Fusion - the Fusion 360 Bridge

@@ -3646,6 +3646,198 @@ def _ad_call(verb: str, args: dict, timeout: int = 60) -> dict:     return {"_adCallError": "; ".join(why)}  +def _fusion_signin_cfg_path():+    import pathlib+    d = pathlib.Path(os.path.expanduser("~")) / ".adom" / "fusion-signin"+    d.mkdir(parents=True, exist_ok=True)+    return d / "profile.json"+++def _remembered_signin_profile():+    try:+        import json as _j+        p = _fusion_signin_cfg_path()+        if p.exists():+            return (_j.loads(p.read_text()) or {}).get("profile") or None+    except Exception:+        pass+    return None+++def _remember_signin_profile(profile: str):+    try:+        import json as _j+        _fusion_signin_cfg_path().write_text(_j.dumps({"profile": profile}))+    except Exception:+        pass+++def _chrome_authorize_urls(max_age_min: int = 12):+    """Scan Chrome + Edge profile History DBs for RECENT Autodesk-desktop OAuth authorize+    URLs (the Fusion Identity SDK ones - marked by `idsdk` / redirect to idmgr/callback).++    This is how we fix Fusion opening the WRONG browser profile: Fusion fires its OAuth at+    the OS-default browser, but the FULL authorize URL (client_id, PKCE challenge, state,+    request_id) lands in that browser's History. We read it back and re-open it in the+    profile the user actually authenticates Autodesk in. The URL is NOT tied to a browser+    (its redirect is accounts.autodesk.com/idmgr/callback + an autodesk:// protocol handoff+    matched by request_id), so completing it in ANY profile hands the token to the running+    Fusion. Verified live (John, 2026-07-21).++    Returns a list of {url, sourceProfileDir, browser, ageSec} newest first.+    """+    import glob, sqlite3, shutil, tempfile, time as _t+    la = os.environ.get("LOCALAPPDATA", "")+    roots = []+    if la:+        roots.append(("chrome", os.path.join(la, "Google", "Chrome", "User Data")))+        roots.append(("edge", os.path.join(la, "Microsoft", "Edge", "User Data")))+    now = _t.time()+    found = []+    for browser, root in roots:+        if not os.path.isdir(root):+            continue+        for hist in glob.glob(os.path.join(root, "*", "History")):+            prof_dir = os.path.basename(os.path.dirname(hist))+            tmp = os.path.join(tempfile.gettempdir(), "adom_hist_%s_%s.db" % (browser, prof_dir))+            try:+                shutil.copy2(hist, tmp)  # copy first - Chrome keeps History locked+                con = sqlite3.connect(tmp)+                rows = con.execute(+                    "SELECT url, last_visit_time FROM urls "+                    "WHERE url LIKE '%developer.api.autodesk.com/authentication/v2/authorize%' "+                    "OR url LIKE '%idp.auth.autodesk.com/as/authorize%' "+                    "ORDER BY last_visit_time DESC LIMIT 6").fetchall()+                con.close()+            except Exception:+                continue+            for url, cts in rows:+                if "idsdk" not in url and "idmgr" not in url:+                    continue  # only the DESKTOP-app (Fusion) flow, not a web app+                epoch = (cts / 1_000_000) - 11644473600+                age = now - epoch+                if age <= max_age_min * 60:+                    found.append({"url": url, "sourceProfileDir": prof_dir,+                                  "browser": browser, "ageSec": int(age)})+    found.sort(key=lambda x: x["ageSec"])+    return found+++def _orchestrate_signin(args: dict) -> dict:+    """Sign Fusion in through the CORRECT browser profile - the fix for Fusion firing its+    OAuth at the OS-default browser (often the wrong Autodesk account). See the+    fusion-multiprofile-signin skill.++    Staged: pick the target profile (remembered / arg / probed / ask) -> ensure Fusion has+    emitted its OAuth URL (click Sign In if not) -> read that URL from the wrong browser's+    History -> re-open it in the TARGET profile in the BACKGROUND -> report where it waits.