package-registry-manager 0.22.10 → 0.22.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "package-registry-manager",
-  "version": "0.22.10",
+  "version": "0.22.11",
   "description": "Inspect repositories and guide secure package-registry setup",
   "type": "module",
   "bin": {
@@ -41,8 +41,8 @@
   },
   "dependencies": {
     "@link-foundation/gh-manager": "https://codeload.github.com/link-foundation/gh-manager/tar.gz/29808e088ac8fd8374361920bbebab07a4d63ac6",
-    "browser-commander": "^0.31.0",
-    "command-stream": "^2.1.0",
+    "browser-commander": "^0.31.2",
+    "command-stream": "^2.4.0",
     "playwright": "^1.63.0",
     "selenium-webdriver": "^4.50.0"
   },

package/src/auth-urls.mjs

@@ -111,6 +111,7 @@ export function runInteractive(command, options) {
       shell: false,
     });
     let legacyLogin = false;
+    let openings = Promise.resolve();
     const stop = options.stopOnLegacyLogin
       ? () => {
           legacyLogin = true;
@@ -119,7 +120,11 @@ export function runInteractive(command, options) {
       : undefined;
     const scan =
       options.onUrl || stop
-        ? authUrlScanner(options.onUrl ?? (() => {}), stop)
+        ? authUrlScanner((url, kind) => {
+            openings = openings.then(() => options.onUrl?.(url, kind));
+            // Observe rejection until the command closes and propagates it.
+            openings.catch(() => {});
+          }, stop)
         : null;
     let stdout = "";
     child.stdout.setEncoding("utf8");
@@ -141,9 +146,20 @@ export function runInteractive(command, options) {
       });
     }
     child.on("error", reject);
-    child.on("close", (code) => {
+    child.on("close", async (code) => {
       scan?.("\n");
-      resolve({ code: code ?? 1, stdout, legacyLogin, approvalExpired });
+      try {
+        await openings;
+        resolve({
+          code: code ?? 1,
+          stdout,
+          stderr: errors,
+          legacyLogin,
+          approvalExpired,
+        });
+      } catch (error) {
+        reject(error);
+      }
     });
   });
 }

package/src/browser.mjs

@@ -74,7 +74,13 @@ export function npmPrefillScript(prefill, submit = false) {
   const config = ${JSON.stringify(prefill)};
   const shouldSubmit = ${JSON.stringify(submit)};
   const normalized = value => (value || '').replace(/\\s+/g, ' ').trim().toLowerCase();
-  const controls = Array.from(document.querySelectorAll('input, select, textarea'));
+  const provider = Array.from(document.querySelectorAll('button, label, [role="radio"]'))
+    .find(element => normalized(element.textContent) === 'github');
+  if (provider) provider.click();
+  const githubForm = document.querySelector('#pending-github-publisher-form, #github-publisher-form');
+  const controls = Array.from((githubForm || document).querySelectorAll('input, select, textarea'))
+    .filter(control => !control.disabled && control.type !== 'hidden'
+      && (githubForm || control.getClientRects().length > 0));
   const setValue = (control, value) => {
     const prototype = control instanceof HTMLSelectElement
       ? HTMLSelectElement.prototype
@@ -88,7 +94,7 @@ export function npmPrefillScript(prefill, submit = false) {
   };
   const textFor = control => {
     const explicit = control.id
-      ? document.querySelector(\`label[for="\${CSS.escape(control.id)}"]\`)?.textContent
+      ? (control.closest('form') || document).querySelector(\`label[for="\${CSS.escape(control.id)}"]\`)?.textContent
       : '';
     return normalized([explicit, control.getAttribute('aria-label'), control.name,
       control.placeholder, control.closest('label')?.textContent].filter(Boolean).join(' '));
@@ -103,19 +109,18 @@ export function npmPrefillScript(prefill, submit = false) {
   const filled = [];
   const used = new Set();
   for (const [labels, value] of values) {
-    if (!value) continue;
+    if (!value && labels[0] !== 'environment') continue;
     const control = controls.find(candidate => !used.has(candidate)
       && labels.some(label => textFor(candidate).includes(label)));
     if (control) { setValue(control, value); used.add(control); filled.push(labels[0]); }
   }
-  const provider = Array.from(document.querySelectorAll('button, label, [role="radio"]'))
-    .find(element => normalized(element.textContent).includes('github'));
-  if (provider && filled.length === 0) provider.click();
   let submitted = false;
-  if (shouldSubmit && filled.length >= 3) {
-    const button = Array.from(document.querySelectorAll('button, input[type="submit"]'))
+  const required = ['organization', 'repository', 'workflow', ...(githubForm?.id.startsWith('pending-') ? ['project'] : [])];
+  const form = githubForm || controls.find(control => /repository|repo/.test(textFor(control)))?.closest('form');
+  if (shouldSubmit && required.every(field => filled.includes(field))) {
+    const button = Array.from((form || document).querySelectorAll('button, input[type="submit"]'))
       .find(candidate => /add|save|configure|submit/.test(normalized(candidate.textContent || candidate.value))
-        && !candidate.disabled);
+        && !candidate.disabled && !candidate.classList.contains('button--disabled'));
     if (button) { button.click(); submitted = true; }
   }
   return { filled, providerSelected: Boolean(provider), submitted };

