teamshare-bridge 0.26.12 → 0.26.13

package/dist/lib/browser/login.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.FIND_LOGIN_FIELDS_JS = void 0;
 exports.findLoginFields = findLoginFields;
+exports.loginStepOf = loginStepOf;
 exports.typeTextVerified = typeTextVerified;
 exports.fillFieldVerified = fillFieldVerified;
 exports.performLogin = performLogin;
@@ -14,17 +16,21 @@ exports.isCredentialFocused = isCredentialFocused;
  * module is the explicit, OPT-IN escape hatch (`allowCredentials`), authored so
  * the LLM never has to type a secret itself:
  *
- *   - `findLoginFields(page)` locates the username / password / submit controls
- *     with plain DOM heuristics (autocomplete -> input type -> label/text).
- *   - `performLogin(page, { username, password })` fills them, handles the common
- *     two-step email -> Continue -> password flow, submits, and returns a
- *     structured result. It is LLM-free.
- *   - `fillFieldVerified(page, x, y, value)` is the hardened insert: it focuses
- *     the field, replaces its contents, and VERIFIES the value actually landed,
- *     falling back to character-by-character key events when `Input.insertText`
- *     is swallowed (a controlled/echoing password widget).
+ *   - `findLoginFields(page)` locates the username / password / submit / OTP
+ *     controls with DOM heuristics. It scopes the search to the TOPMOST OPEN
+ *     DIALOG when one exists, because a login opened in a modal must not be
+ *     confused with a footer newsletter field or the page's nav "Login" button.
+ *   - `performLogin(page, { username, password, otp? })` clears every field,
+ *     fills it, verifies the exact value, submits, and follows the site's real
+ *     flow: email → password, email → OTP, email → password → OTP, password →
+ *     OTP, OTP only. It NEVER reports success while an OTP field is visible.
+ *   - `fillFieldVerified(page, control, value)` always clears first (select-all
+ *     + Backspace + native value setter), verifies the field is EMPTY, then
+ *     types and verifies the value EXACTLY. The old version compared only the
+ *     length, so an autofilled value plus the typed text could pass as
+ *     "filled" - or fail forever.
  *   - `typeTextVerified(page, text)` is the same verification for the generic
- *     `type` action, so a password typed by the agent is confirmed too.
+ *     `type` action; `clearFirst` makes it replace instead of append.
  *
  * The auto-answer loop (`browse --auto-answer`) is a DIFFERENT code path and
  * still never touches credentials - see `personal-fields.ts`.
@@ -32,34 +38,60 @@ exports.isCredentialFocused = isCredentialFocused;
  * NO secret is ever logged here.
  */
 const cdp_1 = require("./cdp");
-/** DOM heuristic: locate the login controls. Runs entirely in the page. */
-const FIND_LOGIN_FIELDS_JS = `(() => {
+/** DOM heuristic: locate the login controls, scoped to the topmost modal. */
+exports.FIND_LOGIN_FIELDS_JS = `(() => {
   const vis = (el) => {
     if (!el) return false;
     const r = el.getBoundingClientRect();
     if (r.width === 0 || r.height === 0) return false;
     const cs = getComputedStyle(el);
-    return cs.visibility !== 'hidden' && cs.display !== 'none';
-  };
-  const box = (el, hint) => {
-    const r = el.getBoundingClientRect();
-    return { x: Math.round(r.x + r.width / 2), y: Math.round(r.y + r.height / 2), hint: hint || '' };
+    return cs.visibility !== 'hidden' && cs.display !== 'none' && cs.opacity !== '0';
   };
   const hintOf = (el) => [el.getAttribute('name'), el.id, el.getAttribute('autocomplete')].filter(Boolean).join('/');
-  const inputs = [...document.querySelectorAll('input, textarea')].filter(vis);
   const lowerType = (el) => (el.type || '').toLowerCase();
+  const autocomplete = (el) => (el.getAttribute('autocomplete') || '').toLowerCase();
+
+  // MODAL SCOPE (2026-10): a login opened in a dialog must win over a footer
+  // newsletter input or the page's nav Login button. Prefer the first visible
+  // dialog/frame that actually contains a login-ish field; otherwise the last
+  // visible dialog; otherwise the document.
+  const dialogSel = 'dialog[open],[role="dialog"],[aria-modal="true"],' +
+    '[class*="modal"],[class*="Modal"],[class*="dialog"],[class*="Dialog"]';
+  const dialogEls = [...document.querySelectorAll(dialogSel)].filter(vis);
+  const hasStrongLogin = (d) => !!d.querySelector('input[type="password"],input[autocomplete="username"],input[autocomplete="current-password"],input[autocomplete="new-password"],input[autocomplete="one-time-code"]');
+  const hasEmailAndContinue = (d) => {
+    if (!d.querySelector('input[type="email"],input[autocomplete="email"]')) return false;
+    return [...d.querySelectorAll('button,[role="button"],input[type="submit"]')].some((el) =>
+      /continue|next|sign|log\\s?in|verify|submit/i.test((el.innerText || el.textContent || el.value || '').trim()),
+    );
+  };
+  let scope =
+    dialogEls.find(hasStrongLogin) ||
+    dialogEls.find(hasEmailAndContinue) ||
+    dialogEls.find((d) => d.querySelector('input,textarea')) ||
+    null;
+  if (!scope && dialogEls.length) scope = dialogEls[dialogEls.length - 1];
+  const root = scope || document;
+
+  // Clear the previous scan's tags so a re-rendered modal cannot be addressed
+  // through a stale element.
