teamshare-bridge 0.26.17 → 0.26.19

package/dist/lib/browser/otp.js

@@ -0,0 +1,329 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectOtpGroup = detectOtpGroup;
+exports.fillOtpGroup = fillOtpGroup;
+/**
+ * Segmented OTP / one-time-code fill for the DEBUG browser (2026-10).
+ *
+ * Real OTP widgets are N sibling inputs (usually `maxlength="1"`,
+ * `inputmode="numeric"`, sometimes `autocomplete="new-password"`) plus a
+ * sensor that auto-submits when the last digit lands. Typing the whole code
+ * into ONE cell therefore fails `TYPE_NOT_VERIFIED`, and retrying without
+ * clearing appends into populated cells until the site rate-limits the run
+ * ("Too many invalid OTP attempts").
+ *
+ * `fillOtp` detects the group by SHAPE (N visible single-char inputs, never
+ * by autocomplete alone), clears every cell and verifies empty, types one
+ * digit per cell with real key events, re-reads values after each insert,
+ * and only submits when the widget did NOT auto-submit itself.
+ */
+const cdp_1 = require("./cdp");
+const FILL_OTP_JS = `(() => {
+  const vis = (el) => {
+    if (!el) return false;
+    const r = el.getBoundingClientRect();
+    if (r.width === 0 || r.height === 0) return false;
+    const cs = getComputedStyle(el);
+    return cs.visibility !== 'hidden' && cs.display !== 'none' && cs.opacity !== '0';
+  };
+  const dialogSel = 'dialog[open],[role="dialog"],[aria-modal="true"],' +
+    '[class*="modal"],[class*="Modal"],[class*="dialog"],[class*="Dialog"]';
+  const dialogs = [...document.querySelectorAll(dialogSel)].filter(vis);
+  const scope = dialogs.length ? dialogs[dialogs.length - 1] : document;
+  const inputs = [...scope.querySelectorAll('input')]
+    .filter(vis)
+    .filter((el) => !el.disabled && !el.readOnly && (el.type || '').toLowerCase() !== 'hidden');
+  const single = inputs.filter((el) => {
+    const ml = el.getAttribute('maxlength') ?? el.getAttribute('maxLength');
+    const n = ml === null || ml === undefined ? NaN : Number(ml);
+    return n === 1;
+  });
+  // A segmented OTP widget: at least 4 single-char inputs, or an explicit
+  // one-time-code input with siblings of the same shape.
+  let group = [];
+  if (single.length >= 4) {
+    // Keep the largest run of adjacent single-char inputs in DOM order.
+    group = single;
+  } else {
+    const otpish = inputs.filter((el) => {
+      const ac = (el.getAttribute('autocomplete') || '').toLowerCase();
+      if (ac === 'one-time-code') return true;
+      const hint = [el.getAttribute('name'), el.id, el.getAttribute('aria-label')].filter(Boolean).join(' ');
+      return /otp|one[- ]?time|verif|code/i.test(hint);
+    });
+    if (otpish.length >= 4) group = otpish;
+    else if (otpish.length === 1 && single.length >= 2) group = [otpish[0], ...single.filter((el) => el !== otpish[0])];
+  }
+  if (group.length < 4) return null;
+  // Sort by on-screen position (top then left) so auto-advance order is right.