package/src/cli-main.mjs

@@ -67,11 +67,11 @@ Setup options:
                                   through the crates.io API
   --keep-session                  Stay signed in after setup: npm keeps its
                                   session token in npm's user configuration
-                                  until npm logout; crates.io keeps only the
-                                  automated profile's browser session
+                                  until npm logout; the shared browser profile
+                                  keeps registry sessions across packages
   --browser <default|automated>   Open sign-in and approval pages in your
-                                  default browser, or in the automated
-                                  profile too (default: default)
+                                  default browser, or in the automated profile;
+                                  npm reuses the automated profile
   --browser-channel <channel>     Installed browser channel (default: chrome):
                                   ${launchChannels().join(", ")}
   --browser-executable <path>     Installed browser executable to launch
@@ -83,7 +83,7 @@ Setup options:
                                   ${importSources().join(", ")}
                                   into the automated profile; default takes the
                                   system default browser, auto the first
-                                  browser signed in to the registry
+                                  browser with registry cookies or saved logins
   --browser-import-scope <full|domains>
                                   Import the whole profile, or only the
                                   registry's sign-in cookies (default: full

package/src/flows.mjs

@@ -346,7 +346,7 @@ export function npmFlow(packageInfo, context) {
       "sign-in",
       "Sign in to npm in the browser",
       "command",
-      "Start a web login; the tool opens the printed URL in your default browser, where you are usually already signed in and only approve. No token is created or read by the tool.",
+      "Start a web login in the dedicated browser profile reused for publish approvals and publisher forms. Complete sign-in and 2FA in that browser. No token is created or read by the tool.",
       {
         command: command("npm", [
           "login",

package/src/npm-policy.mjs

@@ -1,4 +1,5 @@
 import { npmName, registryEndpoint, USER_AGENT } from "./registry-state.mjs";
+import { checkSimilarity, namingError } from "./npm-similarity.mjs";
 
 /** Bounded punctuation variants, including npm's punctuation-free moniker. */
 export function nameVariants(name) {
@@ -52,18 +53,17 @@ export async function checkNamePolicy(name, options = {}) {
       );
     }
     if (variant !== name) {
-      throw new Error(
-        `npm name '${name}' is similar to existing '${variant}'; use @owner/${name} or a longer descriptive name`,
-      );
+      throw await namingError(name, variant, options);
     }
     return;
   }
+  await checkSimilarity(name, options);
 }
 
 /** Report npm policy refusal once, without entering authentication retry logic. */
 export function policyRefusal(output) {
   return (
     /\bE403\b|403 Forbidden/i.test(output) &&
-    /too similar|forbidden|blocked|not allowed/i.test(output)
+    /too similar|package name.*(?:forbidden|blocked|not allowed)/i.test(output)
   );
 }

