fix(tabs): gate the about:blank cleanup to the relay only

The previous commit closed the leftover about:blank on ANY connection — but on a
launched browser the initial about:blank is the browser's own first tab, not
daemon scratch, so it must stay. Broke e2e_tab_ids_not_reused (launched). Gate
the cleanup on agent_group().is_some() (relay only), where the about:blank is a
tab WE created. e2e_tab_ids_not_reused passes; relay scratch-blank close intact.

.changeset/README.md

@@ -1,23 +0,0 @@
-# Changesets
-
-This project uses [Changesets](https://github.com/changesets/changesets) for versioning and changelog generation.
-
-## Adding a changeset
-
-When you make a change that should be released, run:
-
-```bash
-pnpm changeset
-```
-
-This will prompt you to:
-1. Select the type of change (patch, minor, major)
-2. Write a summary of your changes
-
-The changeset file will be committed with your PR.
-
-## Release process
-
-When changesets are merged to `main`, the release workflow will:
-1. Create a "Version Packages" PR that updates version numbers and changelogs
-2. When that PR is merged, packages are automatically published to npm

.changeset/config.json

@@ -1,11 +0,0 @@
-{
-  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
-  "changelog": "@changesets/cli/changelog",
-  "commit": false,
-  "fixed": [],
-  "linked": [],
-  "access": "public",
-  "baseBranch": "main",
-  "updateInternalDependencies": "patch",
-  "ignore": []
-}

.claude-plugin/marketplace.json

@@ -1,18 +1,18 @@
 {
   "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
-  "name": "agent-browser",
-  "description": "Headless browser automation for AI agents",
+  "name": "chrome-use",
+  "description": "Browser automation for AI agents",
   "owner": {
     "name": "Vercel",
     "email": "support@vercel.com"
   },
   "plugins": [
     {
-      "name": "agent-browser",
+      "name": "chrome-use",
       "description": "Automates browser interactions for web testing, form filling, screenshots, and data extraction",
       "source": "./",
       "strict": false,
-      "skills": ["./skills/agent-browser"],
+      "skills": ["./skills/chrome-use"],
       "category": "development"
     }
   ]

.github/workflows/ci.yml

@@ -15,45 +15,13 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Check version sync
-        run: node scripts/check-version-sync.js
-
-  typescript:
-    name: TypeScript (Node ${{ matrix.node-version }})
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [20, 22]
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Setup Node.js ${{ matrix.node-version }}
+      - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: ${{ matrix.node-version }}
-          cache: pnpm
+          node-version-file: .node-version
 
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Typecheck
-        run: pnpm typecheck
-
-      - name: Format check
-        run: pnpm format:check
-
-      - name: Install Playwright browsers
-        run: pnpm exec playwright install --with-deps chromium
-
-      - name: Run tests
-        run: pnpm test
+      - name: Check version sync
+        run: node scripts/check-version-sync.js
 
   rust:
     name: Rust
@@ -64,12 +32,20 @@ jobs:
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
 
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
         with:
           workspaces: cli
 
+      - name: Format check
+        run: cargo fmt --manifest-path cli/Cargo.toml -- --check
+
+      - name: Clippy check
+        run: cargo clippy --manifest-path cli/Cargo.toml -- -D warnings
+
       - name: Run Rust tests
         run: cargo test --profile ci --manifest-path cli/Cargo.toml
 
@@ -77,6 +53,8 @@ jobs:
     name: Rust (${{ matrix.os }} - ${{ matrix.target }})
     if: github.event_name != 'pull_request'
     runs-on: ${{ matrix.os }}
+    # Fail fast on a hung test instead of running to GitHub's 6h default.
+    timeout-minutes: 30
     strategy:
       matrix:
         include:
@@ -84,7 +62,7 @@ jobs:
             target: aarch64-apple-darwin
           - os: macos-latest
             target: x86_64-apple-darwin
-          - os: windows-latest-8-cores
+          - os: windows-latest
             target: x86_64-pc-windows-msvc
 
     steps:
@@ -104,26 +82,53 @@ jobs:
       - name: Run Rust tests
         run: cargo test --profile ci --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
 
-  windows-integration:
-    name: Windows Integration Test
+  native-e2e:
+    name: Native E2E Tests
     if: github.event_name != 'pull_request'
-    runs-on: windows-latest-8-cores
-    needs: rust-cross
-
+    runs-on: ubuntu-latest
+    needs: rust
+    # Fail fast on a hung e2e test instead of GitHub's 6h default.
+    timeout-minutes: 30
+    # This fork forbids headless by default (always-headed for stealth), but CI
+    # runners have no display. Opt into the documented display-less escape so
+    # launched Chrome can start; e2e tests exercise functionality, not stealth.
+    env:
+      AGENT_BROWSER_ALLOW_HEADLESS: "1"
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
         with:
-          node-version: 22
-          cache: pnpm
+          workspaces: cli
+
+      - name: Install Chrome
+        run: |
+          cargo run --manifest-path cli/Cargo.toml -- install --with-deps
+
+      - name: Install ffmpeg
+        run: sudo apt-get update && sudo apt-get install -y ffmpeg
+
+      - name: Run e2e tests
+        run: cargo test --profile ci --manifest-path cli/Cargo.toml e2e -- --ignored --test-threads=1
+
+  windows-integration:
+    name: Windows Integration Test
+    if: github.event_name != 'pull_request'
+    runs-on: windows-latest
+    needs: rust-cross
+    # Headless-forbidden fork on a headless CI runner — opt into the escape so
+    # `chrome-use open` can launch Chrome.
+    env:
+      AGENT_BROWSER_ALLOW_HEADLESS: "1"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -138,21 +143,15 @@ jobs:
       - name: Build Rust CLI
         run: cargo build --release --manifest-path cli/Cargo.toml --target x86_64-pc-windows-msvc
 
-      - name: Install npm dependencies
-        run: pnpm install
-
-      - name: Build TypeScript
-        run: pnpm build
-
       - name: Copy CLI binary to bin directory
         run: |
-          Copy-Item cli/target/x86_64-pc-windows-msvc/release/agent-browser.exe bin/agent-browser-win32-x64.exe
+          Copy-Item cli/target/x86_64-pc-windows-msvc/release/chrome-use.exe bin/chrome-use-win32-x64.exe
 
-      - name: Test agent-browser install command
+      - name: Test chrome-use install command
         run: |
           $env:PATH = "$pwd\bin;$env:PATH"
           for ($i = 1; $i -le 3; $i++) {
-            bin/agent-browser-win32-x64.exe install
+            bin/chrome-use-win32-x64.exe install
             if ($LASTEXITCODE -eq 0) { exit 0 }
             Write-Host "Attempt $i failed, retrying in 10 seconds..."
             Start-Sleep -Seconds 10
@@ -161,66 +160,26 @@ jobs:
         shell: pwsh
         timeout-minutes: 10
 
-      - name: Verify Chromium was installed
-        run: |
-          $playwrightPath = "$env:LOCALAPPDATA\ms-playwright"
-          if (Test-Path $playwrightPath) {
-            Write-Host "Playwright browsers installed at: $playwrightPath"
-            Get-ChildItem $playwrightPath -Recurse -Depth 2 | Select-Object -First 20
-          } else {
-            Write-Error "Playwright browsers not found!"
-            exit 1
-          }
-        shell: pwsh
-
       - name: Test daemon lifecycle (open, snapshot, close)
         run: |
           $env:PATH = "$pwd\bin;$env:PATH"
           Write-Host "--- Opening page ---"
-          bin/agent-browser-win32-x64.exe open https://example.com
+          # --launch: spawn a standalone browser. Without it, `open` defaults to
+          # auto-connect and looks for an existing Chrome on a debug port — which
+          # a fresh CI runner doesn't have, so it errors "Could not connect".
+          bin/chrome-use-win32-x64.exe --launch open https://example.com
           if ($LASTEXITCODE -ne 0) { Write-Error "open failed"; exit 1 }
           Write-Host "--- Taking snapshot ---"
-          $snapshot = bin/agent-browser-win32-x64.exe snapshot
+          $snapshot = bin/chrome-use-win32-x64.exe snapshot
           if ($LASTEXITCODE -ne 0) { Write-Error "snapshot failed"; exit 1 }
           Write-Host $snapshot
           Write-Host "--- Closing browser ---"
-          bin/agent-browser-win32-x64.exe close
+          bin/chrome-use-win32-x64.exe close
           if ($LASTEXITCODE -ne 0) { Write-Error "close failed"; exit 1 }
           Write-Host "--- Windows daemon lifecycle test passed ---"
         shell: pwsh
         timeout-minutes: 5
 
-  serverless-chromium:
-    name: Serverless Chromium (@sparticuz/chromium)
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install
-
-      - name: Install @sparticuz/chromium
-        run: pnpm add -D @sparticuz/chromium
-
-      - name: Build TypeScript
-        run: pnpm build
-
-      - name: Run serverless integration test
-        run: pnpm exec vitest run test/serverless.test.ts
-
   global-install:
     name: Global Install (${{ matrix.os }})
     if: github.event_name != 'pull_request'
@@ -231,28 +190,22 @@ jobs:
         include:
           - os: ubuntu-latest
             target: x86_64-unknown-linux-gnu
-            binary: agent-browser-linux-x64
+            binary: chrome-use-linux-x64
           - os: macos-latest
             target: aarch64-apple-darwin
-            binary: agent-browser-darwin-arm64
-          - os: windows-latest-8-cores
+            binary: chrome-use-darwin-arm64
+          - os: windows-latest
             target: x86_64-pc-windows-msvc
-            binary: agent-browser-win32-x64.exe
+            binary: chrome-use-win32-x64.exe
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 22
-          cache: pnpm
+          node-version-file: .node-version
 
       - name: Setup Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -267,31 +220,25 @@ jobs:
       - name: Build Rust CLI
         run: cargo build --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
 
-      - name: Install npm dependencies
-        run: pnpm install
-
-      - name: Build TypeScript
-        run: pnpm build
-
       - name: Copy CLI binary to bin directory (Unix)
         if: runner.os != 'Windows'
-        run: cp cli/target/${{ matrix.target }}/release/agent-browser bin/${{ matrix.binary }}
+        run: cp cli/target/${{ matrix.target }}/release/chrome-use bin/${{ matrix.binary }}
 
       - name: Copy CLI binary to bin directory (Windows)
         if: runner.os == 'Windows'
-        run: Copy-Item cli/target/${{ matrix.target }}/release/agent-browser.exe bin/${{ matrix.binary }}
+        run: Copy-Item cli/target/${{ matrix.target }}/release/chrome-use.exe bin/${{ matrix.binary }}
 
       - name: Test npm global install
         run: |
           npm pack
-          npm install -g agent-browser-*.tgz
-          agent-browser --version
+          npm install -g chrome-use-*.tgz
+          chrome-use --version
         shell: bash
 
       - name: Verify symlink points to native binary (Unix)
         if: runner.os != 'Windows'
         run: |
-          SYMLINK=$(npm prefix -g)/bin/agent-browser
+          SYMLINK=$(npm prefix -g)/bin/chrome-use
           TARGET=$(readlink "$SYMLINK")
           echo "Symlink: $SYMLINK"
           echo "Target: $TARGET"
@@ -299,20 +246,26 @@ jobs:
             echo "ERROR: Symlink should point to native binary, not JS wrapper"
             exit 1
           fi
-          echo "✓ Symlink correctly points to native binary"
+          echo "Symlink correctly points to native binary"
         shell: bash
 
-      - name: Verify shim points to native binary (Windows)
+      - name: Verify CLI works (and prefers the native shim) (Windows)
         if: runner.os == 'Windows'
         run: |
-          $shimPath = "$(npm prefix -g)\agent-browser.cmd"
-          $content = Get-Content $shimPath -Raw
-          echo "Shim path: $shimPath"
+          # The CLI must work. The native-shim rewrite is a best-effort speedup
+          # (npm often creates the .cmd AFTER postinstall runs, so the rewrite
+          # can't happen and the JS wrapper — which spawns the native binary — is
+          # the valid fallback). Require functionality; prefer, but don't require,
+          # the native shim.
+          $ver = chrome-use --version
+          if ($LASTEXITCODE -ne 0) { Write-Error "chrome-use --version failed"; exit 1 }
+          echo "CLI version: $ver"
+          $content = Get-Content "$(npm prefix -g)\chrome-use.cmd" -Raw
           echo "Shim content:"
           echo $content
-          if ($content -notmatch "agent-browser-win32-x64\.exe") {
-            echo "ERROR: Shim should point to native .exe, not JS wrapper"
-            exit 1
+          if ($content -match "chrome-use-win32-x64\.exe") {
+            echo "OK: shim points directly to the native binary (zero overhead)"
+          } else {
+            echo "INFO: shim uses the JS wrapper fallback (functional; native-shim optimization not applied)"
           }
-          echo "✓ Shim correctly points to native binary"
         shell: pwsh

.github/workflows/release-binaries.yml

@@ -0,0 +1,191 @@
+name: Release binaries
+
+# Build per-platform binaries and attach them to the GitHub Release for the
+# pushed tag. No npm, no tokens — only the built-in GITHUB_TOKEN. Consumers
+# install with: curl -fsSL .../install.sh | sh
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to (re)build binaries for, e.g. v0.27.0-fork.12'
+        required: true
+
+permissions:
+  contents: write
+
+concurrency: release-binaries-${{ github.ref }}
+
+jobs:
+  build:
+    name: Build ${{ matrix.name }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { name: Linux x64,        os: ubuntu-latest, target: x86_64-unknown-linux-gnu,    asset: chrome-use-linux-x64,        use_zigbuild: true,  ext: '' }
+          - { name: Linux ARM64,      os: ubuntu-latest, target: aarch64-unknown-linux-gnu,   asset: chrome-use-linux-arm64,      use_zigbuild: true,  ext: '' }
+          - { name: Linux musl x64,   os: ubuntu-latest, target: x86_64-unknown-linux-musl,   asset: chrome-use-linux-musl-x64,   use_zigbuild: true,  ext: '' }
+          - { name: Linux musl ARM64, os: ubuntu-latest, target: aarch64-unknown-linux-musl,  asset: chrome-use-linux-musl-arm64, use_zigbuild: true,  ext: '' }
+          - { name: Windows x64,      os: ubuntu-latest, target: x86_64-pc-windows-gnu,       asset: chrome-use-win32-x64,        use_zigbuild: false, ext: '.exe' }
+          - { name: macOS x64,        os: macos-latest,  target: x86_64-apple-darwin,         asset: chrome-use-darwin-x64,       use_zigbuild: false, ext: '' }
+          - { name: macOS ARM64,      os: macos-latest,  target: aarch64-apple-darwin,        asset: chrome-use-darwin-arm64,     use_zigbuild: false, ext: '' }
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install cross-compilation tools (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu gcc-x86-64-linux-gnu mingw-w64
+
+      - name: Install cargo-zigbuild
+        if: matrix.use_zigbuild
+        run: |
+          pip3 install ziglang
+          cargo install cargo-zigbuild
+
+      - name: Configure Rust linkers
+        if: runner.os == 'Linux'
+        run: |
+          mkdir -p ~/.cargo
+          cat >> ~/.cargo/config.toml << 'EOF'
+          [target.aarch64-unknown-linux-gnu]
+          linker = "aarch64-linux-gnu-gcc"
+
+          [target.x86_64-pc-windows-gnu]
+          linker = "x86_64-w64-mingw32-gcc"
+          EOF
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: cli
+
+      - name: Build (zigbuild)
+        if: matrix.use_zigbuild
+        run: cargo zigbuild --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
+
+      - name: Build (cargo)
+        if: '!matrix.use_zigbuild'
+        run: cargo build --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
+
+      - name: Package (.tar.gz + .sha256)
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          src="cli/target/${{ matrix.target }}/release/chrome-use${{ matrix.ext }}"
+          # The binary inside every archive is named `chrome-use` (or .exe);
+          # install.sh extracts that fixed name regardless of platform.
+          cp "$src" "dist/chrome-use${{ matrix.ext }}"
+          chmod +x "dist/chrome-use${{ matrix.ext }}" || true
+          ( cd dist
+            tar czf "${{ matrix.asset }}.tar.gz" "chrome-use${{ matrix.ext }}"
+            if command -v sha256sum >/dev/null 2>&1; then
+              sha256sum "${{ matrix.asset }}.tar.gz" > "${{ matrix.asset }}.tar.gz.sha256"
+            else
+              shasum -a 256 "${{ matrix.asset }}.tar.gz" > "${{ matrix.asset }}.tar.gz.sha256"
+            fi
+          )
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: ${{ matrix.asset }}
+          path: dist/${{ matrix.asset }}.tar.gz*
+          retention-days: 3
+
+  release:
+    name: Attach binaries to GitHub Release
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      # The release job is separate from the build matrix and has no repo by
+      # default — check it out (full history + tags) so the changelog step has a
+      # git repo to diff. Without this, `git` failed with "not a git repository"
+      # and the changelog came out empty.
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+          fetch-depth: 0
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: List assets
+        run: ls -la dist
+
+      # Build the changelog from conventional-commit subjects since the previous
+      # tag. GitHub's built-in generate_release_notes only lists merged PRs,
+      # which is near-empty for this commit-to-main workflow — so we render the
+      # commit log ourselves and every release shows what actually changed.
+      - name: Generate changelog
+        id: changelog
+        run: |
+          # fetch-depth:0 gets history, but the tag refs the changelog needs
+          # aren't always present in a detached-HEAD tag checkout — pull them in.
+          git fetch --tags --force --quiet origin 2>/dev/null || true
+          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          PREV="$(git describe --tags --abbrev=0 "${TAG}^" 2>/dev/null || true)"
+          RANGE="${TAG}"
+          [ -n "$PREV" ] && RANGE="${PREV}..${TAG}"
+          # Group commit subjects by conventional-commit type so the notes are
+          # scannable ("what's new / what's fixed") instead of a flat dev log.
+          LOG="$(git log "$RANGE" --no-merges --pretty='%s' | grep -v '^chore(release)' || true)"
+          # NOTE: the job runs under `bash -e`. grep returning 1 (no match) and
+          # the `[ -n "$body" ]` test returning 1 (empty section) must NOT abort
+          # the script — otherwise a release whose commit range lacks a whole
+          # category (e.g. only `feat`, no `fix`) dies before writing the closing
+          # heredoc delimiter and the whole release step fails. `|| true` +
+          # `return 0` keep section() always-succeeding.
+          section() { # $1=header  $2=grep-pattern
+            local body; body="$(printf '%s\n' "$LOG" | grep -E "$2" | sed 's/^/- /' || true)"
+            [ -n "$body" ] && printf '\n### %s\n%s\n' "$1" "$body"
+            return 0
+          }
+          {
+            echo "notes<<__NOTES_EOF__"
+            echo "## What changed"
+            section "✨ Features" '^feat'
+            section "🐛 Fixes" '^fix'
+            section "🔧 Other" '^(perf|refactor|docs|build|ci|test|style|revert)'
+            if [ -n "$PREV" ]; then
+              echo ""
+              echo "**Full changelog**: https://github.com/${{ github.repository }}/compare/${PREV}...${TAG}"
+            fi
+            echo "__NOTES_EOF__"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Attach to release
+        uses: softprops/action-gh-release@v3
+        with:
+          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
+          files: |
+            dist/*.tar.gz
+            dist/*.tar.gz.sha256
+          fail_on_unmatched_files: true
+          # The commit-based changelog so every release shows what changed. The
+          # first matrix job to run creates the release with these notes;
+          # append_body:false keeps later platform jobs from duplicating them.
+          body: ${{ steps.changelog.outputs.notes }}
+          append_body: false

