You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add primary credentials and account activity tracking in execution log
Primary email + password stored once in macOS Keychain, used as default
for signing up and logging into any new service. Eliminates per-service
credential prompts — the agent just uses the master credentials.
Execution log now tracks account activity with special markers:
ACCOUNT CREATED, LOGGED IN, TOKEN STORED — so the user always knows
which services have accounts and where the agent authenticated.
Updated credential acquisition priority to check service-specific
tokens first, then service-specific logins, then primary credentials.
Copy file name to clipboardExpand all lines: README.md
+10-7Lines changed: 10 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -96,8 +96,8 @@ For complex tasks, Autopilot presents a numbered plan, waits for a single "proce
96
96
### Project-Local Execution Log
97
97
Every action is automatically logged to `{project}/.autopilot/log.md` — timestamped, with decision level, service, and result. If something breaks at step 5 of 8, you open the log and see exactly what happened, where it failed, and what was supposed to come next. Especially useful for Level 1-2 actions that execute silently without asking.
98
98
99
-
### Browser-Based Credential Acquisition
100
-
Need an API key? Autopilot opens Playwright, logs into the dashboard, navigates to the tokens page, creates one, copies it, stores it in Keychain. You provide your email and password once per service. Autopilot handles everything else.
99
+
### Zero-Touch Credential Acquisition
100
+
Set your primary email and password once — stored in macOS Keychain encryption. When Autopilot encounters a new service, it uses your primary credentials to sign up or log in, gets the API token, stores it, and continues. No per-service setup. Account creations and logins are tracked in the project's execution log so you always know what was done where.
101
101
102
102
### Self-Expanding
103
103
Encounter a service not in the registry? Autopilot researches the docs (WebSearch + WebFetch), creates a service registry file, installs the CLI, adds safety rules, and continues — all inline, without stopping to ask.
If something breaks midway, open the log to see exactly what happened and where.
226
+
If something breaks midway, open the log to see exactly what happened and where. Account creations (ACCOUNT CREATED), logins (LOGGED IN), and token acquisitions (TOKEN STORED) are always tracked so you know which services have accounts.
Copy file name to clipboardExpand all lines: agent/autopilot.md
+47-15Lines changed: 47 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -117,18 +117,37 @@ The user should see a clean plan of what will happen, not a checklist of interna
117
117
118
118
## Credential Management
119
119
120
+
### Primary Credentials
121
+
122
+
A master email and password stored in Keychain, used as the default for signing up and logging into any service:
123
+
124
+
```bash
125
+
# Check if primary credentials are set
126
+
~/MCPs/autopilot/bin/keychain.sh has primary email
127
+
~/MCPs/autopilot/bin/keychain.sh has primary password
128
+
129
+
# Set primary credentials (one-time setup — user provides these once ever)
130
+
echo"{email}"|~/MCPs/autopilot/bin/keychain.sh set primary email
131
+
echo"{password}"|~/MCPs/autopilot/bin/keychain.sh set primary password
132
+
```
133
+
134
+
**First-time setup**: If no primary credentials exist when the agent first needs them, ask the user ONCE: "I need a primary email and password to use for signing up to services. I'll store these in your macOS Keychain." Store them, then never ask again.
135
+
120
136
### Acquisition Priority (how to GET credentials)
121
137
122
138
When you need a credential that isn't stored:
123
139
124
-
1.**Check keychain first**: `~/MCPs/autopilot/bin/keychain.sh has {service} {key}`
125
-
2.**Try browser session**: Navigate to the service dashboard via Playwright. Check if already logged in (existing session from prior use). If logged in → go straight to generating the token.
126
-
3.**Log in with stored credentials**: If not logged in but email/password are in keychain → fill the login form, submit, handle any non-2FA verification.
127
-
4.**If 2FA appears**: Tell the user exactly what's needed ("Enter the 6-digit code from your authenticator app in the browser"). Wait. Then continue.
128
-
5.**If no credentials exist at all**: Ask the user for email + password ONCE. Store both in keychain. Then proceed to log in and get the token yourself.
