignInConfig(env = process.env) {
+      const password = trimEnv(env, "GOOGLE_SIGNIN_PASSWORD");
+      if (!password)
+        return null;
+      const email = (trimEnv(env, "GOOGLE_SIGNIN_EMAIL") ?? trimEnv(env, "VERIFICATION_INBOX_ADDRESS"))?.toLowerCase();
+      if (!email || !email.includes("@"))
+        return null;
+      const totpSecret = trimEnv(env, "GOOGLE_SIGNIN_TOTP_SECRET");
+      return {
+        email,
+        password,
+        passwordKey: exports.GOOGLE_SIGNIN_PASSWORD_KEY,
+        totpSecret,
+        totpAvailable: !!totpSecret
+      };
+    }
+    function mergeGoogleSignInSecrets(credentials, env = process.env) {
+      const cfg = loadGoogleSignInConfig(env);
+      if (!cfg)
+        return credentials;
+      if (credentials[exports.GOOGLE_SIGNIN_PASSWORD_KEY])
+        return credentials;
+      return { ...credentials, [exports.GOOGLE_SIGNIN_PASSWORD_KEY]: cfg.password };
+    }
+    function googleSignInGuidanceOpts(env = process.env) {
+      const cfg = loadGoogleSignInConfig(env);
+      if (!cfg)
+        return void 0;
+      return {
+        googleEmail: cfg.email,
+        googlePasswordKey: cfg.passwordKey,
+        googleTotpAvailable: cfg.totpAvailable
+      };
+    }
+    function googleSignInAllowedEmails(env = process.env) {
+      const cfg = loadGoogleSignInConfig(env);
+      return cfg ? [cfg.email] : [];
+    }
+    function collectGoogleSignInEnv(env = process.env) {
+      const out = {};
+      for (const key of exports.GOOGLE_SIGNIN_ENV_KEYS) {
+        const value = env[key]?.trim();
+        if (value)
+          out[key] = value;
+      }
+      return out;
+    }
+    function generateTotp(secret, atMs = Date.now(), stepSeconds = 30, digits = 6) {
+      const key = decodeBase32(secret);
+      const counter = Math.floor(atMs / 1e3 / stepSeconds);
+      const buf = Buffer.alloc(8);
+      buf.writeUInt32BE(Math.floor(counter / 4294967296), 0);
+      buf.writeUInt32BE(counter >>> 0, 4);
+      const hmac = (0, node_crypto_1.createHmac)("sha1", key).update(buf).digest();
+      const offset = hmac[hmac.length - 1] & 15;
+      const bin = (hmac[offset] & 127) << 24 | hmac[offset + 1] << 16 | hmac[offset + 2] << 8 | hmac[offset + 3];
+      const otp = bin % 10 ** digits;
+      return String(otp).padStart(digits, "0");
+    }
+    function decodeBase32(input) {
+      const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+      const cleaned = input.toUpperCase().replace(/[\s=-]+/g, "");
+      let bits = 0;
+      let value = 0;
+      const out = [];
+      for (const ch of cleaned) {
+        const idx = alphabet.indexOf(ch);
+        if (idx < 0)
+          continue;
+        value = value << 5 | idx;
+        bits += 5;
+        if (bits >= 8) {
+          bits -= 8;
+          out.push(value >>> bits & 255);
+        }
+      }
+      return Buffer.from(out);
+    }
+    function buildGoogleSignInPromptSection(opts, variant) {
+      const totpNative = opts.googleTotpAvailable ? " If Google asks for a 2-step / Authenticator code, call `provision_google_totp` and type the 6-digit `code` it returns (do not invent a code)." : " If Google asks for 2-step verification and you have no authenticator code tool, STOP and report Google SSO as BLOCKED (2FA not configured on this runner).";
+      const totpCli = opts.googleTotpAvailable ? " If Google asks for a 2-step / Authenticator code, call `inbox_google_totp` and type the 6-digit `code` it returns." : " If Google asks for 2-step verification, STOP and report Google SSO as BLOCKED (2FA not configured on this runner).";
+      const totp = variant === "cli" ? totpCli : totpNative;
+      const fill = variant === "cli" ? `fill_credential with credentialKey \`${opts.googlePasswordKey}\`` : `\`fill_credential\` (credentialKey \`${opts.googlePasswordKey}\`)`;
+      const plainProvision = variant === "cli" ? "`inbox_provision_identity` with `plain: true`" : "`provision_identity` with `plain: true`";
+      return `
+Google / Gmail SSO fallback (SECOND choice \u2014 email+password signup is FIRST):
+- FIRST follow the email-field playbook above whenever a signup form has an email / username / password field (including after clicking "Sign up with email"). Do NOT click Google if that form exists.