+  document.querySelectorAll('[data-ts-login]').forEach((e) => e.removeAttribute('data-ts-login'));
+
+  const inputs = [...root.querySelectorAll('input,textarea')]
+    .filter(vis)
+    .filter((el) => lowerType(el) !== 'hidden' && !el.disabled && !el.readOnly);
 
   const pw =
     inputs.find((el) => lowerType(el) === 'password') ||
-    inputs.find((el) => ['current-password', 'new-password'].includes((el.getAttribute('autocomplete') || '').toLowerCase())) ||
+    inputs.find((el) => ['current-password', 'new-password'].includes(autocomplete(el))) ||
     null;
 
   let user =
-    inputs.find((el) => (el.getAttribute('autocomplete') || '').toLowerCase() === 'username') ||
+    inputs.find((el) => autocomplete(el) === 'username') ||
     inputs.find((el) => lowerType(el) === 'email') ||
     null;
   if (!user) {
-    const textish = inputs.filter((el) => ['', 'text', 'email', 'tel'].includes(lowerType(el)) && lowerType(el) !== 'password');
+    const textish = inputs.filter((el) => ['', 'text', 'email', 'tel'].includes(lowerType(el)));
     if (pw) {
       user = textish.find((el) => (el.compareDocumentPosition(pw) & Node.DOCUMENT_POSITION_PRECEDING)) || null;
     }
@@ -67,44 +99,83 @@ const FIND_LOGIN_FIELDS_JS = `(() => {
   }
 
   const otp =
-    inputs.find((el) => (el.getAttribute('autocomplete') || '').toLowerCase() === 'one-time-code') ||
-    inputs.find((el) => /otp|one[- ]?time|verif|code/i.test(hintOf(el))) ||
+    inputs.find((el) => autocomplete(el) === 'one-time-code') ||
+    inputs.find((el) => /otp|one[- ]?time|verif|code/i.test(hintOf(el) || '')) ||
     null;
 
-  const submitRe = /sign\\s?in|log\\s?in|login|continue|next|submit|log\\s?on|enter|proceed/i;
-  const clickable = [...document.querySelectorAll('button, input[type=submit], input[type=button], [role=button], a')].filter(vis);
+  // The same element can match several heuristics; one role wins.
+  if (user && otp && user === otp) user = null;
+  if (user && pw && user === pw) user = null;
+
+  const submitRe = /sign\\s?in|log\\s?in|login|continue|next|submit|log\\s?on|enter|proceed|verify|confirm/i;
+  const clickable = [...root.querySelectorAll('button,input[type=submit],input[type=button],[role=button],a')]
+    .filter(vis)
+    .filter((el) => el.disabled !== true && el.getAttribute('aria-disabled') !== 'true');
   let submit =
     clickable.find((el) => (el.getAttribute('type') || '').toLowerCase() === 'submit') ||
     clickable.find((el) => submitRe.test((el.innerText || el.textContent || el.value || '').trim())) ||
-    clickable.find((el) => /submit/i.test(hintOf(el))) ||
+    clickable.find((el) => /submit/i.test(hintOf(el) || '')) ||
     null;
 
+  const box = (el, hint, role) => {
+    el.setAttribute('data-ts-login', role);
+    const r = el.getBoundingClientRect();
+    return {
+      x: Math.round(r.x + r.width / 2),
+      y: Math.round(r.y + r.height / 2),
+      hint: hint || '',
+      role: role,
+    };
+  };
+
   return {
-    username: user && vis(user) ? box(user, hintOf(user)) : null,
-    password: pw && vis(pw) ? box(pw, hintOf(pw)) : null,
-    submit: submit ? box(submit, (submit.innerText || submit.textContent || submit.value || '').trim().slice(0, 40)) : null,
-    otp: otp ? box(otp, hintOf(otp)) : null,
+    username: user && vis(user) ? box(user, hintOf(user), 'username') : null,
+    password: pw && vis(pw) ? box(pw, hintOf(pw), 'password') : null,
+    submit: submit ? box(submit, (submit.innerText || submit.textContent || submit.value || '').trim().slice(0, 40), 'submit') : null,
+    otp: otp && vis(otp) ? box(otp, hintOf(otp), 'otp') : null,
+    modal: !!scope,
   };
 })()`;
 async function findLoginFields(page) {
+    const empty = {
+        username: null,
+        password: null,
+        submit: null,
+        otp: null,
+        modal: false,
+    };
     try {
-        const value = await (0, cdp_1.evaluateJs)(page, FIND_LOGIN_FIELDS_JS);
-        if (!value || typeof value !== 'object') {
-            return { username: null, password: null, submit: null, otp: null };
-        }
+        const value = await (0, cdp_1.evaluateJs)(page, exports.FIND_LOGIN_FIELDS_JS);
+        if (!value || typeof value !== 'object')
+            return empty;
+        const v = value;
         return {
-            username: value.username ?? null,
-            password: value.password ?? null,
-            submit: value.submit ?? null,
-            otp: value.otp ?? null,
+            username: v.username ?? null,
+            password: v.password ?? null,
+            submit: v.submit ?? null,
+            otp: v.otp ?? null,
+            modal: v.modal === true,
         };
     }
     catch {
-        return { username: null, password: null, submit: null, otp: null };
+        return empty;
     }
 }
-/** Read the active element's value length (password fields expose .value to JS). */
-async function activeValue(page) {
+/**
+ * The login phase a `waitFor {for:"loginStep"}` caller can wait for. Password
+ * wins over OTP (a password+OTP screen is still the password step), then OTP,
+ * then username; no fields means the step is finished.