+  group = group.slice().sort((a, b) => {
+    const ra = a.getBoundingClientRect();
+    const rb = b.getBoundingClientRect();
+    if (Math.abs(ra.y - rb.y) > ra.height / 2) return ra.y - rb.y;
+    return ra.x - rb.x;
+  });
+  group.forEach((el, i) => el.setAttribute('data-ts-otp', String(i)));
+  return {
+    length: group.length,
+    tags: group.map((el) => String(el.tagName || '').toLowerCase()),
+    modal: scope !== document,
+    values: group.map((el) => typeof el.value === 'string' ? el.value : ''),
+  };
+})()`;
+async function detectOtpGroup(page) {
+    try {
+        const v = await (0, cdp_1.evaluateJs)(page, FILL_OTP_JS);
+        if (!v || typeof v !== 'object')
+            return null;
+        const rec = v;
+        const length = typeof rec.length === 'number' ? rec.length : 0;
+        if (!length || length < 4 || length > 12)
+            return null;
+        return {
+            length,
+            tags: Array.isArray(rec.tags) ? rec.tags : [],
+            modal: rec.modal === true,
+            values: Array.isArray(rec.values) ? rec.values : [],
+        };
+    }
+    catch {
+        return null;
+    }
+}
+async function otpValues(page) {
+    try {
+        const v = await (0, cdp_1.evaluateJs)(page, `(() => [...document.querySelectorAll('[data-ts-otp]')].sort((a,b)=>Number(a.getAttribute('data-ts-otp'))-Number(b.getAttribute('data-ts-otp'))).map((el)=>typeof el.value==='string'?el.value:''))()`);
+        return Array.isArray(v) ? v : [];
+    }
+    catch {
+        return [];
+    }
+}
+async function clearOtpGroup(page, length) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+            await (0, cdp_1.evaluateJs)(page, `(() => { const els=[...document.querySelectorAll('[data-ts-otp]')].sort((a,b)=>Number(a.getAttribute('data-ts-otp'))-Number(b.getAttribute('data-ts-otp'))); for (const el of els) { el.focus(); el.select && el.select(); const proto = el.tagName==='TEXTAREA'?window.HTMLTextAreaElement&&HTMLTextAreaElement.prototype:window.HTMLInputElement&&HTMLInputElement.prototype; try { const setter = proto && Object.getOwnPropertyDescriptor(proto,'value'); if (setter && setter.set) setter.set.call(el,''); } catch {} el.value=''; el.dispatchEvent(new Event('input',{bubbles:true})); el.dispatchEvent(new Event('change',{bubbles:true})); } return true; })()`);
+        }
+        catch {
+            /* retry */
+        }
+        await (0, cdp_1.sleep)(60);
+        const values = await otpValues(page);
+        if (values.length === length && values.every((v) => v === ''))
+            return true;
+    }
+    return false;
+}
+async function focusOtpCell(page, index) {
+    try {
+        const ok = await (0, cdp_1.evaluateJs)(page, `(() => { const els=[...document.querySelectorAll('[data-ts-otp]')].sort((a,b)=>Number(a.getAttribute('data-ts-otp'))-Number(b.getAttribute('data-ts-otp'))); const el=els[${index}]; if(!el){return false;} el.focus(); el.select && el.select(); return document.activeElement===el; })()`);
+        return ok === true;
+    }
+    catch {
+        return false;
+    }
+}
+async function typeOtpDigit(page, digit) {
+    // Real key events so framework listeners (React/Vue OTP sensors) observe
+    // the same sequence a hardware keyboard produces.
+    try {
+        await (0, cdp_1.cdpSend)(page, 'Input.insertText', { text: digit });
+        return;
+    }
+    catch {
+        /* fall through to key events */
+    }
+    const key = digit;
+    const code = digit.startsWith('Numpad') ? digit : `Digit${digit}`;
+    try {
+        await (0, cdp_1.cdpSend)(page, 'Input.dispatchKeyEvent', {
+            type: 'keyDown',
+            key,
+            code,
+            text: digit,
+            unmodifiedText: digit,
+            windowsVirtualKeyCode: 48 + Number(digit),
+            nativeVirtualKeyCode: 48 + Number(digit),
+        });
+        await (0, cdp_1.cdpSend)(page, 'Input.dispatchKeyEvent', { type: 'keyUp', key, code });
+    }
+    catch {
+        /* best-effort */
+    }
+}
+async function visibleOtpError(page) {
+    try {
+        const v = await (0, cdp_1.evaluateJs)(page, `(() => {
+        const sel = '[role="alert"],.error,.text-red-500,.text-destructive,[class*="error" i]';
+        const els = [...document.querySelectorAll(sel)].filter((el) => {
+          const r = el.getBoundingClientRect();
+          if (r.width === 0 || r.height === 0) return false;
+          const t = (el.innerText || '').trim();
+          return t.length > 0 && t.length < 300;
+        });
+        return els.length ? els[0].innerText.trim().slice(0, 300) : null;
+      })()`);
+        return typeof v === 'string' && v ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function clickOtpSubmit(page) {
+    try {
+        const clicked = await (0, cdp_1.evaluateJs)(page, `(() => {
+        const scope = document;
+        const btns = [...scope.querySelectorAll('button,input[type="submit"],[role="button"]')].filter((el) => {
+          const r = el.getBoundingClientRect();
+          if (r.width === 0 || r.height === 0) return false;
+          if (el.disabled) return false;
+          const t = ((el.innerText || el.textContent || el.value || '')).trim();
+          return /verify|confirm|continue|submit|next/i.test(t);
+        });
+        if (!btns.length) return false;
+        btns[0].click();
+        return true;
+      })()`);
+        return clicked === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Fill a segmented OTP widget digit-by-digit.