+- ONLY if there is no email+password signup field and the only path is "Continue with Google" / "Sign up with Gmail" / "Sign in with Google": click that button. If a Google popup opens, switch to it (browser tabs).
+- On accounts.google.com, type the BARE Google account email \`${opts.googleEmail}\` (no plus-tag \u2014 Google account login rejects plus-addresses) with browser_type, click Next, then fill the Google password with ${fill}. NEVER type the Google password as text and NEVER use the IMAP app password here.
+- Click Next.${totp}
+- Click Continue / Allow on any consent screen, then return to the app tab.
+- If the app then emails a verification code/link, first call ${plainProvision} (Google SSO uses the bare inbox address, not the +tag), then complete it with the inbox tools as usual.
+- Register / Google-sign-in ONCE per run. If Google says the account is already used on this app, that is success \u2014 continue as the logged-in user.`;
+    }
+  }
+});
+
 // ../runner-core/dist/services/credential-tools.js
 var require_credential_tools = __commonJS({
   "../runner-core/dist/services/credential-tools.js"(exports) {
@@ -8578,6 +8699,7 @@ var require_credential_tools = __commonJS({
     exports.mcpResultIsError = mcpResultIsError;
     exports.aggressiveScrubCredentials = aggressiveScrubCredentials;
     var scrub_credentials_js_1 = require_scrub_credentials();
+    var google_signin_js_1 = require_google_signin();
     exports.FILL_CREDENTIAL_TOOL = {
       type: "function",
       function: {
@@ -8588,7 +8710,7 @@ var require_credential_tools = __commonJS({
           properties: {
             credentialKey: {
               type: "string",
-              description: 'The credential variable name (e.g. "TEST_USER_EMAIL", "TEST_USER_PASSWORD", "TEST_ADMIN_EMAIL"). Must be one of the keys listed in the Test Credentials section of the prompt.'
+              description: 'The credential variable name (e.g. "TEST_USER_EMAIL", "TEST_USER_PASSWORD", "GOOGLE_SIGNIN_PASSWORD"). Must be one of the keys listed in the Test Credentials section of the prompt.'
             },
             element: {
               type: "string",
@@ -8854,6 +8976,14 @@ CREDENTIAL ROTATION (required when the STORED user's secret changes \u2014 read
           didMutate: false
         };
       }
+      if (key === google_signin_js_1.GOOGLE_SIGNIN_PASSWORD_KEY) {
+        return {
+          content: JSON.stringify({
+            error: "set_credential: GOOGLE_SIGNIN_PASSWORD is a runner-operator secret and cannot be persisted to project Test Data"
+          }),
+          didMutate: false
+        };
+      }
       if (!(key in ctx.credentials)) {
         const available = Object.keys(ctx.credentials).filter((k) => ctx.credentials[k]).join(", ") || "(none configured)";
         return {
@@ -74115,7 +74245,7 @@ var require_inbox_tools = __commonJS({
   "../runner-core/dist/services/inbox-tools.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = exports.INBOX_TOOL_NAMES = exports.INBOX_TOOLS = exports.OPEN_VERIFICATION_LINK_TOOL = exports.GET_VERIFICATION_LINK_TOOL = exports.EXTRACT_VERIFICATION_CODE_TOOL = exports.READ_VERIFICATION_EMAIL_TOOL = exports.WAIT_FOR_VERIFICATION_TOOL = exports.CHECK_INBOX_TOOL = exports.PROVISION_IDENTITY_TOOL = void 0;
+    exports.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = exports.INBOX_TOOL_NAMES = exports.INBOX_TOOLS = exports.PROVISION_GOOGLE_TOTP_TOOL = exports.OPEN_VERIFICATION_LINK_TOOL = exports.GET_VERIFICATION_LINK_TOOL = exports.EXTRACT_VERIFICATION_CODE_TOOL = exports.READ_VERIFICATION_EMAIL_TOOL = exports.WAIT_FOR_VERIFICATION_TOOL = exports.CHECK_INBOX_TOOL = exports.PROVISION_IDENTITY_TOOL = void 0;
     exports.createInboxRunState = createInboxRunState;
     exports.dispatchInboxTool = dispatchInboxTool;
     exports.isPublicHttpUrl = isPublicHttpUrl;
@@ -74130,6 +74260,7 @@ var require_inbox_tools = __commonJS({
     exports.clearThrowawayRegisterSeed = clearThrowawayRegisterSeed;
     exports.buildInboxAgentsGuidance = buildInboxAgentsGuidance;
     var verification_inbox_js_1 = require_verification_inbox();
+    var google_signin_js_1 = require_google_signin();
     function createInboxRunState(config, opts = {}) {
       const baseEmail = config.address;
       const tag = opts.tag !== void 0 ? opts.tag : opts.tagSeed ? (0, verification_inbox_js_1.deriveProjectInboxTag)(opts.tagSeed, opts.projectScope) : null;
@@ -74251,6 +74382,14 @@ var require_inbox_tools = __commonJS({