.github/workflows/release.yml

@@ -1,268 +0,0 @@
-name: Release
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  # Build native binaries for all platforms first
-  build-binaries:
-    name: Build ${{ matrix.name }}
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: Linux x64
-            os: ubuntu-latest
-            target: x86_64-unknown-linux-gnu
-            binary: agent-browser-linux-x64
-            use_zigbuild: true
-          - name: Linux ARM64
-            os: ubuntu-latest
-            target: aarch64-unknown-linux-gnu
-            binary: agent-browser-linux-arm64
-            use_zigbuild: true
-          - name: Windows x64
-            os: ubuntu-latest
-            target: x86_64-pc-windows-gnu
-            binary: agent-browser-win32-x64.exe
-            use_zigbuild: false
-          - name: macOS x64
-            os: macos-latest
-            target: x86_64-apple-darwin
-            binary: agent-browser-darwin-x64
-            use_zigbuild: false
-          - name: macOS ARM64
-            os: macos-latest
-            target: aarch64-apple-darwin
-            binary: agent-browser-darwin-arm64
-            use_zigbuild: false
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: pnpm
-
-      - name: Install npm dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Sync version
-        run: pnpm run version:sync
-
-      - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Install cross-compilation tools (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu gcc-x86-64-linux-gnu mingw-w64
-
-      - name: Install cargo-zigbuild
-        if: matrix.use_zigbuild
-        run: |
-          pip3 install ziglang
-          cargo install cargo-zigbuild
-
-      - name: Configure Rust linkers
-        if: runner.os == 'Linux'
-        run: |
-          mkdir -p ~/.cargo
-          cat >> ~/.cargo/config.toml << 'EOF'
-          [target.aarch64-unknown-linux-gnu]
-          linker = "aarch64-linux-gnu-gcc"
-
-          [target.x86_64-pc-windows-gnu]
-          linker = "x86_64-w64-mingw32-gcc"
-          EOF
-
-      - name: Cache Rust build artifacts
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: cli
-
-      - name: Build with zigbuild
-        if: matrix.use_zigbuild
-        run: cargo zigbuild --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
-
-      - name: Build with cargo
-        if: '!matrix.use_zigbuild'
-        run: cargo build --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
-
-      - name: Copy binary
-        run: |
-          mkdir -p artifacts
-          if [[ "${{ matrix.target }}" == *"windows"* ]]; then
-            cp cli/target/${{ matrix.target }}/release/agent-browser.exe artifacts/${{ matrix.binary }}
-          else
-            cp cli/target/${{ matrix.target }}/release/agent-browser artifacts/${{ matrix.binary }}
-            chmod +x artifacts/${{ matrix.binary }}
-          fi
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.binary }}
-          path: artifacts/${{ matrix.binary }}
-          retention-days: 7
-
-  # Create release PR or publish to npm (with binaries)
-  release:
-    name: Release
-    needs: build-binaries
-    runs-on: ubuntu-latest
-    outputs:
-      published: ${{ steps.changesets.outputs.published }}
-      publishedPackages: ${{ steps.changesets.outputs.publishedPackages }}
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: pnpm
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install Dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Download all binary artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts/
-
-      - name: Move binaries to bin directory
-        run: |
-          mkdir -p bin
-          find artifacts -type f -name 'agent-browser-*' -exec mv {} bin/ \;
-          rm -rf artifacts
-          chmod +x bin/agent-browser-* 2>/dev/null || true
-          echo "Binaries in bin/:"
-          ls -la bin/
-
-      - name: Verify all binaries exist
-        run: |
-          EXPECTED_BINARIES=(
-            "agent-browser-linux-x64"
-            "agent-browser-linux-arm64"
-            "agent-browser-win32-x64.exe"
-            "agent-browser-darwin-x64"
-            "agent-browser-darwin-arm64"
-          )
-          MIN_SIZE=100000  # Binaries should be at least 100KB
-          ERRORS=0
-          for binary in "${EXPECTED_BINARIES[@]}"; do
-            if [ ! -f "bin/$binary" ]; then
-              echo "ERROR: Missing bin/$binary"
-              ERRORS=$((ERRORS + 1))
-            else
-              SIZE=$(stat -c%s "bin/$binary" 2>/dev/null || stat -f%z "bin/$binary")
-              if [ "$SIZE" -lt "$MIN_SIZE" ]; then
-                echo "ERROR: bin/$binary is too small ($SIZE bytes, expected >= $MIN_SIZE)"
-                ERRORS=$((ERRORS + 1))
-              else
-                echo "OK: bin/$binary ($SIZE bytes)"
-              fi
-            fi
-          done
-          if [ "$ERRORS" -gt 0 ]; then
-            echo "Error: $ERRORS binary issues found"
-            exit 1
-          fi
-          echo "All 5 platform binaries present and valid"
-
-      - name: Create Release Pull Request or Publish to npm
-        id: changesets
-        uses: changesets/action@v1
-        with:
-          version: pnpm ci:version
-          publish: pnpm ci:publish
-          title: 'chore: version packages'
-          commit: 'chore: version packages'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_VERCEL_TOKEN_ELEVATED }}
-
-  # Create GitHub release with binaries after npm publish
-  github-release:
-    name: Create GitHub Release
-    needs: release
-    if: needs.release.outputs.published == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4
-        with:
-          ref: main
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts/
-
-      - name: Move binaries to bin directory
-        run: |
-          mkdir -p bin
-          find artifacts -type f -name 'agent-browser-*' -exec mv {} bin/ \;
-          rm -rf artifacts
-          chmod +x bin/agent-browser-* 2>/dev/null || true
-          ls -la bin/
-
-      - name: Verify binaries exist
-        run: |
-          BINARY_COUNT=$(ls bin/agent-browser-* 2>/dev/null | wc -l)
-          if [ "$BINARY_COUNT" -lt 5 ]; then
-            echo "Error: Expected 5 binaries, found $BINARY_COUNT"
-            ls -la bin/
-            exit 1
-          fi
-          echo "Found $BINARY_COUNT binaries"
-
-      - name: Create GitHub Release
-        run: |
-          VERSION=$(node -p "require('./package.json').version")
-          TAG="v$VERSION"
-          
-          # Check if release already exists
-          if gh release view "$TAG" &>/dev/null; then
-            echo "Release $TAG already exists, uploading binaries..."
-            gh release upload "$TAG" bin/agent-browser-* --clobber
-          else
-            echo "Creating release $TAG..."
-            gh release create "$TAG" \
-              --title "$TAG" \
-              --generate-notes \
-              bin/agent-browser-*
-          fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -6,6 +6,7 @@ dist/
 
 # Native binaries (keep the launcher scripts)
 bin/agent-browser-*
+bin/.install-method
 !bin/agent-browser
 !bin/agent-browser.cmd
 
@@ -37,6 +38,10 @@ __pycache__/
 *.webm
 test/e2e/.dogfood-output/
 
+# ...but these are real repo assets, not test artifacts — keep them tracked
+!assets/*.png
+!extensions/ab-connect/icons/*.png
+
 # Package manager
 package-lock.json
 yarn.lock
@@ -45,6 +50,9 @@ yarn.lock
 .env
 .env.local
 
+# Windows debug instance config
+scripts/windows-debug/.instance
+
 # opensrc - source code for packages
 opensrc/
 
@@ -56,3 +64,15 @@ docs/package-lock.json
 
 # pnpm
 .pnpm-store/
+
+# TypeScript
+*.tsbuildinfo
+
+# next
+.next/
+out/
+
+# extension signing key (never commit) + local-only id record
+.secrets/
+*.pem
+/cu-test-artifacts

.husky/pre-commit

@@ -1,3 +1,2 @@
-pnpm lint-staged
 node scripts/sync-version.js
 git add cli/Cargo.toml cli/Cargo.lock

.husky/pre-push

@@ -0,0 +1,8 @@
+if [ "${SKIP_CLAWHUB_SYNC:-0}" = "1" ]; then
+  echo "Skipping ClawHub sync (SKIP_CLAWHUB_SYNC=1)"
+  exit 0
+fi
+
+pnpm run clawhub:sync || {
+  echo "ClawHub sync failed. Push continues. Run 'pnpm run clawhub:sync' manually after fixing login/network."
+}

.node-version

@@ -0,0 +1 @@
+24

AGENTS.md

@@ -9,6 +9,7 @@ This project uses **pnpm**. Always use `pnpm` instead of `npm` or `yarn` for ins
 ## Code Style
 
 - Do not use emojis in code, output, or documentation. Unicode symbols (✓, ✗, →, ⚠) are acceptable.
+- In documentation and markdown, never use double hyphens (`--`) as a dash. Use an emdash (—) sparingly when needed. Prefer rewriting the sentence to avoid dashes entirely.
 - CLI colored output uses `cli/src/color.rs`. This module respects the `NO_COLOR` environment variable. Never use hardcoded ANSI color codes.
 - CLI flags must always use kebab-case (e.g., `--auto-connect`, `--allow-file-access`). Never use camelCase for flags (e.g., `--autoConnect` is wrong).
 
@@ -16,35 +17,79 @@ This project uses **pnpm**. Always use `pnpm` instead of `npm` or `yarn` for ins
 
 When adding or changing user-facing features (new flags, commands, behaviors, environment variables, etc.), update **all** of the following:
 
-1. `cli/src/output.rs` -- `--help` output (flags list, examples, environment variables)
-2. `README.md` -- Options table, relevant feature sections, examples
-3. `skills/agent-browser/SKILL.md` -- so AI agents know about the feature
-4. `docs/src/app/` -- the Next.js docs site (MDX pages)
+1. `cli/src/output.rs` — `--help` output (flags list, examples, environment variables)
+2. `README.md` — Options table, relevant feature sections, examples
+3. `skill-data/core/SKILL.md` (and its `references/`) — so AI agents know about the feature when they load the core skill. Edit `skill-data/core/SKILL.md` for overview/workflow changes; edit `skill-data/core/references/*.md` for detailed reference content. Do **not** put feature content in `skills/chrome-use/SKILL.md` — that file is an intentionally thin discovery stub for `npx skills add` and exists only to redirect agents to `chrome-use skills get core`.
+4. `docs/src/app/` — the Next.js docs site (MDX pages)
 5. Inline doc comments in the relevant source files
 
 This applies to changes that either human users or AI agents would need to know about. Do not skip any of these locations.
 
 In the `docs/src/app/` MDX files, always use HTML `<table>` syntax for tables (not markdown pipe tables). This matches the existing convention across the docs site.
 
-## Dual Architecture (Node.js + Native)
+## Dashboard (packages/dashboard)
 
-The codebase has two daemon implementations:
+- Never use native browser dialogs (`alert`, `confirm`, `prompt`). Use shadcn/ui components (`Dialog`, `AlertDialog`, etc.) instead.
+- Use param-case (kebab-case) for all file and folder names (e.g., `session-tree.tsx`, not `SessionTree.tsx`). The `ui/` directory follows shadcn conventions which already uses param-case.
 
-- **Node.js/Playwright** (default) -- `src/daemon.ts`, `src/actions.ts`, `src/browser.ts`, and the rest of `src/`
-- **Rust/Native** (experimental, `--native` or `AGENT_BROWSER_NATIVE=1`) -- `cli/src/native/daemon.rs`, `cli/src/native/actions.rs`, `cli/src/native/browser.rs`, and the rest of `cli/src/native/`
+## Releasing
 
-When modifying browser automation logic (commands, actions, protocol handling), changes **must** be made in **both** paths:
+Releases are manual, single-PR affairs. There is no changesets automation. The maintainer controls the changelog voice and format.
 
-| Node.js Path | Native Path |
-|---|---|
-| `src/actions.ts` | `cli/src/native/actions.rs` |
-| `src/browser.ts` | `cli/src/native/browser.rs` |
-| `src/daemon.ts` | `cli/src/native/daemon.rs` |
-| `src/protocol.ts` | `cli/src/native/cdp/client.rs` |
-| `src/snapshot.ts` | `cli/src/native/snapshot.rs` |
-| `src/state-utils.ts` | `cli/src/native/state.rs` |
+To prepare a release:
 
-New commands must be implemented in both paths, or explicitly stubbed in the native path with a clear `"Not yet implemented: {action}"` error. The goal is eventual full migration to native, but until then both paths must stay in sync.
+1. Create a branch (e.g. `prepare-v0.24.0`)
+2. Bump `version` in `package.json`
+3. Run `pnpm version:sync` to update `cli/Cargo.toml`, `cli/Cargo.lock`, and `packages/dashboard/package.json`
+4. Write the changelog entry in `CHANGELOG.md` at the top, under a new `## <version>` heading, wrapped in `<!-- release:start -->` and `<!-- release:end -->` markers. Remove the `<!-- release:start -->` and `<!-- release:end -->` markers from the previous release entry so only the new release has markers.
+5. Add a matching entry to `docs/src/app/changelog/page.mdx` at the top (below the `# Changelog` heading)
+6. Open a PR and merge to `main`
+
+When the PR merges, CI compares `package.json` version to what's on npm. If it differs, it builds all 7 platform binaries, publishes to npm, and creates the GitHub release automatically. The GitHub release body is extracted from the content between the `<!-- release:start -->` and `<!-- release:end -->` markers in `CHANGELOG.md`.
+
+### Writing the changelog
+
+Review the git log since the last release and write the entry in `CHANGELOG.md`. Follow the existing format and voice. Group changes under `### New Features`, `### Bug Fixes`, `### Improvements`, etc. Bold the feature/fix name, then describe it concisely. Reference PR numbers in parentheses.
+
+Wrap the release notes (everything between the `## <version>` heading and the previous version) in markers so CI can extract them for the GitHub release. Only the current release should have markers; remove the `<!-- release:start -->` and `<!-- release:end -->` markers from any previous release entry:
+
+```markdown
+## 0.24.1
+
+<!-- release:start -->
+### Bug Fixes
+
+- Fixed **baz** not working when qux is enabled (#1235)
+
+### Contributors
+
+- @ctate
+<!-- release:end -->
+
+## 0.24.0
+
+### New Features
+
+- **Foo command** - Added `foo` command for bar (#1234)
+```
+
+Include a `### Contributors` section listing the GitHub usernames (with `@` prefix) of everyone who contributed to the release. Check the git log between the previous tag and HEAD to find them.
+
+Do not prefix entries with commit hashes. Do not use the changesets `### Patch Changes` / `### Minor Changes` headings. Use descriptive section names instead.
+
+### Docs changelog
+
+The docs changelog at `docs/src/app/changelog/page.mdx` mirrors `CHANGELOG.md` but uses a slightly different format. Each entry uses:
+
+- A `v` prefix on the version (e.g. `## v0.24.0`)
+- A date line with the full date: `<p className="text-[#888] text-sm">March 30, 2026</p>`
+- A `---` separator between entries
+
+Match the existing style in that file.
+
+## Architecture
+
+This is a Rust codebase. The browser automation daemon lives in `cli/src/native/` (daemon, actions, browser, CDP client, snapshot, state). The `--engine` flag selects Chrome vs Lightpanda. The `install` command downloads Chrome from Chrome for Testing directly.
 