+ */
+function loginStepOf(fields) {
+    if (fields.password)
+        return 'password';
+    if (fields.otp)
+        return 'otp';
+    if (fields.username)
+        return 'username';
+    return 'done';
+}
+/** Read the active element's value (input/textarea; contenteditable is null). */ async function activeValue(page) {
     try {
         const v = await (0, cdp_1.evaluateJs)(page, `(() => { const a = document.activeElement; return a && typeof a.value === 'string' ? a.value : null; })()`);
         return typeof v === 'string' ? v : null;
@@ -113,6 +184,19 @@ async function activeValue(page) {
         return null;
     }
 }
+/** Read a tagged login control's value. Never logged or returned to the agent. */
+async function controlValue(page, control) {
+    const role = control.role;
+    if (!role || role === 'submit')
+        return null;
+    try {
+        const v = await (0, cdp_1.evaluateJs)(page, `(() => { const el = document.querySelector('[data-ts-login="${role}"]'); return el && typeof el.value === 'string' ? el.value : null; })()`);
+        return typeof v === 'string' ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** CDP key/code for a printable char (local copy - avoids a browse-editor cycle). */
 function charKey(c) {
     if (/^[a-z]$/.test(c))
@@ -185,36 +269,16 @@ async function typeCharByChar(page, text) {
         await (0, cdp_1.sleep)(12);
     }
 }
-/** Select the focused control's current contents so the next insert replaces it. */
+/** Select the focused control's current contents. */
 async function selectActive(page) {
     try {
-        await (0, cdp_1.evaluateJs)(page, `(() => { const a = document.activeElement; if (a && a.select) { try { a.select(); return true; } catch (e) {} } if (a && a.setSelectionRange) { try { a.setSelectionRange(0, a.value ? a.value.length : 0); return true; } catch (e) {} } return false; })()`);
+        await (0, cdp_1.evaluateJs)(page, `(() => { const a = document.activeElement; if (!a) return false; if (a.select) { try { a.select(); return true; } catch (e) {} } if (a.setSelectionRange && typeof a.value === 'string') { try { a.setSelectionRange(0, a.value.length); return true; } catch (e) {} } if (a.isContentEditable) { const sel = window.getSelection(); if (sel) { const r = document.createRange(); r.selectNodeContents(a); sel.removeAllRanges(); sel.addRange(r); return true; } } return false; })()`);
     }
     catch {
         /* best-effort */
     }
 }
-/**
- * Type text into the currently focused control and VERIFY it landed.
- * `Input.insertText` first (fires a proper `input` event for controlled
- * components); on a shortfall, retry character-by-character via key events.
- * Returns the value actually observed in the field.
- */
-async function typeTextVerified(page, text) {
-    const before = (await activeValue(page)) ?? '';
-    // Insert path: replaces any current selection.
-    try {
-        await (0, cdp_1.cdpSend)(page, 'Input.insertText', { text });
-    }
-    catch {
-        /* fall through to key events */
-    }
-    await (0, cdp_1.sleep)(60);
-    let after = (await activeValue(page)) ?? '';
-    if (after.length >= before.length + text.length)
-        return true;
-    // Fallback: clear, then key-event each character.
-    await selectActive(page);
+async function pressBackspace(page) {
     try {
         await (0, cdp_1.cdpSend)(page, 'Input.dispatchKeyEvent', {
             type: 'keyDown',
@@ -234,17 +298,29 @@ async function typeTextVerified(page, text) {
     catch {
         /* best-effort */
     }
-    await (0, cdp_1.sleep)(40);
-    await typeCharByChar(page, text);
-    await (0, cdp_1.sleep)(60);
-    after = (await activeValue(page)) ?? '';
-    return after.length >= text.length || after.length > before.length;
 }
-/**
- * Fill a specific control (by click coords) with a value and verify it landed.
- * Clears the field first (select-all then insert / backspace).
- */
-async function fillFieldVerified(page, control, value) {
+/** Set a tagged input's value through the prototype setter (React-safe). */
+async function setNativeControlValue(page, role, value) {
+    try {
+        const ok = await (0, cdp_1.evaluateJs)(page, `(() => {
+        const el = document.querySelector('[data-ts-login="${role}"]');
+        if (!el || typeof el.value !== 'string') return false;
+        const proto = el.tagName === 'TEXTAREA' ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype;
+        const desc = Object.getOwnPropertyDescriptor(proto, 'value');
+        if (!desc || !desc.set) return false;
+        desc.set.call(el, ${JSON.stringify(value)});
+        el.dispatchEvent(new Event('input', { bubbles: true }));
+        el.dispatchEvent(new Event('change', { bubbles: true }));
+        return true;
+      })()`);
+        return ok === true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Focus the exact tagged control (click + JS focus, not a coordinate guess). */
+async function focusControl(page, control) {
     try {
         await (0, cdp_1.cdpSend)(page, 'Input.dispatchMouseEvent', {
             type: 'mousePressed',
@@ -260,41 +336,167 @@ async function fillFieldVerified(page, control, value) {
             button: 'left',
             clickCount: 1,
         });
-        await (0, cdp_1.sleep)(80);
-        // Focus the element directly too (a click can land on a wrapping label).