         }
       }
     };
+    exports.PROVISION_GOOGLE_TOTP_TOOL = {
+      type: "function",
+      function: {
+        name: "provision_google_totp",
+        description: "Return a one-time 6-digit Authenticator code for the operator Google account. Call this ONLY when Google Sign-In shows a 2-step / Authenticator challenge after you submitted the Google password. Type the returned code into the Google prompt. Do not invent a code.",
+        parameters: { type: "object", properties: {} }
+      }
+    };
     exports.INBOX_TOOLS = [
       exports.PROVISION_IDENTITY_TOOL,
       exports.CHECK_INBOX_TOOL,
@@ -74258,7 +74397,8 @@ var require_inbox_tools = __commonJS({
       exports.READ_VERIFICATION_EMAIL_TOOL,
       exports.EXTRACT_VERIFICATION_CODE_TOOL,
       exports.GET_VERIFICATION_LINK_TOOL,
-      exports.OPEN_VERIFICATION_LINK_TOOL
+      exports.OPEN_VERIFICATION_LINK_TOOL,
+      exports.PROVISION_GOOGLE_TOTP_TOOL
     ];
     exports.INBOX_TOOL_NAMES = new Set(exports.INBOX_TOOLS.map((t) => t.function.name));
     var DEFAULT_MAX_RESULT_CHARS = 8e3;
@@ -74270,7 +74410,7 @@ var require_inbox_tools = __commonJS({
     }
     var INBOX_AUTH_DEAD_GUIDANCE = "the inbox authentication is PERMANENTLY rejected (revoked/wrong app password) \u2014 STOP calling inbox tools; none of them can succeed this run. Treat email verification as UNAVAILABLE: hard-stop at any emailed code/link wall, NEVER type a guessed code, and report verification-gated flows as BLOCKED (blockedReason: inbox authentication failed). Continue with publicly reachable coverage.";
     async function dispatchInboxTool(toolName, toolArgs, ctx) {
-      if (ctx.state.authDead) {
+      if (ctx.state.authDead && toolName !== "provision_google_totp") {
         return err(`${toolName} skipped: ${INBOX_AUTH_DEAD_GUIDANCE}`);
       }
       try {
@@ -74289,6 +74429,8 @@ var require_inbox_tools = __commonJS({
             return await handleGetLink(toolArgs, ctx);
           case "open_verification_link":
             return await handleOpenLink(toolArgs, ctx);
+          case "provision_google_totp":
+            return handleProvisionGoogleTotp();
           default:
             return err(`inbox dispatch: unknown tool "${toolName}"`);
         }
@@ -74464,6 +74606,20 @@ var require_inbox_tools = __commonJS({
         didMutate: !failed
       };
     }
+    function handleProvisionGoogleTotp(env = process.env) {
+      const cfg = (0, google_signin_js_1.loadGoogleSignInConfig)(env);
+      if (!cfg) {
+        return err("Google SSO is not configured on this runner (GOOGLE_SIGNIN_PASSWORD unset). Prefer email-field signup, or report Google SSO as BLOCKED.");
+      }
+      if (!cfg.totpSecret) {
+        return err("Google Authenticator 2FA is not configured on this runner (GOOGLE_SIGNIN_TOTP_SECRET unset). STOP and report Google SSO as BLOCKED (2FA not configured).");
+      }
+      return ok({
+        code: (0, google_signin_js_1.generateTotp)(cfg.totpSecret),
+        digits: 6,
+        instructions: "Type this 6-digit code into the Google 2-step / Authenticator prompt. Do not reuse it later \u2014 call this tool again if Google asks for another code."
+      });
+    }
     function requireProvisioned(ctx) {
       if (ctx.state.provisioned)
         return null;
@@ -74598,7 +74754,7 @@ var require_inbox_tools = __commonJS({
 ${where} You register using ONE real, monitored email (\`${opts.email}\`) and can complete email-verification (OTP code or confirmation link) end-to-end. This OVERRIDES the general "do not submit forms" rule for the signup/registration form ONLY.
 
 Steps:
-1. Navigate to the Sign Up / Register page (click the link in the UI).
+1. Navigate to the Sign Up / Register page (click the link in the UI). FIRST look for an email+password signup form (including after "Sign up with email"). Use Google / Gmail SSO ONLY if that form does not exist.
 2. Call \`provision_identity\` \u2192 it returns the email to register with (\`${opts.email}\`). The \`+\` part is a normal sub-address that still lands in our inbox.
 3. Fill the signup form: type that email into the email field with \`browser_type\` (this generated inbox email is intentionally visible and is allowed for registration); fill the password field with single-field \`fill_credential\` (credentialKey \`${opts.passwordKey}\`); fill any name/other required fields with simple test values. Do NOT use \`fill_credential_form\` for registration.
