Dbochman/grocery-reorder

Star Market Grocery Reorder

Automates grocery reordering from Star Market (Albertsons family) using a managed headless Pinchtab instance plus the CSMS API. Logs in as Julia, finds the most recent order, clicks Reorder to add all items to the cart, then verifies. Does NOT checkout.

Usage

# Reorder most recent order (default)
python3 ~/.openclaw/workspace/scripts/grocery-reorder.py

# Reorder a specific order
python3 ~/.openclaw/workspace/scripts/grocery-reorder.py --order-id 160816581

# Dry run (login + list orders, no reorder)
python3 ~/.openclaw/workspace/scripts/grocery-reorder.py --dry-run

Environment

Requires all Star Market env vars loaded from ~/.openclaw/.secrets-cache:

| Variable | Source | Description | |----------|--------|-------------| | STARMARKET_PASSWORD | 1Password | Account password | | STARMARKET_USERNAME | 1Password | Login email | | STARMARKET_GMAIL | secrets-cache | Gmail for MFA code retrieval | | STARMARKET_USER_HASH | secrets-cache | Account-specific API hash | | STARMARKET_DEVICE_TOKEN | secrets-cache | Remembered device token (skips MFA) |

set -a && source ~/.openclaw/.secrets-cache && set +a
PATH=/opt/homebrew/bin:/opt/homebrew/opt/node@22/bin:/usr/bin:/bin:$PATH
python3 ~/.openclaw/workspace/scripts/grocery-reorder.py

Output

{"status": "success", "order_id": "160816581", "cart": {"items": 9, "total": "34.00"}}
{"status": "dry-run", "order_id": "160816581", "orders": [...]}

How It Works

1. Browser: Acquires the persistent grocery profile as a managed headless Pinchtab instance, opens an isolated Star Market tab, and cleans up only its own resources.
2. Login: Navigates to Star Market sign-in page. If already logged in (Julia Joy visible), skips login. Otherwise:
   • CSMS API auth (/abs/pub/cnc/csmsservice/api/csms/authn) with device token
   • Password verify via API
   • MFA via email if needed: sends code via API, reads from Julia's Gmail via gws, verifies via API
   • Establishes browser session via SWY.OKTA.autoSignInWithSessionToken(sessionToken)
3. Get Orders: Navigates to /order-account/orders, extracts order IDs from a[href*="/order-account/orders/"] links
4. Reorder: Navigates to order detail page, clicks Reorder button via full Angular-compatible event dispatch (PointerEvent + MouseEvent sequence with real coordinates)
5. Verify: Navigates to /erums/cart, confirms items were added and reads cart total

Key Technical Details

• Angular event dispatch: Standard .click() doesn't work on Angular buttons. Must dispatch full event sequence: pointerdown, mousedown, pointerup, mouseup, click (both Pointer and Mouse) with real clientX/clientY from getBoundingClientRect()
• CSMS API headers: Requires Content-Type: application/vnd.safeway.v2+json, ocp-apim-subscription-key, x-swy-banner: starmarket, x-aci-user-hash
• XHR from browser: API calls are made via XMLHttpRequest from within the browser (same-origin, inherits cookies)
• Device remembered: After first MFA, the device token is remembered and subsequent logins skip MFA
• Cart URL: /erums/cart (not /shop/cart)

Scheduling

No recurring grocery reorder job is currently installed. Run it on demand; any future scheduled job must retain the no-checkout rule and report results so Julia can review the cart and complete pickup scheduling.

Safety

• NEVER checks out — only adds items to cart
• Requires all STARMARKET_* env vars (see Environment section above)
• MFA codes read from Julia's Gmail via gws (requires auth for the account in STARMARKET_GMAIL)
• Requires ~/.openclaw/bin/pinchtab-headless-instance; the script starts and scopes the browser instance itself

Troubleshooting

• "No orders found": The Angular SPA may need more time to load. The script retries 6 times with 5-second intervals.
• "SWY.OKTA not available": Pinchtab isn't on a Star Market page. Navigate to starmarket.com first.
• MFA keeps being required: The device token may have been invalidated. After one successful MFA, it should be remembered.
• Reorder button "not found": The order detail page may have a different button label. Check the page text for the exact wording.