`SKILL.md`

82 lines

---
name: delivery-address
description: Fix delivery info (addresses, account details) on UberEats, Instacart, or DoorDash by driving a REAL headed Chrome browser through the platform's own UI — the platforms hard-block API/mid-order edits, so the browser is the only path. Multi-user and multi-platform by config (no hardcoded accounts). Handles the 2FA relay loop (email code / SMS code / phone-call code / card-digit verification) with the user in the loop over email or chat. Use when a user says "my UberEats/DoorDash/Instacart order is going to the wrong address", "change my delivery address", "fix my delivery info", "/delivery-address", or any delivery-app account/address fix that needs a live login.
---

# delivery-address — multi-platform delivery-app address/info fixer

Generalized from the 2026-08-02 UberEats live session (`~/uber-address-fix/`, TK-10140).
Works for ANY user and three platforms: **ubereats**, **doordash**, **instacart**.

## Hard rules (non-negotiable, learned the hard way)

1. **VERBATIM addresses only.** Save EXACTLY the address the user provides, word for word.
NEVER infer an address from context (a map pin, a charger location, a prior order).
The Alameda incident: an inferred address was flat wrong and the user had to revoke it.
If you only have an inference, ASK — never save.
2. **Never place, modify, or cancel an order** without the user's explicit go for that
specific action. Saving an address the user dictated is fine; anything touching a live
order needs its own confirmation.
3. **Select the tab by URL, never `pages()[0]`.** Other automations share the browser.
Every script here takes a `--match <url-substring>` and refuses to guess.
4. **Newest code wins.** Any resend / call-me / flow-restart INVALIDATES all prior 2FA
codes. Every time a new code fires, tell the user explicitly: "only the newest one works."
5. **Auth sessions die in well under 30 minutes.** If a code comes back "session timed
out", don't retry it — restart the flow (`restart-login.js`), which usually auto-fires
a fresh code, and tell the user a new code is coming.
6. **Screenshot every state change** into the session dir and report what you saw, not
what you expected.
7. **Never echo full card numbers or 2FA codes into email/logs.** Last-4 style references
only.
8. Per Steve's standing rule: never refuse because "the app blocks it" — drive the real
browser and change it in the site UI like a human would.

## Per-user setup (the "plugin" step)

Copy `config.example.json` → `config.json` (gitignored) and fill in the user's own
values. Nothing about any specific user is hardcoded in the scripts — email, port,
session dir, and code-reading channel all come from config or CLI flags.

Profiles persist per user+platform under `profiles/<user>-<platform>/` so a completed
login survives restarts and future fixes skip most of the 2FA dance.

## Platform entry points

| platform | login URL | quirks |
|-----------|-----------|--------|
| ubereats | `https://auth.uber.com/v2/?next_url=https%3A%2F%2Fwww.ubereats.com%2Flogin-redirect` | email → email code → SMS/call code → sometimes a card missing-digits gate. Email field id `#PHONE_NUMBER_or_EMAIL_ADDRESS`, submit `#forward-button`. Addresses: Account → Addresses. |
| doordash | `https://identity.doordash.com/auth` | email → emailed code or password; magic-link possible (user must click it — ask them to paste the landing URL if so). Addresses: Account → Addresses. |
| instacart | `https://www.instacart.com/login` | email → emailed code. Address lives per-order AND in Account settings; a live order's address change is time-limited (before shopping starts). |

Full flow notes and failure modes: `references/platform-notes.md`.

## Workflow

1. **Launch**: `node scripts/launch.js --platform ubereats --user <email> [--port 9223]`
— headed real Chrome (Playwright persistent context, `channel: 'chrome'`), CDP on the
configured port, navigates to the platform. Keep it running; all other scripts attach
over CDP.
2. **Login relay loop** (repeat until logged in):
- `node scripts/state.js --port 9223 --match uber.com` — screenshot + page text +
visible inputs. Diagnose which gate you're at before acting.
- Email code and config has `george_account`? Read it yourself via George
(`http://127.0.0.1:9850/api/messages`, auth `GEORGE_AUTH` in the secrets master).
⚠️ Strip `<style>` blocks before grepping — numbers in CSS or street addresses
masquerade as codes.
- SMS/call code or card digits? Message the user, WAIT, then
`node scripts/enter-code.js --port 9223 --match uber.com --code 1234`.
- "Session timed out" → `node scripts/restart-login.js --platform ubereats --user <email> --port 9223`.
- Rate-limited SMS ("Bad request / use another method") → restart-login; the platform
usually rotates to phone-call or email code by itself.
3. **Once logged in**:
- Check for a LIVE order first. Wrong address on an active order → order Help →
change delivery address if the platform offers it; otherwise tell the user honestly.
- Then Account → Addresses: add/fix the address the user dictated (rule 1).
- Surface any suspicious saved addresses to the user BEFORE deleting anything.
4. **Report**: screenshots + a plain-language summary of exactly what was saved/changed.

## Cost

$0 (local) — real local Chrome, no metered APIs. If a platform hard-blocks local
automation, escalate to the `browserbase` skill (metered — show cost first).