opendevbrowser 0.0.16 → 0.0.18

package/skills/opendevbrowser-design-agent/scripts/extract-canvas-plan.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ $# -lt 1 || $# -gt 2 ]]; then
+  cat <<'EOF' >&2
+Usage:
+  ./skills/opendevbrowser-design-agent/scripts/extract-canvas-plan.sh <design-contract.json> [canvas-session.json]
+EOF
+  exit 2
+fi
+
+input_path="$1"
+session_path="${2:-}"
+
+node - "$input_path" "$session_path" <<'NODE'
+const fs = require("node:fs");
+
+const inputPath = process.argv[2];
+const sessionPath = process.argv[3];
+const requiredKeys = [
+  "targetOutcome",
+  "visualDirection",
+  "layoutStrategy",
+  "contentStrategy",
+  "componentStrategy",
+  "motionPosture",
+  "responsivePosture",
+  "accessibilityPosture",
+  "validationTargets"
+];
+
+const payload = JSON.parse(fs.readFileSync(inputPath, "utf8"));
+const plan = payload.generationPlan ?? payload;
+const missing = requiredKeys.filter((key) => !(key in plan));
+
+let sessionPayload = null;
+if (sessionPath) {
+  sessionPayload = JSON.parse(fs.readFileSync(sessionPath, "utf8"));
+}
+
+const sessionResult = sessionPayload?.data?.result ?? sessionPayload?.result ?? sessionPayload ?? {};
+
+if (missing.length > 0) {
+  console.error(`Missing generationPlan keys: ${missing.join(", ")}`);
+  process.exit(1);
+}
+
+process.stdout.write(JSON.stringify({
+  requestId: payload.requestId ?? "req_plan_from_contract",
+  canvasSessionId: payload.canvasSessionId ?? sessionResult.canvasSessionId ?? "<canvas-session-id>",
+  leaseId: payload.leaseId ?? sessionResult.leaseId ?? "<lease-id>",
+  documentId: payload.documentId ?? sessionResult.documentId ?? "<document-id>",
+  generationPlan: plan
+}, null, 2));
+process.stdout.write("\n");
+NODE

package/skills/opendevbrowser-design-agent/scripts/validate-skill-assets.sh

@@ -0,0 +1,223 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+skill_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+skill_file="$skill_root/SKILL.md"
+
+node - "$skill_root" "$skill_file" <<'NODE'
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const [skillRoot, skillFile] = process.argv.slice(2);
+
+const requiredPaths = [
+  "artifacts/design-workflows.md",
+  "artifacts/design-contract-playbook.md",
+  "artifacts/frontend-evaluation-rubric.md",
+  "artifacts/external-pattern-synthesis.md",
+  "artifacts/component-pattern-index.md",
+  "artifacts/existing-surface-adaptation.md",
+  "artifacts/app-shell-and-state-wiring.md",
+  "artifacts/state-ownership-matrix.md",
+  "artifacts/async-search-state-ownership.md",
+  "artifacts/loading-and-feedback-surfaces.md",
+  "artifacts/theming-and-token-ownership.md",
+  "artifacts/isolated-preview-validation.md",
+  "artifacts/performance-audit-playbook.md",
+  "artifacts/scroll-reveal-surface-planning.md",
+  "artifacts/research-harvest-workflow.md",
+  "artifacts/design-release-gate.md",
+  "artifacts/opendevbrowser-ui-example-map.md",
+  "artifacts/implementation-anti-patterns.md",
+  "assets/templates/design-brief.v1.md",
+  "assets/templates/design-audit-report.v1.md",
+  "assets/templates/design-contract.v1.json",
+  "assets/templates/canvas-generation-plan.design.v1.json",
+  "assets/templates/design-review-checklist.json",
+  "assets/templates/real-surface-design-matrix.json",
+  "assets/templates/reference-pattern-board.v1.json",
+  "assets/templates/design-release-gate.v1.json",
+  "scripts/design-workflow.sh",
+  "scripts/extract-canvas-plan.sh",
+  "scripts/validate-skill-assets.sh"
