Opendevbrowser Login Automation

Login Automation Skill

Use this skill for deterministic auth testing that handles MFA and anti-bot checkpoints without unsafe bypass patterns.

Pack Contents

• artifacts/login-workflows.md
• assets/templates/login-scenario-matrix.json
• assets/templates/challenge-checkpoint.md
• assets/templates/auth-signals.json
• scripts/run-login-workflow.sh
• scripts/record-auth-signals.sh
• scripts/validate-skill-assets.sh
• Shared robustness matrix: ../opendevbrowser-best-practices/artifacts/browser-agent-known-issues-matrix.md

Fast Start

1. Validate pack integrity.

./skills/opendevbrowser-login-automation/scripts/validate-skill-assets.sh

2. Print a ready workflow.

./skills/opendevbrowser-login-automation/scripts/run-login-workflow.sh password
./skills/opendevbrowser-login-automation/scripts/run-login-workflow.sh mfa
./skills/opendevbrowser-login-automation/scripts/run-login-workflow.sh challenge-checkpoint

Supporting Surfaces

• Use browser replay (screencast-start / screencast-stop) when login timing, MFA transitions, or challenge loops need temporal evidence.
• Use desktop observation only for read-only evidence around native dialogs or sibling desktop surfaces; it stays core-owned and is not extension relay control.
• Use --challenge-automation-mode off|browser|browser_with_helper when workflow or macro execution needs bounded browser-scoped computer use; the helper is not a desktop agent.

Core Rules

• Use snapshot refs, not ad-hoc selectors.
• Run one decision loop at a time: snapshot -> action -> snapshot.
• Use low-level pointer controls when a deterministic test gate or slider challenge requires gesture input, then re-snapshot before resuming auth steps.
• Never store credentials in skill files, logs, screenshots, or committed fixtures.
• Treat anti-bot challenges as checkpoints (manual solve or approved test keys), not bypass targets.
• Keep a bounded retry budget (max 2 automated retries) and honor Retry-After when present.

Session Reuse by Mode

• extension reuses the attached live tab or profile state; it does not run system cookie bootstrap.
• managed attempts readable system Chrome-family cookie bootstrap before first navigation.
• cdpConnect attempts readable system Chrome-family cookie bootstrap before first navigation.
• cookie-import is the explicit add or override lane after session creation, not the automatic bootstrap path.
• Canonical direct-run release evidence policy lives in ../opendevbrowser-best-practices/SKILL.md.

Parallel Multitab Alignment

• Apply shared concurrency policy from ../opendevbrowser-best-practices/SKILL.md ("Parallel Operations").
• Validate login workflow browser-mode sweeps with auto, extension, and managed before parity sign-off.
• For lower-level session parity, separately validate direct connect or CDP attach sessions where login tests use browser action tools.
• Treat extension headless attempts as expected unsupported_mode; do not force unsupported auth runs.

Robustness Coverage (Known-Issue Matrix)

Matrix source: ../opendevbrowser-best-practices/artifacts/browser-agent-known-issues-matrix.md

• ISSUE-01: stale refs / DOM churn
• ISSUE-02: challenge or SSO iframe boundaries
• ISSUE-03: popup/new-tab SSO redirects
• ISSUE-04: MFA/session step-up branching
• ISSUE-05: anti-bot challenge loops
• ISSUE-06: 429/backoff discipline
• ISSUE-07: extension readiness on resume

Challenge-Aware Flow

1. Preflight: goto login page, wait, snapshot actionables.
2. Enter identifier and password.
3. Submit once.
4. Branch by observed state:
   • authenticated shell appears -> success validation
   • MFA prompt appears -> continue MFA branch
   • popup/new-tab SSO appears -> switch target and continue auth branch
   • deterministic slider or pointer gate appears -> complete pointer workflow, then re-snapshot
   • anti-bot challenge appears -> checkpoint branch
   • invalid credentials or lockout message -> failure branch

opendevbrowser_goto sessionId="<session-id>" url="https://example.com/login"
opendevbrowser_wait sessionId="<session-id>" until="networkidle"
opendevbrowser_snapshot sessionId="<session-id>" format="actionables"
opendevbrowser_type sessionId="<session-id>" ref="<identifier-ref>" text="<resolved-identifier>"
opendevbrowser_type sessionId="<session-id>" ref="<password-ref>" text="<resolved-password>"
opendevbrowser_click sessionId="<session-id>" ref="<submit-ref>"
opendevbrowser_wait sessionId="<session-id>" until="networkidle"
opendevbrowser_snapshot sessionId="<session-id>" format="outline"

Anti-Bot Checkpoint Pattern

Use this when CAPTCHA/turnstile/challenge pages appear.

1. Detect challenge UI from snapshot refs or page text.
2. Pause automation and mark checkpoint in run log.
3. If the environment exposes a deterministic test slider or pointer gate, use low-level pointer commands and re-snapshot before continuing.
4. Otherwise complete the challenge manually (or with provider-approved test key in non-production).
5. Resume from a fresh snapshot and continue auth validation.

Signals to monitor:

• challenge iframe/widget visible
• error copy like "verify you are human"
• repeated 403/429 responses on auth endpoints
• repeated challenge pages after resume (loop condition)

Challenge loop guardrail:

• After 2 challenge checkpoints without success, stop automation and escalate.
• If Retry-After is available, wait at least that duration before any retry.

MFA Pattern

1. Submit primary credentials.
2. Wait for OTP/passkey/TOTP ref visibility.
3. Enter second factor.
4. Submit and validate authenticated state.

opendevbrowser_wait sessionId="<session-id>" ref="<mfa-input-ref>" state="visible"
opendevbrowser_type sessionId="<session-id>" ref="<mfa-input-ref>" text="<resolved-otp>"
opendevbrowser_click sessionId="<session-id>" ref="<mfa-submit-ref>"
opendevbrowser_wait sessionId="<session-id>" until="networkidle"

Validation Signals

Validate at least two independent signals:

• URL/route transition to authenticated area.
• Auth-only element visible (opendevbrowser_is_visible).
• Auth request success from opendevbrowser_network_poll.
• Invalid-credential rejection from opendevbrowser_network_poll is acceptable failure proof when UI copy is suppressed or delayed.

opendevbrowser_network_poll sessionId="<session-id>" max=50

Session Persistence and Reauth

Use persistent profiles for remember-me checks:

opendevbrowser_launch profile="auth-test" persistProfile=true noExtension=true

Close and relaunch, then confirm one of:

• still authenticated without credential prompt
• intentionally forced reauth policy was applied

Failure Modes

• Invalid credentials: prefer explicit field/banner errors, but accept network rejection evidence when UI copy is absent.
• Rate limit/lockout: stop retries, apply cooldown, rotate test account.
• Challenge loop: escalate as anti-bot pressure issue.
• MFA unavailable for test account: mark incomplete test prerequisite.

References

Use these sources when tuning login automation behavior:

• Playwright auth guide: https://playwright.dev/docs/auth
• OWASP Authentication Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
• NIST SP 800-63B (Digital Identity): https://pages.nist.gov/800-63-4/sp800-63b.html
• Cloudflare Turnstile testing keys: https://developers.cloudflare.com/turnstile/tutorials/testing/
• reCAPTCHA v2 testing keys: https://developers.google.com/recaptcha/docs/faq
• hCaptcha test keys: https://docs.hcaptcha.com/