 ## Testing
 
@@ -77,6 +122,68 @@ cd cli && cargo fmt -- --check   # Check formatting
 cd cli && cargo clippy            # Lint
 ```
 
+## Windows Debugging
+
+A remote Windows Server 2022 EC2 instance is available for debugging Windows-specific issues. It uses AWS Systems Manager (SSM) with no SSH or open ports. Commands run via `aws ssm send-command` and return stdout/stderr.
+
+### Prerequisites
+
+The instance must be provisioned first (one-time, by a human):
+
+```bash
+./scripts/windows-debug/provision.sh
+```
+
+Requires: AWS CLI v2 configured with `ec2:*`, `iam:CreateRole`, `iam:AttachRolePolicy`, `ssm:SendCommand`, `ssm:GetCommandInvocation` permissions and a default VPC.
+
+### Usage
+
+Start the instance (if stopped):
+
+```bash
+./scripts/windows-debug/start.sh
+```
+
+Run a command on Windows:
+
+```bash
+./scripts/windows-debug/run.sh "<powershell-command>"
+```
+
+Sync the current git branch and rebuild:
+
+```bash
+./scripts/windows-debug/sync.sh
+```
+
+Stop the instance when done (avoids cost):
+
+```bash
+./scripts/windows-debug/stop.sh
+```
+
+### Common Workflows
+
+Run unit tests on Windows:
+
+```bash
+./scripts/windows-debug/run.sh "cd C:\chrome-use && cargo test --manifest-path cli\Cargo.toml"
+```
+
+Run e2e tests on Windows:
+
+```bash
+./scripts/windows-debug/run.sh "cd C:\chrome-use && cargo test e2e --manifest-path cli\Cargo.toml -- --ignored --test-threads=1"
+```
+
+Check bootstrap progress (first boot only):
+
+```bash
+./scripts/windows-debug/run.sh "Get-Content C:\bootstrap.log"
+```
+
+The repo lives at `C:\chrome-use` on the instance. Rust, Git, and Chrome are pre-installed. The `run.sh` wrapper automatically adds cargo and git to PATH.
+
 <!-- opensrc:start -->
 
 ## Source Code Reference

CHANGELOG.md

@@ -1,253 +0,0 @@
-# agent-browser
-
-## 0.16.1
-
-### Patch Changes
-
-- c4180c8: Improved Chrome launch reliability by automatically detecting containerized environments (Docker, Podman, Kubernetes) and enabling --no-sandbox when needed. Added support for discovering Playwright-installed Chromium browsers and enhanced error messages with helpful diagnostics when Chrome fails to launch.
-
-## 0.16.0
-
-### Minor Changes
-
-- 05018b3: Added experimental native Rust daemon (`--native` flag, `AGENT_BROWSER_NATIVE=1` env, or `"native": true` in config). The native daemon communicates with Chrome directly via CDP, eliminating Node.js and Playwright dependencies. Supports 150+ commands with full parity to the default Node.js daemon. Includes WebDriver backend for Safari/iOS, CDP protocol codegen, request tracking, frame context management, and comprehensive e2e and parity tests.
-
-## 0.15.3
-
-### Patch Changes
-
-- 62241b5: Fixed Windows compatibility issues including proper handling of extended-length path prefixes from canonicalize(), prevention of MSYS/Git Bash path translation that could mangle arguments, and improved daemon startup reliability. Also added ARM64 Windows support in postinstall shims and expanded CI testing with a full daemon lifecycle test on Windows.
-
-## 0.15.2
-
-### Patch Changes
-
-- 6aea316: Documentation site improvements and internal tooling updates including enhanced code blocks, mobile navigation, and docs chat components. CLI connection and output handling refinements. Skill creator reference documentation and scripts have been reorganized.
-
-## 0.15.1
-
-### Patch Changes
-
-- 7bd8ce9: Added support for chrome:// and chrome-extension:// URLs in navigation and recording commands. These special browser URLs are now preserved as-is instead of having https:// incorrectly prepended.
-
-## 0.15.0
-
-### Minor Changes
-
-- 2e38882: - Added security hardening: authentication vault, content boundary markers, domain allowlist, action policy, action confirmation, and output length limits.
-  - Added `--download-path` flag (and `AGENT_BROWSER_DOWNLOAD_PATH` env / `downloadPath` config key) to set a default download directory.
-  - Added `--selector` flag to `scroll` command for scrolling within specific container elements.
-
-## 0.14.0
-
-### Minor Changes
-
-- b7665e5: - Added `keyboard` command for raw keyboard input -- type with real keystrokes, insert text, and press shortcuts at the currently focused element without needing a selector.
-  - Added `--color-scheme` flag and `AGENT_BROWSER_COLOR_SCHEME` env var for persistent dark/light mode preference across browser sessions.
-  - Fixed IPC EAGAIN errors (os error 35/11) by adding backpressure-aware socket writes, command serialization, and lowering the default Playwright timeout to 25s (configurable via `AGENT_BROWSER_DEFAULT_TIMEOUT`).
-  - Fixed remote debugging (CDP) reconnection.
-  - Fixed state load failing when no browser is running.
-  - Fixed `--annotate` flag warning appearing when not explicitly passed via CLI.
-
-## 0.13.0
-
-### Minor Changes
-
-- ebd8717: Added new diff commands for comparing snapshots, screenshots, and URLs between page states. You can now run visual pixel diffs against baseline images, compare accessibility tree snapshots with customizable depth and selectors, and diff two URLs side-by-side with optional screenshot comparison.
-
-## 0.12.0
-
-### Minor Changes
-
-- 69ffad0: Add annotated screenshots with the new --annotate flag, which overlays numbered labels on interactive elements and prints a legend mapping each label to its element ref. This enables multimodal AI models to reason about visual layout while using the same @eN refs for subsequent interactions. The flag can also be set via the AGENT_BROWSER_ANNOTATE environment variable.
-
-## 0.11.1
-
-### Patch Changes
-
-- c6fc7df: Added documentation for command chaining with && across README, CLI help output, docs, and skill files, explaining how to efficiently chain multiple agent-browser commands in a single shell invocation since the browser persists via a background daemon.
-
-## 0.11.0
-
-### Minor Changes
-
-- 5dc40b4: Added configuration file support with automatic loading from user and project directories, new profiler commands for Chrome DevTools profiling, computed styles getter, browser extension loading, storage state management, and iOS device emulation. Expanded click command with new-tab option, improved find command with additional actions and filtering options, and enhanced CDP connection to accept WebSocket URLs. Documentation has been significantly expanded with new sections for configuration, profiling, and proxy support.
-
-## 0.10.0
-
-### Minor Changes
-
-- 1112a16: Added session persistence with automatic save/restore of cookies and localStorage across browser restarts using --session-name flag, with optional AES-256-GCM encryption for saved state data. New state management commands allow listing, showing, renaming, clearing, and cleaning up old session files. Also added --new-tab option for click commands to open links in new tabs.
-
-## 0.9.4
-
-### Patch Changes
-
-- 323b6cd: Fix all Clippy lint warnings in the Rust CLI: remove redundant import, use `.first()` instead of `.get(0)`, use `.copied()` instead of `.map(|s| *s)`, use `.contains()` instead of `.iter().any()`, use `then_some` instead of lazy `then`, and simplify redundant match guards.
-
-## 0.9.3
-
-### Patch Changes
-
-- d03e238: Added support for custom executable path in CLI browser launch options. Documentation site received UI improvements including a new chat component with sheet-based interface and updated dependencies.
-
-## 0.9.2
-
-### Patch Changes
-
-- 76d23db: Documentation site migrated to MDX for improved content authoring, added AI-powered docs chat feature, and updated README with Homebrew installation instructions for macOS users.
-
-## 0.9.1
-
-### Patch Changes
-
-- ae34945: Added --allow-file-access flag to enable opening and interacting with local file:// URLs (PDFs, HTML files) by passing Chromium flags that allow JavaScript access to local files. Added -C/--cursor flag for snapshots to include cursor-interactive elements like divs with onclick handlers or cursor:pointer styles, which is useful for modern web apps using custom clickable elements.
-
-## 0.9.0
-
-### Minor Changes
-
-- 9d021bd: Add iOS Simulator and real device support for mobile Safari testing via Appium. New CLI commands include `device list` to show available simulators, `tap` and `swipe` for touch interactions, and the `--device` flag to specify which iOS device to use. Configure with `-p ios` provider flag or `AGENT_BROWSER_PROVIDER=ios` environment variable.
-
-## 0.8.10
-
-### Patch Changes
-
-- 17dba8f: Add --stdin flag for eval command to read JavaScript from stdin, enabling heredoc usage for multiline scripts
-- daeede4: Add --stdin flag for the eval command to read JavaScript from stdin, enabling heredoc usage for multiline scripts. Also fix binary permission issues on macOS/Linux when postinstall scripts don't run (e.g., with bun).
-
-## 0.8.9
-
-### Patch Changes
-
-- 0dc36f2: Add --stdin flag for eval command to read JavaScript from stdin, enabling heredoc usage for multiline scripts
-
-## 0.8.8
-
-### Patch Changes
-
-- 2771588: Added base64 encoding support for the eval command with -b/--base64 flag to avoid shell escaping issues when executing JavaScript. Updated documentation with AI agent setup instructions and reorganized the docs structure by consolidating agent mode content into the installation page.
-
-## 0.8.7
-
-### Patch Changes
-
-- d24f753: Fixed browser launch options not being passed correctly when using persistent profiles, ensuring args, userAgent, proxy, and ignoreHTTPSErrors settings now work properly. Added pre-flight checks for socket path length limits and directory write permissions to provide clearer error messages when daemon startup fails. Improved error handling to properly exit with failure status when browser launch fails.
-
-## 0.8.6
-
-### Patch Changes
-
-- d75350a: Improved daemon connection reliability by adding automatic retry logic for transient errors like connection resets, broken pipes, and temporary resource unavailability. The CLI now cleans up stale socket and PID files before starting a new daemon, and includes better detection of daemon responsiveness to handle race conditions during shutdown.
-
-## 0.8.5
-
-### Patch Changes
-
-- cb2f8c3: Fixed version synchronization to automatically update Cargo.lock alongside Cargo.toml during releases, and made the CLI binary executable. This ensures the Rust CLI version stays in sync with the npm package version.
-
-## 0.8.4
-
-### Patch Changes
-
-- 759302e: Fixed "Daemon not found" error when running through AI agents (e.g., Claude Code) by resolving symlinks in the executable path. Previously, npm global bin symlinks weren't being resolved correctly, causing intermittent daemon discovery failures.
-
-## 0.8.3
-
-### Patch Changes
-
-- 4116a8a: Replaced shell-based CLI wrappers with a cross-platform Node.js wrapper to enable npx support on Windows. Added postinstall logic to patch npm's bin entry on global installs, allowing the native binary to be invoked directly with zero overhead. Added CI tests to verify global installation works correctly across all platforms.
-
-## 0.8.2
-
-### Patch Changes
-
-- 7e6336f: Fixed the Windows CMD wrapper to use the native binary directly instead of routing through Node.js, improving startup performance and reliability. Added retry logic to the CI install command to handle transient failures during browser installation.
-
-## 0.8.1
-
-### Patch Changes
-
-- 8eec634: Improved release workflow to validate binary file sizes and ensure binaries are executable after npm install. Updated documentation site with a new mobile navigation system and added v0.8.0 changelog entries. Reformatted CHANGELOG.md for better readability.
-
-## v0.8.0
-
-### New Features
-
-- **Kernel cloud browser provider** - Connect to Kernel (https://kernel.sh) for remote browser infrastructure via `-p kernel` flag or `AGENT_BROWSER_PROVIDER=kernel`. Supports stealth mode, persistent profiles, and automatic profile find-or-create.
-- **Ignore HTTPS certificate errors** - New `--ignore-https-errors` flag for working with self-signed certificates and development environments
-- **Enhanced cookie management** - Extended `cookies set` command with `--url`, `--domain`, `--path`, `--httpOnly`, `--secure`, `--sameSite`, and `--expires` flags for setting cookies before page load
-
-### Bug Fixes
-
-- Fixed tab list command not recognizing new pages opened via clicks or `target="_blank"` links (#275)
-- Fixed `check` command hanging indefinitely (#272)
-- Fixed `set device` not applying deviceScaleFactor - HiDPI screenshots now work correctly (#270)
-- Fixed state load and profile persistence not working in v0.7.6 (#268)
-- Screenshots now save to temp directory when no path is provided (#247)
-
-### Security
-
-- Daemon and stream server now reject cross-origin connections (#274)
-
-## 0.7.6
-
-### Patch Changes
-
-- a4d0c26: Allow null values for the screenshot selector field. Previously, passing a null selector would fail validation, but now it is properly handled as an optional value.
-
-## 0.7.5
-
-### Patch Changes
-
-- 8c2a6ec: Fix GitHub release workflow to handle existing releases. If a release already exists, binaries are uploaded to it instead of failing.
-
-## 0.7.4
-
-### Patch Changes
-
-- 957b5e5: Fix binary permissions on install. npm doesn't preserve execute bits, so postinstall now ensures the native binary is executable.
-
-## 0.7.3
-
-### Patch Changes
-
-- 161d8f5: Fix native binary distribution in npm package. Native binaries for all platforms (Linux x64/arm64, macOS x64/arm64, Windows x64) are now correctly included when publishing.
-
-## 0.7.2
-
-### Patch Changes
-
-- 6afede2: Fix native binary distribution in npm package
-
-  Native binaries for all platforms (Linux x64/arm64, macOS x64/arm64, Windows x64) are now included in the npm package. Previously, the release workflow published to npm before building binaries, causing "No binary found" errors on installation.
-
-## 0.7.1
-
-### Patch Changes
-
-- Fix native binary distribution in npm package. Native binaries for all platforms (Linux x64/arm64, macOS x64/arm64, Windows x64) are now included in the npm package. Previously, the release workflow published to npm before building binaries, causing "No binary found" errors on installation.
-
-## 0.7.0
-
-### Minor Changes
-
-- 316e649: ## New Features
-  - **Cloud browser providers** - Connect to Browserbase or Browser Use for remote browser infrastructure via `-p` flag or `AGENT_BROWSER_PROVIDER` env var
-  - **Persistent browser profiles** - Store cookies, localStorage, and login sessions across browser restarts with `--profile`
-  - **Remote CDP WebSocket URLs** - Connect to remote browser services via WebSocket URL (e.g., `--cdp "wss://..."`)
-  - **Download commands** - New `download` command and `wait --download` for file downloads with ref support
-  - **Browser launch configuration** - New `--args`, `--user-agent`, and `--proxy-bypass` flags for fine-grained browser control
-  - **Enhanced skills** - Hierarchical structure with references and templates for Claude Code
-
-  ## Bug Fixes
-  - Screenshot command now supports refs and has improved error messages
-  - WebSocket URLs work in `connect` command
-  - Fixed socket file location (uses `~/.agent-browser` instead of TMPDIR)
-  - Windows binary path fix (.exe extension)
-  - State load and path-based actions now show correct output messages
-
-  ## Documentation
-  - Added Claude Code marketplace plugin installation instructions
-  - Updated skill documentation with references and templates
-  - Improved error documentation

README.zh.md

@@ -0,0 +1,320 @@
+# chrome-use
+
+[English](README.md) · **简体中文**
+
+![chrome-use](assets/hero.png)
+
+**chrome-use** 让任意 AI agent 直接操作你自己正在用的、已登录的 Chrome —— 复用你的登录态，对反爬/反自动化系统**完全不可检测**，因为它**就是**你的真实浏览器。属于 `*-use` 家族（iphone-use 驱动你的真实 iPhone，chrome-use 驱动你的真实 Chrome）。
+
+<sub>最初基于 [vercel-labs/agent-browser](https://github.com/vercel-labs/agent-browser)（Apache-2.0）；现已是独立项目 —— 隐身/扩展中继架构、反检测、humanize、多 agent 隔离与 CLI 都已大幅分化。</sub>
+
+## 把你**已经登录好**的浏览器，交给你的 AI agent
+
+**不用开新 Chrome。不用重新登录。不用跟"你是不是机器人"较劲。**
+
+chrome-use 让**任意** agent（Claude Code、Cursor、Codex、你自己的脚本）直接操作你**已经登录了所有网站**的那个 Chrome。它在**你的窗口里**点击，你看着它干活，撞到 2FA / 验证码的瞬间你接管一下，它接着跑。因为它**就是你的真实浏览器**（一键装的扩展、原生消息、无调试端口），网站眼里它 100% 是人：**[CreepJS 实测 0% 机器人](#反检测)。**
+
+**为什么不用……**
+
+- **Playwright / Puppeteer / browser-use？** 它们开的是**空**浏览器 —— 每个登录你重做、每个验证码你硬扛、最后还被标成自动化。我们直接用你**现成的**会话。
+- **Claude 的 Chrome 插件？** 很好，但**只能给 Claude 用**。我们给**任意** agent / CLI 用。
+- **裸 `--remote-debugging-port`**（web-access 等）？ Chrome 136+ **每次连都弹** "Allow remote debugging?"。我们**永不弹** —— 商店一键装，原生消息。
+
+<details>
+<summary><b>完整对比矩阵</b>（要细节的看这里）</summary>
+
+| | [Claude in Chrome](https://www.anthropic.com/claude/chrome) | web-access / 裸 CDP 端口 | Playwright · Puppeteer · browser-use | **chrome-use** |
+|---|:---:|:---:|:---:|:---:|
+| **任意** agent / CLI 都能用（不绑单一 app） | ❌ 仅 Claude | ✅ | ✅ | ✅ |
+| 驱动你**真实、已登录**的 Chrome | ✅ | ✅ | ❌ 全新空 profile | ✅ |
+| **不弹 "Allow remote debugging?"** | ✅ | ❌ 每次连都弹 | —（自带浏览器） | ✅ 原生消息 |
+| 真实浏览器指纹（CreepJS ~0%）¹ | ✅ | ✅ | ❌ 自动化特征 / headless | ✅ **已实测 0%** |
+| **无 `Runtime.enable` CDP 泄漏**（rebrowser）² | — | ❌ 泄漏 | ❌ 泄漏 | ✅ **默认关闭** |
+| 多 agent 共用**同一个**真实 Chrome、标签组隔离³ | ❌ 单 app | ⚠️ 共享 tab、无隔离 | ❌ 各开各的浏览器 | ✅ |
+| 权限面 | 16 个，含 `<all_urls>` | 完整 CDP | 完全控制 | **7 个，无 `<all_urls>`** |
+
