# <site name> (<domain>)

- **Login entry URL:** the URL that lands on the sign-in flow
- **Flow type:** single-page | email-first | account-picker | SSO-redirect | other
- **2FA:** none | TOTP authenticator | SMS | push  (and whether "remember device" is offered)
- **Anti-automation notes:** custom-masked fields, isTrusted requirements, etc.

## Steps
1. …each step: the action, the exact selector if non-obvious, the pup verb to use, and
   whether it AUTO-APPROVES or PAUSES for the human.

## Field selectors
- username: `<selector>`  (type: text/email)
- password: `<selector>`  (note if NOT type=password)
- submit:   `<selector or button text>`

## Gotchas
- anything that bit someone: React-controlled fields, reloads that clear values, redirects, etc.

# pup login recipes — how the AI signs you into any site

**pup is your AI's doppelganger on the web.** For most sites, pup logs you in automatically:
it fills your saved credential from the OS-keychain vault and submits, no dialog, no fuss. But
real login flows differ wildly, email-first steps, account pickers, custom-masked password
fields, 2FA, anti-bot defenses, and a generic approach fails on the tricky ones.

This folder is a **growing corpus of per-site login recipes**: one file per domain documenting
the exact sequence pup should drive to sign you in, and which steps need *you* (the human) for a
moment. Every Adom user's AI reads these, and **you can contribute the recipe for any site you
hit** so the next person's AI just works.

The goal is thousands of recipes so pup can truly log into anything, for all of us.

## The operating context: Auto mode

Adom users run their AI in Claude Code **Auto mode** (Hydrogen puts you there). Auto approves
safe actions and pauses on risky ones. So every recipe is written Auto-mode-aware:

- **Prefer structured pup verbs** (`pup_login`, `pup_type`, `pup_click`) over raw `pup_eval`,
  the safety check allows the former and pauses the latter. See the `pup-auto-mode` dev skill.
- **Mark which steps auto-approve vs. pause for the human.** Typing a *new* credential pauses
  (correct, you confirm the site); everything after the vault knows it flows silently.
- **Always on the durable `adom-you` profile**, so the session + 2FA-remember persist and you
  rarely re-authenticate. Never log in on an isolated throwaway.

## Anti-bot walls: pup surfs as consumer Google Chrome (pup ≥ 2.0.141)

Many sites (Cloudflare/Akamai) fingerprint the browser's **client-hints brands**. Chrome for
Testing omits the `Google Chrome` brand real Chrome carries, and the walls flag that. pup now adds
it to every tab automatically, so a page that used to serve "Just a moment…" loads normally — this
genuinely is the user on their own Windows Chrome, with CfT only as the automation harness. If a
site *still* challenges, it wants an interaction: reload once, wait, and rarely a real
`pup_assisted_click`. Never hammer-reload. See `ee-parts-sites.md` for a worked example across a
dozen electronics sites.

## Recipe file format

Name the file by registrable domain: `login-recipes/<domain>.md` (e.g. `gusto.com.md`). Use:

```markdown
# <site name> (<domain>)

- **Login entry URL:** the URL that lands on the sign-in flow
- **Flow type:** single-page | email-first | account-picker | SSO-redirect | other
- **2FA:** none | TOTP authenticator | SMS | push  (and whether "remember device" is offered)
- **Anti-automation notes:** custom-masked fields, isTrusted requirements, etc.

## Steps
1. …each step: the action, the exact selector if non-obvious, the pup verb to use, and
   whether it AUTO-APPROVES or PAUSES for the human.

## Field selectors
- username: `<selector>`  (type: text/email)
- password: `<selector>`  (note if NOT type=password)
- submit:   `<selector or button text>`

## Gotchas
- anything that bit someone: React-controlled fields, reloads that clear values, redirects, etc.
```

## Contributing (any Adom user)

Hit a site whose login your AI fumbled? Tell your AI "add a pup login recipe for <site>" or open
a PR on the pup wiki page (Files tab → `login-recipes/`). Include the flow type, the field
selectors, and any gotcha. Keep secrets OUT, recipes describe the *flow*, never credentials.