+];
+
+const jsonTemplates = [
+  "assets/templates/design-contract.v1.json",
+  "assets/templates/canvas-generation-plan.design.v1.json",
+  "assets/templates/design-review-checklist.json",
+  "assets/templates/real-surface-design-matrix.json",
+  "assets/templates/reference-pattern-board.v1.json",
+  "assets/templates/design-release-gate.v1.json"
+];
+
+const executableScripts = [
+  "scripts/design-workflow.sh",
+  "scripts/extract-canvas-plan.sh",
+  "scripts/validate-skill-assets.sh"
+];
+
+const workflowResolverMarkers = [
+  "resolve-odb-cli.sh",
+  "CLI_PREFIX"
+];
+
+const skillDocMarkers = [
+  "artifacts/design-workflows.md",
+  "artifacts/design-contract-playbook.md",
+  "artifacts/frontend-evaluation-rubric.md",
+  "artifacts/external-pattern-synthesis.md",
+  "artifacts/component-pattern-index.md",
+  "artifacts/existing-surface-adaptation.md",
+  "artifacts/app-shell-and-state-wiring.md",
+  "artifacts/state-ownership-matrix.md",
+  "artifacts/async-search-state-ownership.md",
+  "artifacts/loading-and-feedback-surfaces.md",
+  "artifacts/theming-and-token-ownership.md",
+  "artifacts/isolated-preview-validation.md",
+  "artifacts/performance-audit-playbook.md",
+  "artifacts/scroll-reveal-surface-planning.md",
+  "artifacts/research-harvest-workflow.md",
+  "artifacts/design-release-gate.md",
+  "artifacts/opendevbrowser-ui-example-map.md",
+  "artifacts/implementation-anti-patterns.md",
+  "assets/templates/design-audit-report.v1.md",
+  "assets/templates/design-contract.v1.json",
+  "assets/templates/canvas-generation-plan.design.v1.json",
+  "assets/templates/reference-pattern-board.v1.json",
+  "assets/templates/design-release-gate.v1.json",
+  "scripts/extract-canvas-plan.sh",
+  "canvas.plan.set",
+  "canvas.history.undo",
+  "canvas.history.redo",
+  "canvas_history_requested",
+  "research-harvest",
+  "release-gate",
+  "performance-audit",
+  "Delivered to agent",
+  "Stored only; fetch with annotate --stored",
+  "ISSUE-01",
+  "ISSUE-07",
+  "ISSUE-08",
+  "ISSUE-12",
+  "v0.dev/docs/prompting/text",
+  "docs.lovable.dev/prompting/prompting-best-practices"
+];
+
+const patternMarkers = [
+  "Anthropic",
+  "Vercel v0",
+  "Lovable",
+  "iannuttall/claude-agents",
+  "Dimillian",
+  "OpenDevBrowser-Specific Adaptation"
+];
+
+const failures = [];
+const fullPath = (relPath) => path.join(skillRoot, relPath);
+
+for (const relPath of requiredPaths) {
+  if (!fs.existsSync(fullPath(relPath))) {
+    failures.push(`Missing required asset: ${relPath}`);
+  }
+}
+
+for (const relPath of executableScripts) {
+  if (!fs.existsSync(fullPath(relPath))) continue;
+  const mode = fs.statSync(fullPath(relPath)).mode & 0o111;
+  if (mode === 0) {
+    failures.push(`Script is not executable: ${relPath}`);
+  }
+}
+
+for (const relPath of jsonTemplates) {
+  if (!fs.existsSync(fullPath(relPath))) continue;
+  try {
+    JSON.parse(fs.readFileSync(fullPath(relPath), "utf8"));
+  } catch {
+    failures.push(`Invalid JSON template: ${relPath}`);
+  }
+}
+
+const skillDoc = fs.readFileSync(skillFile, "utf8");
+for (const marker of skillDocMarkers) {
+  if (!skillDoc.includes(marker)) {
+    failures.push(`SKILL.md missing marker: ${marker}`);
+  }
+}
+
+const patternDoc = fs.readFileSync(fullPath("artifacts/external-pattern-synthesis.md"), "utf8");
+for (const marker of patternMarkers) {
+  if (!patternDoc.includes(marker)) {
+    failures.push(`external-pattern-synthesis missing marker: ${marker}`);
+  }