    - If the form REJECTS the email (says "invalid email" / will not accept the "+"), call \`provision_identity\` again with \`plain: true\` and use the bare address it returns instead.
@@ -74616,6 +74772,11 @@ Rules:
 - The provisioned email is reused for this project; if signup says it is ALREADY registered, the account already exists \u2014 log in with that email + the \`${opts.passwordKey}\` password instead of registering again.
 - You register ONCE per run. After you submit the signup form in step 4, NEVER submit it again and NEVER create a second account \u2014 even if verification is slow, even if a later login attempt fails. Recover by re-polling \`wait_for_verification\` (and at most one "Resend"), not by re-registering.
 - Only call the verification tools AFTER submitting the signup form, and pass the site as \`senderMatch\` so you read YOUR verification email (the inbox is shared).
+${opts.googleEmail && opts.googlePasswordKey ? (0, google_signin_js_1.buildGoogleSignInPromptSection)({
+        googleEmail: opts.googleEmail,
+        googlePasswordKey: opts.googlePasswordKey,
+        googleTotpAvailable: opts.googleTotpAvailable
+      }, "native") : ""}
 `;
     }
     exports.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK = `## EMAIL VERIFICATION UNAVAILABLE \u2014 FINAL OVERRIDE (supersedes any instruction above)
@@ -74770,11 +74931,12 @@ This project asked to REGISTER a new account, but this runner CANNOT receive ema
       }
       return false;
     }
-    function buildInboxAgentsGuidance(email, passwordKey) {
+    function buildInboxAgentsGuidance(email, passwordKey, google) {
+      const googleBlock = google ? (0, google_signin_js_1.buildGoogleSignInPromptSection)(google, "cli") : "";
       return `## Account registration & email verification (ENABLED)
 This run registers a new account using our ONE real, monitored inbox (the address \`${email}\` \u2014 the "+" part is a normal sub-address that still lands in our inbox) and can complete email verification end-to-end. This overrides any "do not submit forms" guidance for the signup form only.
 
-1. Go to the Sign Up / Register page.
+1. Go to the Sign Up / Register page. FIRST look for an email+password signup form (including after "Sign up with email"). Use Google / Gmail SSO ONLY if that form does not exist.
 2. Call \`inbox_provision_identity\` \u2192 it returns the email to register with (\`${email}\`). Type that email into the email field.
    - If the form REJECTS the email (says "invalid email" / will not accept the "+"), call \`inbox_provision_identity\` with \`plain: true\` and use the bare address it returns instead.
 3. Fill the password with the \`${passwordKey}\` credential (use fill_credential). Submit the signup form.
@@ -74785,6 +74947,7 @@ This run registers a new account using our ONE real, monitored inbox (the addres
    - If it returns BOTH, try the code first; if the app insists on the link, open it, then enter the code if the page it lands on asks for one.
    - Otherwise call \`inbox_read_email\` to read the body.
 5. NEVER invent an email address \u2014 always use exactly what \`inbox_provision_identity\` returns. The address is reused for this project; if signup says it is already registered, log in with it + \`${passwordKey}\` instead. Register ONCE per run \u2014 never submit signup twice or make a second account; if verification is slow, re-poll \`inbox_wait_for_verification\` (at most one Resend) instead of re-registering.
