fix(api): classify the take-over method on an unclear outcome too

A passkey prompt (e.g. GitHub's webauthn step) asks for a security key rather
than a code, so the outcome classifier can land on 'unknown' instead of
'needs_2fa'. Classify the verification method on 'unknown' as well so the
take-over panel still recognizes the passkey and guides the user to a code
method. The classifier degrades to 'other' for a genuinely non-verification
page, so the panel stays generic there.

Author: tofikwest

apps/api/src/browserbase/browser-credential-signin.service.spec.ts

@@ -193,6 +193,24 @@ describe('BrowserCredentialSigninService', () => {
     expect(result.twoFactorMethod).toBe('passkey');
   });
 
+  it('classifies a passkey prompt that lands as an unclear outcome (GitHub webauthn)', async () => {
+    // GitHub's passkey step asks for a key, not a code, so the outcome classifier
+    // can return 'unknown' — we still read the method so the panel guides the user.
+    const extract = jest
+      .fn()
+      .mockResolvedValueOnce({ state: 'unknown' })
+      .mockResolvedValueOnce({ state: 'unknown' })
+      .mockResolvedValueOnce({ method: 'passkey' });
+    const sessions = makeSessions(extract, jest.fn().mockResolvedValue(undefined));
+    const profiles = makeProfiles(profile);
+    withCredentials({ username: 'user@x.com', password: 'secret' });
+
+    const result = await run(sessions, profiles);
+
+    expect(result.failure).toBe('unknown');
+    expect(result.twoFactorMethod).toBe('passkey');
+  });
+
   it('re-points the live view after the sign-in attempt so a 2FA take-over sees the right tab', async () => {
     const extract = jest
       .fn()

apps/api/src/browserbase/browser-credential-signin.service.ts

@@ -259,12 +259,19 @@ export class BrowserCredentialSigninService {
       await record(outcome, FAILURE_REASON[outcome]);
       finish('warn');
 
-      // A human is about to take over a verification step — read HOW the page
-      // wants them to verify (enter a code, switch off a passkey, or a
-      // passkey-only login we can't automate) so the UI gives exact guidance.
+      // A human is about to take over — read HOW the page wants them to verify
+      // (enter a code, switch off a passkey, or a passkey-only login we can't
+      // automate) so the UI gives exact guidance. We also classify on 'unknown'
+      // because a passkey prompt (e.g. GitHub's webauthn step, which asks for a
+      // key rather than a code) can land there; the classifier degrades to
+      // 'other' for a genuinely non-verification page, so the panel stays generic.
       // Best-effort: undefined just falls back to the generic take-over copy.
       let twoFactorMethod: TwoFactorMethod | undefined;
-      if (outcome === 'needs_2fa' || outcome === 'challenge') {
+      if (
+        outcome === 'needs_2fa' ||
+        outcome === 'challenge' ||
+        outcome === 'unknown'
+      ) {
         twoFactorMethod = await classifyTwoFactorMethod(activeStagehand);
       }
       return { isLoggedIn: false, failure: outcome, twoFactorMethod };