+<sub>¹ 三家"真实 Chrome"工具在 CreepJS 上都 ~0%（毕竟是真浏览器），我们的是实测过的。² rebrowser `runtimeEnableLeak` —— 我们的中继路径实测无泄漏；Claude in Chrome 未独立测试（—）。³ web-access 也能跑并行子 agent，但无每会话隔离；本工具每个 `--session` 拿到自己彩色、命令隔离的标签组。实测数字见 [反检测](#反检测)。</sub>
+
+</details>
+
+## 为什么选 chrome-use
+
+<img src="assets/fingerprint.png" alt="真实但不可检测的指纹" width="300" align="right" />
+
+**常规浏览器自动化**（Playwright / Puppeteer，或全新 `--launch`）启动的是空 profile 的全新浏览器：你得重新登录，网站也能看出是自动化。
+
+**chrome-use** 连接你**现有**的 Chrome —— cookies、会话、浏览器指纹全是真的，因为它**就是**你的真实浏览器。
+
+| | 常规自动化 | chrome-use |
+|---|---|---|
+| 浏览器 | 启动新 Chrome | 连接你的 Chrome |
+| 登录态 | 空，要重新登 | 你现有的会话 |
+| 指纹 | 带自动化标记 | 你的真实指纹 |
+| 协作 | 独立窗口 | 同一窗口，随时接管 |
+| 验证码 | Agent 卡住 | 你点一下，Agent 继续 |
+
+## 工作原理
+
+![工作原理](assets/how-it-works.png)
+
+你的 **chrome-use CLI** 通过 Chrome **原生消息（native messaging）** 和一个小**浏览器扩展**通信 —— 这是本机进程间通道，**无网络端口、无 token、无远程服务器**。扩展用 `chrome.debugger` 驱动你指定的标签页（在你**已登录**的 Chrome 里），再把结果交还给 CLI。全程都在你本机。
+
+![架构](assets/architecture.png)
+
+每个 `--session` 拿到**自己的彩色标签组**，多个 agent 共用同一个真实浏览器、互不干扰，也不动你自己的标签页。
+
+## 为什么用扩展（而非裸调试端口）
+
+其他本地工具走裸 `--remote-debugging-port`（CDP）驱动 Chrome。从 **Chrome 136** 起，每次这样连接都会弹出一个阻塞式的 **"Allow remote debugging?"** 同意框 —— 而且端口得提前开好。我们的扩展改用原生消息：**装一次，之后零确认。**
+
+| | **chrome-use**（本扩展） | web-access（裸 CDP 端口） | Claude in Chrome（chrome.debugger） |
+|---|---|---|---|
+| 连接方式 | 原生消息 —— 无端口、无 token | `--remote-debugging-port` | `chrome.debugger` |
+| **"Allow remote debugging?" 弹框** | **从不** ✅ | **每次连都弹** 🔴 | 无 |
+| 复用你的真实登录 | 是 | 是 | 是 |
+| `Runtime.enable`（CDP）泄漏¹ | **默认关闭 → 干净** ✅ | 域已启用 | 不适用 |
+| CreepJS 隐身分² | **0% stealth · 0% headless** ✅ | 真实 Chrome | 真实 Chrome |
+| 每会话标签组 / 并发 agent | **支持** ✅ | 无 | 无 |
+| 为 chrome-use CLI 打造 | 是 | 独立代理 | 单 app 助手 |
+
+> ¹ 对 [rebrowser-bot-detector](https://bot-detector.rebrowser.net/) 实测：我们的中继报 `runtimeEnableLeak: 🟢 No leak`、`navigatorWebdriver: 🟢`。
+> ² 对 [CreepJS](https://abrahamjuliot.github.io/creepjs/) 在「连接真实 Chrome」路径上实测 —— 见 [反检测](#反检测)。
+>
+> 同意框不是假想：裸端口工具**每次** attach 都会弹（Chrome 136+ 安全策略）。扩展路径从不弹。
+
+## 安装
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh
+```
+
+从最新的 [GitHub Release](https://github.com/leeguooooo/chrome-use/releases) 下载对应平台的预编译二进制，安装 `chrome-use`（以及 `abs` 别名）。无需 npm，无需 token。
+
+<details>
+<summary>其他安装方式</summary>
+
+- **锁定版本：** `AGENT_BROWSER_VERSION=v0.27.0-fork.12 curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh`
+- **自定义路径：** `AGENT_BROWSER_BIN_DIR=$HOME/bin curl -fsSL … | sh`
+- **Windows：** 从 [Releases 页](https://github.com/leeguooooo/chrome-use/releases) 下载 `chrome-use-win32-x64.tar.gz`，把 `chrome-use.exe` 放进 PATH。
+- **npm（旧渠道）：** `npm install -g chrome-use` —— 仍在发布，但 GitHub Releases 现在是主渠道。
+</details>
+
+### 安装 AI agent skills
+
+```bash
+npx skills add leeguooooo/chrome-use
+```
+
+把 `skills/chrome-use` 拉进当前项目，让你的 AI agent 拿到正确的用法和预授权的 bash 权限。
+
+## 命令名
+
+`chrome-use`、`chrome-use`、`abs` 是**同一个二进制** —— `abs` 只是短别名。没有单独的「隐身可执行文件」；隐身是**运行时行为**（见下方 [反检测](#反检测)），根据你是连接真实 Chrome 还是 `--launch` 全新实例自动启用。
+
+## 连接你的 Chrome
+
+**推荐 —— 浏览器扩展（一键，无弹窗）。** 从 Chrome 应用商店安装 [**chrome-use** 扩展](https://chromewebstore.google.com/detail/chrome-use/knfcmbamhjmaonkfnjhldjedeobeafmk)，再注册一次本地桥：
+
+```bash
+chrome-use extension install      # 注册原生消息 host（一次性）
+chrome-use open https://x.com/home
+```
+
+之后 `chrome-use open` 就通过**原生消息**驱动你真实、已登录的 Chrome —— 无调试端口、无 token、**永远不弹 "Allow remote debugging?"**。扩展自动更新、重启不掉，零确认（适合无人值守 / agent 场景）。
+
+<details>
+<summary>备选 —— 裸 remote-debugging 端口（会弹同意框）</summary>
+
+不装扩展时，chrome-use 退回用 CDP 连接，而 Chrome 只在带 remote-debugging 端口启动时才暴露它：
+
+```bash
+# macOS
+open -a "Google Chrome" --args --remote-debugging-port=9222
+# Linux
+google-chrome --remote-debugging-port=9222
+# Windows: 给 Chrome 快捷方式 target 加 --remote-debugging-port=9222
+```
+
+然后 `chrome-use open <url>` 自动发现端口。首次连接 **Chrome 136+ 会弹 "Allow remote debugging?"** —— 点一次 Allow（该 Chrome 会话内持续有效）。上面的扩展则完全避开这个框。
+</details>
+
+## 用法
+
+```bash
+# 连接你的 Chrome 并导航
+chrome-use open https://example.com
+
+# 一切都在你已登录的浏览器里进行
+chrome-use click "Post"
+chrome-use fill "Title" "Hello World"
+chrome-use screenshot ./page.png
+```
+
+Agent 在你的 Chrome 里操作 —— 你能实时看到开标签、加载、点击。任意时刻都能接管（比如手动过验证码），然后让 agent 继续。
+
+### 独立模式（`--launch`）
+
+```bash
+# 临时：全新空 profile —— 无 cookie 无登录（适合 CI / 测试）
+chrome-use --launch open https://example.com
+
+# 保留登录：用你真实的 Chrome profile 启动
+chrome-use --launch --profile auto open https://x.com/home
+# 或显式指定：--profile Default / --profile "Profile 1"
+```
+
+## 站点适配器 —— 把一个网站变成「结构化数据 CLI」
+
+大多数「读 GitHub issue」「搜 Reddit」「拉我的 B 站动态」这类任务，根本不需要点击 +
+截图 —— 网站登录态背后本来就有 JSON 接口。**站点适配器**就是一小段 JS 函数，它在你
+**已登录的标签页内**调用那个接口（用你的 cookie、同源 `fetch`、网站自己的模块），返回
+干净的 JSON。网站分辨不出它和你的区别，因为它**就是你**。
+
+chrome-use 本身不附带任何适配器 —— `site update` 会在运行时拉取社区的
+[**bb-sites**](https://github.com/epiral/bb-sites) 适配器包（就像包管理器拉依赖），
+然后在 chrome-use 的隐身通道上运行它们：
+
+```bash
+chrome-use site update                          # 拉取适配器包（约 145 条命令）
+chrome-use site list                            # github/issues、reddit/search、bilibili/feed…
+chrome-use site info github/issues              # 查看某个适配器的参数 + 域名
+
+# 运行一个 —— 会导航到对应站点（已在该站点则复用当前标签页）并返回 JSON
+chrome-use site github/issues epiral/bb-browser --json
+chrome-use site reddit/search "rust async" --json
+chrome-use site bilibili/feed --json            # 能用，因为走的是你的登录态
+```
+
+位置参数按适配器声明的参数顺序填入；`--key value` 按名覆盖。适配器由 bb-sites 社区编写、
+版权归各自作者所有 —— chrome-use 只负责运行它们。
+
+**自动同步 + 自动提示。** 你基本不用手动 `site update`:chrome-use 首次使用时自动拉取,
+之后每周后台刷新一次(`AGENT_BROWSER_SITES_TTL_DAYS` 调周期,`AGENT_BROWSER_SITES_NO_AUTO_UPDATE=1`
+关闭)。而当你 `open`/`snapshot` 一个有适配器的域名时,chrome-use 会在输出里直接把可用命令
+亮出来 —— 一行 `💡 site adapters for <域名>`,`--json` 下则是 `siteAdapters` 字段 —— 这样
+agent 会直接改用结构化适配器,而不是去扒 DOM:
+
+```text
+$ chrome-use open https://github.com
+💡 site adapters for github.com — prefer these for structured data:
+   github/issues, github/me, github/repo, …
+   e.g. chrome-use site github/issues --json
+✓ GitHub
+```
+
+## 自动化测试（`chrome-use test`）
+
+把反复的「打开它、点一圈、看对不对」变成**可重跑的测试套件** —— 前端的单元测试。用 YAML 写用例；步骤复用 chrome-use 自己的命令，断言编译成一次检查：
+
+```yaml
+# smoke.yaml
+suite: chatgpt smoke
+setup:
+  - account: chatgpt/huayue          # 注入一个 cookie-use 登录（可选）
+cases:
+  - name: home loads logged in
+    steps:
+      - open: https://chatgpt.com/
+      - wait: { load: networkidle }
+    assert:
+      - url: { contains: chatgpt.com }
+      - visible: "#prompt-textarea"
+```
+
+```bash
+chrome-use test smoke.yaml                     # 启动隔离浏览器，跑用例
+chrome-use test smoke.yaml --session default   # …或对你已连接的 Chrome 跑
+```
+
+```
+suite: chatgpt smoke  (session cu-test)
+  ✓ home loads logged in   1.2s
+  ✗ composer takes text    0.8s
+      assert text "#prompt-textarea" contains "hi" → got ""
+      ↳ cu-test-artifacts/composer-takes-text.png
+2 cases · 1 passed · 1 failed
+```
+
+任一用例失败时退出码非零（可直接丢进 CI），失败用例会存截图。断言：`url` · `visible` · `hidden` · `text` · `count` · `eval`。步骤：`open` · `click` · `fill` · `type` · `press` · `wait` · `scroll` · `eval`。完整指南：`chrome-use skills get test`。发现回归？加个用例 —— 用得越多，套件越值钱。
+
+## 反检测
+
+连接你真实 Chrome 时，我们**零** JS 注入 —— 浏览器指纹完全是真的。指导原则是 **native CDP/Chrome 覆盖优先于 JS 谎言**：被重定义的 getter 本身可被检测，原生覆盖则不会。
+
+- `navigator.webdriver = false` 走 `Emulation.setAutomationOverride`（原生，CreepJS 类说谎检测查不出）。
+- **`Runtime.enable` 默认关闭** —— 活着的 `Runtime` 域是可被检测的 CDP 信号（patchright/rebrowser 的 "runtime leak"），即便连的是你真实 Chrome。只在你主动开启 console/错误捕获时才启用。
+
+**实测结果（连接真实 Chrome，中继路径）：**
+
+| 检测站 | 结果 |
+|---|---|
+| [CreepJS](https://abrahamjuliot.github.io/creepjs/) | **0% stealth · 0% headless**（零 override 痕迹） |
+| [bot.incolumitas.com](https://bot.incolumitas.com/) | 全部 OK（overflowTest / overrideTest / puppeteerExtraStealth / worker 一致性） |
+| [rebrowser-bot-detector](https://bot-detector.rebrowser.net/) | `runtimeEnableLeak` 🟢 · `pwInitScripts` 🟢 |
+| [bot.sannysoft.com](https://bot.sannysoft.com) | 全绿 |
+
+CreepJS 上的 `0% stealth` 是关键数字：因为连接路径**什么都不打补丁**，根本没有可供说谎检测器抓的 override。（读 `navigator.languages` 顺序或 IP 地理位置的面板可能给个软性的「navigator」/「location」标记 —— 那反映的是*你真实 Chrome* 的语言列表和网络，不是自动化破绽。）
+
+`--launch` 独立模式（全新浏览器）会改用一整套隐身补丁，也能过上述检测 —— 唯一例外：CreepJS 报 **~20% stealth**，因为 srcdoc-iframe 的 `contentWindow` 补丁触发了它的 `hasIframeProxy` 探测（用来藏自动化的 proxy 本身成了破绽）。其余全干净（`0% headless`、sannysoft/browserscan 全绿、Cloudflare 通过）。设 **`AGENT_BROWSER_DISABLE_IFRAME_PROXY=1`** 去掉那个补丁即可拿到干净的 **0% stealth**（代价是放弃小众的 srcdoc-iframe 遮蔽）。**扩展连接路径**（你的真实 Chrome）零 JS 注入、不受影响 —— 它才是货真价实的 0% 路径。
+
+### 类人输入（行为隐身）
+
+指纹隐身只是一半——最强的反爬厂商（Akamai、PerimeterX、DataDome）还会给**行为**打分。点击时光标瞬移到元素正中心、没有接近轨迹、按下即抬起,这本身就是破绽,**哪怕我们的 CDP 事件是 `isTrusted`**。
+
+开启 humanize 后,光标像手在动:点击走带减速的贝塞尔曲线、落在元素内**偏离正中心**的抖动点;打字用变速的击键间隔;滚动分段缓动;拖拽走曲线。而且**自适应**——每次导航探测页面是否有已知反爬厂商(cookie/脚本/全局变量),命中就自动升到全套类人动作,普通站点保持瞬时(零开销)。
+
+页面自己的 `mousemove` 流看到的(行为检测器分析的正是这个):
+
+| | 轨迹 |
+|---|---|
+| **off**（默认） | 直线 · 死磕正中心 · 瞬时 |
+| **human** | 曲线 · 先慢后快再慢 · 落点偏移 |
+
+用 `--humanize off\|fast\|human` 或 `AGENT_BROWSER_HUMANIZE` 控制。默认 `off`,自适应检测器按页面自动升档。
+
+### 静默操作
+
+操作你的真实 Chrome 不该打断你的工作。agent **全程在后台操作**:新标签后台打开(在自己的彩色会话标签组里),**从不强制把标签拽到前台**,并用 `Emulation.setFocusEmulationEnabled` 让每个 agent 标签照常渲染、`document.hasFocus()` / `visibilityState` 仍报 `visible`。于是截图正常、页面不被降频,"标签全程隐藏"也不会变成新的机器人信号。你在自己的标签里照常工作,agent 在旁边默默干活。(想置顶某个标签仍可显式调用命令。)
+
+### 自己验证
+
+别光听我们说 —— 把你连接的 Chrome 指向最硬的公开检测器,自己对比:
+
+- **[CreepJS](https://abrahamjuliot.github.io/creepjs/)** —— 最全面的指纹 / 说谎检测器
+- **[bot.incolumitas.com](https://bot.incolumitas.com/)** —— 行为 + 指纹打分,方法公开
+- **[BrowserScan](https://www.browserscan.net/bot-detection)** —— Webdriver / User-Agent / CDP / Navigator
+- **[bot.sannysoft.com](https://bot.sannysoft.com)** —— 经典自动化特征清单
+- **[pixelscan.net](https://pixelscan.net/)** · **[iphey.com](https://iphey.com/)** —— 一致性与身份
+
+我们故意**不自带 bot 检测器** —— 最强、最诚实的基准,就是拿市面上最好的检测器去测你的真实浏览器。
+
+### 调参（环境变量）
+
+| 变量 | 默认 | 作用 |
+|---|---|---|
+| `AGENT_BROWSER_CAPTURE_CONSOLE` | 关 | 启用 `Runtime` 域,让 `console` / `errors` 捕获页面输出。关闭可保持最隐身的画像。 |
+| `AGENT_BROWSER_HUMANIZE` | 关 | 类人输入动作:`off`(瞬时)、`fast`(轻量缓动轨迹)、`human`(全套曲线轨迹 + 落点抖动 + 击键节奏 + 缓动滚动/拖拽)。也可用 `--humanize`。默认 `off`;自适应检测器会把 Akamai/PerimeterX/DataDome 守护的页面自动升到 `human`。 |
+| `AGENT_BROWSER_TIMEZONE` | 未设 | 仅 `--launch`。IANA id(如 `Asia/Tokyo`)原生设置时区(Intl + Date 跟随,无 JS 谎言)以匹配代理;`auto` 按 locale 推导。 |
+| `AGENT_BROWSER_BLOCK_WEBRTC` | auto | 仅 `--launch`。设了代理时自动强制 WebRTC 走代理(不泄漏真实 IP)。`1` 无代理时也隐藏本地 IP;`0` 退出。 |
+| `AGENT_BROWSER_HIDE_CANVAS` | 关 | 仅 `--launch`。加入会话稳定的 canvas/audio 指纹噪声。默认关(噪声本身就是一种「谎言」)。 |
+| `AGENT_BROWSER_ADAPTIVE_REF` | 开 | 当保存的 `@ref` 移动且 role/name 重查失败时,按指纹相似度重定位(需高分 + 明显领先,否则明确报错)。`0` 关闭。 |
+| `AGENT_BROWSER_CLICK_MODE` | _(auto)_ | 点击策略。默认先滚动入视、派发坐标点击,若被浮层遮挡则回退 DOM `.click()`。`dom` 始终用 `.click()`(适合 blur 即关的自动补全/菜单项);`coord` 严格只用坐标(遮挡时硬失败)。 |
+
+## chrome-use 的独特之处
+
+- **默认 auto-connect** —— `chrome-use open` 连你现有的 Chrome 而非启新的
+- **扩展中继传输** —— 一键安装的 Chrome 商店扩展 + 原生消息，无调试端口、无 "Allow remote debugging?" 弹框
+- **CDP 原生隐身** —— 反检测走 Chrome/CDP 覆盖而非 JS 补丁；连真实 Chrome 零补丁，仅 `--launch` 用全补丁
+- **Humanize** —— 类人光标轨迹 + 自适应反爬处理
+- **多 agent 隔离** —— 多个 agent 通过 per-session 标签组共享同一个真实 Chrome，互不串扰
+- **静默运行** —— 后台操作，绝不抢你的前台标签
+
+<sub>最初基于 [vercel-labs/agent-browser](https://github.com/vercel-labs/agent-browser)（Apache-2.0）；两个项目已大幅分化。</sub>
+
+## License
+
+Apache-2.0
+
+---
+
+> 由 **leeguooooo** 打造 —— AI agent、逆向工程与 Cloudflare Workers 的实战笔记见 **[blog.misonote.com](https://blog.misonote.com)** · 关注 **[X @leeguooooo](https://x.com/leeguooooo)**

bin/chrome-use.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 /**
- * Cross-platform CLI wrapper for agent-browser
+ * Cross-platform CLI wrapper for chrome-use
  * 
  * This wrapper enables npx support on Windows where shell scripts don't work.
  * For global installs, postinstall.js patches the shims to invoke the native
  * binary directly (zero overhead).
  */
 
-import { spawn } from 'child_process';
+import { spawn, execSync } from 'child_process';
 import { existsSync, accessSync, chmodSync, constants } from 'fs';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
@@ -16,6 +16,17 @@ import { platform, arch } from 'os';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
+// Detect if the system uses musl libc (e.g. Alpine Linux)
+function isMusl() {
+  if (platform() !== 'linux') return false;
+  try {
+    const result = execSync('ldd --version 2>&1 || true', { encoding: 'utf8' });
+    return result.toLowerCase().includes('musl');
+  } catch {
+    return existsSync('/lib/ld-musl-x86_64.so.1') || existsSync('/lib/ld-musl-aarch64.so.1');
+  }
+}
+
 // Map Node.js platform/arch to binary naming convention
 function getBinaryName() {
   const os = platform();
@@ -27,7 +38,7 @@ function getBinaryName() {
       osKey = 'darwin';
       break;
     case 'linux':
-      osKey = 'linux';
+      osKey = isMusl() ? 'linux-musl' : 'linux';
       break;
     case 'win32':
       osKey = 'win32';
@@ -51,7 +62,7 @@ function getBinaryName() {
   }
 
   const ext = os === 'win32' ? '.exe' : '';
-  return `agent-browser-${osKey}-${archKey}${ext}`;
+  return `chrome-use-${osKey}-${archKey}${ext}`;
 }
 
 function main() {

cli/Cargo.lock

@@ -43,30 +43,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "agent-browser"
-version = "0.16.1"
-dependencies = [
- "aes-gcm",
- "async-trait",
- "base64",
- "dirs",
- "futures-util",
- "getrandom 0.2.17",
- "image",
- "libc",
- "reqwest",
- "serde",
- "serde_json",
- "sha2",
- "similar",
- "tokio",
- "tokio-tungstenite",
- "url",
- "uuid",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "aligned"
 version = "0.4.3"
@@ -85,6 +61,15 @@ dependencies = [
  "equator",
 ]
 
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.102"
@@ -225,6 +210,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "built"
 version = "0.8.0"
@@ -261,6 +255,15 @@ version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "cc"
 version = "1.2.56"
@@ -285,6 +288,59 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chrome-use"
+version = "1.5.27"
+dependencies = [
+ "aes",
+ "aes-gcm",
+ "async-trait",
+ "base64",
+ "cbc",
+ "chrono",
+ "dirs",
+ "futures-util",
+ "getrandom 0.2.17",
+ "hex",
+ "hmac",
+ "image",
+ "include_dir",
+ "libc",
+ "pbkdf2",
+ "regex-lite",
+ "reqwest",
+ "rust-embed",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+ "sha1",
+ "sha2",
+ "similar",
+ "socket2",
+ "tempfile",
+ "time",
+ "tokio",
+ "tokio-tungstenite",
+ "url",
+ "urlencoding",
+ "uuid",
+ "windows-sys 0.52.0",
+ "zip",
+]
+
+[[package]]
+name = "chrono"
+version = "0.4.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "wasm-bindgen",
+ "windows-link",
+]
+
 [[package]]
 name = "cipher"
 version = "0.4.4"
@@ -301,6 +357,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
 
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
 [[package]]
 name = "core2"
 version = "0.4.0"
@@ -385,6 +447,15 @@ version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d7a1e2f27636f116493b8b860f5546edb47c8d8f8ea73e1d2a20be88e28d1fea"
 
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "powerfmt",
+]
+
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -393,6 +464,7 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
  "crypto-common",
+ "subtle",
 ]
 
 [[package]]
@@ -484,6 +556,12 @@ dependencies = [
  "zune-inflate",
 ]
 
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
 [[package]]
 name = "fax"
 version = "0.2.6"
@@ -527,6 +605,7 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -559,6 +638,12 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
 [[package]]
 name = "futures-macro"
 version = "0.3.32"
@@ -589,9 +674,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-core",
+ "futures-io",
  "futures-macro",
  "futures-sink",
  "futures-task",
+ "memchr",
  "pin-project-lite",
  "slab",
 ]
@@ -698,6 +785,21 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "http"
 version = "1.4.0"
@@ -798,6 +900,30 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "icu_collections"
 version = "2.1.1"
@@ -946,6 +1072,25 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c5cedc30da3a610cac6b4ba17597bdf7152cf974e8aab3afb3d54455e371c8"
 
+[[package]]
+name = "include_dir"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "923d117408f1e49d914f1a379a309cffe4f18c05cf4e3d12e613a15fc81bd0dd"
+dependencies = [
+ "include_dir_macros",
+]
+
+[[package]]
+name = "include_dir_macros"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cab85a7ed0bd5f0e76d93846e0147172bed2e2d3f859bcc33a8d9699cad1a75"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.13.0"
@@ -964,6 +1109,7 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
+ "block-padding",
  "generic-array",
 ]
 
@@ -1067,6 +1213,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+
 [[package]]
 name = "litemap"
 version = "0.8.1"
@@ -1172,6 +1324,12 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050"
+
 [[package]]
 name = "num-derive"
 version = "0.4.2"
@@ -1242,6 +1400,16 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35fb2e5f958ec131621fdd531e9fc186ed768cbe395337403ae56c17a74c68ec"
 
+[[package]]
+name = "pbkdf2"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
+dependencies = [
+ "digest",
+ "hmac",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -1294,6 +1462,12 @@ dependencies = [
  "zerovec",
 ]
 
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -1414,7 +1588,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -1572,6 +1746,12 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
+[[package]]
+name = "regex-lite"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
+
 [[package]]
 name = "reqwest"
 version = "0.12.28"
@@ -1581,6 +1761,7 @@ dependencies = [
  "base64",
