[danielehrhardt]

What

Logins and 2FA codes now find each other by themselves.

• Try, then link. When an agent calls vault_fill_totp for a login that has no 2FA linked, Godmode picks the free 2FA entry that most likely belongs to it, types its code on the login's own site and watches the page. Once the site takes the code (the code field is gone on two looks in a row, no error text, still on the login's site), the pair is linked for good. If the site rejects it, the next call tries the next likely entry. Nothing is linked on a guess alone.
• Fuzzy matching (vault/totpGuess.ts): issuer vs. login name, URL and domains (exact, prefix/contains, Levenshtein, aliases such as X/Twitter, AWS/Amazon Web Services, Google/Gmail), account name vs. username (full, local part). The site has to match; a shared email alone never counts. A short brand inside a much longer one (Meta vs. Metabase) is only a weak guess.
• One-click linking in the app. The 2FA page shows a panel with the logins and codes that clearly belong together (pre-checked) and likely ones (unchecked). GET/POST /api/totp/autolink.
• Missing-2FA inbox suggestions use the same matcher.

Safety

• A guessed code is only typed on the login's own site (same fill binding as before), only for entries the agent may use and that are link-compatible (global or same workspace).
• linkCredentialTotpIfFree never replaces an existing link on either side.
• Every auto-link is audited (totp.autolink).

Screenshots

2FA page with suggestions, and after linking (cards show their logins live):

See 2fa-autolink-panel.png and 2fa-after-link.png (attached in the conversation).

Tests

• test/totp-guess.test.ts: scoring, ranking, one-to-one suggestions, page watcher (accepted / rejected / off-site / superseded / timeout).
• test/mcp.test.ts: end to end through vault_fill_totp — the right code gets linked after the site accepts it; rejected guesses move on and are never linked.