+}
+
+const extractScript = fullPath("scripts/extract-canvas-plan.sh");
+const contractTemplate = fullPath("assets/templates/design-contract.v1.json");
+const extractResult = spawnSync(extractScript, [contractTemplate], { encoding: "utf8" });
+if (extractResult.status !== 0) {
+  failures.push(`extract-canvas-plan.sh failed on template: ${extractResult.stderr.trim() || extractResult.stdout.trim()}`);
+} else {
+  try {
+    const output = JSON.parse(extractResult.stdout);
+    const requiredPlanKeys = [
+      "targetOutcome",
+      "visualDirection",
+      "layoutStrategy",
+      "contentStrategy",
+      "componentStrategy",
+      "motionPosture",
+      "responsivePosture",
+      "accessibilityPosture",
+      "validationTargets"
+    ];
+    for (const key of requiredPlanKeys) {
+      if (!(key in (output.generationPlan ?? {}))) {
+        failures.push(`extract-canvas-plan output missing key: ${key}`);
+      }
+    }
+  } catch {
+    failures.push("extract-canvas-plan.sh produced invalid JSON output");
+  }
+}
+
+const workflowScript = fullPath("scripts/design-workflow.sh");
+const workflowSource = fs.readFileSync(workflowScript, "utf8");
+for (const marker of workflowResolverMarkers) {
+  if (!workflowSource.includes(marker)) {
+    failures.push(`design-workflow.sh missing resolver marker: ${marker}`);
+  }
+}
+
+for (const workflow of [
+  "list",
+  "contract-first",
+  "research-harvest",
+  "screenshot-audit",
+  "canvas-contract",
+  "real-surface-validation",
+  "performance-audit",
+  "release-gate",
+  "ship-audit"
+]) {
+  const result = spawnSync(workflowScript, [workflow], { encoding: "utf8" });
+  if (result.status !== 0) {
+    failures.push(`design-workflow.sh failed for mode ${workflow}: ${result.stderr.trim() || result.stdout.trim()}`);
+    continue;
+  }
+  if ((result.stdout ?? "").trim().length === 0) {
+    failures.push(`design-workflow.sh produced empty output for mode ${workflow}`);
+  }
+}
+
+if (failures.length > 0) {
+  for (const failure of failures) {
+    console.error(failure);
+  }
+  process.exit(1);
+}
+
+console.log("Design-agent skill assets validated.");
+NODE

package/skills/opendevbrowser-form-testing/SKILL.md

@@ -28,14 +28,29 @@ Use this skill for robust form automation across dynamic, multi-step, challenge-
 ./skills/opendevbrowser-form-testing/scripts/run-form-workflow.sh challenge-checkpoint
 ```
 
+## Supporting Surfaces
+
+- Use browser replay (`screencast-start` / `screencast-stop`) when transient validation, step transitions, or challenge timing need temporal evidence.
+- Use desktop observation only for read-only evidence around OS-owned dialogs such as file choosers or sibling desktop prompts.
+- Use `--challenge-automation-mode off|browser|browser_with_helper` for bounded browser-scoped computer use on submit or challenge branches; it is not desktop automation.
+
 ## Core Rules
 
 - Snapshot first, then act.
 - Keep one field mutation per decision loop in failure analysis.
 - Re-snapshot after each invalid submit to avoid stale refs.
 - Verify both UX and network behavior for each submission branch.
+- Use low-level pointer controls when a deterministic challenge or slider gate is part of the approved test path, then re-snapshot before continuing.
 - Keep challenge retries bounded and honor `Retry-After` when 429 pressure appears.
 
+## Session Reuse by Mode
+
+- `extension` reuses the attached live tab or profile state; it does not run system cookie bootstrap.