  "bytes",
  "futures-core",
+ "futures-util",
  "http",
  "http-body",
  "http-body-util",
@@ -1600,12 +1781,14 @@ dependencies = [
  "sync_wrapper",
  "tokio",
  "tokio-rustls",
+ "tokio-util",
  "tower",
  "tower-http",
  "tower-service",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
+ "wasm-streams",
  "web-sys",
  "webpki-roots 1.0.5",
 ]
@@ -1630,12 +1813,59 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "rust-embed"
+version = "8.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04113cb9355a377d83f06ef1f0a45b8ab8cd7d8b1288160717d66df5c7988d27"
+dependencies = [
+ "rust-embed-impl",
+ "rust-embed-utils",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-impl"
+version = "8.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0902e4c7c8e997159ab384e6d0fc91c221375f6894346ae107f47dd0f3ccaa"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rust-embed-utils",
+ "syn",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-utils"
+version = "8.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5bcdef0be6fe7f6fa333b1073c949729274b05f123a0ad7efcb8efd878e5c3b1"
+dependencies = [
+ "sha2",
+ "walkdir",
+]
+
 [[package]]
 name = "rustc-hash"
 version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"
 
+[[package]]
+name = "rustix"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "rustls"
 version = "0.23.37"
@@ -1683,6 +1913,15 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.27"
@@ -1744,6 +1983,19 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.6"
@@ -1868,6 +2120,19 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "tempfile"
+version = "3.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0136791f7c95b1f6dd99f9cc786b91bb81c3800b639b3478e561ddb7be95e5f1"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.1",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -1922,6 +2187,37 @@ dependencies = [
  "zune-jpeg 0.4.21",
 ]
 
+[[package]]
+name = "time"
+version = "0.3.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
+
+[[package]]
+name = "time-macros"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tinystr"
 version = "0.8.2"
@@ -2000,6 +2296,19 @@ dependencies = [
  "webpki-roots 0.26.11",
 ]
 
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -2090,6 +2399,12 @@ dependencies = [
  "utf-8",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
 [[package]]
 name = "typenum"
 version = "1.19.0"
@@ -2118,6 +2433,12 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -2136,6 +2457,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
 [[package]]
 name = "utf-8"
 version = "0.7.6"
@@ -2176,6 +2503,16 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
 [[package]]
 name = "want"
 version = "0.3.1"
@@ -2290,6 +2627,19 @@ dependencies = [
  "wasmparser",
 ]
 
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "wasmparser"
 version = "0.244.0"
@@ -2346,12 +2696,74 @@ version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a28ac98ddc8b9274cb41bb4d9d4d5c425b6020c50c46f25559911905610b4a88"
 
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -2777,12 +3189,44 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "zip"
+version = "8.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b680f2a0cd479b4cff6e1233c483fdead418106eae419dc60200ae9850f6d004"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "indexmap",
+ "memchr",
+ "typed-path",
+ "zopfli",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3be3d40e40a133f9c916ee3f9f4fa2d9d63435b5fbe1bfc6d9dae0aa0ada1513"
+
 [[package]]
 name = "zmij"
 version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2fc5a66a20078bf1251bde995aa2fdcc4b800c70b5d92dd2c62abc5c60f679f8"
 
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
 [[package]]
 name = "zune-core"
 version = "0.4.12"

cli/Cargo.toml

@@ -1,27 +1,51 @@
 [package]
-name = "agent-browser"
-version = "0.16.1"
+name = "chrome-use"
+version = "1.5.27"
 edition = "2021"
 description = "Fast browser automation CLI for AI agents"
 license = "Apache-2.0"
+repository = "https://github.com/leeguooooo/chrome-use"
+homepage = "https://github.com/leeguooooo/chrome-use"
+readme = "../README.md"
+keywords = ["browser", "automation", "ai", "cdp", "chrome"]
+categories = ["command-line-utilities", "web-programming"]
+
+[[bin]]
+name = "chrome-use"
+path = "src/main.rs"
 
 [dependencies]
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+regex-lite = "0.1"
 dirs = "5.0"
+include_dir = "0.7"
 base64 = "0.22"
 getrandom = "0.2"
-tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "io-util", "time", "sync", "signal"] }
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "io-util", "io-std", "time", "sync", "signal", "process"] }
 tokio-tungstenite = { version = "0.24", features = ["rustls-tls-webpki-roots"] }
 futures-util = "0.3"
 url = "2"
 uuid = { version = "1", features = ["v4"] }
 image = "0.25"
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots", "stream"] }
 sha2 = "0.10"
 aes-gcm = "0.10"
 async-trait = "0.1"
+socket2 = "0.6"
 similar = "2"
+zip = { version = "8.2.0", default-features = false, features = ["deflate"] }
+time = { version = "0.3", features = ["formatting"] }
+hmac = "0.12"
+hex = "0.4"
+aes = "0.8"
+cbc = "0.1"
+pbkdf2 = { version = "0.12", default-features = false, features = ["hmac"] }
+sha1 = "0.10"
+chrono = "0.4"
+urlencoding = "2"
+rust-embed = "8"
+serde_yaml = "0.9"
 
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
@@ -29,6 +53,9 @@ libc = "0.2"
 [target.'cfg(windows)'.dependencies]
 windows-sys = { version = "0.52", features = ["Win32_System_Threading", "Win32_Foundation"] }
 
+[dev-dependencies]
+tempfile = "3"
+
 [build-dependencies]
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"

cli/build.rs

@@ -3,7 +3,42 @@ use std::env;
 use std::fs;
 use std::path::Path;
 
+/// Embed the version of the `ab-connect` extension this CLI ships alongside, so
+/// `doctor` can tell a connected extension "you're older than what this CLI
+/// expects, update it." Read from the extension manifest at build time so it
+/// stays in sync with whatever extension version is in the same checkout/release
+/// (the ext is on its own 0.4.x line, separate from the CLI version). Falls back
+/// to "unknown" if the manifest can't be read.
+fn embed_extension_version() {
+    let manifest = Path::new("../extensions/ab-connect/manifest.json");
+    println!("cargo:rerun-if-changed=../extensions/ab-connect/manifest.json");
+    let version = fs::read_to_string(manifest)
+        .ok()
+        .and_then(|s| serde_json::from_str::<serde_json::Value>(&s).ok())
+        .and_then(|v| v.get("version").and_then(|x| x.as_str()).map(String::from))
+        .unwrap_or_else(|| "unknown".to_string());
+    println!("cargo:rustc-env=AB_CONNECT_VERSION={}", version);
+}
+
+/// Ensure `packages/dashboard/out/` exists so `rust-embed` doesn't fail during
+/// Rust-only dev builds where the dashboard hasn't been built. The placeholder
+/// `index.html` is only written when the directory is completely absent.
+fn ensure_dashboard_dir() {
+    let dashboard_out = Path::new("../packages/dashboard/out");
+    println!("cargo:rerun-if-changed=../packages/dashboard/out");
+    if !dashboard_out.join("index.html").exists() {
+        let _ = fs::create_dir_all(dashboard_out);
+        let _ = fs::write(
+            dashboard_out.join("index.html"),
+            "<!DOCTYPE html><html><body><p>Dashboard not built. Run: cd packages/dashboard &amp;&amp; pnpm build</p></body></html>\n",
+        );
+    }
+}
+
 fn main() {
+    ensure_dashboard_dir();
+    embed_extension_version();
+
     let protocol_dir = Path::new("cdp-protocol");
     let out_dir = env::var("OUT_DIR").unwrap();
     let out_path = Path::new(&out_dir).join("cdp_generated.rs");
@@ -175,7 +210,7 @@ fn to_snake_case(s: &str) -> String {
             // Only insert underscore at transitions from lowercase to uppercase,
             // or when an uppercase sequence ends (e.g. "DOM" -> "dom", not "d_o_m")
             let prev_upper = chars[i - 1].is_uppercase();
-            let next_lower = chars.get(i + 1).map_or(false, |n| n.is_lowercase());
+            let next_lower = chars.get(i + 1).is_some_and(|n| n.is_lowercase());
             if !prev_upper || next_lower {
                 result.push('_');
             }
@@ -202,7 +237,7 @@ fn resolve_ref(
             // Check if this type actually exists in the referenced domain
             if domain_types
                 .get(ref_domain)
-                .map_or(false, |t| t.contains(ref_type))
+                .is_some_and(|t| t.contains(ref_type))
             {
                 format!(
                     "super::cdp_{}::{}",
@@ -339,7 +374,7 @@ fn generate_domain(
                 if variant == "Self" {
                     variant = "SelfValue".to_string();
                 }
-                if variant.chars().next().map_or(false, |c| c.is_ascii_digit()) {
+                if variant.chars().next().is_some_and(|c| c.is_ascii_digit()) {
                     variant = format!("V{}", variant);
                 }
                 if seen_variants.insert(variant.clone()) {

cli/src/chat.rs

@@ -0,0 +1,503 @@
+use std::io::Write as _;
+use std::process::exit;
+
+use serde_json::{json, Value};
+
+use crate::color;
+use crate::flags::Flags;
+use crate::native::stream::chat;
+
+const DEFAULT_MODEL: &str = "anthropic/claude-sonnet-4.6";
+
+#[derive(Clone, Copy, PartialEq)]
+enum Verbosity {
+    Quiet,
+    Normal,
+    Verbose,
+}
+
+pub fn run_chat(flags: &Flags, message: Option<String>) {
+    if !chat::is_chat_enabled() {
+        if flags.json {
+            println!(
+                "{}",
+                json!({"success": false, "error": "AI_GATEWAY_API_KEY not set. Set the AI_GATEWAY_API_KEY environment variable to enable chat."})
+            );
+        } else {
+            eprintln!(
+                "{} AI_GATEWAY_API_KEY not set. Set the AI_GATEWAY_API_KEY environment variable to enable chat.",
+                color::error_indicator()
+            );
+        }
+        exit(1);
+    }
+
+    let verbosity = if flags.quiet {
+        Verbosity::Quiet
+    } else if flags.verbose {
+        Verbosity::Verbose
+    } else {
+        Verbosity::Normal
+    };
+
+    let model = flags
+        .model
+        .clone()
+        .unwrap_or_else(|| DEFAULT_MODEL.to_string());
+
+    let rt = tokio::runtime::Runtime::new().expect("Failed to create tokio runtime");
+
+    let is_tty = std::io::IsTerminal::is_terminal(&std::io::stdin());
+
+    match message {
+        Some(msg) => {
+            rt.block_on(run_single_turn(
+                &flags.session,
+                &model,
+                &msg,
+                verbosity,
+                flags.json,
+            ));
+        }
+        None if !is_tty => {
+            let mut input = String::new();
+            if let Err(e) = std::io::stdin().read_line(&mut input) {
+                if flags.json {
+                    println!(
+                        "{}",
+                        json!({"success": false, "error": format!("Failed to read stdin: {}", e)})
+                    );
+                } else {
+                    eprintln!("{} Failed to read stdin: {}", color::error_indicator(), e);
+                }
+                exit(1);
+            }
+            let input = input.trim();
+            if input.is_empty() {
+                if flags.json {
+                    println!(
+                        "{}",
+                        json!({"success": false, "error": "No input provided"})
+                    );
+                } else {
+                    eprintln!("{} No input provided", color::error_indicator());
+                }
+                exit(1);
+            }
+            rt.block_on(run_single_turn(
+                &flags.session,
+                &model,
+                input,
+                verbosity,
+                flags.json,
+            ));
+        }
+        None => {
+            rt.block_on(run_interactive(
+                &flags.session,
+                &model,
+                verbosity,
+                flags.json,
+            ));
+        }
+    }
+}
+
+async fn run_single_turn(
+    session: &str,
+    model: &str,
+    message: &str,
+    verbosity: Verbosity,
+    json_mode: bool,
+) {
+    let mut openai_messages: Vec<Value> =
+        vec![json!({"role": "system", "content": chat::get_system_prompt()})];
+    openai_messages.push(json!({"role": "user", "content": message}));
+
+    let result = run_chat_turn(session, model, &mut openai_messages, verbosity, json_mode).await;
+    if !result {
+        exit(1);
+    }
+}
+
+async fn run_interactive(session: &str, model: &str, verbosity: Verbosity, json_mode: bool) {
+    let mut openai_messages: Vec<Value> =
+        vec![json!({"role": "system", "content": chat::get_system_prompt()})];
+
+    let gateway_url = std::env::var("AI_GATEWAY_URL")
+        .unwrap_or_else(|_| chat::DEFAULT_AI_GATEWAY_URL.to_string())
+        .trim_end_matches('/')
+        .to_string();
+    let api_key = std::env::var("AI_GATEWAY_API_KEY").unwrap_or_default();
+    let url = format!("{}/v1/chat/completions", gateway_url);
+    let client = chat::http_client();
+
+    loop {
+        if !json_mode {
+            eprint!("{} ", color::cyan(">"));
+            let _ = std::io::stderr().flush();
+        }
+
+        let mut input = String::new();
+        match std::io::stdin().read_line(&mut input) {
+            Ok(0) => break,
+            Err(_) => break,
+            Ok(_) => {}
+        }
+
+        let input = input.trim();
+        if input.is_empty() {
+            continue;
+        }
+
+        if matches!(input, "quit" | "exit" | "q") {
+            break;
+        }
+
+        openai_messages.push(json!({"role": "user", "content": input}));
+
+        // Compaction check
+        let total_chars = chat::estimate_chars(&openai_messages);
+        if total_chars > chat::COMPACT_THRESHOLD_CHARS
+            && openai_messages.len() > chat::KEEP_RECENT_MESSAGES + 2
+        {
+            let split = chat::find_safe_split(&openai_messages, chat::KEEP_RECENT_MESSAGES);
+            let to_summarize = &openai_messages[1..split];
+            if let Some(summary) =
+                chat::summarize_for_compaction(client, &url, &api_key, model, to_summarize).await
+            {
+                let summary_msg = json!({
+                    "role": "system",
+                    "content": format!("[Conversation summary]\n{}", summary)
+                });
+                let recent = openai_messages[split..].to_vec();
+                openai_messages = vec![openai_messages[0].clone(), summary_msg];
+                openai_messages.extend(recent);
+            }
+        }
+
+        let success =
+            run_chat_turn(session, model, &mut openai_messages, verbosity, json_mode).await;
+
+        if !success && !json_mode {
+            // Continue the loop on error; don't exit interactive mode
+        }
+
+        if !json_mode {
+            eprintln!();
+        }
+    }
+}
+
+/// Runs one chat turn: sends messages to the gateway, streams text/tool calls,
+/// executes tools in a loop until the model is done. Appends assistant and tool
+/// messages to `openai_messages`. Returns true on success.
+async fn run_chat_turn(
+    session: &str,
+    model: &str,
+    openai_messages: &mut Vec<Value>,
+    verbosity: Verbosity,
+    json_mode: bool,
+) -> bool {
+    let gateway_url = std::env::var("AI_GATEWAY_URL")
+        .unwrap_or_else(|_| chat::DEFAULT_AI_GATEWAY_URL.to_string())
+        .trim_end_matches('/')
+        .to_string();
+    let api_key = match std::env::var("AI_GATEWAY_API_KEY") {
+        Ok(k) => k,
+        Err(_) => {
+            if json_mode {
+                println!(
+                    "{}",
+                    json!({"success": false, "error": "AI_GATEWAY_API_KEY not set"})
+                );
+            } else {
+                eprintln!("{} AI_GATEWAY_API_KEY not set", color::error_indicator());
+            }
+            return false;
+        }
+    };
+
+    let tools: Value = serde_json::from_str(chat::CHAT_TOOLS).unwrap();
+    let url = format!("{}/v1/chat/completions", gateway_url);
+    let client = chat::http_client();
+
+    let total_deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(300);
+    let tool_timeout = std::time::Duration::from_secs(60);
+
+    let mut all_text = String::new();
+    let mut all_tool_calls: Vec<Value> = Vec::new();
+    let mut had_text = false;
+
+    for _step in 0..50 {
+        if tokio::time::Instant::now() >= total_deadline {
+            if json_mode {
+                println!(
+                    "{}",
+                    json!({"success": false, "error": "Chat session timed out (5 minute limit)."})
+                );
+            } else {
+                eprintln!(
+                    "\n{} Chat session timed out (5 minute limit).",
+                    color::error_indicator()
+                );
+            }
+            return false;
+        }
+
+        let gateway_body = json!({
+            "model": model,
+            "messages": openai_messages,
+            "tools": tools,
+            "stream": true,
+        });
+
+        let gw_response = match client
+            .post(&url)
+            .header("Authorization", format!("Bearer {}", api_key))
+            .header("Content-Type", "application/json")
+            .body(gateway_body.to_string())
+            .send()
+            .await
