Security conscious domain. We do automations on behalf of our clients and they don't want credentials stored. "Handling" 2FA automatically is completely unacceptable, it breaks the entire point of the 2FA security model. Besides, login sometimes involves out-of-band 2FA methods including phone number.
Re: Puppeteer automation as part of the script -- we have a feature we wrote for one of our customers that we didn't promote to production where you can define a deterministic action in the dashboard that allows you to paste in JavaScript, but we're likely not to push that to prod anytime soon. Could you explain your reasoning for wanting to use Puppeteer still? We've generally seen customers fully switch over to Simplex instead of relying on their original Puppeteer/Playwright scripts -- since we have action caching, the underlying script (click on div locator with this div id, etc.) is pretty similar to what you'd get using Playwright.