+- `managed` attempts readable system Chrome-family cookie bootstrap before first navigation.
+- `cdpConnect` attempts readable system Chrome-family cookie bootstrap before first navigation.
+- Use `cookie-import` only when you intentionally need to add or override cookies after session creation.
+- Canonical direct-run release evidence policy lives in `../opendevbrowser-best-practices/SKILL.md`.
+
 ## Parallel Multitab Alignment
 
 - Apply shared concurrency policy from `../opendevbrowser-best-practices/SKILL.md` ("Parallel Operations").
@@ -101,9 +116,10 @@ opendevbrowser_get_attr sessionId="<session-id>" ref="<field-ref>" name="aria-de
 For forms guarded by challenge providers:
 
 1. Detect challenge widget/frame state.
-2. Mark manual checkpoint in run log.
-3. Complete challenge manually or by approved test key in non-production.
-4. Resume from fresh snapshot and continue validation.
+2. If the environment exposes a deterministic slider/test gate, complete it with low-level pointer controls and re-snapshot.
+3. Otherwise mark a manual checkpoint in the run log.
+4. Complete challenge manually or by approved test key in non-production.
+5. Resume from fresh snapshot and continue validation.
 
 Do not implement challenge bypass behavior.
 

package/skills/opendevbrowser-form-testing/artifacts/form-workflows.md

@@ -31,7 +31,8 @@
 ## Challenge checkpoint workflow
 
 1. Detect challenge state
-2. Pause and annotate checkpoint
-3. Resume after manual completion
-4. Continue assertions from refreshed snapshot
-5. Stop and escalate after repeated challenge loops
+2. If the environment exposes a deterministic slider/test gate, complete it with low-level pointer controls and re-snapshot
+3. Otherwise pause and annotate a manual checkpoint
+4. Resume after completion from a refreshed snapshot
+5. Continue assertions from refreshed snapshot
+6. Stop and escalate after repeated challenge loops

package/skills/opendevbrowser-form-testing/assets/templates/challenge-decision-tree.json

@@ -7,6 +7,8 @@
     "ISSUE-06"
   ],
   "action": "manual_checkpoint",
+  "pointer_gate_required": false,
+  "pointer_gate_completed": false,
   "max_challenge_retries": 2,
   "retry_after_seconds": 0,
   "resume_conditions": [

package/skills/opendevbrowser-form-testing/scripts/validate-skill-assets.sh

@@ -15,6 +15,16 @@ required=(
 )
 
 status=0
+
+require_marker() {
+  local label="$1"
+  local output="$2"
+  local marker="$3"
+  if [[ "$output" != *"$marker"* ]]; then
+    echo "$label missing marker: $marker" >&2
+    status=1
+  fi
+}
 for rel in "${required[@]}"; do
   if [[ ! -f "$root/$rel" ]]; then
     echo "Missing required asset: $rel" >&2
@@ -42,6 +52,105 @@ for rel in assets/templates/validation-matrix.json assets/templates/challenge-de
   fi
 done
 
+list_output="$("$root/scripts/run-form-workflow.sh" list)"
+for workflow_name in \
+  discovery \
+  validation \
+  multi-step \
+  dynamic-required \
+  file-upload \
+  challenge-checkpoint
+do
+  require_marker "workflow list" "$list_output" "$workflow_name"
+done
+
+validation_output="$("$root/scripts/run-form-workflow.sh" validation)"
+require_marker "validation workflow" "$validation_output" "aria-invalid"
+require_marker "validation workflow" "$validation_output" "opendevbrowser_dom_get_text"
+
+multi_step_output="$("$root/scripts/run-form-workflow.sh" multi-step)"
+require_marker "multi-step workflow" "$multi_step_output" "next-step-ref"
+require_marker "multi-step workflow" "$multi_step_output" "state=\"visible\""
+
+challenge_output="$("$root/scripts/run-form-workflow.sh" challenge-checkpoint)"
+require_marker "challenge-checkpoint workflow" "$challenge_output" "pause automation"
+require_marker "challenge-checkpoint workflow" "$challenge_output" "opendevbrowser_snapshot"
+