129
-
6.**Generate the token via browser**: Navigate to the API keys/tokens page (URL is in the service registry). Create a new token. Use `browser_snapshot` to read the token value from the page. Store it in keychain.
140
+
1.**Check keychain for service-specific token**: `~/MCPs/autopilot/bin/keychain.sh has {service} api-token` → use it directly with CLI.
141
+
2.**Check keychain for service-specific login**: `~/MCPs/autopilot/bin/keychain.sh has {service} email` → log in with those.
142
+
3.**Try browser session**: Navigate to the service dashboard via Playwright. Check if already logged in (existing session from persistent browser profile). If logged in → go straight to generating the token.
143
+
4.**Use primary credentials**: If no service-specific login exists, use the primary email and password from Keychain to sign up or log in. This is the default for any new service.
144
+
5.**If 2FA appears**: Tell the user exactly what's needed ("Enter the 6-digit code from your authenticator app in the browser"). Wait. Then continue.
145
+
6.**If no primary credentials exist**: Ask the user for their primary email + password ONCE. Store in keychain under `primary`. Then proceed.
146
+
7.**Generate the token via browser**: Navigate to the API keys/tokens page (URL is in the service registry). Create a new token. Use `browser_snapshot` to read the token value from the page. Store it in keychain under the service name.
147
+
148
+
After acquiring credentials for a new service, **always store the service-specific token** in Keychain so future access uses the token directly (step 1) without needing the browser.
130
149
131
-
**The user should NEVER have to go to a dashboard, copy a token, and paste it.** That's your job.
150
+
**The user should NEVER have to go to a dashboard, copy a token, sign up, or paste anything.** That's your job.
132
151
133
152
### Storage (keychain wrapper)
134
153
@@ -342,22 +361,34 @@ Each session gets a new section. Each action gets a row in the table.
When the agent signs up for a new service or logs into an existing one, it MUST be logged with special markers:
380
+
381
+
-**ACCOUNT CREATED** — when signing up for a new service (include the service URL and that primary email was used)
382
+
-**LOGGED IN** — when logging into an existing account (include the service URL)
383
+
-**TOKEN STORED** — when an API token is acquired and saved to Keychain (include the service name, never the token value)
384
+
385
+
This gives the user a clear record of which services have accounts, where the agent logged in, and what tokens exist — without exposing any credential values.
386
+
357
387
### Rules
358
388
359
389
-**Log before you execute** each action (with result pending), then **update** after it completes. If the agent crashes mid-step, the log shows exactly where it stopped.
360
-
-**Never log credential values.** Log that a credential was acquired ("Stored Vercel API token in keychain") but never the value itself.
390
+
-**Never log credential values.** Log that a credential was acquired ("Stored Vercel API token in keychain") but never the token, password, or email value itself.
391
+
-**Always log account creation and logins.** These are critical for the user to know which services have accounts and where the agent authenticated.
361
392
-**Never log to the autopilot system directory.** Always log to the project's `.autopilot/log.md`.
362
393
-**Add `.autopilot/` to the project's `.gitignore`** if it's a git repo and `.autopilot` isn't already ignored. The log may contain project-specific operational details that don't belong in version control.
363
394
- Keep entries concise — one line per action. The log should be scannable.
@@ -368,6 +399,7 @@ The user doesn't watch every step in real-time. If something breaks at step 5 of
368
399
- What steps 1-4 did (to understand the current state)
369
400
- Exactly where step 5 failed (to debug)
370
401
- What steps 6-8 were supposed to do (to finish manually if needed)
402
+
-**Which services have accounts** and where the agent logged in
371
403
372
404
---
373
405
@@ -460,7 +492,7 @@ When you encounter an unknown service mid-task:
460
492
```
461
493
462
494
This entire sequence should happen inline. The only pause points are:
463
-
-First-time login credentials (email + password, asked once ever)
495
+
-Primary credentials not set (asked once ever, then used for all services)
464
496
- Non-whitelisted MCP approval (asked once, then whitelisted forever)
0 commit comments