-        await (0, cdp_1.evaluateJs)(page, `(() => { const el = document.elementFromPoint(${control.x}, ${control.y}); const f = el && (el.closest ? el.closest('input,textarea') : null); if (f) { try { f.focus(); } catch (e) {} } return !!f; })()`);
-        await selectActive(page);
-        await (0, cdp_1.cdpSend)(page, 'Input.insertText', { text: value });
         await (0, cdp_1.sleep)(60);
-        let current = (await activeValue(page)) ?? '';
-        if (current === value || current.length === value.length)
+        const role = control.role;
+        if (!role)
             return true;
-        // Fallback: clear + per-char key events.
+        const ok = await (0, cdp_1.evaluateJs)(page, `(() => { const el = document.querySelector('[data-ts-login="${role}"]'); if (!el) return false; try { el.focus(); } catch (e) {} return true; })()`);
+        return ok === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Clear a login control and VERIFY it is empty. Tries selection+Backspace
+ * first, then the native value setter, up to 3 times - because Chrome/site
+ * autofill can re-populate a field right after it is cleared.
+ */
+async function clearControl(page, control) {
+    const role = control.role;
+    if (!role || role === 'submit')
+        return false;
+    for (let attempt = 0; attempt < 3; attempt++) {
+        await focusControl(page, control);
         await selectActive(page);
-        await (0, cdp_1.cdpSend)(page, 'Input.dispatchKeyEvent', {
-            type: 'keyDown',
-            key: 'Backspace',
-            code: 'Backspace',
-            windowsVirtualKeyCode: 8,
-            nativeVirtualKeyCode: 8,
-        });
-        await (0, cdp_1.cdpSend)(page, 'Input.dispatchKeyEvent', {
-            type: 'keyUp',
-            key: 'Backspace',
-            code: 'Backspace',
-            windowsVirtualKeyCode: 8,
-            nativeVirtualKeyCode: 8,
-        });
+        await pressBackspace(page);
+        await (0, cdp_1.sleep)(50);
+        let current = await controlValue(page, control);
+        if (current === '')
+            return true;
+        await setNativeControlValue(page, role, '');
+        await (0, cdp_1.sleep)(50);
+        current = await controlValue(page, control);
+        if (current === '')
+            return true;
+        await (0, cdp_1.sleep)(80);
+    }
+    return (await controlValue(page, control)) === '';
+}
+/** Clear the currently focused element (generic type path). */
+async function clearActiveField(page) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+        await selectActive(page);
+        await pressBackspace(page);
         await (0, cdp_1.sleep)(40);
-        await typeCharByChar(page, value);
-        await (0, cdp_1.sleep)(60);
-        current = (await activeValue(page)) ?? '';
-        return current.length === value.length;
+        let current = await activeValue(page);
+        if (current === '')
+            return true;
+        if (current === null) {
+            // Contenteditable: the selection path above may have selected it; one
+            // more Backspace removes the selection.
+            await pressBackspace(page);
+            await (0, cdp_1.sleep)(40);
+            if ((await activeValue(page)) === null)
+                return true;
+        }
+        try {
+            await (0, cdp_1.evaluateJs)(page, `(() => {
+          const a = document.activeElement;
+          if (!a || typeof a.value !== 'string') return false;
+          const proto = a.tagName === 'TEXTAREA' ? HTMLTextAreaElement.prototype : HTMLInputElement.prototype;
+          const desc = Object.getOwnPropertyDescriptor(proto, 'value');
+          if (!desc || !desc.set) return false;
+          desc.set.call(a, '');
+          a.dispatchEvent(new Event('input', { bubbles: true }));
+          a.dispatchEvent(new Event('change', { bubbles: true }));
+          return true;
+        })()`);
+        }
+        catch {
+            /* best-effort */
+        }
+        await (0, cdp_1.sleep)(40);
+        current = await activeValue(page);
+        if (current === '' || current === null)
+            return true;
+    }
+    return false;
+}
+/**
+ * Type text into the currently focused control and VERIFY it landed.
+ * With `clearFirst`, the field is emptied and verified empty BEFORE the insert.
+ * Success is an EXACT value match (never a length comparison).
+ */
+async function typeTextVerified(page, text, opts) {
+    const before = await activeValue(page);
+    const clearFirst = opts?.clearFirst === true;
+    if (clearFirst && !(await clearActiveField(page)))
+        return false;
+    try {
+        await (0, cdp_1.cdpSend)(page, 'Input.insertText', { text });
     }
     catch {
+        /* fall through to key events */
+    }
+    await (0, cdp_1.sleep)(80);
+    let after = await activeValue(page);
+    if (after === null)
+        return true; // contenteditable: no readable value
+    const expected = clearFirst ? text : `${before ?? ''}${text}`;
+    if (after === expected)
+        return true;
+    if (clearFirst && after === text)
+        return true;
+    // Generic `type` may insert at a cursor in the middle of an existing value:
+    // accept a value that grew by at least the typed text (the old semantics).