package/src/npm-similarity.mjs

@@ -0,0 +1,153 @@
+import { npmName, registryEndpoint, USER_AGENT } from "./registry-state.mjs";
+
+/** Compare punctuation-free monikers and a bounded Damerau edit distance. */
+export function similarName(name, candidate) {
+  if (name.startsWith("@") || candidate.startsWith("@")) {
+    return false;
+  }
+  const normalize = (value) => value.toLowerCase().replaceAll(/[._-]/g, "");
+  const a = normalize(name),
+    b = normalize(candidate);
+  if (a === b) {
+    return true;
+  }
+  if (Math.abs(a.length - b.length) > 2 || a.length > 214 || b.length > 214) {
+    return false;
+  }
+  const rows = Array.from({ length: a.length + 1 }, (_, i) =>
+    Array.from({ length: b.length + 1 }, (_, j) =>
+      i === 0 ? j : j === 0 ? i : 0,
+    ),
+  );
+  for (let i = 1; i <= a.length; i += 1) {
+    for (let j = 1; j <= b.length; j += 1) {
+      rows[i][j] = Math.min(
+        rows[i - 1][j] + 1,
+        rows[i][j - 1] + 1,
+        rows[i - 1][j - 1] + Number(a[i - 1] !== b[j - 1]),
+      );
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        rows[i][j] = Math.min(rows[i][j], rows[i - 2][j - 2] + 1);
+      }
+    }
+  }
+  return (
+    rows[a.length][b.length] <= (Math.min(a.length, b.length) >= 6 ? 2 : 1)
+  );
+}
+
+async function lookup(base, route, options) {
+  return (options.fetch ?? globalThis.fetch)(`${base}/${route}`, {
+    headers: {
+      accept: "application/json",
+      "cache-control": "no-cache, no-store",
+      "user-agent": USER_AGENT,
+    },
+    signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+  });
+}
+
+/** Check a finite set of proposed names; only a 404 means currently free. */
+export async function freeAlternatives(name, options = {}) {
+  const leaf = name.split("/").at(-1);
+  const scope = options.npmScope?.replace(/^@/, "");
+  const candidates = [
+    ...new Set([
+      ...(options.nameAlternatives ?? []),
+      ...(scope ? [`@${scope}/${leaf}`] : []),
+      `${leaf}-package`,
+      `${leaf}-toolkit`,
+    ]),
+  ]
+    .filter((value) => value !== name)
+    .slice(0, 8);
+  const base = registryEndpoint("npm", options.env ?? process.env);
+  const free = [];
+  for (const candidate of candidates) {
+    if (
+      !/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/.test(candidate) ||
+      candidate.length > 214
+    ) {
+      continue;
+    }
+    try {
+      if (
+        (await lookup(base, `${npmName(candidate)}?_=${Date.now()}`, options))
+          .status === 404
+      ) {
+        free.push(candidate);
+      }
+    } catch {
+      /* Unknown availability is never reported as free. */
+    }
+  }
+  return free;
+}
+
+/** A naming error includes verified alternatives without requesting credentials. */
+export async function namingError(name, conflicting, options = {}) {
+  const free = await freeAlternatives(name, options);
+  return new Error(
+    `npm name '${name}' may be refused as too similar to existing '${conflicting}'; ${free.length ? `currently free alternatives: ${free.join(", ")} (scope ownership and npm policy still apply)` : "choose your own npm scope or a longer descriptive name; availability could not be confirmed"}. Rename package.json and retry; no authentication retry was attempted.`,
+  );
+}
+
+/** Public npm search is a bounded heuristic, not the private registry policy. */
+export async function checkSimilarity(name, options = {}) {
+  if (name.startsWith("@")) {
+    return;
+  }
+  const base = registryEndpoint("npm", options.env ?? process.env);
+  // npm search does not always correct typos; verify common public monikers.
+  for (const candidate of [
+    "lodash",
+    "express",
+    "react",
+    "typescript",
+    "webpack",
+    "eslint",
+    "prettier",
+    "commander",
+    "axios",
+    "chalk",
+    "debug",
+    "dotenv",
+    "yargs",
+    "semver",
+    "glob",
+    "minimist",
+    "moment",
+    "jquery",
+    "rxjs",
+    "tslib",
+  ]) {
+    if (
+      similarName(name, candidate) &&
+      (await lookup(base, candidate, options)).ok
+    ) {
+      throw await namingError(name, candidate, options);
+    }
+  }
+  const queries = [...new Set([name, name.split(/[._-]/).at(-1)])].filter(
+    Boolean,
+  );
+  for (const query of queries) {
+    const response = await lookup(
+      base,
+      `-/v1/search?text=${encodeURIComponent(query)}&size=250&popularity=1&quality=0&maintenance=0`,
+      options,
+    );
+    if (!response.ok) {
+      throw new Error(
+        `npm similarity search failed (${response.status}); no approval requested`,
+      );
+    }
+    const document = await response.json();
+    for (const item of (document.objects ?? []).slice(0, 250)) {
+      const candidate = item.package?.name;
+      if (candidate && similarName(name, candidate)) {
+        throw await namingError(name, candidate, options);
+      }
+    }
+  }
+}