+${googleBlock}
 `;
     }
   }
@@ -88619,6 +88782,7 @@ var require_browser_config = __commonJS({
     var path_1 = __require("path");
     var os_1 = __require("os");
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
+    var google_signin_js_1 = require_google_signin();
     exports.IS_CLOUD = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD);
     exports.CLOUD_ARGS = [
       "--no-sandbox",
@@ -88724,6 +88888,10 @@ var require_browser_config = __commonJS({
       (document.head || document.documentElement).appendChild(style);
 
       // Layer 2: Web Animations API - make instant (preserves completion callbacks)
+      try {
+        Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
+      } catch {}
+
       const origAnimate = Element.prototype.animate;
       Element.prototype.animate = function(keyframes, options) {
         if (typeof options === 'object' && options !== null) {
@@ -88830,6 +88998,20 @@ var require_browser_config = __commonJS({
         return null;
       }
     }
+    function googleSsoCloudLaunch(env = process.env) {
+      if (!(0, shared_1.parseBoolFlag)(env.RUNNER_CLOUD))
+        return null;
+      if (!(0, google_signin_js_1.loadGoogleSignInConfig)(env))
+        return null;
+      const executablePath = getFullChromiumPath();
+      if (!executablePath)
+        return null;
+      return {
+        executablePath,
+        extraArgs: ["--headless=new"],
+        ignoreDefaultArgs: ["--enable-automation"]
+      };
+    }
     function getMCPBrowserConfig2(opts) {
       const userDataDir = opts?.forceIsolated ? null : getTestUserDataDir2();
       const headless = isHeadless2();
@@ -88853,15 +89035,21 @@ var require_browser_config = __commonJS({
         };
       }
       const headlessShellPath = getHeadlessShellPath();
-      const useHeadlessShell = headless && headlessShellPath && !opts?.harPath;
+      const googleLaunch = googleSsoCloudLaunch();
+      const useHeadlessShell = headless && headlessShellPath && !opts?.harPath && !googleLaunch;
+      const cloud = (0, shared_1.parseBoolFlag)(process.env.RUNNER_CLOUD);
+      const args = [
+        ...cloud ? exports.CLOUD_ARGS : ["--disable-blink-features=AutomationControlled"],
+        ...googleLaunch?.extraArgs ?? []
+      ];
       return {
         browserName: "chromium",
         isolated: true,
         launchOptions: {
-          headless,
-          ...useHeadlessShell ? { executablePath: headlessShellPath } : {},
+          headless: googleLaunch ? false : headless,
+          ...googleLaunch ? { executablePath: googleLaunch.executablePath, ignoreDefaultArgs: googleLaunch.ignoreDefaultArgs } : useHeadlessShell ? { executablePath: headlessShellPath } : {},
           channel: "",
-          args: exports.IS_CLOUD ? exports.CLOUD_ARGS : ["--disable-blink-features=AutomationControlled"],
+          args,
           ...slowMo > 0 ? { slowMo } : {}
         },
         contextOptions: {
@@ -88874,15 +89062,21 @@ var require_browser_config = __commonJS({
     function getPlaywrightLaunchOptions2(withProfile = false, extraArgs) {
       const headless = isHeadless2();
       const slowMo = getSlowMoMs();
+      const googleLaunch = googleSsoCloudLaunch();
       const baseArgs = exports.IS_CLOUD ? exports.CLOUD_ARGS : [
         "--disable-blink-features=AutomationControlled"
       ];
-      const mergedArgs = extraArgs && extraArgs.length > 0 ? [...baseArgs, ...extraArgs] : [...baseArgs];
+      const mergedArgs = [
+        ...baseArgs,
+        ...googleLaunch?.extraArgs ?? [],
+        ...extraArgs && extraArgs.length > 0 ? extraArgs : []
+      ];
       return {
-        headless,
+        headless: googleLaunch ? false : headless,
         // Use Chrome channel only when a real Chrome user profile is being loaded.
         // In isolated mode, bundled Chromium avoids hard dependency on Chrome installation.
         ...exports.IS_CLOUD || !withProfile ? {} : { channel: "chrome" },
+        ...googleLaunch ? { executablePath: googleLaunch.executablePath, ignoreDefaultArgs: googleLaunch.ignoreDefaultArgs } : {},
         args: mergedArgs,
         ...slowMo > 0 ? { slowMo } : {}
       };
@@ -320224,6 +320418,7 @@ var require_playwright_mcp_config = __commonJS({
     var promises_1 = __require("fs/promises");
     var node_path_1 = __require("path");
     var browser_config_js_1 = require_browser_config();
+    var google_signin_js_1 = require_google_signin();
     var PLAYWRIGHT_MCP_VERSION = "0.0.68";
     var INBOX_SECRET_ENV_KEYS = [
       "VERIFICATION_INBOX_HOST",
@@ -320233,7 +320428,10 @@ var require_playwright_mcp_config = __commonJS({
       "VERIFICATION_INBOX_PASSWORD",
       "VERIFICATION_INBOX_ADDRESS",
       "VERIFICATION_INBOX_MAILBOX",
-      "VERIFICATION_INBOX_EXTRA_MAILBOXES"
+      "VERIFICATION_INBOX_EXTRA_MAILBOXES",
+      "GOOGLE_SIGNIN_PASSWORD",
+      "GOOGLE_SIGNIN_EMAIL",
