Add authenticated designlang extract path for coulomb.social

Interactive Playwright session capture (XDG storageState, mode 0600)
plus a designlang pack wrapper that never prints secrets. Document the
intended OpenBao lane tenants/binky/coulomb-social/bubble-member for
later password custody; interactive capture is the default for Bubble.

scripts/capture-auth-state.mjs

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+/**
+ * Capture a Playwright storageState for https://coulomb.social after you log in.
+ *
+ * Default: headed browser — you complete login, then press Enter in this terminal.
+ * Optional: --from-password-files reads EMAIL/PASSWORD from XDG auth dir (OpenBao-exported).
+ *
+ * Never prints secret values. Writes mode-0600 storage-state.json only.
+ */
+import { chromium } from "playwright";
+import {
+  mkdirSync,
+  writeFileSync,
+  chmodSync,
+  existsSync,
+  readFileSync,
+  statSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+
+const BASE_URL = process.env.COULOMB_SOCIAL_URL || "https://coulomb.social";
+const AUTH_DIR =
+  process.env.COULOMB_SOCIAL_AUTH_DIR ||
+  join(homedir(), ".config", "coulomb-social", "auth");
+const STATE_PATH = join(AUTH_DIR, "storage-state.json");
+const EMAIL_PATH = join(AUTH_DIR, "email");
+const PASSWORD_PATH = join(AUTH_DIR, "password");
+
+const fromPasswordFiles = process.argv.includes("--from-password-files");
+const headless = process.argv.includes("--headless");
+
+function ensureAuthDir() {
+  mkdirSync(AUTH_DIR, { recursive: true, mode: 0o700 });
+  try {
+    chmodSync(AUTH_DIR, 0o700);
+  } catch {
+    /* best effort */
+  }
+}
+
+function readSecretFile(path) {
+  if (!existsSync(path)) {
+    throw new Error(`Missing secret file: ${path}`);
+  }
+  const mode = statSync(path).mode & 0o777;
+  if (mode & 0o077) {
+    console.warn(
+      `warning: ${path} is group/world-readable (mode ${mode.toString(8)}); chmod 600 recommended`,
+    );
+  }
+  return readFileSync(path, "utf8").trim();
+}
+
+async function waitForUserContinue() {
+  const rl = createInterface({ input, output });
+  console.log("");
+  console.log(">>> Log in as your coulomb.social user in the browser window.");
+  console.log(">>> Navigate to an authenticated page you want designlang to see.");
+  console.log(">>> Then return here and press Enter to save the session.");
+  console.log("");
+  await rl.question("Press Enter when logged in… ");
+  rl.close();
+}
+
+async function tryPasswordLogin(page, email, password) {
+  // Best-effort Bubble-style login. Interactive capture is preferred when MFA/CAPTCHA appears.
+  await page.goto(BASE_URL, { waitUntil: "domcontentloaded", timeout: 60_000 });
+  await page.waitForTimeout(1500);
+
+  const emailBox =
+    (await page.$('input[type="email"]')) ||
+    (await page.$('input[name*="email" i]')) ||
+    (await page.$('input[placeholder*="email" i]')) ||
+    (await page.$('input[placeholder*="Email" i]'));
+  const passBox =
+    (await page.$('input[type="password"]')) ||
+    (await page.$('input[name*="password" i]'));
+
+  if (!emailBox || !passBox) {
+    throw new Error(
+      "Could not find email/password fields automatically. Re-run without --from-password-files and log in interactively.",
+    );
+  }
+
+  await emailBox.fill(email);
+  await passBox.fill(password);
+
+  const submit =
+    (await page.$('button[type="submit"]')) ||
+    (await page.$('input[type="submit"]')) ||
+    (await page.$('button:has-text("Log in")')) ||
+    (await page.$('button:has-text("Login")')) ||
+    (await page.$('button:has-text("Sign in")'));
+
+  if (submit) {
+    await submit.click();
+  } else {
+    await passBox.press("Enter");
+  }
+
+  await page.waitForTimeout(4000);
+  console.log("Password login attempt finished (no secrets printed).");
+  console.log("If MFA/CAPTCHA is required, re-run in interactive mode.");
+}
+
+async function main() {
+  ensureAuthDir();
+
+  console.log(`Auth dir: ${AUTH_DIR}`);
+  console.log(`Target:   ${BASE_URL}`);
+  console.log(`State →   ${STATE_PATH}`);
+
+  const browser = await chromium.launch({
+    headless: Boolean(headless && fromPasswordFiles),
+    channel: process.env.COULOMB_SOCIAL_CHROME_CHANNEL || undefined,
+  });
+
+  const context = await browser.newContext({
+    viewport: { width: 1280, height: 900 },
+  });
+  const page = await context.newPage();
+
+  try {
+    if (fromPasswordFiles) {
+      const email = readSecretFile(EMAIL_PATH);
+      const password = readSecretFile(PASSWORD_PATH);
+      await tryPasswordLogin(page, email, password);
+    } else {
+      await page.goto(BASE_URL, {
+        waitUntil: "domcontentloaded",
+        timeout: 60_000,
+      });
+      await waitForUserContinue();
+    }
+
+    const state = await context.storageState();
+    writeFileSync(STATE_PATH, JSON.stringify(state, null, 2) + "\n", {
+      mode: 0o600,
+    });
+    chmodSync(STATE_PATH, 0o600);
+
+    const cookieCount = state.cookies?.length ?? 0;
+    const originCount = state.origins?.length ?? 0;
+    console.log("");
+    console.log(
+      `Saved storageState (${cookieCount} cookies, ${originCount} origins).`,
+    );
+    console.log(`File: ${STATE_PATH}`);
+    console.log("Next: ./scripts/run-design-extract.sh");
+  } finally {
+    await browser.close();
+  }
+}
+
+main().catch((err) => {
+  console.error(err.message || err);
+  process.exit(1);
+});