package/src/publisher-form.mjs

@@ -0,0 +1,102 @@
+import { npmPrefillScript } from "./browser.mjs";
+
+/** Verify the server-rendered publisher row, and surface form validation errors. */
+export function publisherConfirmationScript(config, pending = true) {
+  return `(() => {
+    const config = ${JSON.stringify(config)};
+    const pending = ${JSON.stringify(pending)};
+    const errors = Array.from(document.querySelectorAll('#pending-github-publisher-form .form-errors, #pending-github-publisher-form .form-group__error, #github-publisher-form .form-errors, #github-publisher-form .form-group__error, .error-message, .notification-bar--danger')).map(node => node.textContent.trim()).filter(Boolean);
+    const rows = Array.from(document.querySelectorAll('tr, .publisher, .card'));
+    const confirmed = rows.some(row => {
+      const repository = Array.from(row.querySelectorAll('a[href]')).some(link => {
+        try { const url = new URL(link.href); return url.hostname === 'github.com' && (url.pathname === '/' + config.organization + '/' + config.repository || url.pathname.startsWith('/' + config.organization + '/' + config.repository + '/')); } catch { return false; }
+      });
+      return repository && row.querySelector('td')?.textContent.trim() === (pending ? config.project : 'GitHub')
+        && [config.workflow, config.environment].filter(Boolean).every(value => row.innerText.split(/\\s+/).includes(value));
+    });
+    return { confirmed, error: errors.join('; ') };
+  })()`;
+}
+
+/** Wait through sign-in, fill and verify a trusted-publisher form. */
+export async function fillPublisherForm(
+  session,
+  pending = session.plan.mode !== "attach",
+) {
+  const page = session.automation;
+  const script = npmPrefillScript(session.plan.trusted_publisher, false);
+  const deadline = Date.now() + (session.options.waitTimeoutMs ?? 10 * 60_000);
+  console.log(
+    "  Finish sign-in and 2FA in the browser; waiting for the trusted-publisher form.",
+  );
+  for (;;) {
+    const result = await page.evaluate(script).catch(() => ({}));
+    const required = [
+      "organization",
+      "repository",
+      "workflow",
+      ...(session.plan.registry === "pypi" && pending ? ["project"] : []),
+    ];
+    if (required.every((field) => result.filled?.includes(field))) {
+      break;
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(
+        "timed out waiting for sign-in and the trusted-publisher form; nothing submitted",
+      );
+    }
+    await new Promise((resolve) =>
+      setTimeout(resolve, session.options.pollIntervalMs ?? 500),
+    );
+  }
+  const submit =
+    session.plan.registry === "pypi" ||
+    session.options.yes ||
+    /^(?:y|yes)$/i.test(
+      await session.prompt(
+        "Submit this trusted-publisher configuration? [y/N] ",
+      ),
+    );
+  if (!submit) {
+    throw new Error(
+      "trusted-publisher submission declined; release not started",
+    );
+  }
+  if (submit) {
+    const submission = await page.evaluate(
+      npmPrefillScript(session.plan.trusted_publisher, true),
+    );
+    if (!submission.submitted) {
+      throw new Error(
+        "the form was not submitted; review the visible browser and submit manually",
+      );
+    }
+    if (session.plan.registry === "pypi") {
+      for (;;) {
+        const state = await page
+          .evaluate(
+            publisherConfirmationScript(
+              session.plan.trusted_publisher,
+              pending,
+            ),
+          )
+          .catch(() => ({}));
+        if (state.error) {
+          throw new Error(`PyPI refused the pending publisher: ${state.error}`);
+        }
+        if (state.confirmed) {
+          session.conditions.delete("trust-missing");
+          break;
+        }
+        if (Date.now() >= deadline) {
+          throw new Error(
+            "timed out verifying the PyPI pending publisher; release not started",
+          );
+        }
+        await new Promise((resolve) =>
+          setTimeout(resolve, session.options.pollIntervalMs ?? 500),
+        );
+      }
+    }
+  }
+}

package/src/python.mjs

@@ -1,4 +1,5 @@
-import { readdir } from "node:fs/promises";
+import { readdir, mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
 import path from "node:path";
 import { exec } from "command-stream";
 