+        {
+            Ok(r) => r,
+            Err(e) => {
+                if json_mode {
+                    println!(
+                        "{}",
+                        json!({"success": false, "error": format!("Gateway request failed: {}", e)})
+                    );
+                } else {
+                    eprintln!(
+                        "\n{} Gateway request failed: {}",
+                        color::error_indicator(),
+                        e
+                    );
+                }
+                return false;
+            }
+        };
+
+        if !gw_response.status().is_success() {
+            let body_text = gw_response.text().await.unwrap_or_default();
+            if json_mode {
+                println!("{}", json!({"success": false, "error": body_text}));
+            } else {
+                eprintln!("\n{} {}", color::error_indicator(), body_text);
+            }
+            return false;
+        }
+
+        let (text_chunks, tool_calls) =
+            parse_gateway_stream(gw_response, verbosity, json_mode).await;
+
+        if !text_chunks.is_empty() {
+            let text = text_chunks.join("");
+            all_text.push_str(&text);
+            if !json_mode {
+                if !had_text && verbosity != Verbosity::Quiet {
+                    // Add blank line before text if we showed tool calls
+                    if !all_tool_calls.is_empty() {
+                        println!();
+                    }
+                }
+                had_text = true;
+            }
+
+            let mut content = json!(text);
+            if let Some(last) = openai_messages.last() {
+                if last.get("role").and_then(|r| r.as_str()) == Some("assistant")
+                    && last.get("tool_calls").is_some()
+                {
+                    content = json!(text);
+                }
+            }
+            openai_messages.push(json!({"role": "assistant", "content": content}));
+        }
+
+        if tool_calls.is_empty() {
+            break;
+        }
+
+        let tc_values: Vec<Value> = tool_calls
+            .iter()
+            .map(|(id, name, args)| {
+                json!({"id": id, "type": "function", "function": {"name": name, "arguments": args}})
+            })
+            .collect();
+
+        if text_chunks.is_empty() {
+            openai_messages.push(json!({"role": "assistant", "tool_calls": tc_values}));
+        } else {
+            // If we had both text and tool calls in the same response, merge them
+            if let Some(last) = openai_messages.last_mut() {
+                if last.get("role").and_then(|r| r.as_str()) == Some("assistant")
+                    && last.get("tool_calls").is_none()
+                {
+                    last["tool_calls"] = json!(tc_values);
+                } else {
+                    openai_messages.push(json!({"role": "assistant", "tool_calls": tc_values}));
+                }
+            }
+        }
+
+        for (tc_id, _tc_name, tc_args) in &tool_calls {
+            let input: Value = serde_json::from_str(tc_args).unwrap_or(json!({}));
+            let command = input.get("command").and_then(|c| c.as_str()).unwrap_or("");
+
+            if !json_mode && verbosity != Verbosity::Quiet {
+                eprintln!("{}", color::dim(&format!("> {}", command)));
+            }
+
+            let result =
+                match tokio::time::timeout(tool_timeout, chat::execute_chat_tool(session, command))
+                    .await
+                {
+                    Ok(r) => r,
+                    Err(_) => "Tool execution timed out after 60 seconds.".to_string(),
+                };
+
+            if !json_mode && verbosity == Verbosity::Verbose {
+                for line in result.lines() {
+                    eprintln!("  {}", color::dim(line));
+                }
+            }
+
+            all_tool_calls.push(json!({
+                "command": command,
+                "output": result
+            }));
+
+            openai_messages.push(json!({
+                "role": "tool",
+                "tool_call_id": tc_id,
+                "content": result
+            }));
+        }
+    }
+
+    if json_mode {
+        println!(
+            "{}",
+            json!({
+                "success": true,
+                "text": all_text,
+                "tool_calls": all_tool_calls
+            })
+        );
+    } else if !had_text && !json_mode {
+        // Model returned only tool calls with no final text; print newline for clean output
+        println!();
+    }
+
+    true
+}
+
+/// Parses the SSE stream from the AI gateway, printing text deltas to stdout in
+/// real-time. Returns (collected_text_chunks, tool_calls).
+async fn parse_gateway_stream(
+    gw_response: reqwest::Response,
+    verbosity: Verbosity,
+    json_mode: bool,
+) -> (Vec<String>, Vec<(String, String, String)>) {
+    use futures_util::StreamExt as _;
+
+    let mut text_chunks: Vec<String> = Vec::new();
+    let mut tool_call_args: std::collections::HashMap<usize, (String, String, String)> =
+        std::collections::HashMap::new();
+    let mut byte_stream = gw_response.bytes_stream();
+    let mut buffer = String::new();
+
+    while let Some(chunk_result) = byte_stream.next().await {
+        let chunk = match chunk_result {
+            Ok(c) => c,
+            Err(_) => break,
+        };
+
+        buffer.push_str(&String::from_utf8_lossy(&chunk));
+
+        while let Some(newline_pos) = buffer.find('\n') {
+            let line = buffer[..newline_pos].trim_end_matches('\r').to_string();
+            buffer = buffer[newline_pos + 1..].to_string();
+
+            if line.is_empty() {
+                continue;
+            }
+            let Some(data) = line.strip_prefix("data: ") else {
+                continue;
+            };
+            if data == "[DONE]" {
+                let tool_calls = collect_tool_calls(&mut tool_call_args);
+                if !json_mode && !text_chunks.is_empty() {
+                    // End the streamed text line
+                    let _ = std::io::stdout().flush();
+                }
+                return (text_chunks, tool_calls);
+            }
+            let Ok(sse_json) = serde_json::from_str::<Value>(data) else {
+                continue;
+            };
+            let delta = sse_json
+                .get("choices")
+                .and_then(|c| c.get(0))
+                .and_then(|c| c.get("delta"));
+            let Some(delta) = delta else { continue };
+
+            if let Some(text) = delta.get("content").and_then(|c| c.as_str()) {
+                if !text.is_empty() {
+                    text_chunks.push(text.to_string());
+                    if !json_mode && verbosity != Verbosity::Quiet {
+                        print!("{}", text);
+                        let _ = std::io::stdout().flush();
+                    }
+                }
+            }
+
+            if let Some(tcs) = delta.get("tool_calls").and_then(|t| t.as_array()) {
+                for tc in tcs {
+                    let idx = tc.get("index").and_then(|i| i.as_u64()).unwrap_or(0) as usize;
+                    if let std::collections::hash_map::Entry::Vacant(e) = tool_call_args.entry(idx)
+                    {
+                        let id = tc
+                            .get("id")
+                            .and_then(|i| i.as_str())
+                            .unwrap_or("")
+                            .to_string();
+                        let name = tc
+                            .get("function")
+                            .and_then(|f| f.get("name"))
+                            .and_then(|n| n.as_str())
+                            .unwrap_or("")
+                            .to_string();
+                        e.insert((id, name, String::new()));
+                    }
+                    if let Some(arg_delta) = tc
+                        .get("function")
+                        .and_then(|f| f.get("arguments"))
+                        .and_then(|a| a.as_str())
+                    {
+                        let entry = tool_call_args.get_mut(&idx).unwrap();
+                        entry.2.push_str(arg_delta);
+                    }
+                }
+            }
+        }
+    }
+
+    if !json_mode && !text_chunks.is_empty() {
+        let _ = std::io::stdout().flush();
+    }
+    let tool_calls = collect_tool_calls(&mut tool_call_args);
+    (text_chunks, tool_calls)
+}
+
+fn collect_tool_calls(
+    map: &mut std::collections::HashMap<usize, (String, String, String)>,
+) -> Vec<(String, String, String)> {
+    let mut indices: Vec<usize> = map.keys().copied().collect();
+    indices.sort();
+    indices
+        .into_iter()
+        .filter_map(|idx| map.remove(&idx))
+        .collect()
+}

cli/src/color.rs

@@ -1,15 +1,30 @@
-//! Color output utilities respecting NO_COLOR environment variable.
+//! Color output utilities.
 //!
-//! When the NO_COLOR environment variable is present (regardless of value),
-//! all color formatting is disabled per https://no-color.org/
+//! Colors are off by default (agent-friendly). Enable with
+//! `AGENT_BROWSER_COLOR=1`. Setting `NO_COLOR` to any value disables
+//! colors per <https://no-color.org/>.
 
 use std::env;
 use std::sync::OnceLock;
 
-/// Returns true if color output is enabled (NO_COLOR is NOT set)
+fn env_is_truthy(name: &str) -> Option<bool> {
+    env::var(name)
+        .ok()
+        .map(|val| !matches!(val.to_lowercase().as_str(), "0" | "false" | "no"))
+}
+
+/// Returns true if color output is enabled.
+///
+/// Priority: `NO_COLOR` (presence disables, per spec) >
+/// `AGENT_BROWSER_COLOR` (truthy enables) > default (off).
 pub fn is_enabled() -> bool {
     static COLORS_ENABLED: OnceLock<bool> = OnceLock::new();
-    *COLORS_ENABLED.get_or_init(|| env::var("NO_COLOR").is_err())
+    *COLORS_ENABLED.get_or_init(|| {
+        if env::var_os("NO_COLOR").is_some() {
+            return false;
+        }
+        env_is_truthy("AGENT_BROWSER_COLOR").unwrap_or(false)
+    })
 }
 
 /// Format text in red (errors)

cli/src/connect.rs

@@ -0,0 +1,754 @@
+//! `chrome-use connect` — zero-confirmation control of the user's real,
+//! logged-in Chrome via the `ab-connect` MV3 extension over Chrome **native
+//! messaging** (no localhost port, no token; Chrome authenticates the extension
+//! to this host by id).
+//!
+//! Two pieces live here:
+//! - `run_connect` — `--install` writes the native-messaging host manifest (and
+//!   a tiny launcher) so Chrome will spawn us; with no flag it reports status.
+//! - `run_nm_host` — the hidden `__nm-host` mode Chrome launches: it speaks the
+//!   native-messaging stdio framing (4-byte little-endian length + JSON).
+//!
+//! This step wires the transport end-to-end (Chrome ⇄ host). Bridging the host
+//! to the daemon's relay + CdpClient is layered on next.
+
+use std::io::Write;
+use std::path::PathBuf;
+
+/// Native-messaging host name; must match `HOST_NAME` in the extension and the
+/// manifest filename. `com.agent_browser.connect` is the original name, used by
+/// every shipped extension up to ab-connect 0.4.2.
+pub const HOST_NAME: &str = "com.agent_browser.connect";
+
+/// Alternate host name for the chrome-use rebrand era (ab-connect 0.5.0+). We
+/// install AND recognize both names so the relay works regardless of which
+/// extension version a user has — old (0.4.2) or new — with no forced
+/// re-install. See [`install_native_host`] / [`host_installed`].
+pub const HOST_NAME_ALT: &str = "com.leeguoo.chrome_use";
+
+/// Every native-messaging host name this CLI installs and accepts.
+pub const HOST_NAMES: &[&str] = &[HOST_NAME, HOST_NAME_ALT];
+
+/// Stable id of the `ab-connect` extension, pinned by the `key` in its
+/// manifest.json (and the signing key of the published `.crx`). Chrome only lets
+/// that extension talk to this host, and the force-install policy references it.
+pub const EXTENSION_ID: &str = "ciiljdlhdpfckdcfkphgmfalanpdejep";
+
+/// The Chrome Web Store assigns its own id (the manifest "key" is stripped from
+/// store uploads), so the published build has a different origin than the local
+/// Load-unpacked one. Allow both to talk to the native-messaging host.
+pub const STORE_EXTENSION_ID: &str = "knfcmbamhjmaonkfnjhldjedeobeafmk";
+
+/// Update URL the force-install policy points at. MUST be the Chrome Web Store
+/// endpoint: Chrome 149 tags any **off-Web-Store** force-installed extension
+/// `[BLOCKED]` on an unmanaged browser (verified on macOS — chrome://policy shows
+/// `[BLOCKED]…` / "Error, Warning"). Self-hosting a `.crx` therefore does NOT
+/// work on consumer Chrome; the extension must be published to the Web Store, and
+/// then this policy force-installs it silently (Web Store extensions are allowed).
+pub const UPDATE_URL: &str = "https://clients2.google.com/service/update2/crx";
+
+/// Public Web Store listing — the guaranteed one-click "Add to Chrome" path,
+/// and the fallback when the force-install profile can't be approved headlessly.
+pub const STORE_URL: &str =
+    "https://chromewebstore.google.com/detail/ciiljdlhdpfckdcfkphgmfalanpdejep";
+
+/// Stable identifiers for the generated Chrome configuration profile, so a
+/// re-install replaces (rather than duplicates) it in System Settings.
+const PROFILE_ID: &str = "work.pwtk.chrome-use.ab-connect";
+const PROFILE_UUID: &str = "A1B2C3D4-AB00-4CCE-9E10-AAAABBBBCCCC";
+const PROFILE_PAYLOAD_UUID: &str = "A1B2C3D4-AB01-4CCE-9E10-DDDDEEEEFFFF";
+
+/// `chrome-use extension <install|uninstall|status>` (local; no daemon).
+/// `args` is the cleaned argv including the leading "extension".
+pub fn run_connect(args: &[String], json: bool) {
+    let install = args.iter().any(|a| a == "--install" || a == "install");
+    let uninstall = args.iter().any(|a| a == "--uninstall" || a == "uninstall");
+
+    if uninstall {
+        let removed = remove_host_manifests();
+        let profile_removed = remove_force_install_profile();
+        if json {
+            report(
+                json,
+                true,
+                &format!("removed {removed} native-host manifest(s)"),
+            );
+        } else {
+            println!("✓ removed {removed} native-host manifest(s).");
+            if profile_removed {
+                println!("✓ removed ~/.chrome-use/ab-connect.mobileconfig");
+            }
+            if cfg!(target_os = "macos") {
+                println!(
+                    "  To fully remove the extension, delete the \"chrome-use connect\" profile\n\
+                     in System Settings → Profiles (or run: profiles remove -identifier {PROFILE_ID})."
+                );
+            }
+        }
+        return;
+    }
+    if install {
+        let no_open = args.iter().any(|a| a == "--no-open");
+        match install_native_host() {
+            Ok(paths) => {
+                let profile = install_force_install_profile(no_open);
+                if json {
+                    println!(
+                        "{}",
+                        serde_json::to_string(&serde_json::json!({
+                            "success": true,
+                            "data": {
+                                "installed": paths,
+                                "extensionId": EXTENSION_ID,
+                                "profile": profile.as_ref().ok().map(|p| p.display().to_string()),
+                                "profileError": profile.as_ref().err(),
+                                "updateUrl": UPDATE_URL,
+                            }
+                        }))
+                        .unwrap_or_default()
+                    );
+                } else {
+                    println!("✓ native-messaging host installed:");
+                    for p in &paths {
+                        println!("  {p}");
+                    }
+                    match profile {
+                        Ok(path) => {
+                            println!(
+                                "\n✓ Chrome force-install profile written:\n  {}",
+                                path.display()
+                            );
+                            if cfg!(target_os = "macos") {
+                                println!(
+                                    "\nGet the extension into Chrome (one-time). Either:\n\
+                                     A) One click: open {STORE_URL}\n   and press \"Add to Chrome\".\n\
+                                     B) Silent: approve the profile, then restart Chrome —\n   \
+                                     System Settings → General → Device Management → double-click\n   \
+                                     \"chrome-use connect\" → Install. Chrome then force-installs +\n   \
+                                     auto-updates it (no token, no per-use confirmation).\n\
+                                     Both need the extension published to the Web Store; until then use\n   \
+                                     chrome://extensions → Developer mode → Load unpacked → extensions/ab-connect."
+                                );
+                            }
+                        }
+                        Err(e) => {
+                            println!("\n! could not write the force-install profile: {e}");
+                            println!(
+                                "  Fallback: load extensions/ab-connect via chrome://extensions →\n\
