CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

console fill: sign-in only by the top-level URL, the main frame's form or an Apple sign-in frame

Browse source 
Google's account widget and cookie rotation frames (accounts.google.com /
ogs.google.com) on a signed-in Play Console no longer count as a sign-in
page. Each detection logs its rule and URL; heartbeats name the page; a
copied Chrome session that lands on a sign-in URL is said plainly; the
sign-in wait gets a watchdog dump, and --debug-dump up to 3 dumps.
Fixtures and tests for the chooser and home with the widget frames and a
top-level accounts.google.com page; pitfall 16.
This commit is contained in:
CRTkafa 2026-10-12 07:28:42 +08:00
parent b48407115e
commit 3aedf9e137
10 changed files with 294 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

5
cli/lib/console-forms.ts
View file

@ -167,6 +167,11 @@ export function isSignInUrl(url: string): boolean {
} catch { return false; }
}
/** An Apple sign-in frame (idmsa.apple.com / appleid.apple.com): the only child frame whose form counts as a sign-in. */
export function isAppleSignInFrame(url: string): boolean {
try { const h = new URL(url).hostname; return h === 'idmsa.apple.com' || h === 'appleid.apple.com'; } catch { return false; }
}
/**
* Whole visible texts (or labels / placeholders) that only a sign-in form shows, English and Turkish. Apple's form
* lives in an idmsa.apple.com frame and starts with no password field (Email or Phone Number > Continue > passkey or