@@ -136,7 +137,7 @@ export function applyPython(plan, tools) {
     detected: selected
       ? `${selected.program} (${selected.version})`
       : "no compatible interpreter found",
-    required: `Install Python satisfying ${requirement || "the project requirements"} and its build module (python -m pip install build)`,
+    required: `Install Python satisfying ${requirement || "the project requirements"} with venv support; the tool installs build in a temporary environment`,
     ok: Boolean(selected),
   };
   plan.prerequisites = [
@@ -147,3 +148,38 @@ export function applyPython(plan, tools) {
     build.command = { program: selected.program, args: ["-m", "build"] };
   }
 }
+
+/** Provision the build frontend without modifying the selected interpreter. */
+export async function buildPythonDistribution(program, cwd, options = {}) {
+  const directory = await mkdtemp(path.join(os.tmpdir(), "prm-python-build-"));
+  const executable = path.join(
+    directory,
+    process.platform === "win32" ? "Scripts/python.exe" : "bin/python",
+  );
+  const run =
+    options.run ??
+    ((file, args) =>
+      exec(file, args, { cwd, capture: true, mirror: true, stdin: "ignore" }));
+  try {
+    for (const [file, args] of [
+      [program, ["-m", "venv", directory]],
+      [
+        executable,
+        ["-m", "pip", "install", "--disable-pip-version-check", "build"],
+      ],
+      [executable, ["-m", "build"]],
+    ]) {
+      if (options.verbose) {
+        console.error(`+ ${file} ${args.join(" ")}`);
+      }
+      const result = await run(file, args);
+      if (result.code !== 0) {
+        throw new Error(
+          `Python build preparation or build failed (${file}, status ${result.code}); ensure the selected Python supports venv and pip`,
+        );
+      }
+    }
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}

package/src/setup-batch.mjs

@@ -140,6 +140,7 @@ export async function executePlans(plans, options, summary = true) {
   const deferred = new Map();
   const outcomes = [];
   let failure;
+  let preserveNpmSession = false;
   try {
     for (const plan of plans) {
       const session = new SetupSession(plan, {
@@ -170,6 +171,7 @@ export async function executePlans(plans, options, summary = true) {
         });
         failure ??= error;
       } finally {
+        preserveNpmSession ||= session.conditions.has("npm-name-refused");
         const steps = await session.cleanup({
           deferAuth: plans.length > 1,
           closeBrowser: false,
@@ -185,6 +187,12 @@ export async function executePlans(plans, options, summary = true) {
     }
   } finally {
     for (const { session, step } of deferred.values()) {
+      if (preserveNpmSession && step.id === "sign-out") {
+        console.log(
+          "Keeping the npm session after a naming refusal; rename the package and retry.",
+        );
+        continue;
+      }
       session.automation = automation;
       try {
         await session.runStep(step);

package/src/setup.mjs

@@ -19,15 +19,12 @@ import {
 } from "./approvals.mjs";
 import { connectAutomation } from "./automation.mjs";
 import { runCratesApiStep } from "./crates-api.mjs";
-import {
-  detachedRunner,
-  npmPrefillScript,
-  openInUserBrowser,
-} from "./browser.mjs";
+import { detachedRunner, openInUserBrowser } from "./browser.mjs";
 import { detectDefaultBrowser, openWithCommand } from "./default-browser.mjs";
 import { CLEANUP_CONDITIONS } from "./flows.mjs";
 import { setupCredential } from "./credential-setup.mjs";
 import { checkNamePolicy, policyRefusal } from "./npm-policy.mjs";
+import { namingError } from "./npm-similarity.mjs";
 import { pagesSettingsUrl, pagesState } from "./pages.mjs";
 import { packageDirectory } from "./plan.mjs";
 import { twoFactorMode } from "./prerequisites.mjs";
@@ -35,6 +32,7 @@ import { getJson, probePackage } from "./registry-state.mjs";
 import { launchBrowser, signInDomains } from "./sign-in-import.mjs";
 import { PUBLISH_REJECTED, selectReleaseRun } from "./release-runs.mjs";
 import { runRepositoryRepair } from "./repository-repair.mjs";
+import { buildPythonDistribution } from "./python.mjs";
 import {
   publisherIdentities,
   publisherMatches,
@@ -105,16 +103,16 @@ export class SetupSession {
         ["sign-out", "crates-sign-out"].includes(step.id) &&
         this.conditions.has(step.when)
       ) {
-        if (step.id === "sign-out" && this.options.keepSession) {
+        if (step.id === "sign-out" && this.keepsSession(step)) {
           console.log(
-            "Keeping the npm session (--keep-session); run npm logout to revoke it.",
+            "Keeping the npm session for reuse; run npm logout to revoke it.",
           );
         } else {
           deferred.push(step);
         }
       } else if (step.id === "sign-out" && this.keepsSession(step)) {
         console.log(
-          "Keeping the npm session (--keep-session): its token stays in npm's user configuration until you run npm logout, and the next run reuses it while npm whoami succeeds.",
+          "Keeping the npm session for reuse: its token stays in npm's user configuration until you run npm logout, and the next run reuses it while npm whoami succeeds.",
         );
       } else if (this.conditions.has(step.when) && step.kind === "api") {
         this.log(`==> ${step.title}`);
@@ -148,7 +146,8 @@ export class SetupSession {
 
