dirpush 0.1.5 → 0.1.6

package/.agents/skills/dirpush/references/authentication.md

@@ -13,14 +13,14 @@ Always drive the browser through `dirpush ab` (agent-browser on the agents' own
 
 ## Creating a password without ever seeing it
 
-Generate, fill, and store in **one** shell command so the secret never appears in your context or in any file:
+With the sign-up (or reset) page open in `dirpush ab`, one command generates the password, types it into every field you name, checks the site got it, and saves it to the vault. It never appears in your context or any file:
 
 ```bash
-PW=$(openssl rand -base64 18) && dirpush ab fill @<password-ref> "$PW" && \
-  printf %s "$PW" | agent-browser auth save <directory-id>-<product-id> --url <login-url> --username <email> --password-stdin && unset PW
+dirpush browser password <directory-id>-<product-id> --url <this page's url> --username <email> \
+  [--login-url <the site's sign-in page>] '<password selector>' ['<confirm selector>']
 ```
 
-(Repeat the `fill` for a "confirm password" field inside the same command.) Before `auth save`, check the fields really hold it, e.g. `agent-browser eval '[...document.querySelectorAll("input[type=password]")].map(p=>p.value.length)'` → all 24. A `fill` can report success on a selector that matched nothing, leaving a vault entry for a password the site never got.
+Passwords always have upper, lower, digit and symbol (24 chars). Pass `--login-url` whenever the page isn't the sign-in page (a sign-up form, a reset link): the vault opens that URL for every later `browser login`. Never generate passwords yourself (`openssl rand -base64` can lack a symbol, and sites reject it).
 
 ## Continue with Google (`accounts.oauth_google`)
 

package/package.json

@@ -37,7 +37,7 @@
     "url": "https://github.com/baronunread/dirpush.git"
   },
   "homepage": "https://dirpush.com",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "keywords": [
     "directories",
     "startup",

package/src/browser.ts

@@ -136,7 +136,7 @@ export function strongPassword() {
  * New account password: generated here, typed into every given field of the open tab on `url`'s site, checked,
  * then saved to the vault as `name`. Returns no secret.
  */
-export async function newPassword(name: string, url: string, username: string, selectors: string[]) {
+export async function newPassword(name: string, url: string, username: string, selectors: string[], loginUrl = url) {
   if (!selectors.length) throw new Error("pass the password field selector(s), e.g. 'input[type=password]'");
   const page = await pageOn(url);
   const pw = strongPassword();
@@ -145,6 +145,7 @@ export async function newPassword(name: string, url: string, username: string, s
   const lengths = JSON.parse(ab(["eval", `JSON.stringify(${JSON.stringify(selectors)}.map((s) => document.querySelector(s)?.value.length ?? -1))`]));
   const got = (typeof lengths === "string" ? JSON.parse(lengths) : lengths) as number[];
   if (got.some((n) => n !== pw.length)) throw new Error(`password fields not filled (lengths ${got.join(", ")}); nothing saved`);
-  ab(["auth", "save", name, "--url", url, "--username", username, "--password-stdin"], pw);
+  // The vault keeps the sign-in page: `browser login` opens on it later, so a reset or sign-up URL there breaks logins.
+  ab(["auth", "save", name, "--url", loginUrl, "--username", username, "--password-stdin"], pw);
   return { vault: name, username, fields: selectors.length, page: page.url.slice(0, 200), saved: true };
 }

package/src/cli.ts

@@ -79,6 +79,7 @@ const { values: flags, positionals } = parseArgs({
     source: { type: "string" },
     job: { type: "string" },
     url: { type: "string" },
+    "login-url": { type: "string" },
     username: { type: "string" },
     rel: { type: "string" }, // registry set-link
     samples: { type: "string" },
@@ -655,8 +656,8 @@ const commands: Record<string, (() => Promise<unknown> | unknown) | undefined> =
   "browser stop": () => stopBrowser(),
   "browser login": () => vaultLogin(arg(0, "vault-name")),
   "browser password": () => {
-    if (!flags.url || !flags.username) throw new Error("browser password <vault-name> --url <login-url> --username <email> <field-selector…>");
-    return newPassword(arg(0, "vault-name"), flags.url, flags.username, args.slice(1));
+    if (!flags.url || !flags.username) throw new Error("browser password <vault-name> --url <page-url> --username <email> [--login-url <sign-in page>] <field-selector…>");
+    return newPassword(arg(0, "vault-name"), flags.url, flags.username, args.slice(1), flags["login-url"]);
   },
   async "serve"() {
     const { serve } = await import("./server");
@@ -730,7 +731,7 @@ const HELP: [string, [string, string][]][] = [
     ["google-login", "the human signs into Google once in the agents' Chrome profile"],
     ["browser start | status | stop", "the dedicated Chrome (real profile, Google services blocked) agents drive"],
     ["browser login <vault-name>", "fill a saved login into the open tab on that site (password never shown)"],
-    ["browser password <vault-name> --url u --username e <selector…>", "new account: generate, fill, verify and save a password (never shown)"],
+    ["browser password <vault-name> --url u --username e [--login-url u] <selector…>", "new password (sign-up or reset): generate, fill, verify and save it (never shown); --login-url when the page isn't the sign-in page (e.g. a reset link)"],
   ]],
   ["Other", [
     ["dr show | dr refresh [--all]", "Domain Rating history (refresh needs AHREFS_API_KEY)"],