+ *
+ * Never types into a populated cell: every cell is cleared and verified
+ * empty first. After the last digit the page gets a short settle window so
+ * an auto-submit sensor (navigation / loading state) can fire before the
+ * caller decides whether to click submit itself.
+ */
+async function fillOtpGroup(page, opts) {
+    const code = String(opts.code ?? '').replace(/\D/g, '');
+    const group = await detectOtpGroup(page);
+    if (!group) {
+        return {
+            ok: false,
+            filled: 0,
+            expected: 0,
+            values: [],
+            autoSubmitted: false,
+            submitted: false,
+            modal: false,
+            error: 'OTP_GROUP_NOT_FOUND',
+            detail: 'No segmented OTP widget (4+ single-char inputs) is visible.',
+        };
+    }
+    const expected = opts.digits ?? group.length;
+    if (code.length !== expected || code.length !== group.length) {
+        return {
+            ok: false,
+            filled: 0,
+            expected: group.length,
+            values: group.values,
+            autoSubmitted: false,
+            submitted: false,
+            modal: group.modal,
+            error: 'OTP_LENGTH_MISMATCH',
+            detail: `Code has ${code.length} digits but the widget has ${group.length} cells. Count the boxes and pass digits.`,
+        };
+    }
+    const urlBefore = (() => {
+        try {
+            return page.url ?? '';
+        }
+        catch {
+            return '';
+        }
+    })();
+    if (!(await clearOtpGroup(page, group.length))) {
+        return {
+            ok: false,
+            filled: 0,
+            expected: group.length,
+            values: await otpValues(page),
+            autoSubmitted: false,
+            submitted: false,
+            modal: group.modal,
+            error: 'OTP_CLEAR_FAILED',
+            detail: 'The OTP cells could not be emptied (autofill is fighting the clear). Retry fillOtp.',
+        };
+    }
+    for (let i = 0; i < group.length; i++) {
+        await focusOtpCell(page, i);
+        await (0, cdp_1.sleep)(40);
+        await typeOtpDigit(page, code[i]);
+        await (0, cdp_1.sleep)(90);
+        const values = await otpValues(page);
+        if (values[i] !== code[i]) {
+            // Re-focus by DOM position and retry once — auto-advance may have
+            // moved focus past a slow render.
+            await focusOtpCell(page, i);
+            await (0, cdp_1.sleep)(40);
+            await typeOtpDigit(page, code[i]);
+            await (0, cdp_1.sleep)(90);
+            const retry = await otpValues(page);
+            if (retry[i] !== code[i]) {
+                return {
+                    ok: false,
+                    filled: i,
+                    expected: group.length,
+                    values: retry,
+                    autoSubmitted: false,
+                    submitted: false,
+                    modal: group.modal,
+                    error: 'OTP_DIGIT_NOT_VERIFIED',
+                    detail: `Digit ${i + 1} did not land (cell ${i + 1} of ${group.length}).`,
+                    visibleError: (await visibleOtpError(page)) ?? undefined,
+                };
+            }
+        }
+    }
+    const values = await otpValues(page);
+    // Settle: an auto-submit sensor typically navigates or shows a spinner
+    // within ~1.5s. Poll cheaply so `submit:"auto"` sees it.