scripts/capture-auth-state.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Wrapper so Node resolves playwright from scripts/node_modules.
+set -euo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$DIR"
+if [[ ! -d node_modules/playwright ]]; then
+  echo "Installing playwright in scripts/ …"
+  npm install
+  npx playwright install chromium
+fi
+exec node ./capture-auth-state.mjs "$@"

scripts/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "coulomb-social-scripts",
+  "private": true,
+  "type": "module",
+  "description": "Local tooling for auth capture and design extract (no app runtime)",
+  "dependencies": {
+    "playwright": "^1.49.0"
+  }
+}

scripts/run-design-extract.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Run designlang against coulomb.social using a captured Playwright storageState.
+# Does not print secrets. Requires: ./scripts/capture-auth-state.mjs first.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+AUTH_DIR="${COULOMB_SOCIAL_AUTH_DIR:-$HOME/.config/coulomb-social/auth}"
+STATE_PATH="${COULOMB_SOCIAL_STORAGE_STATE:-$AUTH_DIR/storage-state.json}"
+OUT_DIR="${COULOMB_SOCIAL_EXTRACT_OUT:-$ROOT/docs/design-extract}"
+URL="${COULOMB_SOCIAL_URL:-https://coulomb.social}"
+
+if [[ ! -f "$STATE_PATH" ]]; then
+  echo "ERROR: No auth session at $STATE_PATH" >&2
+  echo "Capture one first (interactive login as your user):" >&2
+  echo "  $ROOT/scripts/capture-auth-state.sh" >&2
+  echo "Docs: $ROOT/docs/design-extract-auth.md" >&2
+  exit 1
+fi
+
+mode="$(stat -c '%a' "$STATE_PATH" 2>/dev/null || stat -f '%Lp' "$STATE_PATH" 2>/dev/null || echo '?')"
+if [[ "$mode" != "600" && "$mode" != "0600" ]]; then
+  echo "warning: $STATE_PATH mode is $mode (prefer 600)" >&2
+fi
+
+mkdir -p "$OUT_DIR"
+
+echo "==> designlang extract"
+echo "    url:   $URL"
+echo "    auth:  $STATE_PATH (session file present; not printed)"
+echo "    out:   $OUT_DIR"
+echo "    extra: $*"
+
+# Default pack is useful for agent rebuild; caller can pass more flags.
+# --cookie-file accepts Playwright storageState JSON.
+exec npx --yes designlang pack "$URL" \
+  --cookie-file "$STATE_PATH" \
+  -o "$OUT_DIR" \
+  --name coulomb-social \
+  "$@"