+      "GOOGLE_SIGNIN_TOTP_SECRET"
     ];
     function collectInboxSecretEnv() {
       const out = {};
@@ -320274,12 +320472,13 @@ var require_playwright_mcp_config = __commonJS({
       const body = cfg.format === "json" ? buildJsonConfig(cfg) : buildTomlConfig(cfg);
       await (0, promises_1.writeFile)(cfg.configPath, body, { encoding: "utf8", mode: 384 });
       if (!cfg.cdpEndpoint && browser_config_js_1.IS_CLOUD) {
+        const launchOptions = (0, browser_config_js_1.getMCPBrowserConfig)({ forceIsolated: true }).launchOptions ?? {
+          headless: true,
+          args: [...browser_config_js_1.CLOUD_ARGS]
+        };
         const browserConfig = {
           browser: {
-            launchOptions: {
-              headless: true,
-              args: [...browser_config_js_1.CLOUD_ARGS]
-            }
+            launchOptions
           }
         };
         await (0, promises_1.writeFile)(mcpBrowserConfigPath(cfg.configPath), JSON.stringify(browserConfig, null, 2) + "\n", { encoding: "utf8", mode: 384 });
@@ -320303,7 +320502,11 @@ var require_playwright_mcp_config = __commonJS({
       ];
       if (cfg.includeCredentialServer && cfg.cdpEndpoint) {
         const serverJs = (0, node_path_1.join)(__dirname, "credential-mcp-server.js");
-        blocks.push("[mcp_servers.validateqa_credentials]", 'command = "node"', `args = ["${tomlEscape(serverJs)}"]`, "enabled = true", "startup_timeout_sec = 30", "tool_timeout_sec = 60", "", "[mcp_servers.validateqa_credentials.env]", `CDP_ENDPOINT = "${tomlEscape(cfg.cdpEndpoint)}"`, "");
+        blocks.push("[mcp_servers.validateqa_credentials]", 'command = "node"', `args = ["${tomlEscape(serverJs)}"]`, "enabled = true", "startup_timeout_sec = 30", "tool_timeout_sec = 60", "", "[mcp_servers.validateqa_credentials.env]", `CDP_ENDPOINT = "${tomlEscape(cfg.cdpEndpoint)}"`);
+        for (const [k, v] of Object.entries((0, google_signin_js_1.collectGoogleSignInEnv)())) {
+          blocks.push(`${k} = "${tomlEscape(v)}"`);
+        }
+        blocks.push("");
       }
       if (cfg.includeDiscoveryServer) {
         if (!cfg.runDir) {
@@ -320351,7 +320554,7 @@ var require_playwright_mcp_config = __commonJS({
           type: "stdio",
           command: "node",
           args: [serverJs],
-          env: { CDP_ENDPOINT: cfg.cdpEndpoint }
+          env: { CDP_ENDPOINT: cfg.cdpEndpoint, ...(0, google_signin_js_1.collectGoogleSignInEnv)() }
         };
       }
       if (cfg.includeDiscoveryServer) {
@@ -328558,6 +328761,7 @@ var require_discover_explorer = __commonJS({
     var credential_tools_js_1 = require_credential_tools();
     var inbox_tools_js_1 = require_inbox_tools();
     var verification_inbox_js_1 = require_verification_inbox();
+    var google_signin_js_1 = require_google_signin();
     var discover_planner_js_1 = require_discover_planner();
     var exploration_prompt_builder_js_1 = require_exploration_prompt_builder();
     var ai_queue_js_1 = require_ai_queue();
@@ -328962,7 +329166,8 @@ NEVER assert: user-specific text (names, emails), counts/numbers, timestamps, ma
     };
     function buildSystemPrompt(baseUrl, variableContext, existingSiteMap, existingTestNames, options) {
       const browserCredentials = variableContext.allTestVariables ?? variableContext.publicTestVariables;
-      const { secrets: explorerSecretVars, publics: explorerPublicVarsRaw } = (0, credential_tools_js_1.partitionTestVariables)(browserCredentials);
+      const { secrets: explorerSecretVarsRaw, publics: explorerPublicVarsRaw } = (0, credential_tools_js_1.partitionTestVariables)(browserCredentials);
+      const explorerSecretVars = options?.inboxPrompt ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(explorerSecretVarsRaw) : explorerSecretVarsRaw;
       const hasCredentials = Object.keys(explorerSecretVars).length > 0;
       const { DISCOVERY_SHOULD_REGISTER: _omitRegisterFlag, ...explorerPublicVars } = explorerPublicVarsRaw;
       const explorerPublicLines = (0, credential_tools_js_1.renderPublicVariablesBlock)(explorerPublicVars);
@@ -329579,10 +329784,12 @@ ${inbox_tools_js_1.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK}` : ""}`;
       if (emailVerificationUnavailable) {
         logs2.push("Email verification unavailable \u2014 the agent will ATTEMPT registration once; any flow requiring an emailed code/link will be reported BLOCKED.");
       }
+      const googleGuidance = (0, google_signin_js_1.googleSignInGuidanceOpts)();
       const inboxPromptBlock = inboxState ? (0, inbox_tools_js_1.buildInboxPromptBlock)({
         email: inboxState.email,
         passwordKey: inboxState.passwordKey ?? "TEST_USER_PASSWORD",
-        context: options?.mode
+        context: options?.mode,
+        ...googleGuidance
       }) : "";
       try {
         const { tools: mcpTools } = await mcpClient.listTools();