+    if (!clearFirst && after.length >= (before?.length ?? 0) + text.length) {
+        return true;
+    }
+    // Fallback: clear, then key-event each character.
+    if (!(await clearActiveField(page)))
+        return false;
+    await typeCharByChar(page, text);
+    await (0, cdp_1.sleep)(100);
+    after = await activeValue(page);
+    return after === text || after === null;
+}
+/**
+ * Fill a specific login control with a value and verify it EXACTLY.
+ *
+ * ALWAYS clears first (the old version only selected), verifies the field is
+ * empty, inserts, and compares the observed value to the expected one. If the
+ * site/autofill fights the insert, it retries with key events and finally with
+ * the native value setter. Returns false when the value could not be made to
+ * stick.
+ */
+async function fillFieldVerified(page, control, value) {
+    if (!control.role || control.role === 'submit')
         return false;
+    // 1. Read (for diagnostics only), clear, verify EMPTY.
+    if (!(await clearControl(page, control)))
+        return false;
+    // 2. Native insert (fires the real input event React observes).
+    await focusControl(page, control);
+    try {
+        await (0, cdp_1.cdpSend)(page, 'Input.insertText', { text: value });
     }
+    catch {
+        /* fall through */
+    }
+    await (0, cdp_1.sleep)(80);
+    let current = await controlValue(page, control);
+    if (current === value)
+        return true;
+    // 3. Clear + per-character key events.
+    if (!(await clearControl(page, control)))
+        return false;
+    await focusControl(page, control);
+    await typeCharByChar(page, value);
+    await (0, cdp_1.sleep)(100);
+    current = await controlValue(page, control);
+    if (current === value)
+        return true;
+    // 4. Last resort: native setter + input/change (controlled components that
+    //    reject synthetic key events still accept this).
+    if (!(await clearControl(page, control)))
+        return false;
+    await setNativeControlValue(page, control.role, value);
+    await (0, cdp_1.sleep)(80);
+    current = await controlValue(page, control);
+    return current === value;
 }
+/** Click a tagged control by its coordinates. */
 async function clickControl(page, control) {
     if (!control)
         return false;
@@ -336,125 +538,430 @@ async function pressEnter(page) {
         nativeVirtualKeyCode: 13,
     });
 }
-/** Poll for a control to appear, up to `timeoutMs`. */
-async function waitForPasswordField(page, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
+/**
+ * Read a visible validation/credential error. Scoped to the top modal when one
+ * is open, so the page's unrelated "error" banner is not mistaken for a login
+ * rejection. Never returns a field value.
+ */
+async function visibleLoginError(page) {
+    try {
+        const value = await (0, cdp_1.evaluateJs)(page, `(() => {
+        const vis = (el) => {
+          if (!el) return false;
+          const r = el.getBoundingClientRect();
+          if (r.width === 0 || r.height === 0) return false;
+          const cs = getComputedStyle(el);
+          return cs.visibility !== 'hidden' && cs.display !== 'none';
+        };
+        const dialogs = [...document.querySelectorAll('dialog[open],[role="dialog"],[aria-modal="true"]')].filter(vis);
+        const scope = dialogs.length ? dialogs[dialogs.length - 1] : document;
+        const out = [];
+        const add = (t) => {
+          const text = String(t == null ? '' : t).replace(/\\s+/g, ' ').trim().slice(0, 240);
+          if (text.length < 3) return;
+          if (/^(error|errors|warning|warnings)$/i.test(text)) return;
+          if (!out.includes(text) && out.length < 3) out.push(text);
+        };
+        for (const el of [...scope.querySelectorAll('[role="alert"],[aria-invalid="true"]')].filter(vis).slice(0, 4)) {
+          add(el.innerText || el.textContent || el.getAttribute('aria-label') || '');
+        }
+        const sels = '[class*="field-error"],[class*="form-error"],[class*="validation-error"],[class*="error-message"],[class*="invalid-feedback"],[class*="error"],[class*="danger"]';
+        for (const el of [...scope.querySelectorAll(sels)].filter(vis).slice(0, 12)) {
+          add(el.innerText || el.textContent || '');
+        }
+        return out.join(' | ');
+      })()`);
+        return typeof value === 'string' && value.trim() ? value.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Poll for the next login step after a submit. */
+async function waitForLoginChange(page, opts) {
+    const deadline = Date.now() + opts.timeoutMs;
+    let startUrl = '';
+    try {
+        startUrl = String(await (0, cdp_1.evaluateJs)(page, 'location.href'));
+    }
+    catch {
+        startUrl = '';
+    }
+    let last = await findLoginFields(page);
+    while (Date.now() < deadline) {
+        await (0, cdp_1.sleep)(250);
+        const fields = await findLoginFields(page);
+        let url = '';
+        try {
+            url = String(await (0, cdp_1.evaluateJs)(page, 'location.href'));
+        }
+        catch {
+            url = '';
+        }
+        // The dialog that held the form closed: the sign-in was accepted (or the
+        // modal was dismissed). Do not fall through to a footer email field.
