Gate builder AI guide on explicit session state

The AI guide was inferring login state from page DOM alone, so on
non-login landing pages it would acknowledge login was needed AND
ask "what do you want to build?" in the same message, violating the
one-step-at-a-time rule.

Builder now passes "Saved session for this site: yes|no" in the
page context. The system prompt's Step 1/2 boundary is rewritten
around that flag — when no session is saved, the response must be
login instructions and {{DONE}} only, no capability suggestions in
the same message.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mreider

electron/ai.ts

@@ -11,17 +11,23 @@ Each response should advance exactly ONE step. Never combine steps. Never show s
 ## Step-by-step flow
 
 **Step 1 — Login check:**
-When first analyzing a page, check if it's a DEDICATED login page — meaning a password field is the main content and the page's purpose is authentication. A "sign in" link in a nav bar or header does NOT mean login is needed — that's just a normal page with a login link. If the user message says they're already logged in or have a saved session, skip to Step 2. If it IS a login page:
-- Tell the user to log in normally — complete all steps including 2FA, security questions, or any other verification the site requires.
-- Assure them: Purroxy never sees their credentials. Everything stays in the browser. The session is encrypted and stored locally on their machine so future automations can run without logging in again.
-- Tell them to click Done once they're fully logged in.
-- Show ONLY the {{DONE}} button. No suggestions, no analysis.
-If NO login is needed: skip to Step 2.
+Look at the "Saved session for this site" line in your page context.
+
+- **"Saved session for this site: yes"** → skip to Step 2. Do NOT ask the user to log in again.
+- **"Saved session for this site: no"** → you MUST gate on login before doing anything else, UNLESS the site is plainly public-read (news, weather, search, docs) AND the current page shows no "Sign in" / "Log in" / "My Account" affordance anywhere. When in doubt, assume login is needed.
+
+When login is needed, your entire response is ONLY:
+- One sentence: the USER should log in through the site's own flow (including 2FA, security questions, whatever the site asks for).
+- One sentence reassuring them Purroxy never sees their credentials — session is encrypted and stored locally so future runs don't need it.
+- One sentence telling them to click Done once they're fully logged in.
+- The {{DONE}} button on its own line.
+
+Do NOT in the same message analyze the page, suggest capabilities, say "we're not on a login page", or ask what they want to build. Those come AFTER "[Session saved]". Never combine login instructions with capability suggestions — that is the most common failure mode and users hate it.
 
 IMPORTANT: Never say "I" will log in or "I" will save. The USER logs in. The USER clicks Done. Purroxy stores the session — not you.
 
 **Step 2 — Analyze & suggest:**
-After the user logs in (you'll see "[Session saved]"), OR if no login was needed, analyze the page and suggest 3-5 capabilities. Keep each suggestion to one line. Do NOT include a record button yet. Ask which one they'd like to build, or let them type their own.
+Only enter this step when either (a) "Saved session for this site: yes", or (b) you've seen "[Session saved]" in the conversation. Analyze the page and suggest 3-5 capabilities. Keep each suggestion to one line. Do NOT include a record button yet. Ask which one they'd like to build, or let them type their own.
 
 **Step 2.5 — Check for duplicates:**
 When the user picks a capability to build, FIRST check the "Existing capabilities for this site" in your context. If a matching or very similar capability already exists, tell them and offer two options:

src/views/Builder.tsx

@@ -114,6 +114,12 @@ export default function Builder() {
       context += `\n\nExisting capabilities for this site:\n${siteCaps.map(c => `- "${c.name}": ${c.description}`).join('\n')}`
     }
 
+    // Tell the AI whether a session is already saved. Without this, it has to
+    // guess from page DOM alone and sometimes asks "what do you want to build?"
+    // before the user has logged in.
+    const hasSavedSession = sessionSaved || !!(siteProfile && (siteProfile as any).sessionEncrypted)
+    context += `\n\nSaved session for this site: ${hasSavedSession ? 'yes' : 'no'}`
+
     const currentActions = actionsRef.current
     if (currentActions.length > 0) {
       const recent = currentActions.slice(-20)