@@ -329603,7 +329810,8 @@ ${inbox_tools_js_1.EMAIL_VERIFICATION_UNAVAILABLE_OVERRIDE_BLOCK}` : ""}`;
         }
         const browserCredsForTools = variableContext.allTestVariables ?? variableContext.publicTestVariables;
         const { secrets: explorerToolSecrets } = (0, credential_tools_js_1.partitionTestVariables)(browserCredsForTools);
-        if (Object.keys(explorerToolSecrets).length > 0) {
+        const explorerToolSecretsWithGoogle = inboxState ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(explorerToolSecrets) : explorerToolSecrets;
+        if (Object.keys(explorerToolSecretsWithGoogle).length > 0) {
           openaiTools.push(credential_tools_js_1.FILL_CREDENTIAL_TOOL, credential_tools_js_1.FILL_CREDENTIAL_FORM_TOOL);
           if (options?.onCredentialUpdate) {
             openaiTools.push(credential_tools_js_1.SET_CREDENTIAL_TOOL);
@@ -330243,8 +330451,12 @@ ${currentSummary}`;
           let finishBouncedThisBatch = false;
           let finishStreakCountedThisBatch = false;
           const fullVarMapForGuard = variableContext.allTestVariables ?? variableContext.publicTestVariables;
-          const { secrets: secretsOnlyForGuard } = (0, credential_tools_js_1.partitionTestVariables)(fullVarMapForGuard);
-          const allowedCredentialValues = inboxState ? [inboxState.email] : [];
+          const { secrets: partitionedSecretsForGuard } = (0, credential_tools_js_1.partitionTestVariables)(fullVarMapForGuard);
+          const secretsOnlyForGuard = inboxState ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(partitionedSecretsForGuard) : partitionedSecretsForGuard;
+          const allowedCredentialValues = [...new Set([
+            ...inboxState ? [inboxState.email, inboxState.baseEmail] : [],
+            ...inboxState ? (0, google_signin_js_1.googleSignInAllowedEmails)() : []
+          ].filter((value) => !!value))];
           const secretsForLogging = Object.fromEntries(Object.entries(secretsOnlyForGuard).filter(([, value]) => !allowedCredentialValues.includes(value)));
           for (const toolCall of assistantMessage.tool_calls) {
             const toolName = toolCall.function.name;
@@ -331095,8 +331307,9 @@ Exploration complete: ${summary}`);
               }
               const fullVarMap = variableContext.allTestVariables ?? variableContext.publicTestVariables;
               const { secrets: dispatchSecrets } = (0, credential_tools_js_1.partitionTestVariables)(fullVarMap);
+              const fillSecrets = inboxState ? (0, google_signin_js_1.mergeGoogleSignInSecrets)(dispatchSecrets) : dispatchSecrets;
               try {
-                const result = toolName === "fill_credential" ? await (0, credential_tools_js_1.handleFillCredential)(toolArgs, { mcpClient, credentials: dispatchSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS }) : await (0, credential_tools_js_1.handleFillCredentialForm)(toolArgs, { mcpClient, credentials: dispatchSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS });
+                const result = toolName === "fill_credential" ? await (0, credential_tools_js_1.handleFillCredential)(toolArgs, { mcpClient, credentials: fillSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS }) : await (0, credential_tools_js_1.handleFillCredentialForm)(toolArgs, { mcpClient, credentials: fillSecrets, maxResultChars: MAX_TOOL_RESULT_CHARS });
                 if (result.didMutate) {
                   lastSnapshotText = null;
                   const codeLines = (0, exploration_parser_js_1.extractCodeLines)(result.content);
@@ -333136,7 +333349,7 @@ ${keyLines || "- (none provided)"}
 ## EXACTLY what to do
 1. Navigate to ${baseUrl} and take a \`browser_snapshot\`.
 2. Find the Sign Up / Register / Create account affordance (match by PURPOSE, in the app's own language) and open the signup form. If a reveal button hides the fields ("Sign up with Email"), click it first.
-3. Follow the "Account Registration (verification inbox is ENABLED)" steps below EXACTLY: call \`provision_identity\` for the email, type that email, fill the password with \`fill_credential\`, fill any other required fields with simple test values, and submit.
+3. Follow the "Account Registration (verification inbox is ENABLED)" steps below EXACTLY: call \`provision_identity\` for the email, type that email, fill the password with \`fill_credential\`, fill any other required fields with simple test values, and submit. If there is NO email+password signup field and only "Continue with Google" / "Sign up with Gmail", follow the Google / Gmail SSO fallback in that section (bare Google account email, \`fill_credential\` with \`GOOGLE_SIGNIN_PASSWORD\`, never the IMAP app password).
 4. Complete email verification using the inbox tools (\`wait_for_verification\` \u2192 enter the code or \`open_verification_link\`). Re-poll if the email is slow; resend AT MOST once; NEVER register a second account.