+                                 Developer mode → Load unpacked."
+                            );
+                        }
+                    }
+                }
+            }
+            Err(e) => report(json, false, &format!("install failed: {e}")),
+        }
+        return;
+    }
+
+    // Status.
+    let manifest = host_manifest_path_for_chrome();
+    let installed = manifest.as_ref().map(|p| p.exists()).unwrap_or(false);
+    if json {
+        println!(
+            "{}",
+            serde_json::to_string(&serde_json::json!({
+                "success": true,
+                "data": {
+                    "installed": installed,
+                    "manifest": manifest.as_ref().map(|p| p.display().to_string()),
+                    "extensionId": EXTENSION_ID,
+                }
+            }))
+            .unwrap_or_default()
+        );
+    } else if installed {
+        println!("✓ native-messaging host installed ({HOST_NAME}).");
+        println!("  Load the ab-connect extension and it connects automatically.");
+    } else {
+        println!("✗ not installed. Run: chrome-use connect --install");
+    }
+}
+
+/// Write the launcher script + native-messaging host manifest(s).
+fn install_native_host() -> Result<Vec<String>, String> {
+    let home = dirs::home_dir().ok_or("no home dir")?;
+    let ab_dir = home.join(".chrome-use");
+    std::fs::create_dir_all(&ab_dir).map_err(|e| e.to_string())?;
+
+    // Chrome execs the manifest `path` directly with the calling extension's
+    // origin as argv[1]; a launcher lets us run the binary in __nm-host mode
+    // regardless of how/where chrome-use is installed.
+    let exe = std::env::current_exe().map_err(|e| e.to_string())?;
+    let launcher = ab_dir.join("nm-host.sh");
+    let script = format!(
+        "#!/bin/sh\n# chrome-use native-messaging host launcher (auto-generated)\nexec \"{}\" __nm-host \"$@\"\n",
+        exe.display()
+    );
+    std::fs::write(&launcher, script).map_err(|e| e.to_string())?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = std::fs::set_permissions(&launcher, std::fs::Permissions::from_mode(0o755));
+    }
+
+    // Write a manifest under EVERY accepted host name (both point to the same
+    // launcher + allowed extensions), so any extension version's
+    // `connectNative(<its host name>)` finds a matching host json.
+    let mut written = Vec::new();
+    for dir in native_messaging_dirs() {
+        if let Some(parent) = dir.parent() {
+            if !parent.exists() {
+                continue; // that browser isn't installed
+            }
+        }
+        std::fs::create_dir_all(&dir).map_err(|e| e.to_string())?;
+        for host in HOST_NAMES {
+            let manifest = serde_json::json!({
+                "name": host,
+                "description": "chrome-use connect — native messaging host",
+                "path": launcher.display().to_string(),
+                "type": "stdio",
+                "allowed_origins": [
+                    format!("chrome-extension://{EXTENSION_ID}/"),
+                    format!("chrome-extension://{STORE_EXTENSION_ID}/"),
+                ],
+            });
+            let body = serde_json::to_string_pretty(&manifest).map_err(|e| e.to_string())?;
+            let path = dir.join(format!("{host}.json"));
+            std::fs::write(&path, &body).map_err(|e| e.to_string())?;
+            written.push(path.display().to_string());
+        }
+    }
+    if written.is_empty() {
+        return Err("no Chrome/Chromium NativeMessagingHosts directory found".into());
+    }
+    Ok(written)
+}
+
+/// Write a Chrome configuration profile that force-installs `ab-connect` from
+/// [`UPDATE_URL`], and (unless `no_open`) `open` it so the user approves it once
+/// in System Settings. Returns the profile path. macOS only — elsewhere it
+/// returns an error and the caller prints the manual fallback.
+fn install_force_install_profile(no_open: bool) -> Result<PathBuf, String> {
+    if !cfg!(target_os = "macos") {
+        return Err("force-install profile is macOS-only; on Linux set Chrome's \
+                    ExtensionInstallForcelist policy JSON, or Load unpacked from chrome://extensions"
+            .into());
+    }
+    let home = dirs::home_dir().ok_or("no home dir")?;
+    let ab_dir = home.join(".chrome-use");
+    std::fs::create_dir_all(&ab_dir).map_err(|e| e.to_string())?;
+    let path = ab_dir.join("ab-connect.mobileconfig");
+    std::fs::write(&path, force_install_mobileconfig()).map_err(|e| e.to_string())?;
+    if !no_open {
+        // `open` queues the profile in System Settings for one-time approval.
+        let _ = std::process::Command::new("open").arg(&path).status();
+    }
+    Ok(path)
+}
+
+/// The `.mobileconfig` payload: a user-scope Chrome policy that force-installs
+/// the extension from the Chrome Web Store. User scope installs without admin —
+/// just a one-time approval click. Must use the STORE id (the Web Store update
+/// server serves the published extension under the id it assigned, not the local
+/// Load-unpacked id).
+fn force_install_mobileconfig() -> String {
+    let forcelist = format!("{STORE_EXTENSION_ID};{UPDATE_URL}");
+    format!(
+        r#"<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>PayloadContent</key>
+  <array>
+    <dict>
+      <key>PayloadType</key><string>com.google.Chrome</string>
+      <key>PayloadVersion</key><integer>1</integer>
+      <key>PayloadIdentifier</key><string>{PROFILE_ID}.chrome</string>
+      <key>PayloadUUID</key><string>{PROFILE_PAYLOAD_UUID}</string>
+      <key>PayloadEnabled</key><true/>
+      <key>PayloadDisplayName</key><string>chrome-use connect (Chrome)</string>
+      <key>ExtensionInstallForcelist</key>
+      <array>
+        <string>{forcelist}</string>
+      </array>
+    </dict>
+  </array>
+  <key>PayloadType</key><string>Configuration</string>
+  <key>PayloadVersion</key><integer>1</integer>
+  <key>PayloadIdentifier</key><string>{PROFILE_ID}</string>
+  <key>PayloadUUID</key><string>{PROFILE_UUID}</string>
+  <key>PayloadDisplayName</key><string>chrome-use connect</string>
+  <key>PayloadDescription</key><string>Force-installs the chrome-use connect extension so chrome-use can drive your logged-in Chrome. No token, no per-use confirmation.</string>
+  <key>PayloadOrganization</key><string>chrome-use</string>
+  <key>PayloadScope</key><string>User</string>
+  <key>PayloadRemovalDisallowed</key><false/>
+</dict>
+</plist>
+"#
+    )
+}
+
+/// Remove the generated `.mobileconfig` file (the profile itself is removed by
+/// the user from System Settings, or via `profiles remove`).
+fn remove_force_install_profile() -> bool {
+    dirs::home_dir()
+        .map(|h| h.join(".chrome-use").join("ab-connect.mobileconfig"))
+        .filter(|p| p.exists())
+        .map(|p| std::fs::remove_file(&p).is_ok())
+        .unwrap_or(false)
+}
+
+fn remove_host_manifests() -> usize {
+    let mut n = 0;
+    for dir in native_messaging_dirs() {
+        for host in HOST_NAMES {
+            let path = dir.join(format!("{host}.json"));
+            if path.exists() && std::fs::remove_file(&path).is_ok() {
+                n += 1;
+            }
+        }
+    }
+    n
+}
+
+/// Per-OS NativeMessagingHosts directories for Chrome + Chromium-family browsers.
+fn native_messaging_dirs() -> Vec<PathBuf> {
+    let mut dirs_out = Vec::new();
+    #[cfg(target_os = "macos")]
+    {
+        if let Some(app_support) = dirs::config_dir() {
+            for sub in [
+                "Google/Chrome",
+                "Google/Chrome Beta",
+                "Google/Chrome Canary",
+                "Chromium",
+                "Microsoft Edge",
+                "BraveSoftware/Brave-Browser",
+            ] {
+                dirs_out.push(app_support.join(sub).join("NativeMessagingHosts"));
+            }
+        }
+    }
+    #[cfg(all(unix, not(target_os = "macos")))]
+    {
+        if let Some(config) = dirs::config_dir() {
+            for sub in [
+                "google-chrome",
+                "chromium",
+                "microsoft-edge",
+                "BraveSoftware/Brave-Browser",
+            ] {
+                dirs_out.push(config.join(sub).join("NativeMessagingHosts"));
+            }
+        }
+    }
+    dirs_out
+}
+
+fn host_manifest_path_for_chrome() -> Option<PathBuf> {
+    native_messaging_dirs()
+        .into_iter()
+        .flat_map(|d| HOST_NAMES.iter().map(move |h| d.join(format!("{h}.json"))))
+        .find(|p| p.exists())
+        .or_else(|| {
+            native_messaging_dirs()
+                .into_iter()
+                .next()
+                .map(|d| d.join(format!("{HOST_NAME}.json")))
+        })
+}
+
+/// True if the ab-connect native-messaging host manifest is present — i.e. the
+/// user has set up the extension path. When installed, auto-connect treats the
+/// dialog-free extension relay as the *intended* transport and refuses to fall
+/// back to a raw debug port (which would pop Chrome 136+'s "Allow remote
+/// debugging?" consent modal). The relay-url file comes and goes with the
+/// service worker; this manifest is the durable signal that the extension is
+/// the chosen path.
+pub fn host_installed() -> bool {
+    native_messaging_dirs().into_iter().any(|d| {
+        HOST_NAMES
+            .iter()
+            .any(|h| d.join(format!("{h}.json")).exists())
+    })
+}
+
+fn report(json: bool, ok: bool, msg: &str) {
+    if json {
+        println!(
+            "{}",
+            serde_json::to_string(&serde_json::json!({ "success": ok, "error": if ok { serde_json::Value::Null } else { serde_json::json!(msg) }, "message": msg }))
+                .unwrap_or_default()
+        );
+    } else if ok {
+        println!("✓ {msg}");
+    } else {
+        eprintln!("✗ {msg}");
+    }
+    if !ok {
+        std::process::exit(1);
+    }
+}
+
+// ---- native messaging host (`__nm-host`) ----------------------------------
+
+fn nm_log(line: &str) {
+    let path = dirs::home_dir()
+        .map(|h| h.join(".chrome-use").join("nm-host.log"))
+        .unwrap_or_else(|| PathBuf::from("/tmp/ab-nm-host.log"));
+    if let Some(p) = path.parent() {
+        let _ = std::fs::create_dir_all(p);
+    }
+    if let Ok(mut f) = std::fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(&path)
+    {
+        let _ = writeln!(f, "{line}");
+    }
+}
+
+fn random_guid() -> String {
+    let mut b = [0u8; 16];
+    let _ = getrandom::getrandom(&mut b);
+    b.iter().map(|x| format!("{x:02x}")).collect()
+}
+
+/// Where the daemon/CLI reads the relay's CDP WebSocket URL (perms 600).
+///
+/// Cross-binary handoff: the native-messaging *host* writes it and the CLI reads
+/// it, but the two may be different binaries under different brand dirs after
+/// the agent-browser → chrome-use rename. Read from whichever brand dir actually
+/// has the file (an old `agent-browser` host writes `~/.agent-browser`; a
+/// `chrome-use` host writes `~/.chrome-use`); default to [`config_home`].
+fn relay_url_path() -> PathBuf {
+    if let Some(home) = dirs::home_dir() {
+        for base in [".chrome-use", ".agent-browser"] {
+            let p = home.join(base).join("relay-cdp-url");
+            if p.exists() {
+                return p;
+            }
+        }
+        return crate::connection::config_home().join("relay-cdp-url");
+    }
+    PathBuf::from("/tmp/ab-relay-cdp-url")
+}
+
+/// The live relay CDP WebSocket URL, if the native-messaging host is running
+/// (it writes the file on connect and removes it on exit). Used by
+/// `chrome-use extension connect` to attach without the user copying a URL.
+pub fn relay_url() -> Option<String> {
+    let s = std::fs::read_to_string(relay_url_path()).ok()?;
+    let s = s.trim().to_string();
+    if s.starts_with("ws://") {
+        Some(s)
+    } else {
+        None
+    }
+}
+
+/// Append a one-line record of how a CDP connection was established, to
+/// `~/.chrome-use/connect-mode.log`. This is the smoking-gun detector for the
+/// "Allow remote debugging?" consent modal: that modal ONLY appears on a raw
+/// remote-debugging attach / a browser we launched with a debug port — NEVER on
+/// the extension relay. When the modal reappears, this log says which session
+/// took which path and when, so we can tell a code regression (`raw-port` /
+/// `launched` while the relay was up) from Chrome's own extension-debugger
+/// consent UX. Low volume (one line per connection); best-effort, never fails a
+/// connection.
+pub fn log_connect_mode(ws_url: &str, launched: bool, session: &str) {
+    let relay = relay_url();
+    let relay_up = relay.is_some();
+    let mode = if launched {
+        "launched(debug-port)"
+    } else if relay.as_deref() == Some(ws_url) {
+        "relay"
+    } else if ws_url.contains("127.0.0.1") || ws_url.contains("localhost") {
+        "raw-port-attach"
+    } else {
+        "remote-ws"
+    };
+    // A raw-port attach or a self-launch while the relay was available is the
+    // exact thing that pops the consent modal — flag it loudly in the line.
+    let suspect = (mode == "raw-port-attach" || launched) && relay_up;
+    let line = format!(
+        "session={session} mode={mode} relay_up={relay_up}{} ws={ws_url}\n",
+        if suspect { " CONSENT-MODAL-RISK" } else { "" }
+    );
+    if let Some(home) = dirs::home_dir() {
+        let path = home.join(".chrome-use").join("connect-mode.log");
+        use std::io::Write;
+        if let Ok(mut f) = std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(&path)
+        {
+            let _ = f.write_all(line.as_bytes());
+        }
+    }
+}
+
+/// Sidecar recording the connected extension's version, written by the host when
+/// it receives the extension's `hello` (sibling of `relay-cdp-url`). Lets
+/// `doctor` surface which extension build is live without a CDP round-trip.
+fn relay_ext_version_path() -> PathBuf {
+    relay_url_path().with_file_name("relay-ext-version")
+}
+
+/// Version of the connected `ab-connect` extension, if the host learned it from
+/// the extension's `hello`. `None` when no extension has connected since the
+/// host started, or the extension predates version reporting.
+pub fn relay_ext_version() -> Option<String> {
+    let s = std::fs::read_to_string(relay_ext_version_path())
+        .ok()?
+        .trim()
+        .to_string();
+    if s.is_empty() {
+        None
+    } else {
+        Some(s)
+    }
+}
+
+/// Hidden `__nm-host` mode: launched by Chrome for the ab-connect extension.
+///
+/// Bridges the extension (native-messaging stdio, envelope protocol) to a local
+/// **CDP WebSocket endpoint** that chrome-use connects to like any Chrome.
+/// `relay::RelayState` translates envelope ⇄ raw CDP and emulates browser-level
+/// Target discovery. The ws URL carries an unguessable guid (written to a 600
+/// file) so only this user's chrome-use — not arbitrary local processes —
+/// can drive the browser. No token, no user interaction.
+pub fn run_nm_host() {
+    let rt = match tokio::runtime::Builder::new_multi_thread()
+        .enable_all()
+        .build()
+    {
+        Ok(rt) => rt,
+        Err(e) => {
+            nm_log(&format!("[nm-host] runtime build failed: {e}"));
+            return;
+        }
+    };
+    rt.block_on(nm_host_main());
+}
+
+async fn nm_host_main() {
+    use crate::native::relay::{RelayOut, RelayState};
+    use std::collections::HashMap;
+    use std::sync::atomic::{AtomicU64, Ordering};
+    use std::sync::Arc;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    use tokio::sync::{mpsc, Mutex};
+
+    /// client_id -> unbounded sender feeding that client's ws writer.
+    type ClientMap = Arc<Mutex<HashMap<u64, mpsc::UnboundedSender<String>>>>;
+
+    nm_log(&format!(
+        "[nm-host] start argv={:?}",
+        std::env::args().skip(1).collect::<Vec<_>>()
+    ));
+
+    let listener = match tokio::net::TcpListener::bind("127.0.0.1:0").await {
+        Ok(l) => l,
+        Err(e) => {
+            nm_log(&format!("[nm-host] bind failed: {e}"));
+            return;
+        }
+    };
+    let port = listener.local_addr().map(|a| a.port()).unwrap_or(0);
+    let guid = random_guid();
+    let url = format!("ws://127.0.0.1:{port}/{guid}");
+    let url_path = relay_url_path();
+    if let Some(p) = url_path.parent() {
+        let _ = std::fs::create_dir_all(p);
+    }
+    if std::fs::write(&url_path, &url).is_ok() {
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+            let _ = std::fs::set_permissions(&url_path, std::fs::Permissions::from_mode(0o600));
+        }
+    }
+    nm_log(&format!("[nm-host] cdp endpoint {url}"));
+
+    let state = Arc::new(Mutex::new(RelayState::new()));
+    let clients: ClientMap = Arc::new(Mutex::new(HashMap::new()));
+    let next_client_id = Arc::new(AtomicU64::new(1));
+    let (to_ext, mut to_ext_rx) = mpsc::channel::<Vec<u8>>(4096);
+
+    // Single writer to Chrome (extension) over stdout, native-messaging framed.
+    tokio::spawn(async move {
+        let mut out = tokio::io::stdout();
+        while let Some(frame) = to_ext_rx.recv().await {
+            let len = (frame.len() as u32).to_ne_bytes();
+            if out.write_all(&len).await.is_err() || out.write_all(&frame).await.is_err() {
+                break;
+            }
+            let _ = out.flush().await;
+        }
+    });
+
+    // Accept chrome-use CDP clients on the guid-scoped ws endpoint.
