fix: condition autofix auth handoff

Author: beubax

skills/webcmd-autofix/SKILL.md

@@ -12,7 +12,7 @@ When a `webcmd` command fails because a website changed its DOM, API, or respons
 
 Hard stops before any code change:
 
-- **`AUTH_REQUIRED`** (exit code 77): run `webcmd <site> login`, return its `action_required` instructions and `verify_command` (normally `webcmd <site> whoami`) to the user, then wait for the user to report done in the visible browser. Run the returned `verify_command`; verification must succeed before retrying the original command. Never request, type, echo, store, or automate passwords, OTPs, recovery codes, cookies, or session secrets.
+- **`AUTH_REQUIRED`** (exit code 77): if a site login command exists, run `webcmd <site> login`, return its `action_required` instructions and `verify_command` (normally `webcmd <site> whoami`) to the user, and wait for them to report done in the visible browser. Run the returned `verify_command`; verification must succeed before retrying the original command. If no site login command exists, stop browser writes, hand the visible browser to the user, and wait. After they report done, take fresh browser state and use an available identity check or verify the intended post-action state before retrying. Their report alone is not verification. Never request, type, echo, store, or automate passwords, OTPs, recovery codes, cookies, or session secrets.
 - **`BROWSER_CONNECT`** (exit code 69): stop. Tell the user to run `webcmd doctor`.
 - **CAPTCHA / raw-browser user takeover:** stop automation and let the user act in the visible browser. If handoff returned a `verify_command`, run it; verification must succeed before retrying. With no site login command and therefore no returned verifier, take fresh browser state and use an available identity check or verify the intended post-action state before retrying. The user's report alone is not verification. CAPTCHA is not an adapter issue.
 - **Rate limiting / IP block:** stop. This is not an adapter issue.
@@ -125,7 +125,7 @@ Read the trace summary and adapter source. Classify root cause:
 | SELECTOR | DOM restructured or class/id changed | Explore current DOM and find a stable selector |
 | EMPTY_RESULT | API response schema changed, data moved, or real empty result | Check network and visible page before patching |
 | API_ERROR | Endpoint URL changed or new params required | Discover current API through network evidence |
-| AUTH_REQUIRED | Login flow changed or cookies expired | Run `webcmd <site> login` -> return `action_required` and `verify_command` (normally `webcmd <site> whoami`) -> user reports done -> run returned `verify_command`; verification must succeed before retry. CAPTCHA uses the conditional verification policy in Safety Boundaries. |
+| AUTH_REQUIRED | Login flow changed or cookies expired | Follow the conditional AUTH_REQUIRED policy in Safety Boundaries: use the site login command and its returned verifier when available; otherwise use human handoff plus fresh-state supported verification. |
 | TIMEOUT | Page loads differently or lazy-load signal changed | Update wait conditions |
 | PAGE_CHANGED | Major redesign | May need full adapter rewrite through `webcmd-adapter-author` |
 

src/skills.test.ts

@@ -99,6 +99,9 @@ describe('webcmd skills content', () => {
     const autofix = bundledSkill('webcmd-autofix');
     const author = bundledSkill('webcmd-adapter-author');
     const skills = [browser, usage, autofix, author];
+    const autofixAuthRequired = autofix.match(/^- \*\*`AUTH_REQUIRED`\*\*[\s\S]*?(?=\n- \*\*)/m)?.[0] ?? '';
+    const autofixAuthRequiredRow = autofix.split('\n')
+      .find((line) => line.startsWith('| AUTH_REQUIRED |')) ?? '';
 
     expect(browser).toContain('webcmd <site> login');
     expect(browser).toContain('webcmd <site> whoami');
@@ -121,6 +124,9 @@ describe('webcmd skills content', () => {
     for (const skill of [browser, usage, autofix]) {
       expect(skill).toMatch(/no (?:site )?login command[\s\S]{0,500}fresh browser state[\s\S]{0,500}(?:identity check|post-action state)[\s\S]{0,250}before retry/i);
     }
+    expect(autofixAuthRequired).toMatch(/if (?:a|the) site login command exists[\s\S]*webcmd <site> login[\s\S]*returned `verify_command`[\s\S]*verification must succeed[\s\S]*retry/i);
+    expect(autofixAuthRequired).toMatch(/no site login command[\s\S]*stop (?:browser )?writes[\s\S]*visible browser[\s\S]*fresh browser state[\s\S]*(?:identity check|post-action state)[\s\S]*before retry[\s\S]*report alone is not verification/i);
+    expect(autofixAuthRequiredRow).toMatch(/conditional[^|]*Safety Boundaries|no site login command/i);
     expect(autofix).toMatch(/CAPTCHA[\s\S]{0,250}stop automation[\s\S]{0,250}verification must succeed/i);
   });