+dynamic_required_output="$("$root/scripts/run-form-workflow.sh" dynamic-required)"
+require_marker "dynamic-required workflow" "$dynamic_required_output" "toggle-ref"
+require_marker "dynamic-required workflow" "$dynamic_required_output" "opendevbrowser_snapshot"
+
+file_upload_output="$("$root/scripts/run-form-workflow.sh" file-upload)"
+require_marker "file-upload workflow" "$file_upload_output" "file-input-ref"
+require_marker "file-upload workflow" "$file_upload_output" "opendevbrowser_network_poll"
+
+if ! node - "$root" <<'NODE'
+const fs = require("node:fs");
+const path = require("node:path");
+
+const [root] = process.argv.slice(2);
+const failures = [];
+
+const validationMatrix = JSON.parse(fs.readFileSync(path.join(root, "assets/templates/validation-matrix.json"), "utf8"));
+const challengeTree = JSON.parse(fs.readFileSync(path.join(root, "assets/templates/challenge-decision-tree.json"), "utf8"));
+const multiStepState = JSON.parse(fs.readFileSync(path.join(root, "assets/templates/multi-step-state.json"), "utf8"));
+
+if (!Array.isArray(validationMatrix.fields) || validationMatrix.fields.length === 0) {
+  failures.push("validation-matrix.json must declare at least one field.");
+} else {
+  const firstField = validationMatrix.fields[0];
+  for (const testCase of ["empty", "whitespace", "out_of_range", "valid"]) {
+    if (!Array.isArray(firstField.cases) || !firstField.cases.includes(testCase)) {
+      failures.push(`validation-matrix.json missing field case: ${testCase}`);
+    }
+  }
+}
+for (const marker of ["becomes_required_after_toggle", "hidden_field_not_submitted"]) {
+  if (!Array.isArray(validationMatrix.conditional_cases) || !validationMatrix.conditional_cases.includes(marker)) {
+    failures.push(`validation-matrix.json missing conditional case: ${marker}`);
+  }
+}
+for (const marker of ["invalid_blocked", "valid_success"]) {
+  if (!Array.isArray(validationMatrix.submit_cases) || !validationMatrix.submit_cases.includes(marker)) {
+    failures.push(`validation-matrix.json missing submit case: ${marker}`);
+  }
+}
+
+if (challengeTree.action !== "manual_checkpoint") {
+  failures.push("challenge-decision-tree.json must default to manual_checkpoint.");
+}
+if (challengeTree.max_challenge_retries !== 2) {
+  failures.push("challenge-decision-tree.json must cap retries at 2.");
+}
+for (const marker of ["challenge_cleared", "new_snapshot_taken"]) {
+  if (!Array.isArray(challengeTree.resume_conditions) || !challengeTree.resume_conditions.includes(marker)) {
+    failures.push(`challenge-decision-tree.json missing resume condition: ${marker}`);
+  }
+}
+
+for (const key of ["flow", "step_index", "step_name", "completed_steps", "carried_state", "final_confirmation"]) {
+  if (!(key in multiStepState)) {
+    failures.push(`multi-step-state.json missing key: ${key}`);
+  }
+}
+if (typeof multiStepState.final_confirmation?.seen !== "boolean") {
+  failures.push("multi-step-state.json must define final_confirmation.seen as a boolean.");
+}
+if (typeof multiStepState.final_confirmation?.reference_id !== "string") {
+  failures.push("multi-step-state.json must define final_confirmation.reference_id as a string.");
+}
+
+if (failures.length > 0) {
+  for (const failure of failures) {
+    console.error(failure);
+  }
+  process.exit(1);
+}
+NODE
+then
+  status=1
+fi
+
 if [[ $status -ne 0 ]]; then
   exit $status
 fi

package/skills/opendevbrowser-login-automation/SKILL.md

@@ -35,14 +35,29 @@ Use this skill for deterministic auth testing that handles MFA and anti-bot chec
 ./skills/opendevbrowser-login-automation/scripts/run-login-workflow.sh challenge-checkpoint
 ```
 
+## Supporting Surfaces
+
+- Use browser replay (`screencast-start` / `screencast-stop`) when login timing, MFA transitions, or challenge loops need temporal evidence.