   keepsSession(step) {
     return (
-      Boolean(this.options.keepSession) &&
+      (Boolean(this.options.keepSession) ||
+        this.conditions.has("npm-name-refused")) &&
       this.conditions.has(step.when) &&
       step.command?.program === "npm"
     );
@@ -168,8 +167,19 @@ export class SetupSession {
     }
     switch (step.kind) {
       case "check":
+        if (step.id === "build-package" && this.plan.registry === "pypi") {
+          return buildPythonDistribution(
+            step.command.program,
+            this.cwd(step),
+            this.options,
+          );
+        }
         if (step.id === "check-name-policy") {
-          return checkNamePolicy(this.plan.package.name, this.options);
+          return checkNamePolicy(this.plan.package.name, {
+            ...this.options,
+            npmScope:
+              this.options.npmScope ?? this.plan.repository?.github_owner,
+          });
         }
         if (step.id === "check-registry") {
           return this.checkRegistry();
@@ -508,8 +518,19 @@ export class SetupSession {
         step.id === "first-publish" &&
         policyRefusal(String(result.stderr) + String(result.stdout))
       ) {
-        throw new Error(
-          "npm refused this name under its policy; no retry. Choose @owner/name or a longer descriptive name.",
+        this.conditions.add("npm-name-refused");
+        const output = String(result.stderr) + String(result.stdout);
+        const suggested = output.match(/@[a-z0-9._-]+\/[a-z0-9._-]+/g) ?? [];
+        throw await namingError(
+          this.plan.package.name,
+          output.match(/similar to existing package\s+([^\s;]+)/i)?.[1] ??
+            "another package",
+          {
+            ...this.options,
+            npmScope:
+              this.options.npmScope ?? this.plan.repository?.github_owner,
+            nameAlternatives: suggested,
+          },
         );
       }
       if (step.id === "attach-trusted-publisher") {
@@ -624,7 +645,8 @@ export class SetupSession {
     const fill = PREFILLED_FORMS.has(step.id) && this.plan.trusted_publisher;
     await this.open(step.url, Boolean(fill));
     if (fill && this.automation) {
-      await this.prefill();
+      await this.prefill(step.id === "create-pending-publisher");
+      return;
     }
     await this.prompt("Finish this step in the browser, then press Enter...");
     if (step.id === "create-pending-publisher") {
@@ -632,33 +654,9 @@ export class SetupSession {
     }
   }
 
-  async prefill() {
-    await this.prompt("Press Enter when the form is visible...");
-    const page = this.automation;
-    const script = npmPrefillScript(this.plan.trusted_publisher, false);
-    let result = await page.evaluate(script);
-    if (result.filled?.length === 0) {
-      await new Promise((resolve) => setTimeout(resolve, 500));
-      result = await page.evaluate(script);
-    }
-    console.log(`Prefill result: ${JSON.stringify(result)}`);
-    const submit =
-      this.options.yes ||
-      /^(?:y|yes)$/i.test(
-        await this.prompt(
-          "Submit this trusted-publisher configuration? [y/N] ",
-        ),
-      );
-    if (submit) {
-      const submission = await page.evaluate(
-        npmPrefillScript(this.plan.trusted_publisher, true),
-      );
-      if (!submission.submitted) {
-        throw new Error(
-          "the form was not submitted; review the visible browser and submit manually",
-        );
-      }
-    }
+  async prefill(pending = this.plan.mode !== "attach") {
+    const { fillPublisherForm } = await import("./publisher-form.mjs");
+    await fillPublisherForm(this, pending);
   }
 
   async open(url, automate = false) {
@@ -698,6 +696,7 @@ export class SetupSession {
         browser: await launchBrowser(browser, domains, {
           deferred: this.plan.registry === "crates-io",
           verbose: quiet ? false : this.options.verbose,
+          ...this.options.importDiscovery,
         }),
         profile: this.options.browserProfile,
         verbose: quiet ? false : this.options.verbose,
@@ -798,12 +797,12 @@ export class SetupSession {
     return npm ? withFreshLinks(run) : run();
   }
 