+        if (opts.wasModal && !fields.modal && !fields.password && !fields.otp) {
+            return { fields, closed: true };
+        }
+        if (url &&
+            startUrl &&
+            url !== startUrl &&
+            !fields.password &&
+            !fields.otp) {
+            return { fields, closed: true };
+        }
+        if (fields.password || fields.otp)
+            return { fields, closed: false };
+        if (fields.username && !last.username)
+            return { fields, closed: false };
+        if (!fields.username && !fields.password && !fields.otp) {
+            return { fields, closed: true };
+        }
+        last = fields;
+    }
+    return { fields: last, closed: false };
+}
+/** Fill a role, re-scanning once if the modal re-rendered during the clear. */
+async function fillRole(page, role, value) {
     let fields = await findLoginFields(page);
-    while (!fields.password && Date.now() < deadline) {
-        await (0, cdp_1.sleep)(300);
-        fields = await findLoginFields(page);
+    let control = fields[role];
+    if (!control)
+        return false;
+    if (await fillFieldVerified(page, control, value))
+        return true;
+    // A controlled modal can replace the input while clearControl is running;
+    // the tagged element then no longer exists. Re-scan and try the new one.
+    fields = await findLoginFields(page);
+    control = fields[role];
+    return control ? await fillFieldVerified(page, control, value) : false;
+}
+/** Submit the current step: click its tagged control, else Enter in a field. */
+async function submitLogin(page) {
+    // Re-scan before clicking: the control coordinates may be stale after a
+    // React re-render triggered by the value change.
+    const fields = await findLoginFields(page);
+    if (fields.submit) {
+        await clickControl(page, fields.submit);
+        return true;
     }
-    return fields;
+    const target = fields.password ?? fields.username ?? fields.otp;
+    if (target) {
+        await focusControl(page, target);
+        await pressEnter(page);
+        return true;
+    }
+    return false;
 }
-/**
- * Deterministic login. Fills whatever credentials are present, submits, and
- * handles the common two-step (email -> Continue -> password) flow. Returns a
- * structured result; it NEVER throws and NEVER logs a secret.
- */
-async function performLogin(page, opts) {
-    const submit = opts.submit !== false;
-    const stepTimeoutMs = opts.stepTimeoutMs ?? 6000;
-    const maxSteps = opts.maxSteps ?? 2;
-    const result = {
+function baseResult() {
+    return {
         ok: false,
         usernameFilled: false,
         passwordFilled: false,
         otpFilled: false,
         submitted: false,
         twoStep: false,
+        phase: 'unknown',
+        mfaRequired: false,
+    };
+}
+function mfaResult(result, detail) {
+    return {
+        ...result,
+        ok: false,
+        phase: 'otp',
+        mfaRequired: true,
+        error: 'MFA_REQUIRED',
+        detail,
     };
+}
+/**
+ * Deterministic login. Clears and fills every credential field, submits, and
+ * follows the real multi-step flow (including a modal):
+ *
+ *   email → password
+ *   email → OTP
+ *   email → password → OTP
+ *   password → OTP
+ *   OTP only
+ *
+ * It NEVER reports ok while an OTP field is visible. It returns the visible
+ * site error on a rejection and a `phase` on every outcome, so the agent knows
+ * where it stopped instead of improvising with raw `evaluate`.
+ */
+async function performLogin(page, opts) {
+    const submit = opts.submit !== false;
+    const stepTimeoutMs = opts.stepTimeoutMs ?? 6000;
+    const maxSteps = opts.maxSteps ?? 4;
+    const result = baseResult();
     let fields = await findLoginFields(page);
-    // OTP challenge on screen. With a supplied code (a resumed ask_human
-    // answer) fill and submit it; otherwise pause for a human.