+    let autoSubmitted = false;
+    const deadline = Date.now() + 1500;
+    while (Date.now() < deadline) {
+        await (0, cdp_1.sleep)(150);
+        try {
+            const current = await (0, cdp_1.evaluateJs)(page, `(() => location.href)()`);
+            if (typeof current === 'string' && urlBefore && current !== urlBefore) {
+                autoSubmitted = true;
+                break;
+            }
+        }
+        catch {
+            // "Inspected target navigated" means the sensor already submitted.
+            autoSubmitted = true;
+            break;
+        }
+        try {
+            const busy = await (0, cdp_1.evaluateJs)(page, `(() => !!document.querySelector('[aria-busy="true"],[data-loading="true"],.animate-spin'))()`);
+            if (busy === true) {
+                autoSubmitted = true;
+                break;
+            }
+        }
+        catch {
+            break;
+        }
+    }
+    let submitted = false;
+    const mode = opts.submit ?? 'auto';
+    if (mode === 'always' || (mode === 'auto' && !autoSubmitted)) {
+        submitted = await clickOtpSubmit(page);
+    }
+    const visibleError = await visibleOtpError(page);
+    return {
+        ok: true,
+        filled: group.length,
+        expected: group.length,
+        values,
+        autoSubmitted,
+        submitted,
+        modal: group.modal,
+        ...(visibleError ? { visibleError } : {}),
+    };
+}
+//# sourceMappingURL=otp.js.map

package/dist/lib/browser/otp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otp.js","sourceRoot":"","sources":["../../../src/lib/browser/otp.ts"],"names":[],"mappings":";;AA0GA,wCAkBC;AA2HD,oCAmIC;AA1XD;;;;;;;;;;;;;;GAcG;AACH,+BAAiE;AAsCjE,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAmDf,CAAC;AAEC,KAAK,UAAU,cAAc,CAClC,IAAa;IAEb,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,IAAA,gBAAU,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,GAAG,GAAG,CAA4B,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO;YACL,MAAM;YACN,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,IAAiB,CAAC,CAAC,CAAC,EAAE;YAC3D,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,IAAI;YACzB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAmB,CAAC,CAAC,CAAC,EAAE;SAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAa;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,IAAA,gBAAU,EACxB,IAAI,EACJ,sMAAsM,CACvM,CAAC;QACF,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAa,EAAE,MAAc;IACxD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,IAAA,gBAAU,EACd,IAAI,EACJ,woBAAwoB,CACzoB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;QACD,MAAM,IAAA,WAAK,EAAC,EAAE,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,KAAa;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAA,gBAAU,EACzB,IAAI,EACJ,6KAA6K,KAAK,0GAA0G,CAC7R,CAAC;QACF,OAAO,EAAE,KAAK,IAAI,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAa,EAAE,KAAa;IACtD,yEAAyE;IACzE,kDAAkD;IAClD,IAAI,CAAC;QACH,MAAM,IAAA,aAAO,EAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,IAAA,aAAO,EAAC,IAAI,EAAE,wBAAwB,EAAE;YAC5C,IAAI,EAAE,SAAS;YACf,GAAG;YACH,IAAI;YACJ,IAAI,EAAE,KAAK;YACX,cAAc,EAAE,KAAK;YACrB,qBAAqB,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;YACzC,oBAAoB,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,IAAA,aAAO,EAAC,IAAI,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAa;IAC1C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,IAAA,gBAAU,EACxB,IAAI,EACJ;;;;;;;;;WASK,CACN,CAAC;QACF,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAa;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,gBAAU,EAC9B,IAAI,EACJ;;;;;;;;;;;;WAYK,CACN,CAAC;QACF,OAAO,OAAO,KAAK,IAAI,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,YAAY,CAChC,IAAa,EACb,IAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC;YACT,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;YACV,aAAa,EAAE,KAAK;YACpB,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,6DAA6D;SACtE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;IAC7C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC;YACT,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,aAAa,EAAE,KAAK;YACpB,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,YAAY,IAAI,CAAC,MAAM,8BAA8B,KAAK,CAAC,MAAM,0CAA0C;SACpH,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE;QACtB,IAAI,CAAC;YACH,OAAQ,IAAyB,CAAC,GAAG,IAAI,EAAE,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC;YACT,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,MAAM,