fix(rpa_helpers): require positive evidence in _is_already_logged_in to avoid false success

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_rpa_helpers_auth_flows.py

@@ -102,3 +102,56 @@ def test_device_bound_fingerprint_mismatch(monkeypatch):
         ensure_logged_in(page, account, credentials={"plaintext": "pw"})
     assert ei.value.code == "ERR_DEVICE_FINGERPRINT_MISMATCH"
 
+
+def test_is_already_logged_in_default_false():
+    from service.rpa_helpers.auth_flows import _is_already_logged_in
+
+    p = MagicMock()
+    p.url = "about:blank"
+    assert _is_already_logged_in(p, {}) is False
+
+    p.url = "https://www.douyin.com"
+    assert _is_already_logged_in(p, {}) is False
+
+    p.url = "https://www.douyin.com/user/abc"
+    assert _is_already_logged_in(
+        p,
+        {"extra_json": {"logged_in_url_pattern": r"/user/"}},
+    ) is True
+
+    loc_first = MagicMock()
+    loc_first.is_visible.return_value = True
+    loc = MagicMock()
+    loc.first = loc_first
+    p2 = MagicMock()
+    p2.url = "https://example.com/home"
+    p2.locator.return_value = loc
+    assert _is_already_logged_in(
+        p2,
+        {"extra_json": {"logged_in_selector": "#avatar"}},
+    ) is True
+    p2.locator.assert_called_with("#avatar")
+
+
+def test_qr_code_manual_default_no_hooks():
+    from service.rpa_helpers.auth_flows import ensure_logged_in
+
+    qr_first = MagicMock()
+    qr_first.wait_for.side_effect = TimeoutError("mock qr timeout")
+    qr_loc = MagicMock()
+    qr_loc.first = qr_first
+    page = MagicMock()
+    page.url = "about:blank"
+    page.locator.return_value = qr_loc
+
+    account = {"auth_strategy": "qr_code_manual", "url": "http://login.example"}
+    r = ensure_logged_in(page, account)
+    page.goto.assert_called_once_with(
+        "http://login.example",
+        wait_until="domcontentloaded",
+        timeout=60000,
+    )
+    qr_first.wait_for.assert_called_once()
+    assert r.ok is False
+    assert r.message == "qr code not found"
+