 5. Confirm you are signed in \u2014 a redirect to an authenticated route, or an in-place change to authenticated content. Take a \`browser_snapshot\`.
 6. \`capture_page\` the authenticated landing page in its DEFAULT state, then call \`finish_exploration\`. Do this the MOMENT the account is verified and you are signed in.
@@ -333690,6 +333903,7 @@ var require_grok_survey_runner = __commonJS({
     var grok_cli_js_1 = require_grok_cli();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var exploration_parser_js_1 = require_exploration_parser();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var agentic_survey_prompts_js_1 = require_agentic_survey_prompts();
@@ -334214,7 +334428,7 @@ var require_grok_survey_runner = __commonJS({
       };
       const surveyAgentsMd = inboxReg ? `${(0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)()}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)();
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)();
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), surveyAgentsMd, "utf8");
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_survey_prompts_js_1.buildSurveyBriefMd)(briefInput), "utf8");
       log2("Wrote AGENTS.md + BRIEF.md");
@@ -335621,6 +335835,7 @@ var require_grok_discovery_runner = __commonJS({
     var playwright_native_js_1 = require_playwright_native();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var grok_survey_runner_js_1 = require_grok_survey_runner();
     var agentic_discovery_prompts_js_1 = require_agentic_discovery_prompts();
@@ -335914,7 +336129,7 @@ var require_grok_discovery_runner = __commonJS({
         };
         const discoveryAgentsMd = inboxReg ? `${(0, agentic_discovery_prompts_js_1.buildDiscoveryAgentsMd)()}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_discovery_prompts_js_1.buildDiscoveryAgentsMd)();
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_discovery_prompts_js_1.buildDiscoveryAgentsMd)();
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), discoveryAgentsMd, "utf8");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_discovery_prompts_js_1.buildDiscoveryBriefMd)(briefInput), "utf8");
         await (0, promises_1.mkdir)(testsDirPath, { recursive: true });
@@ -336867,7 +337082,7 @@ ${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwo
 
 ---
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxRegV2.email, inboxRegV2.passwordKey)}` : "");
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxRegV2.email, inboxRegV2.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : "");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), agentsMd, "utf8");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_discovery_prompts_js_1.buildDiscoveryBriefMd)(briefInput), "utf8");
         await (0, promises_1.mkdir)(testsDirPath, { recursive: true });
@@ -337839,6 +338054,7 @@ var require_claude_survey_runner = __commonJS({
     var claude_stream_parser_js_1 = require_claude_stream_parser();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var agentic_cli_constants_js_1 = require_agentic_cli_constants();
     var grok_survey_runner_js_1 = require_grok_survey_runner();
@@ -337939,7 +338155,7 @@ ${preview}`);
       };
       const surveyAgentsMd = inboxReg ? `${(0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)({ canvasMode })}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)({ canvasMode });
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_survey_prompts_js_1.buildSurveyAgentsMd)({ canvasMode });
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "AGENTS.md"), surveyAgentsMd, "utf8");
       await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_survey_prompts_js_1.buildSurveyBriefMd)(briefInput), "utf8");
       log2("Wrote AGENTS.md + BRIEF.md");
@@ -338649,6 +338865,7 @@ var require_claude_discovery_runner = __commonJS({
     var claude_cli_js_1 = require_claude_cli();
     var playwright_mcp_config_js_1 = require_playwright_mcp_config();
     var inbox_tools_js_1 = require_inbox_tools();
+    var google_signin_js_1 = require_google_signin();
     var coverage_examples_content_js_1 = require_coverage_examples_content();
     var scrub_credentials_js_1 = require_scrub_credentials();
     var agentic_cli_constants_js_1 = require_agentic_cli_constants();
@@ -338817,7 +339034,7 @@ var require_claude_discovery_runner = __commonJS({
         };
         const explorerContractMd = inboxReg ? `${(0, agentic_discovery_prompts_js_1.buildExplorerContractMd)(contractInput)}
 
-${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey)}` : (0, agentic_discovery_prompts_js_1.buildExplorerContractMd)(contractInput);
+${(0, inbox_tools_js_1.buildInboxAgentsGuidance)(inboxReg.email, inboxReg.passwordKey, (0, google_signin_js_1.googleSignInGuidanceOpts)())}` : (0, agentic_discovery_prompts_js_1.buildExplorerContractMd)(contractInput);
         await (0, promises_1.writeFile)(claudeMdPath, explorerContractMd, "utf8");
         await (0, promises_1.writeFile)((0, node_path_1.join)(runDir, "BRIEF.md"), (0, agentic_discovery_prompts_js_1.buildDiscoveryBriefMd)(briefInput), "utf8");
         await (0, promises_1.mkdir)(testsDirPath, { recursive: true });
@@ -356074,7 +356291,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.92",
+      version: "1.0.93",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.92",
+  "version": "1.0.93",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"