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC;YAC7B,aAAa,EAAE,KAAK;YACpB,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,kBAAkB;YACzB,MAAM,EACJ,qFAAqF;SACxF,CAAC;IACJ,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAA,WAAK,EAAC,EAAE,CAAC,CAAC;QAChB,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,IAAA,WAAK,EAAC,EAAE,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1B,kEAAkE;YAClE,kCAAkC;YAClC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5B,MAAM,IAAA,WAAK,EAAC,EAAE,CAAC,CAAC;YAChB,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,IAAA,WAAK,EAAC,EAAE,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,CAAC;oBACT,QAAQ,EAAE,KAAK,CAAC,MAAM;oBACtB,MAAM,EAAE,KAAK;oBACb,aAAa,EAAE,KAAK;oBACpB,SAAS,EAAE,KAAK;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,KAAK,EAAE,wBAAwB;oBAC/B,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,IAAI;oBACzE,YAAY,EAAE,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,SAAS;iBACzD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,uEAAuE;IACvE,yDAAyD;IACzD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAA,WAAK,EAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAA,gBAAU,EAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;YAClE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACtE,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,aAAa,GAAG,IAAI,CAAC;YACrB,MAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAA,gBAAU,EAC3B,IAAI,EACJ,8FAA8F,CAC/F,CAAC;YACF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,aAAa,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IACnC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7D,SAAS,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,MAAM;QACtB,MAAM;QACN,aAAa;QACb,SAAS;QACT,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/dist/lib/browser/session.d.ts

@@ -2,6 +2,7 @@ import type { CdpPage, ElementInfo, PageInfo, PageText, PageLink } from './cdp';
 import { type NetworkEntry, type ConsoleEntry, type WebSocketFrame, type NetworkLogStatus } from './network-log';
 import { type ReadStagedResult, type FillExcelResult } from './xlsx-template';
 import { type LoginResult, type PerformLoginOptions, type TypeResult } from './login';
+import { type FillOtpOptions, type FillOtpResult } from './otp';
 import { type NativeDialogState, type PagePaginationState, type PageSnapshot, type WaitForKind } from './page-context';
 import { type PageEvent } from './page-events';
 import { type RefElement } from './refs';
@@ -270,19 +271,43 @@ export declare class BrowserSession {
     annotatedScreenshot(format?: 'jpeg' | 'png', quality?: number): Promise<string>;
     /**
      * Read the network + console evidence collected for this session (QA).
-     * `onlyProblems` narrows to failures/redirects; `clear` empties the buffer
-     * after reading so each QA step can report only its own traffic.
+     * `onlyProblems` narrows to failures/redirects; `clear` advances the read
+     * cursor (history is never deleted); `since`/`afterId`/`offset` page it.
      */
     networkLog(opts?: {
         limit?: number;
         clear?: boolean;
         onlyProblems?: boolean;
         maxBodyChars?: number;
+        offset?: number;
+        since?: number;
+        afterId?: string;
     }): Promise<{
         requests: NetworkEntry[];
         console: ConsoleEntry[];
         websockets: WebSocketFrame[];
         status: NetworkLogStatus;
+        truncated?: boolean;
+        bodyCap?: number;
+    }>;
+    /**
+     * Bounded per-action network delta (2026-10): the API requests that started
+     * at/after `since`, newest last. Attached to every mutating action result
+     * so the agent sees the rejected OTP POST (or any API mismatch) without a
+     * second `networkLog` call.
+     */
+    networkDelta(since: number, limit?: number): Promise<{
+        requests: Array<{
+            method: string;
+            url: string;
+            status?: number;
+            failed?: string;
+            blockedReason?: string;
+            durationMs?: number;
+            requestBody?: string;
+            responseBody?: string;
+        }>;
+        pendingRequests: number;
     }>;
     /**
      * Click at (x, y) CSS pixels. Coordinates OUTSIDE the current viewport are
@@ -388,6 +413,14 @@ export declare class BrowserSession {
     type(text: string, opts?: {
         clearFirst?: boolean;
     }): Promise<TypeResult>;
+    /**
+     * Fill a segmented OTP / one-time-code widget digit-by-digit (2026-10).