+    """+    steps = []+    target = args.get("profile")           # explicit override, e.g. "chrome:[email protected]"+    if target:+        _remember_signin_profile(target)+    if not target:+        target = _remembered_signin_profile()++    rd = _handle_fusion_readiness({}, {})+    if not rd.get("running"):+        return {"success": True, "stage": "not_running", "done": False, "steps": steps,+                "_hint": "Fusion is not running. fusion_start, then fusion_signin.",+                "statusVerb": "fusion_signin"}+    if not rd.get("needsSignin"):+        return {"success": True, "stage": "already", "done": True, "steps": steps,+                "narrate": "Fusion is already signed in.",+                "_hint": "Already signed in (ready:%s). Nothing to do." % rd.get("ready"),+                "statusVerb": "fusion_signin"}++    # profiles known to ABE (for target selection + naming)+    profs = _ad_call("nbrowser_profiles", {}, timeout=40)+    pdata = profs.get("data", profs) if isinstance(profs, dict) else {}+    choices = [p for p in (pdata.get("profiles") or []) if isinstance(p, dict) and p.get("profile")]++    # read Fusion's authorize URL from browser history (it fires the OS-default browser)+    urls = _chrome_authorize_urls()+    if not urls:+        return {"success": True, "stage": "click_signin", "done": False, "steps": steps,+                "_hint": ("No recent Fusion OAuth URL in any browser's history yet - Fusion has not "+                          "opened the sign-in browser. CLICK Fusion's 'Sign In' button (it is a "+                          "webview with no UIA node, so image-space desktop_click on the button - "+                          "screenshot the Fusion window for a shotId first), wait ~4s, then call "+                          "fusion_signin again. This verb then grabs the URL Fusion opened in the "+                          "WRONG default browser and re-opens it in the RIGHT profile."),+                "statusVerb": "fusion_signin"}+    auth = urls[0]+    steps.append("captured Fusion OAuth URL from %s profile '%s' (%ss old)"+                 % (auth["browser"], auth["sourceProfileDir"], auth["ageSec"]))++    # choose the TARGET profile if not already fixed+    reason = ""+    if not target:+        # probe each live profile for a real Autodesk session; prefer signed-in, then work over consumer+        for c in choices:+            if not c.get("live"):+                continue+            ls = _ad_call("nbrowser_login_state",+                          {"profile": c["profile"], "url": "https://accounts.autodesk.com/"}, timeout=40)+            lsd = ls.get("data", ls) if isinstance(ls, dict) else {}+            c["_ad"] = "signed-in" if lsd.get("loggedIn") else ("signed-out" if lsd.get("ok") is not None else "unprobed")+            c["_conf"] = lsd.get("confidence"); c["_cookies"] = lsd.get("cookieCount")+        signed = [c for c in choices if c.get("_ad") == "signed-in"]+        if signed:+            signed.sort(key=lambda c: ({"high": 3, "medium": 2, "low": 1}.get(c.get("_conf"), 0), c.get("_cookies") or 0), reverse=True)+            target = signed[0]["profile"]; reason = "it holds a live Autodesk session"+        else:+            _CONSUMER = ("gmail.com", "outlook.com", "hotmail.com", "yahoo.com", "icloud.com", "live.com")+            work = [c for c in choices if c.get("live") and c.get("email") and not any((c["email"] or "").lower().endswith("@" + d) for d in _CONSUMER)]+            if work:+                target = work[0]["profile"]; reason = "it is a work/corporate profile (no live Autodesk session detected - CONFIRM)"+    if target:+        _remember_signin_profile(target)+        reason = reason or "you told me to use it"++    if not target:+        return {"success": True, "stage": "ask_profile", "done": False, "steps": steps,+                "signinAuthUrl": auth["url"], "profileChoices": choices,+                "_hint": ("Captured Fusion's OAuth URL but cannot tell which profile is your Autodesk "+                          "account. ASK the user which profile their Autodesk login belongs to, then "+                          "call fusion_signin {profile:'chrome:<their-account>'} - I will remember it. "+                          "profileChoices lists every profile."),+                "statusVerb": "fusion_signin"}++    tdesc = next((_describe_profile(c) for c in choices if c.get("profile") == target), target)+    r = _ad_call("nbrowser_open_window",+                 {"sessionId": "fusion-signin", "url": auth["url"], "background": True,+                  "profile": target, "thread": "fusion-signin",+                  "purpose": "Fusion Autodesk sign-in (correct profile)"}, timeout=60)+    opened = bool((r.get("data", r) if isinstance(r, dict) else {}).get("sessionId") or r.get("ok") or r.get("success"))+    steps.append(("re-opened it in %s" % tdesc) if opened else ("could not open %s: %s" % (tdesc, r.get("_adCallError"))))++    return {"success": True, "stage": "opened" if opened else "open_failed",+            "done": False, "steps": steps, "signinWhere": tdesc, "signinProfile": target,+            "signinProfileReason": reason, "signinSession": "fusion-signin" if opened else None,+            "signinWrongBrowser": "%s / %s" % (auth["browser"], auth["sourceProfileDir"]),+            "signinAuthUrl": auth["url"],+            "narrate": (("Fusion opened its sign-in in the WRONG browser (%s), so I moved the real "+                         "Autodesk sign-in URL into %s - I picked that because %s. Finish it there, "+                         "or I can drive it, and Fusion will pick up the login automatically."+                         % (auth["sourceProfileDir"], tdesc, reason)) if opened else+                        "I captured Fusion's sign-in URL but could not open the target profile."),+            "_hint": (("The REAL Fusion OAuth URL is now open in %s (session 'fusion-signin'). It "+                       "completes back to the running Fusion via the idmgr/callback + autodesk:// "+                       "protocol handoff (request_id match), so the browser profile no longer has to "+                       "be the OS default - THIS is the fix for Fusion signing into the wrong "+                       "account. TELL the user the exact profile (never 'your browser'), say WHY it "+                       "was chosen (signinProfileReason), and offer: they finish it, you foreground "+                       "it, or (with their OK) you drive 'Continue with Google/Apple/Microsoft'. "+                       "NEVER type their password/2FA. Then poll fusion_readiness until ready:true. "+                       "The wrong-browser tab (%s) can be closed. If the wrong ACCOUNT completes "+                       "anyway, sign Fusion out and re-run. Skill: fusion-multiprofile-signin."+                       % (tdesc, auth["sourceProfileDir"])) if opened else+                      "Open failed: %s. Retry, or open auth url yourself with nbrowser_open_window "+                      "{profile:'%s', url:<signinAuthUrl>}." % (r.get("_adCallError"), target)),+            "statusVerb": "fusion_signin"}++ def _orchestrate_demo(args: dict) -> dict:     """FIRST-TIME-USER DEMO: take a brand-new user from nothing to "wow" in one verb. @@ -3708,6 +3900,16 @@ def _orchestrate_demo(args: dict) -> dict:      # ── 2. SIGN-IN: finish it, do not sit on it ─────────────────────────────────     if rd.get("needsSignin"):+        # Delegate to the multi-profile sign-in fix (reads Fusion's OAuth URL out of the WRONG+        # default browser and re-opens it in the RIGHT profile). Returns its own rich stage.+        si = _orchestrate_signin({"profile": args.get("signinProfile")})+        si["demo"] = True+        if si.get("stage") in ("opened", "click_signin", "ask_profile", "open_failed"):+            si.setdefault("done", False)+            si["_hint"] = (si.get("_hint", "") + "  (This is the fusion_demo sign-in stage - after "+                           "the user is signed in and fusion_readiness is ready:true, call fusion_demo "+                           "again to continue the tour: APS -> project -> schematic -> 2D -> 3D.)")+            return si         # DO IT, don't just describe it: open the Autodesk sign-in in the user's OWN browser,         # in the BACKGROUND so we never yank them out of what they're doing. Then tell the AI         # exactly WHERE it is waiting and offer the three ways forward.@@ -4140,6 +4342,8 @@ def dispatch_command(command: str, args: dict) -> dict:         return _orchestrate_fetch_optimized_glb(args)     if command == "demo":         return _orchestrate_demo(args)+    if command == "signin":+        return _orchestrate_signin(args)     if command == "board_stackup":         return _orchestrate_board_stackup(args)