browser-login

Browser Login (Login Machine Loop)

Goal: log into an arbitrary website without provider-specific scripts by looping:

1. observe current page
2. classify what screen it is
3. act using stable refs/semantic selectors
4. repeat until logged in

Non-Negotiables (Security)

• Never ask the user to paste passwords/OTP into chat.
• Always collect secrets using secret_prompt, then pass only the returned secret://... handle to browser actions.
• Do not store credentials in memory or write them to disk.
• Prefer browser snapshot refs (@e1, @e2) and semantic browser find over brittle CSS selectors.

Setup

1. browser tool must be enabled and the target domain must be in browser.allowed_domains.
2. Start by opening the login URL (or the product URL that redirects to login).

Core Loop

Repeat up to ~20 iterations:

1. Observe:

   • Call browser snapshot with interactive_only=true, compact=true.
   • If the snapshot is insufficient (missing context), take browser screenshot.

2. Classify the screen (pick one):

   • credential_form: there are input fields and a primary submit.
   • email_first: email/username only with a next/continue.
   • password_only: password only (email is remembered).
   • choice_screen: account/workspace picker or auth method selector.
   • blocked_modal: cookie banner / modal blocking clicks.
   • mfa_otp: asks for a code (TOTP/SMS/email).
   • magic_link: instructs user to check email for a link.
   • captcha: challenge detected (cannot solve reliably inside this loop).
   • logged_in: you can see app content / avatar / logout / dashboard.
   • loading: spinners, disabled UI; wait and resnapshot.

3. Act (handlers):

blocked_modal

• Find the dismiss/accept button (often "Accept", "Agree", "Close", "X").
• Use browser click by ref or browser find by text/role, then resnapshot.

credential_form / email_first / password_only

• Identify required fields (email/username, password).
• For each required secret:
  • Use secret_prompt:
    • kind="text" for email/username
    • kind="password" for password
  • Fill using browser fill where value is the returned secret://... handle.
• Submit:
  • Click the primary submit button (ref or browser find by role/text).
• If there is a second step (email -> password), resnapshot and repeat.