Case-insensitive substrings identifying an identity-provider bounce, matched
against the full current URL (e.g. 'auth0.com',
'login.microsoftonline.com', '/u/consent'). Empty → watchdog disabled.
Terminate as Failed/AuthDetour once this many detours occur in one run
(default 2). Exceeding the cap means recovery isn't holding — an environment
fault, not an agent failure.
Auth-detour watchdog tuning. When a session is invalidated mid-flight the page bounces to an identity provider; the agent would otherwise burn ~10 steps re-consenting and the heuristics would mislabel it a navigation loop. The watchdog recovers generically (re-apply auth + re-navigate) without charging the agent a step, and after MaxDetours terminates as an infrastructure
AuthDetourrather than grading the agent on it.