+     *
+     * Detects the group by shape (N visible single-char inputs), clears every
+     * cell, types one digit per cell with verification, waits for the site's
+     * auto-submit sensor, and only clicks submit when it did not fire.
+     */
+    fillOtp(opts: FillOtpOptions): Promise<FillOtpResult>;
     /**
      * Deterministically fill a login form (username + password) and submit.
      * Handles the common two-step email -> Continue -> password flow. Requires

package/dist/lib/browser/session.js

@@ -55,6 +55,7 @@ const launch_1 = require("./launch");
 const owned_registry_1 = require("./owned-registry");
 const process_1 = require("./process");
 const login_1 = require("./login");
+const otp_1 = require("./otp");
 const page_context_1 = require("./page-context");
 const page_events_1 = require("./page-events");
 const refs_1 = require("./refs");
@@ -729,13 +730,50 @@ class BrowserSession {
     }
     /**
      * Read the network + console evidence collected for this session (QA).
-     * `onlyProblems` narrows to failures/redirects; `clear` empties the buffer
-     * after reading so each QA step can report only its own traffic.
+     * `onlyProblems` narrows to failures/redirects; `clear` advances the read
+     * cursor (history is never deleted); `since`/`afterId`/`offset` page it.
      */
     async networkLog(opts) {
         this.ensureConnected();
         return this.network.snapshot(this.page, opts);
     }
+    /**
+     * Bounded per-action network delta (2026-10): the API requests that started
+     * at/after `since`, newest last. Attached to every mutating action result
+     * so the agent sees the rejected OTP POST (or any API mismatch) without a
+     * second `networkLog` call.
+     */
+    async networkDelta(since, limit = 10) {
+        try {
+            const snap = await this.network.snapshot(null, {
+                limit,
+                since,
+                maxBodyChars: 2000,
+            });
+            return {
+                requests: snap.requests.map((e) => ({
+                    method: e.method,
+                    url: e.url.length > 500 ? `${e.url.slice(0, 500)}…` : e.url,
+                    ...(typeof e.status === 'number' ? { status: e.status } : {}),
+                    ...(e.failed ? { failed: e.failed } : {}),
+                    ...(e.blockedReason ? { blockedReason: e.blockedReason } : {}),
+                    ...(typeof e.durationMs === 'number'
+                        ? { durationMs: e.durationMs }
+                        : {}),
+                    ...(e.requestBody
+                        ? { requestBody: e.requestBody.slice(0, 2000) }
+                        : {}),
+                    ...(e.responseBody
+                        ? { responseBody: e.responseBody.slice(0, 2000) }
+                        : {}),
+                })),
+                pendingRequests: this.network.pendingCount(),
+            };
+        }
+        catch {
+            return { requests: [], pendingRequests: 0 };
+        }
+    }
     /**
      * Click at (x, y) CSS pixels. Coordinates OUTSIDE the current viewport are
      * refused loudly — a screenshot pixel is not a CSS pixel (the capture is
@@ -955,16 +993,68 @@ class BrowserSession {
      */
     async type(text, opts) {
         this.ensureConnected();
+        // Segmented OTP widgets (N maxlength=1 cells): typing the whole code into
+        // one cell fails verification and appends on retry. Delegate to the OTP
+        // fill instead of failing with a bare TYPE_NOT_VERIFIED.