-  openLink(url, kind) {
+  async openLink(url, kind) {
     console.log(approvalDeadline(kind));
     if (kind === "approve") {
       console.log(TWO_FACTOR_HINT);
     }
-    this.open(url).catch((error) =>
+    await this.open(url, !this.options.openWith).catch((error) =>
       console.error(`warning: could not open ${url}: ${error.message}`),
     );
   }

package/src/sign-in-import.mjs

@@ -1,9 +1,13 @@
 // Reusing a registry sign-in from an installed browser (#26): the automated
 // profile stays fresh and clean by default; when a step needs a sign-in it
-// does not hold, the tool offers to import only the cookies of the registry's
-// sign-in domains from a browser that has them. Cookie values are never
-// printed, logged, or cached: they are only counted.
+// does not hold, the tool offers registry-domain cookies, then supported
+// saved logins when no cookies exist. Credential values are never logged;
+// discovery counts them through Browser Commander.
 import * as commander from "browser-commander";
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { detachedRunner } from "./browser.mjs";
 
 import { catalogueName } from "./browser-catalogue.mjs";
 import { detectDefaultBrowser } from "./default-browser.mjs";
@@ -50,7 +54,7 @@ export function sourceId(displayName) {
 
 /**
  * The migration Browser Commander runs: the whole profile for `full`, or
- * only the cookies of `domains`.
+ * registry-domain cookies, with usable saved logins for the automatic fallback.
  */
 export function migrationFor(source, scope, domains) {
   const migration = { browser: source.browser };
@@ -58,7 +62,9 @@ export function migrationFor(source, scope, domains) {
     migration.profile = source.profile;
   }
   if (scope === "domains" && domains.length > 0) {
-    migration.include = ["cookies"];
+    migration.include = source.savedLogins
+      ? ["cookies", "passwords", "passkeys"]
+      : ["cookies"];
     migration.domains = domains;
   }
   return migration;
@@ -77,28 +83,51 @@ export async function findSignInSources(domains, options = {}) {
     (left, right) => Number(right === preferred) - Number(left === preferred),
   );
   const found = [];
+  let accessReported = false;
+  const report = async (browser, error) => {
+    if (
+      browser === "safari" &&
+      (options.platform ?? process.platform) === "darwin" &&
+      /EPERM|EACCES|operation not permitted|permission denied/i.test(
+        `${error.code} ${error.message}`,
+      ) &&
+      !accessReported
+    ) {
+      accessReported = true;
+      (options.warn ?? console.error)(
+        "Safari sign-ins are unreadable: enable Full Disk Access for your terminal app in Privacy & Security, then restart the terminal app and retry.",
+      );
+      await (
+        options.openSettings ??
+        (() =>
+          detachedRunner()("open", [
+            "x-apple.systempreferences:com.apple.preference.security?Privacy_AllFiles",
+          ]))
+      )().catch(() => {});
+    } else if (options.verbose) {
+      console.error(`could not read ${browser} sign-in data: ${error.message}`);
+    }
+  };
   for (const browser of browsers) {
-    const profiles = await list({ browser }).catch((error) => {
-      if (options.verbose) {
-        console.error(`could not list ${browser} profiles: ${error.message}`);
-      }
+    const profiles = await list({ browser }).catch(async (error) => {
+      await report(browser, error);
       return [];
     });
     for (const profile of profiles) {
+      if (profile.error) {
+        await report(browser, new Error(profile.error));
+        continue;
+      }
       const matched = [];
       for (const domain of domains) {
         const cookies = await read({
           browser,
-          profile: profile.path,
+          profile: profile.name,
           domainFilter: domain,
           ignoreDecryptionErrors: true,
           cache: false,
-        }).catch((error) => {
-          if (options.verbose) {
-            console.error(
-              `could not read ${browser} cookies for ${domain}: ${error.message}`,
-            );
-          }
+        }).catch(async (error) => {
+          await report(browser, error);
           return [];
         });
         if (cookies.length > 0) {
@@ -109,7 +138,7 @@ export async function findSignInSources(domains, options = {}) {
         const name = profile.displayName ?? profile.name;
         found.push({
           browser,
-          profile: profile.path,
+          profile: profile.name,
           label:
             profiles.length > 1
               ? `${sourceName(browser)} (${name})`
@@ -122,6 +151,70 @@ export async function findSignInSources(domains, options = {}) {
   return found;
 }
 