+- Use desktop observation only for read-only evidence around native dialogs or sibling desktop surfaces; it stays core-owned and is not extension relay control.
+- Use `--challenge-automation-mode off|browser|browser_with_helper` when workflow or macro execution needs bounded browser-scoped computer use; the helper is not a desktop agent.
+
 ## Core Rules
 
 - Use snapshot refs, not ad-hoc selectors.
 - Run one decision loop at a time: snapshot -> action -> snapshot.
+- Use low-level pointer controls when a deterministic test gate or slider challenge requires gesture input, then re-snapshot before resuming auth steps.
 - Never store credentials in skill files, logs, screenshots, or committed fixtures.
 - Treat anti-bot challenges as checkpoints (manual solve or approved test keys), not bypass targets.
 - Keep a bounded retry budget (max 2 automated retries) and honor `Retry-After` when present.
 
+## Session Reuse by Mode
+
+- `extension` reuses the attached live tab or profile state; it does not run system cookie bootstrap.
+- `managed` attempts readable system Chrome-family cookie bootstrap before first navigation.
+- `cdpConnect` attempts readable system Chrome-family cookie bootstrap before first navigation.
+- `cookie-import` is the explicit add or override lane after session creation, not the automatic bootstrap path.
+- Canonical direct-run release evidence policy lives in `../opendevbrowser-best-practices/SKILL.md`.
+
 ## Parallel Multitab Alignment
 
 - Apply shared concurrency policy from `../opendevbrowser-best-practices/SKILL.md` ("Parallel Operations").
@@ -70,6 +85,7 @@ Matrix source: `../opendevbrowser-best-practices/artifacts/browser-agent-known-i
    - authenticated shell appears -> success validation
    - MFA prompt appears -> continue MFA branch
    - popup/new-tab SSO appears -> switch target and continue auth branch
+   - deterministic slider or pointer gate appears -> complete pointer workflow, then re-snapshot
    - anti-bot challenge appears -> checkpoint branch
    - invalid credentials or lockout message -> failure branch
 
@@ -90,8 +106,9 @@ Use this when CAPTCHA/turnstile/challenge pages appear.
 
 1. Detect challenge UI from snapshot refs or page text.
 2. Pause automation and mark checkpoint in run log.
-3. Complete challenge manually (or with provider-approved test key in non-production).
-4. Resume from a fresh snapshot and continue auth validation.
+3. If the environment exposes a deterministic test slider or pointer gate, use low-level pointer commands and re-snapshot before continuing.
+4. Otherwise complete the challenge manually (or with provider-approved test key in non-production).
+5. Resume from a fresh snapshot and continue auth validation.
 
 Signals to monitor:
 - challenge iframe/widget visible
@@ -124,6 +141,7 @@ Validate at least two independent signals:
 - URL/route transition to authenticated area.
 - Auth-only element visible (`opendevbrowser_is_visible`).
 - Auth request success from `opendevbrowser_network_poll`.
+- Invalid-credential rejection from `opendevbrowser_network_poll` is acceptable failure proof when UI copy is suppressed or delayed.
 
 ```text
 opendevbrowser_network_poll sessionId="<session-id>" max=50
@@ -143,7 +161,7 @@ Close and relaunch, then confirm one of:
 
 ## Failure Modes
 
-- Invalid credentials: assert explicit field/banner errors.
+- Invalid credentials: prefer explicit field/banner errors, but accept network rejection evidence when UI copy is absent.
 - Rate limit/lockout: stop retries, apply cooldown, rotate test account.
 - Challenge loop: escalate as anti-bot pressure issue.
 - MFA unavailable for test account: mark incomplete test prerequisite.

