Pup - the AI's own browser

@@ -1,6 +1,6 @@ --- name: pup-vendor-login-description: "How to sign a user into a third-party vendor portal (Autodesk, Fusion, Mouser, DigiKey, and other SSO sites) inside a pup window, so the login PERSISTS and later visits are automatic. Covers the autonomous 'Continue with Google/Microsoft' path that needs no typed password (it reuses the profile's existing Google session), the OAuth-popup behaviour pup shows, driving Google's account chooser (which ignores synthetic clicks), which profile to use for crash-isolation, and the hard limit that some heavy account-admin SPAs (Autodesk's Kepler/React portal) JAM CDP so pup cannot drive the in-portal admin UI. Read this before opening any vendor login in pup. Trigger words: log into autodesk, autodesk sign in, sign into fusion, continue with google, vendor login, portal login, sso login in pup, log into mouser, digikey login, assign a license, autodesk account, manage.autodesk.com, store my login, oauth popup, account chooser."+description: "How to sign a user into a third-party vendor portal (Autodesk, Fusion, Mouser, DigiKey, and other SSO sites) inside a pup window, so the login PERSISTS and later visits are automatic. Covers the autonomous 'Continue with Google/Microsoft' path that needs no typed password (it reuses the profile's existing Google session), the OAuth-popup behaviour pup shows, driving Google's FedCM account chooser (which rejects ALL programmatic clicks — needs a real desktop_hover-then-click), which profile to use for crash-isolation, and the hard limit that some heavy account-admin SPAs (Autodesk's Kepler/React portal) JAM CDP so pup cannot drive the in-portal admin UI. Read this before opening any vendor login in pup. Trigger words: log into autodesk, autodesk sign in, sign into fusion, continue with google, vendor login, portal login, sso login in pup, log into mouser, digikey login, assign a license, autodesk account, manage.autodesk.com, store my login, oauth popup, account chooser." ---  # pup-vendor-login — signing a user into a vendor portal that persists@@ -40,12 +40,23 @@ persists on disk. Email+password works too but needs a credential you do not hav      and the reclaim sweep adopts it as its **own session** named like `adom-you-win<rand>` at      `signin.autodesk.com`. Run `browser_list_windows` and look for the new session; drive THAT one. -4. **Click the account in Google's chooser — Google IGNORES a bare `.click()`.** Dispatch the full-   trusted pointer sequence:+4. **Click the account — Google's "Sign in with Google" chooser (FedCM) REJECTS every in-page and+   in-app click.** Proven 2026-07-28 signing John into Autodesk: DOM `.click()`, a full synthetic+   pointer-event sequence, `page.mouse.click` (browser_click x/y), AND UIA-by-name+   (`desktop_ui_click`) ALL failed — the account lives in a cross-origin FedCM iframe hardened+   against automation. **The ONLY thing that works is a REAL OS cursor HOVER-then-CLICK** via AD's+   desktop verbs (this is the breakthrough):    ```-   browser_eval {"sessionId":"autodesk","expr":"(()=>{const el=document.querySelector('[data-identifier=\"USER@EMAIL\"]'); const r=el.getBoundingClientRect(),cx=r.x+r.width/2,cy=r.y+r.height/2; for(const t of ['pointerdown','mousedown','pointerup','mouseup','click']) el.dispatchEvent(new MouseEvent(t,{bubbles:true,cancelable:true,view:window,clientX:cx,clientY:cy,buttons:1})); return 'clicked';})()"}+   browser_raise_os_window {sessionId, foregroundReason:"<the user's words>"}   # FedCM needs the window focused+   desktop_screenshot_window {hwnd}                                             # get shotId + coordMap+   desktop_hover  {space:"image", shotId, x:<account px>, y:<account px>}        # MOVE the real cursor FIRST — this is the key+   desktop_click  {space:"image", shotId, x:<same>, y:<same>}                   # then the real SendInput click    ```-   List the accounts first with `[...document.querySelectorAll('[data-identifier]')].map(e=>e.getAttribute('data-identifier'))`.+   The HOVER before the click is what satisfies FedCM's genuine-user-activation check — a bare+   desktop_click with NO preceding hover did NOT advance; hover-then-click did. Aim by the+   SCREENSHOT pixel (the account is in an iframe, so top-frame getBoundingClientRect can't locate+   it). If even this is refused, the window is foregrounded with the account visible — ask the USER+   to tap it once.  5. **Confirm the redirect landed** by SCREENSHOT, not eval — the eval often reads one beat before the    redirect completes and reports the stale chooser URL while the screenshot already shows the@@ -107,7 +118,7 @@ a license seat, editing users). Do not promise to click through it. Options, in ## Pitfalls recap (each paid for on 2026-07-28) - Rapid ops crash the Chrome → pace slowly, one op + settle. - Shared-profile crash kills all sessions + loses un-flushed logins → dedicated durable profile.-- Google chooser ignores synthetic clicks → full pointer-event sequence.+- Google FedCM chooser rejects ALL clicks (DOM/synthetic/page.mouse/UIA) → real OS desktop_hover THEN desktop_click; the hover is mandatory. - Button text has hidden whitespace → regex match, not `===`. - Eval reads stale mid-redirect → confirm with a screenshot. - The account-admin SPA jams CDP → hand off to the user or the API; do not fight it.