From 42ade7b4e844e3b5ccb5f4f427fe1255189bce15 Mon Sep 17 00:00:00 2001 From: leeguooooo Date: Wed, 10 Jun 2026 09:58:33 +0900 Subject: [PATCH] docs(skill): headed-default/headless-forbidden + per-session tab groups + stealth ranking Update the served skill (skill-data/core, embedded into the binary) for tonight's changes: --headed is the default and headless is FORBIDDEN (was wrongly 'default is headless'); each --session on the extension-connect path gets its own colored tab group with no cross-talk; anti-detection ranking real-Chrome(extension) > headed-launch > headless(forbidden). Needs a rebuild so standalone installs' embedded skill reflects it. --- skill-data/core/SKILL.md | 13 ++++++++++++- skill-data/core/references/commands.md | 3 ++- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/skill-data/core/SKILL.md b/skill-data/core/SKILL.md index 9d5fb80..87db004 100644 --- a/skill-data/core/SKILL.md +++ b/skill-data/core/SKILL.md @@ -57,6 +57,15 @@ GUI-automation tool** like the `cua-driver` skill — see `agent-browser extension connect`. After that it's zero-confirmation, zero-token CLI. Use `--launch` instead when a fresh, isolated browser is fine. +Each `--session` that connects gets its **own colored Chrome tab group** (named +after the session) and drives only its own tabs — multiple agents share the one +real browser without cross-talk, and the user's own tabs are never grouped. CDP +drives the page without moving the user's mouse/keyboard, so it doesn't fight +them for control. **Anti-detection ranking: this real logged-in Chrome (extension +connect) > a headed launched browser > headless (forbidden).** A genuine human +browser has no headless/automation tells at all, so prefer it for anything +anti-bot-sensitive. + ## Two ways to drive a page — and when to drop to `eval` You have a **real Chrome with the user's DOM**. Two layers, mix them freely: @@ -506,7 +515,9 @@ and [references/authentication.md](references/authentication.md). ```bash --session # isolated browser session --json # JSON output (for machine parsing) ---headed # show the window (default is headless) +--headed # default & always-on for stealth — headless is FORBIDDEN + # (a bot tell: creepjs flags ~33% headless vs 0% headed). + # Display-less servers only: AGENT_BROWSER_ALLOW_HEADLESS=1 --auto-connect # connect to an already-running Chrome --cdp # connect to a specific CDP port --profile # use a Chrome profile (login state survives) diff --git a/skill-data/core/references/commands.md b/skill-data/core/references/commands.md index e9da008..20a228e 100644 --- a/skill-data/core/references/commands.md +++ b/skill-data/core/references/commands.md @@ -302,7 +302,8 @@ agent-browser state load auth.json # Restore saved state ```bash agent-browser --session ... # Isolated browser session agent-browser --json ... # JSON output for parsing -agent-browser --headed ... # Show browser window (not headless) +agent-browser --headed ... # Default & always-on (stealth). Headless is FORBIDDEN + # (bot tell); display-less servers: AGENT_BROWSER_ALLOW_HEADLESS=1 agent-browser --full ... # Full page screenshot (-f) agent-browser --cdp ... # Connect via Chrome DevTools Protocol agent-browser -p ... # Cloud browser provider (--provider)