package/skills/opendevbrowser-login-automation/artifacts/login-workflows.md

@@ -5,7 +5,7 @@
 1. Preflight snapshot
 2. Type identifier/password
 3. Submit
-4. Validate URL + auth-only ref + network status
+4. Validate URL + auth-only ref + network status, or accept invalid-credential rejection from the network log when UI error copy is absent
 5. Re-snapshot before any follow-up action
 
 ## MFA workflow
@@ -27,9 +27,10 @@
 
 1. Detect challenge state
 2. Record checkpoint with timestamp and trigger
-3. Pause automated actions
-4. Resume after challenge completion from fresh snapshot
-5. If challenge repeats twice, stop and escalate as anti-bot pressure
+3. If the environment exposes a deterministic slider/test gate, complete it with low-level pointer controls and re-snapshot
+4. Otherwise pause automated actions for manual completion
+5. Resume after challenge completion from fresh snapshot
+6. If challenge repeats twice, stop and escalate as anti-bot pressure
 
 ## Lockout recovery workflow
 

package/skills/opendevbrowser-login-automation/assets/templates/auth-signals.json

@@ -4,6 +4,8 @@
   "url_after": "",
   "auth_element_ref": "",
   "auth_element_visible": false,
+  "invalid_credentials_ui_seen": false,
+  "invalid_credentials_network_seen": false,
   "network": {
     "login_request_seen": false,
     "status_codes": [],
@@ -11,6 +13,9 @@
   },
   "frames_seen": 0,
   "popup_detected": false,
+  "pointer_gate_detected": false,
+  "pointer_gate_completed": false,
+  "pointer_gate_status": "",
   "challenge_detected": false,
   "challenge_type": "none",
   "challenge_checkpoint_count": 0,

package/skills/opendevbrowser-login-automation/assets/templates/login-scenario-matrix.json

@@ -13,10 +13,11 @@
   "expected_signals": [
     "url_changed",
     "auth_shell_visible",
-    "auth_network_success"
+    "auth_network_success",
+    "pointer_gate_complete_when_required"
   ],
   "failure_signals": [
-    "invalid_credentials",
+    "invalid_credentials_ui_or_network",
     "anti_bot_challenge",
     "rate_limited",
     "lockout"

package/skills/opendevbrowser-login-automation/scripts/run-login-workflow.sh

@@ -13,6 +13,7 @@ Workflows:
   mfa
   sso-popup
   challenge-checkpoint
+  pointer-checkpoint
   challenge-loop-guard
   lockout-recovery
   session-persistence
@@ -62,7 +63,22 @@ FLOW
     cat <<'FLOW'
 # Detect challenge state, then pause automated actions.
 opendevbrowser_snapshot sessionId="<session-id>" format="outline"
-# Manual checkpoint required: solve challenge with approved flow/test keys.
+# If the environment exposes a deterministic slider/test gate, complete it with pointer controls, then re-snapshot.
+# Otherwise manual checkpoint required: solve challenge with approved flow/test keys.
+# Resume only after challenge is solved.
+opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
+opendevbrowser_click sessionId="<session-id>" ref="<continue-ref>"
+opendevbrowser_wait sessionId="<session-id>" until="networkidle"
+FLOW
+    ;;
+  pointer-checkpoint)
+    cat <<'FLOW'
+# Use only for deterministic test gates or slider controls that are part of the approved workflow.
+opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
+opendevbrowser_pointer_move sessionId="<session-id>" x=<start-x> y=<start-y>
+opendevbrowser_pointer_down sessionId="<session-id>" x=<start-x> y=<start-y> button="left"
+opendevbrowser_pointer_drag sessionId="<session-id>" startX=<start-x> startY=<start-y> endX=<end-x> endY=<end-y> steps=12
+opendevbrowser_pointer_up sessionId="<session-id>" x=<end-x> y=<end-y> button="left"
 # Resume only after challenge is solved.
 opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
 opendevbrowser_click sessionId="<session-id>" ref="<continue-ref>"