-    if (fields.otp && !fields.password) {
-        if (opts.otp && submit) {
-            result.otpFilled = await fillFieldVerified(page, fields.otp, opts.otp);
-            if (!result.otpFilled) {
+    if (!fields.username && !fields.password && !fields.otp) {
+        const err = await visibleLoginError(page);
+        return {
+            ...result,
+            error: 'LOGIN_FIELD_NOT_FOUND',
+            ...(err ? { visibleError: err } : {}),
+            detail: 'No username, password or one-time-code field was found on this page (including any open modal).',
+        };
+    }
+    for (let step = 0; step < maxSteps; step++) {
+        const visibleError = await visibleLoginError(page);
+        if (visibleError) {
+            return {
+                ...result,
+                error: 'LOGIN_REJECTED',
+                visibleError,
+                detail: `The site rejected the sign-in: ${visibleError}`,
+            };
+        }
+        fields = await findLoginFields(page);
+        // ── OTP-only challenge ────────────────────────────────────────────────
+        if (fields.otp && !fields.password && !fields.username) {
+            result.phase = 'otp';
+            result.mfaRequired = true;
+            if (!opts.otp) {
+                return mfaResult(result, 'A one-time-code field is on screen. Read the code with wait_for_qa_email (fresh/reuse) or ask the human with ask_human, then END YOUR TURN; call login again with {otp} after the resume.');
+            }
+            const filled = await fillRole(page, 'otp', opts.otp);
+            if (!filled) {
                 return {
                     ...result,
                     error: 'CREDENTIAL_FILL_FAILED',
+                    phase: 'otp',
                     detail: 'The one-time-code field did not accept the value.',
                 };
             }
-            result.submitted = (await clickControl(page, fields.submit)) || false;
-            if (!result.submitted) {
-                await pressEnter(page);
-                result.submitted = true;
+            result.otpFilled = true;
+            result.mfaRequired = false;
+            if (!submit) {
+                return {
+                    ...result,
+                    ok: true,
+                    phase: 'otp',
+                    detail: 'Code filled; submit was disabled.',
+                };
+            }
+            const submitted = await submitLogin(page);
+            result.submitted = submitted;
+            if (!submitted) {
+                return {
+                    ...result,
+                    error: 'LOGIN_FIELD_NOT_FOUND',
+                    detail: 'No code submit control was found.',
+                };
+            }
+            const next = await waitForLoginChange(page, {
+                timeoutMs: stepTimeoutMs,
+                wasModal: fields.modal,
+            });
+            const nextError = await visibleLoginError(page);
+            const advancedOtp = next.closed ||
+                (!next.fields.otp && !next.fields.password && !next.fields.username);
+            if (nextError && !advancedOtp) {
+                return {
+                    ...result,
+                    error: 'LOGIN_REJECTED',
+                    phase: 'otp',
+                    visibleError: nextError,
+                    detail: `The site rejected the code: ${nextError}`,
+                };
+            }
+            if (next.fields.otp) {
+                return mfaResult(result, 'Another one-time-code challenge is on screen. Get the new code and call login again with {otp}.');
             }
-            result.ok = true;
-            return result;
+            return {
+                ...result,
+                ok: true,
+                phase: 'submitted',
+                detail: 'Code submitted. Verify the destination page.',
+            };
         }
-        return {
-            ...result,
-            error: 'MFA_REQUIRED',
-            detail: 'A one-time-code field is on screen. Ask the human for the code with ' +
-                'ask_human (it pauses this run), then END YOUR TURN. Their answer ' +
-                'resumes you; call login again with the code in `otp`.',
-        };
-    }
-    if (!fields.username && !fields.password) {
-        return {
-            ...result,
-            error: 'LOGIN_FIELD_NOT_FOUND',
-            detail: 'No username or password field found on this page.',
-        };
-    }
-    for (let step = 1; step <= maxSteps; step++) {
-        // Fill username on the first step that offers it.
-        if (opts.username && fields.username && !result.usernameFilled) {
-            result.usernameFilled = await fillFieldVerified(page, fields.username, opts.username);
+        // ── Username / email step ─────────────────────────────────────────────
+        if (fields.username && opts.username && !result.usernameFilled) {
+            const filled = await fillRole(page, 'username', opts.username);
+            if (!filled) {
+                const err = await visibleLoginError(page);
+                return {
+                    ...result,
+                    error: 'CREDENTIAL_FILL_FAILED',
+                    phase: 'username',
+                    ...(err ? { visibleError: err } : {}),
+                    detail: 'The username/email field did not accept the value (it may be autofilled, readonly or a custom widget). The field was cleared and retyped.',
+                };
+            }
+            result.usernameFilled = true;
+            result.phase = 'username';
         }
-        // Password present -> fill it and submit. Done.
+        // ── Password step ─────────────────────────────────────────────────────
         if (fields.password) {
-            result.passwordFilled = await fillFieldVerified(page, fields.password, opts.password);
-            if (!result.passwordFilled) {
+            if (!opts.password) {
+                return {
+                    ...result,
+                    error: 'CREDENTIAL_FILL_FAILED',
+                    phase: 'password',
+                    detail: 'A password field is on screen but no password was supplied. Pass password, or use the email/OTP-only flow when the site sends a code.',
+                };
+            }
+            const filled = await fillRole(page, 'password', opts.password);
+            if (!filled) {
+                const err = await visibleLoginError(page);
                 return {
                     ...result,
                     error: 'CREDENTIAL_FILL_FAILED',
-                    detail: 'The password field did not accept the value.',
+                    phase: 'password',
+                    ...(err ? { visibleError: err } : {}),
+                    detail: 'The password field did not accept the value. It was cleared and retyped, but the value did not stick - usually an autofilled field or a custom widget.',
+                };
+            }
+            result.passwordFilled = true;
+            result.phase = 'password';
+            if (!submit) {
+                return {
+                    ...result,
+                    ok: true,
+                    phase: 'password',
+                    detail: 'Credentials filled; submit was disabled.',
+                };
+            }
+            const submitted = await submitLogin(page);
+            result.submitted = submitted;
+            if (!submitted) {
+                return {
+                    ...result,
+                    error: 'LOGIN_FIELD_NOT_FOUND',
+                    detail: 'No submit/sign-in control was found.',
                 };
             }
-            if (submit) {
-                result.submitted = (await clickControl(page, fields.submit)) || false;
-                if (!result.submitted) {
-                    await pressEnter(page);
-                    result.submitted = true;
+            const next = await waitForLoginChange(page, {
+                timeoutMs: stepTimeoutMs,
+                wasModal: fields.modal,
+            });
+            const nextError = await visibleLoginError(page);
+            const advancedPassword = next.closed ||
+                !!next.fields.otp ||
+                (!next.fields.password && !next.fields.username);
+            if (nextError && !advancedPassword) {
+                return {
+                    ...result,
+                    error: 'LOGIN_REJECTED',
+                    phase: 'password',
+                    visibleError: nextError,
+                    detail: `The site rejected the sign-in: ${nextError}`,
+                };
+            }
+            if (next.fields.otp) {
+                if (!opts.otp) {
+                    return mfaResult(result, 'The password was submitted and a one-time-code challenge appeared. Read the code with wait_for_qa_email (fresh/reuse) or ask the human with ask_human, then END YOUR TURN; call login again with {otp} after the resume.');
                 }
+                fields = next.fields;
+                continue;
+            }
+            if (next.fields.password || next.fields.username) {
+                return {
+                    ...result,
+                    error: 'LOGIN_REJECTED',
+                    phase: 'password',
+                    detail: 'The password step did not advance and no visible error was found. Check the page manually - the site may require a different field or a captcha.',
+                };
             }
-            result.ok = true;
-            return result;
-        }
-        // No password yet: this is a multi-step form. Submit step 1 and wait.
