Fusion - the Fusion 360 Bridge

@@ -387,3 +387,77 @@ When only a human can clear something (2FA, credentials, a protocol dialog): Put all of this in response **`_hint`s, not just a skill.** John, 2026-07-22: *"the ai never follows skills well, so hints back in your cli calls is the way to get the ai to act correctly."* Skills are reference; hints are what actually change behaviour at the callsite.++## The PROVEN Fusion sign-in: every step, FG vs BG, and why (2026-07-22)++Signing Fusion in was a mess for a long time. This is the sequence that ACTUALLY worked end to+end, live, with the account signed in and `ready:true`. **Only 2 of 10 steps touch the user's+screen.** Do not regress this.++| # | Step | FG/BG | Method that makes it background | Caption |+|---|------|-------|--------------------------------|---------|+| 1 | `fusion_start` (if not running) | **FG** | Fusion raises its own window on launch | **yes** |+| 2 | find Fusion hwnd + rect | BG | `desktop_list_windows` (also returns `rect`) | no |+| 3 | restore if minimized | **FG-ish** | `desktop_set_window_state` | **yes** |+| 4 | click **Sign In** | **BG** | `desktop_ui_click` UIA Invoke | no |+| 5 | capture authorize URL | BG | copy Chrome `History` + `-wal`/`-shm`, sqlite read | no |+| 6 | re-open URL in target profile | BG | `nbrowser_open_window {background:true}` | no |+| 7 | click "Continue with Google" | BG | CDP `nbrowser_click` | no |+| 8 | pick the account by email | BG | CDP `nbrowser_click` | no |+| 9 | click "Open Product" (`autodesk://`) | BG | CDP `nbrowser_click` | no |+| 10 | poll `fusion_readiness` | BG | HTTP | no |++### The three discoveries that made it work++1. **Fusion's "Sign In" button IS in the UIA tree and IS invokable.** I wrongly claimed for a long+   time that it was an un-automatable webview control and foregrounded the window every time.+   ```+   name "Sign In"  role Button  invokable true+   automationId QTApplication.MW1_0...Nu::QTSignInDialog.backgroundWidget.signin_button+   ```+   `desktop_ui_click {hwnd, name:"Sign In"}` clicks it with NO foreground. **Never SendInput it.**+2. **SSO beats password every time.** Click **"Continue with Google"** (or Apple/Microsoft) BEFORE+   typing any email. If the browser profile already has that identity, the whole login completes+   with **no password and no 2FA**. Typing an email first commits you to the password path.+3. **It must be a FRESH flow.** Re-navigating a `flowId` that already advanced lands on the+   PASSWORD screen with no way back to the provider buttons. If the SSO button is missing, restart+   Fusion for a fresh `request_id` rather than fighting the page.++### CDP only drives windows YOU opened++`nbrowser_*` refuses a tab in a window the user (or Fusion) opened: `not_owned`, and there is no+override. That is WHY step 6 exists - re-opening the captured URL in an **agent-owned** window is+what makes steps 7-9 background-drivable. A side effect is a second window, so close the original.++### Branches++| Condition | Detection | Action |+|---|---|---|+| wrong profile | captured dir != target dir | re-open in target |+| right profile already | dir match (work account is often `Default`!) | `already_right_profile`, do NOT open a duplicate |+| URL older than 150s | `ageSec > 150` | `stale` -> restart Fusion for a fresh request |+| no SSO button | button missing | not a fresh flow -> restart Fusion |+| 6-digit email code | window title `2-step verification` | read from Gmail via `adom-google`, submit with `fusion_signin_2fa` (background) |+| password screen | `h1` "Enter your password" | TRUE WALL - toast the user, never type it |+| `autodesk://` dialog | title has "Identity Manager" | `desktop_ui_click {name:"Open"}` |++**Chrome profile dirs lie to you.** `chrome:[email protected]` maps to dir **`Default`**, and the+personal account to `Profile 1`. Always compare DIRS, never assume "Default == personal".++### ONE login must cover Fusion AND APS++John, 2026-07-22: *"why should the user have to login twice to autodesk to sign in to fusion and+setup aps? why aren't those just driven from 1 login?"*++They cannot share a token (Autodesk DPAPI-encrypts Fusion's store with app entropy, on purpose),+but they CAN share the **warm browser SSO session**. So:++- `fusion_readiness` now reports APS state on EVERY launch and its `_hint` says what to do.+- Right after a successful Fusion sign-in, while the profile's Autodesk SSO session is still warm,+  the bridge starts APS consent itself - it goes through silently. Never make the user log in twice.++### Captions: only when you actually disrupt++Caption (`desktop_caption`, <= 3s) ONLY for steps that take over the screen - launching/restoring+Fusion. Do NOT caption background work; unnecessary captions are their own kind of rude. Always say+WHY, and whether you need anything from the user.