+/** Count usable saved logins through upstream migration into a disposable profile. */
+export async function findSavedLoginSources(domains, options = {}) {
+  if (
+    commander.findBrowserSource(options.targetBrowser ?? "chrome")
+      ?.controlProtocol === "bidi"
+  ) {
+    (options.warn ?? console.error)(
+      "Saved-password migration into Firefox is unavailable in Browser Commander; use --browser-channel chrome for saved-login autofill, or sign in in Firefox.",
+    );
+    return [];
+  }
+  const list = options.listProfiles ?? commander.listBrowserProfiles;
+  const migrate = options.migrateProfile ?? commander.migrateProfile;
+  const browsers = (options.sources ?? importSources()).toSorted(
+    (a, b) =>
+      Number(b === options.defaultSource) - Number(a === options.defaultSource),
+  );
+  const found = [];
+  const installed = [];
+  for (const browser of browsers) {
+    const profiles = await list({ browser }).catch(() => []);
+    if (profiles.length) {
+      installed.push(sourceName(browser));
+    }
+    for (const profile of profiles) {
+      const directory = await mkdtemp(
+        path.join(os.tmpdir(), "prm-login-probe-"),
+      );
+      try {
+        const report = await migrate({
+          from: { browser, profile: profile.name },
+          to: directory,
+          include: ["passwords", "passkeys"],
+          domains,
+          targetBrowser: options.targetBrowser ?? "chrome",
+        });
+        if (report.migrated.passwords > 0 || report.migrated.passkeys > 0) {
+          found.push({
+            browser,
+            profile: profile.name,
+            label: sourceName(browser),
+            domains,
+            savedLogins: true,
+          });
+        }
+      } catch {
+        if (options.verbose) {
+          console.error(
+            `saved-login import unavailable from ${sourceName(browser)}`,
+          );
+        }
+      } finally {
+        await rm(directory, { recursive: true, force: true });
+      }
+    }
+  }
+  if (!found.length) {
+    (options.warn ?? console.error)(
+      `No usable saved password for ${domains.join(", ")} in ${installed.join(", ") || "installed browsers"}. Safari saved passwords require an export; passkeys cannot be exported by the installed Browser Commander. Sign in in the browser.`,
+    );
+  }
+  return found;
+}
+
 /** The source id of the system default browser, when it can be imported. */
 export async function defaultSource(options = {}) {
   const name =
@@ -180,11 +273,21 @@ export async function resolveImportChoice(choice, domains, options = {}) {
     }
     return { browser: preferred, profile: null };
   }
-  const [found] = await findSignInSources(domains, {
+  const discovery = {
     ...options,
     defaultSource: preferred,
-  });
-  return found ? { browser: found.browser, profile: found.profile } : null;
+  };
+  const sources = await findSignInSources(domains, discovery);
+  const [found] = sources.length
+    ? sources
+    : await findSavedLoginSources(domains, discovery);
+  return found
+    ? {
+        browser: found.browser,
+        profile: found.profile,
+        ...(found.savedLogins ? { savedLogins: true } : {}),
+      }
+    : null;
 }
 
 /**
@@ -193,6 +296,7 @@ export async function resolveImportChoice(choice, domains, options = {}) {
  * once it knows the sign-in is missing (`deferred`).
  */
 export async function launchBrowser(browser, domains, options = {}) {
+  options = { targetBrowser: browser?.channel ?? "chrome", ...options };
   const choice = browser?.import?.browser;
   if (!IMPORT_CHOICES.includes(choice)) {
     return browser;
@@ -226,11 +330,12 @@ export async function offerSignInImport(session, domains) {
     return false;
   }
   const options = {
+    targetBrowser: browser.channel,
     verbose: session.options.verbose,
     ...session.options.importDiscovery,
   };
   const preferred = await defaultSource(options);
-  const sources =
+  let sources =
     choice === "default"
       ? [preferred].filter(Boolean).map((id) => ({
           browser: id,
@@ -242,6 +347,12 @@ export async function offerSignInImport(session, domains) {
           ...options,
           defaultSource: preferred,
         });
+  if (!sources.length) {
+    sources = await findSavedLoginSources(domains, {
+      ...options,
+      defaultSource: preferred,
+    });
+  }
   const source = await chooseSignInSource(
     sources,
     domains,
@@ -253,7 +364,11 @@ export async function offerSignInImport(session, domains) {
   }
   await session.reconnect({
     ...browser,
-    import: { browser: source.browser, profile: source.profile },
+    import: {
+      browser: source.browser,
+      profile: source.profile,
+      ...(source.savedLogins ? { savedLogins: true } : {}),
+    },
   });
   console.log(
     `  Imported the ${domains.join(" / ")} sign-in from ${source.label}.`,