+        const digitsOnly = String(text ?? '').replace(/\D/g, '');
+        if (digitsOnly.length >= 4 &&
+            digitsOnly.length <= 12 &&
+            digitsOnly.length === String(text ?? '').trim().length) {
+            try {
+                const group = await (0, otp_1.detectOtpGroup)(this.page);
+                if (group && group.length === digitsOnly.length) {
+                    const filled = await (0, otp_1.fillOtpGroup)(this.page, { code: digitsOnly });
+                    if (filled.ok) {
+                        return {
+                            ok: true,
+                            beforeLength: 0,
+                            afterLength: filled.filled,
+                            focused: 'otp-group',
+                            contentEditable: false,
+                        };
+                    }
+                    throw new Error(`OTP_FILL_FAILED: ${filled.error ?? 'the code did not land'} — ${filled.detail ?? 'use browser_action({action:"fillOtp", code}) instead of type.'} ${filled.visibleError ? `Site says: "${filled.visibleError}". ` : ''}Cells: [${filled.values.map((v) => (v ? '"1-char"' : 'empty')).join(', ')}].`);
+                }
+            }
+            catch (err) {
+                if (err instanceof Error && err.message.startsWith('OTP_FILL_FAILED'))
+                    throw err;
+                /* detection is best-effort — fall through to normal typing */
+            }
+        }
         const credential = await (0, login_1.isCredentialFocused)(this.page);
         if (credential && !this._allowCredentials) {
             throw new Error('LOGIN_BLOCKED: refusing to type into a password/credential field. Pass allowCredentials:true on browser_open (debug browser only), use browser_action({action:"login"}) with supplied credentials, or ask the human to sign in.');
         }
         const result = await (0, login_1.typeTextVerified)(this.page, text, opts);
         if (!result.ok) {
-            throw new Error(`TYPE_NOT_VERIFIED: the typed text did not land (focused: ${result.focused ?? 'nothing focusable'}${result.contentEditable ? ' [contenteditable]' : ''}, before: ${result.beforeLength ?? 'unreadable'} chars, after: ${result.afterLength ?? 'unreadable'} chars). Read the field back via snapshot (focused/valueLength) and retry with clearFirst:true, or fill it with evaluate's native value setter + input/change events.`);
+            // Hint the OTP path when the focused field looks like one cell of many:
+            // the agent otherwise retries `type` and burns OTP attempts.
+            let hint = '';
+            try {
+                const group = await (0, otp_1.detectOtpGroup)(this.page);
+                if (group) {
+                    hint = ` This looks like cell 1 of a ${group.length}-cell OTP widget — call browser_action({action:"fillOtp", code:"<${group.length} digits>"}) instead of type.`;
+                }
+            }
+            catch {
+                /* ignore */
+            }
+            throw new Error(`TYPE_NOT_VERIFIED: the typed text did not land (focused: ${result.focused ?? 'nothing focusable'}${result.contentEditable ? ' [contenteditable]' : ''}, before: ${result.beforeLength ?? 'unreadable'} chars, after: ${result.afterLength ?? 'unreadable'} chars). Read the field back via snapshot (focused/valueLength) and retry with clearFirst:true, or fill it with evaluate's native value setter + input/change events.${hint}`);
         }
         return result;
     }
+    /**
+     * Fill a segmented OTP / one-time-code widget digit-by-digit (2026-10).
+     *
+     * Detects the group by shape (N visible single-char inputs), clears every
+     * cell, types one digit per cell with verification, waits for the site's
+     * auto-submit sensor, and only clicks submit when it did not fire.
+     */
+    async fillOtp(opts) {
+        this.ensureConnected();
+        return (0, otp_1.fillOtpGroup)(this.page, opts);
+    }
     /**
      * Deterministically fill a login form (username + password) and submit.
      * Handles the common two-step email -> Continue -> password flow. Requires
@@ -1301,10 +1391,14 @@ class BrowserSession {
         };
         if (opts?.refs === true && !this._nativeDialog) {
             const scanned = await this.getRefs();
+            const otp = await (0, otp_1.detectOtpGroup)(this.page).catch(() => null);
             return {
                 ...base,
                 refs: scanned.refs,
                 refsText: scanned.lines,
+                ...(otp
+                    ? { oneTimeCode: { length: otp.length, modal: otp.modal } }
+                    : {}),
             };
         }
         return base;
@@ -1343,8 +1437,18 @@ class BrowserSession {
             const state = await (0, page_context_1.readCompactState)(this.page);
             if (!state)
                 return null;
+            let oneTimeCode;
+            try {
+                const otp = await (0, otp_1.detectOtpGroup)(this.page);
+                if (otp)
+                    oneTimeCode = { length: otp.length, modal: otp.modal };
+            }
+            catch {
+                /* OTP detection is best-effort — never fail the observation */
+            }
             return {
                 ...state,
+                ...(oneTimeCode ? { oneTimeCode } : {}),
                 nativeDialog: this._nativeDialog,
                 pendingRequests: this.network.pendingCount(),
                 consoleErrors: this.network.recentErrors(3).map((c) => ({