-        result.twoStep = true;
-        if (!submit) {
             return {
                 ...result,
-                error: 'LOGIN_FIELD_NOT_FOUND',
-                detail: 'Password field is not present and submit was disabled.',
+                ok: true,
+                phase: 'submitted',
+                detail: 'Submitted. Verify the destination page (the sign-in dialog closed or the URL changed).',
             };
         }
-        await clickControl(page, fields.submit);
-        await pressEnter(page).catch(() => undefined);
-        fields = await waitForPasswordField(page, stepTimeoutMs);
-        if (!fields.password) {
-            if (fields.otp) {
+        // ── Email-only step: submit and wait for password/OTP ─────────────────
+        if (fields.username && !fields.password) {
+            if (!submit) {
+                return {
+                    ...result,
+                    ok: true,
+                    phase: 'username',
+                    detail: 'Email filled; submit was disabled.',
+                };
+            }
+            const submitted = await submitLogin(page);
+            result.submitted = submitted;
+            if (!submitted) {
                 return {
                     ...result,
-                    error: 'MFA_REQUIRED',
-                    detail: 'A one-time-code field appeared; a human must complete it.',
+                    error: 'LOGIN_FIELD_NOT_FOUND',
+                    detail: 'No continue/submit control was found.',
+                };
+            }
+            result.twoStep = true;
+            const next = await waitForLoginChange(page, {
+                timeoutMs: stepTimeoutMs,
+                wasModal: fields.modal,
+            });
+            const nextError = await visibleLoginError(page);
+            const advancedEmail = next.closed ||
+                !!next.fields.password ||
+                !!next.fields.otp ||
+                (!!next.fields.username &&
+                    !!fields.username &&
+                    next.fields.username.hint !== fields.username.hint) ||
+                (!next.fields.username && !next.fields.password && !next.fields.otp);
+            if (nextError && !advancedEmail) {
+                return {
+                    ...result,
+                    error: 'LOGIN_REJECTED',
+                    phase: 'username',
+                    visibleError: nextError,
+                    detail: `The site rejected the email: ${nextError}`,
+                };
+            }
+            if (next.fields.username &&
+                fields.username &&
+                next.fields.username.hint === fields.username.hint &&
+                !next.fields.password &&
+                !next.fields.otp) {
+                // Submitting the email again would double-submit a form that simply did
+                // not advance (captcha, disabled button, slow validation).
+                return {
+                    ...result,
+                    error: 'LOGIN_REJECTED',
+                    phase: 'username',
+                    detail: 'The email step did not advance and no visible error was found. The site may require a captcha, a different Continue control, or a moment longer - take a snapshot and check before retrying.',
+                };
+            }
+            if (!next.fields.username && !next.fields.password && !next.fields.otp) {
+                return {
+                    ...result,
+                    ok: true,
+                    phase: 'submitted',
+                    detail: 'Submitted. Verify the destination page; if a code field appears, call login again with {otp}.',
+                };
+            }
+            fields = next.fields;
+            continue;
+        }
+        // ── Nothing editable left ─────────────────────────────────────────────
+        if (!fields.username && !fields.password && !fields.otp) {
+            if (result.submitted) {
+                return {
+                    ...result,
+                    ok: true,
+                    phase: 'submitted',
+                    detail: 'Submitted. Verify the destination page.',
                 };
             }
             return {
                 ...result,
                 error: 'LOGIN_FIELD_NOT_FOUND',
-                detail: 'The password field never appeared after submitting the username.',
+                detail: 'No editable login field was found.',
             };
         }
+        // An OTP is visible together with a credential field and no code was
+        // supplied - do not loop; the human/code is required next.
+        if (fields.otp && !opts.otp) {
+            return mfaResult(result, 'A one-time-code field is on screen. Read the code with wait_for_qa_email (fresh/reuse) or ask the human with ask_human, then END YOUR TURN; call login again with {otp} after the resume.');
+        }
     }
     return {
         ...result,
         error: 'LOGIN_FIELD_NOT_FOUND',
-        detail: 'Login did not reach a password field within the step budget.',
+        detail: 'Login did not settle within the step budget. Take a snapshot and inspect the dialog/page before retrying.',
     };
 }
 /** True when the currently focused element is a password/credential control. */