+    {
+        let state = state.clone();
+        let clients = clients.clone();
+        let next_client_id = next_client_id.clone();
+        let to_ext = to_ext.clone();
+        let guid = guid.clone();
+        tokio::spawn(async move {
+            loop {
+                let (stream, _) = match listener.accept().await {
+                    Ok(x) => x,
+                    Err(_) => break,
+                };
+                let st = state.clone();
+                let client_id = next_client_id.fetch_add(1, Ordering::Relaxed);
+                let (ctx, crx) = mpsc::unbounded_channel::<String>();
+                clients.lock().await.insert(client_id, ctx);
+                let tx = to_ext.clone();
+                let g = guid.clone();
+                let cls = clients.clone();
+                tokio::spawn(async move {
+                    handle_cdp_client(stream, g, st, client_id, crx, tx, cls).await;
+                });
+            }
+        });
+    }
+
+    // Extension → host frames.
+    let mut stdin = tokio::io::stdin();
+    loop {
+        let mut len_buf = [0u8; 4];
+        if stdin.read_exact(&mut len_buf).await.is_err() {
+            break;
+        }
+        let len = u32::from_ne_bytes(len_buf) as usize;
+        let mut buf = vec![0u8; len];
+        if stdin.read_exact(&mut buf).await.is_err() {
+            break;
+        }
+        let v: serde_json::Value = match serde_json::from_slice(&buf) {
+            Ok(v) => v,
+            Err(_) => continue,
+        };
+        // Extension version handshake: record it next to the relay URL so
+        // `doctor` can report which extension build is live (and whether it's
+        // behind). Best-effort; the message carries no CDP payload.
+        if v.get("method").and_then(|m| m.as_str()) == Some("hello") {
+            if let Some(ver) = v.get("version").and_then(|x| x.as_str()) {
+                let _ = std::fs::write(relay_ext_version_path(), ver);
+            }
+            continue;
+        }
+        let outs = {
+            let mut s = state.lock().await;
+            s.handle_ext_message(&v, "")
+        };
+        for o in outs {
+            match o {
+                RelayOut::ToClient { to, msg } => {
+                    let text = msg.to_string();
+                    let cls = clients.lock().await;
+                    match to {
+                        // Command reply → only the client that issued it.
+                        Some(cid) => {
+                            if let Some(tx) = cls.get(&cid) {
+                                let _ = tx.send(text);
+                            }
+                        }
+                        // CDP event → fan out to every connected client.
+                        None => {
+                            for tx in cls.values() {
+                                let _ = tx.send(text.clone());
+                            }
+                        }
+                    }
+                }
+                RelayOut::ToExt(m) => {
+                    let _ = to_ext.send(m.to_string().into_bytes()).await;
+                }
+            }
+        }
+    }
+    nm_log("[nm-host] stdin EOF — Chrome closed the port");
+    let _ = std::fs::remove_file(relay_url_path());
+    let _ = std::fs::remove_file(relay_ext_version_path());
+}
+
+#[allow(clippy::too_many_arguments)]
+// The handshake-callback Result type is dictated by tokio-tungstenite's
+// accept_hdr_async contract; its Err variant (an http Response) can't be shrunk.
+#[allow(clippy::result_large_err)]
+async fn handle_cdp_client(
+    stream: tokio::net::TcpStream,
+    guid: String,
+    state: std::sync::Arc<tokio::sync::Mutex<crate::native::relay::RelayState>>,
+    client_id: u64,
+    mut from_relay: tokio::sync::mpsc::UnboundedReceiver<String>,
+    to_ext: tokio::sync::mpsc::Sender<Vec<u8>>,
+    clients: std::sync::Arc<
+        tokio::sync::Mutex<
+            std::collections::HashMap<u64, tokio::sync::mpsc::UnboundedSender<String>>,
+        >,
+    >,
+) {
+    use crate::native::relay::ClientRoute;
+    use futures_util::{SinkExt, StreamExt};
+    use tokio_tungstenite::tungstenite::Message;
+
+    let want_path = format!("/{guid}");
+    let cb = |req: &tokio_tungstenite::tungstenite::handshake::server::Request,
+              resp: tokio_tungstenite::tungstenite::handshake::server::Response| {
+        if req.uri().path() == want_path {
+            Ok(resp)
+        } else {
+            let mut reject = tokio_tungstenite::tungstenite::handshake::server::ErrorResponse::new(
+                Some("forbidden".to_string()),
+            );
+            *reject.status_mut() = tokio_tungstenite::tungstenite::http::StatusCode::FORBIDDEN;
+            Err(reject)
+        }
+    };
+    let ws = match tokio_tungstenite::accept_hdr_async(stream, cb).await {
+        Ok(ws) => ws,
+        Err(_) => return,
+    };
+    nm_log("[nm-host] cdp client connected");
+    // Ask the extension to (re)attach + announce every tab so this client
+    // discovers the user's existing tabs instead of racing an empty list.
+    let _ = to_ext.send(br#"{"method":"attachAll"}"#.to_vec()).await;
+    let (mut tx, mut rx) = ws.split();
+    loop {
+        tokio::select! {
+            relayed = from_relay.recv() => match relayed {
+                Some(text) => { if tx.send(Message::Text(text)).await.is_err() { break } }
+                None => break,
+            },
+            incoming = rx.next() => match incoming {
+                Some(Ok(Message::Text(text))) => {
+                    let v: serde_json::Value = match serde_json::from_str(&text) {
+                        Ok(v) => v,
+                        Err(_) => continue,
+                    };
+                    let route = { state.lock().await.route_client_command(client_id, &v) };
+                    match route {
+                        ClientRoute::Local(reply) => {
+                            if tx.send(Message::Text(reply.to_string())).await.is_err() { break }
+                        }
+                        ClientRoute::Forward(env) => {
+                            let _ = to_ext.send(env.to_string().into_bytes()).await;
+                        }
+                    }
+                }
+                Some(Ok(Message::Close(_))) | None => break,
+                _ => {}
+            },
+        }
+    }
+    // Unregister and forget this client's in-flight commands.
+    clients.lock().await.remove(&client_id);
+    state.lock().await.drop_client(client_id);
+    nm_log("[nm-host] cdp client disconnected");
+}

cli/src/cookie_export.rs

@@ -0,0 +1,332 @@
+//! Offline export of a Chrome profile's cookies.
+//!
+//! Reads a profile's on-disk cookie store, decrypts the values with the OS
+//! credential-store key, and returns CDP `Network.setCookie`-shaped objects —
+//! the same shape `cookies set --curl` accepts. This is what powers
+//! `cookies transfer`: it moves a logged-in session (whose auth cookies are
+//! httpOnly + secure and span several hosts) from one profile to another
+//! without the source profile being reachable over CDP, and without restarting
+//! Chrome.
+//!
+//! Currently macOS-only. There, value encryption uses the `v10` scheme:
+//! AES-128-CBC with a key derived (PBKDF2-HMAC-SHA1, 1003 iterations) from the
+//! "Chrome Safe Storage" Keychain entry, shared by every profile of one Chrome
+//! install. Other platforms return a clear error.
+
+use serde_json::{json, Value};
+use std::path::{Path, PathBuf};
+
+/// Resolve, read, and decrypt a Chrome profile's cookies.
+///
+/// `profile` accepts a directory name ("Default", "Profile 14"), a display name
+/// ("Davian", case-insensitive), or "auto" (last-used profile). `domain`, when
+/// set, is a comma-separated host-suffix filter (e.g. "claude.ai,anthropic.com")
+/// matched against `host_key`; pass `None` to export every cookie.
+pub fn export_cookies(profile: &str, domain: Option<&str>) -> Result<Vec<Value>, String> {
+    let db = resolve_cookie_db(profile)?;
+    let rows = read_cookie_rows(&db, domain)?;
+    let key = safe_storage_key()?;
+    let mut out = Vec::with_capacity(rows.len());
+    for r in &rows {
+        if let Some(value) = decrypt_value(&r.encrypted_value, &key) {
+            out.push(to_cdp_cookie(r, value));
+        }
+    }
+    Ok(out)
+}
+
+fn resolve_cookie_db(profile: &str) -> Result<PathBuf, String> {
+    use crate::native::cdp::chrome::{find_chrome_user_data_dir, resolve_chrome_profile};
+    let udd = find_chrome_user_data_dir()
+        .ok_or_else(|| "No Chrome user data directory found".to_string())?;
+    let dir = resolve_chrome_profile(&udd, profile)?;
+    let base = udd.join(&dir);
+    // Chrome >=96 keeps cookies under Network/; older builds at the profile root.
+    let net = base.join("Network").join("Cookies");
+    if net.is_file() {
+        return Ok(net);
+    }
+    let root = base.join("Cookies");
+    if root.is_file() {
+        return Ok(root);
+    }
+    Err(format!(
+        "no cookie store found for profile \"{}\" (looked in {} and {})",
+        profile,
+        net.display(),
+        root.display()
+    ))
+}
+
+struct CookieRow {
+    host_key: String,
+    name: String,
+    encrypted_value: Vec<u8>,
+    path: String,
+    is_secure: bool,
+    is_httponly: bool,
+    samesite: i64,
+    expires_utc: i64,
+}
+
+/// Removes a temp directory when dropped.
+struct TempGuard(PathBuf);
+impl Drop for TempGuard {
+    fn drop(&mut self) {
+        let _ = std::fs::remove_dir_all(&self.0);
+    }
+}
+
+fn read_cookie_rows(db: &Path, domain: Option<&str>) -> Result<Vec<CookieRow>, String> {
+    // Copy the store (plus any -wal/-shm) to a temp file so a running Chrome's
+    // lock / hot journal can't block the read or be disturbed by it.
+    let tmp_dir = std::env::temp_dir().join(format!("chrome-use-cookies-{}", uuid::Uuid::new_v4()));
+    std::fs::create_dir_all(&tmp_dir).map_err(|e| format!("temp dir: {}", e))?;
+    let _guard = TempGuard(tmp_dir.clone());
+    let tmp_db = tmp_dir.join("Cookies");
+    copy_db(db, &tmp_db)?;
+
+    let where_clause = build_where(domain)?;
+    let sql = format!(
+        "SELECT json_group_array(json_object(\
+           'h',host_key,'n',name,'e',hex(encrypted_value),'p',path,\
+           'sec',is_secure,'ho',is_httponly,'ss',samesite,'x',expires_utc)) \
+         FROM cookies{};",
+        where_clause
+    );
+    let output = std::process::Command::new("sqlite3")
+        .arg(tmp_db.to_string_lossy().to_string())
+        .arg(&sql)
+        .output()
+        .map_err(|e| {
+            format!(
+                "could not run sqlite3 (required to read the cookie store): {}",
+                e
+            )
+        })?;
+    if !output.status.success() {
+        return Err(format!(
+            "sqlite3 failed reading the cookie store: {}",
+            String::from_utf8_lossy(&output.stderr).trim()
+        ));
+    }
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let trimmed = stdout.trim();
+    if trimmed.is_empty() || trimmed == "null" {
+        return Ok(Vec::new());
+    }
+    let arr: Vec<Value> =
+        serde_json::from_str(trimmed).map_err(|e| format!("parsing cookie rows: {}", e))?;
+    let mut rows = Vec::with_capacity(arr.len());
+    for v in arr {
+        let enc_hex = v.get("e").and_then(|x| x.as_str()).unwrap_or("");
+        let path = v.get("p").and_then(|x| x.as_str()).unwrap_or("/");
+        rows.push(CookieRow {
+            host_key: v
+                .get("h")
+                .and_then(|x| x.as_str())
+                .unwrap_or("")
+                .to_string(),
+            name: v
+                .get("n")
+                .and_then(|x| x.as_str())
+                .unwrap_or("")
+                .to_string(),
+            encrypted_value: hex::decode(enc_hex).unwrap_or_default(),
+            path: if path.is_empty() {
+                "/".to_string()
+            } else {
+                path.to_string()
+            },
+            is_secure: v.get("sec").and_then(|x| x.as_i64()).unwrap_or(0) != 0,
+            is_httponly: v.get("ho").and_then(|x| x.as_i64()).unwrap_or(0) != 0,
+            samesite: v.get("ss").and_then(|x| x.as_i64()).unwrap_or(-1),
+            expires_utc: v.get("x").and_then(|x| x.as_i64()).unwrap_or(0),
+        });
+    }
+    Ok(rows)
+}
+
+fn copy_db(src: &Path, dst: &Path) -> Result<(), String> {
+    std::fs::copy(src, dst).map_err(|e| format!("copying cookie store: {}", e))?;
+    for suffix in ["-wal", "-shm"] {
+        let s = path_with_suffix(src, suffix);
+        if s.is_file() {
+            let _ = std::fs::copy(&s, path_with_suffix(dst, suffix));
+        }
+    }
+    Ok(())
+}
+
+fn path_with_suffix(p: &Path, suffix: &str) -> PathBuf {
+    let mut s = p.as_os_str().to_os_string();
+    s.push(suffix);
+    PathBuf::from(s)
+}
+
+/// Build a `WHERE host_key LIKE '%domain'` clause from a comma-separated filter.
+/// Domains are validated (alnum/./-) so they can be inlined without injection.
+fn build_where(domain: Option<&str>) -> Result<String, String> {
+    let Some(domain) = domain else {
+        return Ok(String::new());
+    };
+    let mut clauses = Vec::new();
+    for d in domain.split(',') {
+        let d = d.trim();
+        if d.is_empty() {
+            continue;
+        }
+        if !d
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '.' || c == '-')
+        {
+            return Err(format!("invalid domain filter \"{}\"", d));
+        }
+        clauses.push(format!("host_key LIKE '%{}'", d));
+    }
+    if clauses.is_empty() {
+        Ok(String::new())
+    } else {
+        Ok(format!(" WHERE {}", clauses.join(" OR ")))
+    }
+}
+
+fn to_cdp_cookie(r: &CookieRow, value: String) -> Value {
+    let mut o = serde_json::Map::new();
+    o.insert("name".into(), json!(r.name));
+    o.insert("value".into(), json!(value));
+    o.insert("domain".into(), json!(r.host_key));
+    o.insert("path".into(), json!(r.path));
+    o.insert("secure".into(), json!(r.is_secure));
+    o.insert("httpOnly".into(), json!(r.is_httponly));
+    // Chrome SameSite: -1 unspecified, 0 None, 1 Lax, 2 Strict.
+    let same_site = match r.samesite {
+        0 => Some("None"),
+        1 => Some("Lax"),
+        2 => Some("Strict"),
+        _ => None,
+    };
+    if let Some(ss) = same_site {
+        // CDP rejects SameSite=None without Secure; downgrade rather than fail.
+        if ss == "None" && !r.is_secure {
+            o.insert("sameSite".into(), json!("Lax"));
+        } else {
+            o.insert("sameSite".into(), json!(ss));
+        }
+    }
+    if let Some(unix) = chrome_epoch_to_unix(r.expires_utc) {
+        o.insert("expires".into(), json!(unix));
+    }
+    Value::Object(o)
+}
+
+/// Chrome stores `expires_utc` as microseconds since 1601-01-01 (0 = session
+/// cookie). CDP wants seconds since the Unix epoch. Returns None for session
+/// cookies and anything that converts to a non-positive time.
+fn chrome_epoch_to_unix(expires_utc: i64) -> Option<f64> {
+    if expires_utc <= 0 {
+        return None;
+    }
+    let unix = expires_utc as f64 / 1_000_000.0 - 11_644_473_600.0;
+    if unix > 0.0 {
+        Some(unix)
+    } else {
+        None
+    }
+}
+
+/// Decrypt a Chrome `v10` cookie value (AES-128-CBC, IV = 16 spaces, PKCS7).
+/// Returns None for unrecognized schemes or undecryptable values.
+fn decrypt_value(enc: &[u8], key: &[u8; 16]) -> Option<String> {
+    if enc.len() < 3 || &enc[0..3] != b"v10" {
+        return None;
+    }
+    use aes::cipher::{block_padding::Pkcs7, BlockDecryptMut, KeyIvInit};
+    type Dec = cbc::Decryptor<aes::Aes128>;
+    let iv = [0x20u8; 16];
+    let mut buf = enc[3..].to_vec();
+    let pt = Dec::new(key.into(), &iv.into())
+        .decrypt_padded_mut::<Pkcs7>(&mut buf)
+        .ok()?;
+    // Chrome >=24 prepends a 32-byte SHA256(host) domain hash to the plaintext.
+    match std::str::from_utf8(pt) {
+        Ok(s) => Some(s.to_string()),
+        Err(_) if pt.len() > 32 => Some(String::from_utf8_lossy(&pt[32..]).into_owned()),
+        Err(_) => None,
+    }
+}
+
+#[cfg(target_os = "macos")]
+fn safe_storage_key() -> Result<[u8; 16], String> {
+    use pbkdf2::pbkdf2_hmac;
+    use sha1::Sha1;
+    let out = std::process::Command::new("security")
+        .args(["find-generic-password", "-ws", "Chrome Safe Storage"])
+        .output()
+        .map_err(|e| format!("could not read Keychain (security command): {}", e))?;
+    if !out.status.success() {
+        return Err(
+            "could not read the 'Chrome Safe Storage' key from Keychain \
+             (you may be prompted to allow access — approve it and retry)"
+                .to_string(),
+        );
+    }
+    let pw = String::from_utf8_lossy(&out.stdout);
+    let pw = pw.trim_end_matches('\n');
+    let mut key = [0u8; 16];
+    pbkdf2_hmac::<Sha1>(pw.as_bytes(), b"saltysalt", 1003, &mut key);
+    Ok(key)
+}
+
+#[cfg(not(target_os = "macos"))]
+fn safe_storage_key() -> Result<[u8; 16], String> {
+    Err("cookies export/transfer is currently supported on macOS only".to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn where_clause_filters_and_validates() {
+        assert_eq!(build_where(None).unwrap(), "");
+        assert_eq!(
+            build_where(Some("claude.ai")).unwrap(),
+            " WHERE host_key LIKE '%claude.ai'"
+        );
+        assert_eq!(
+            build_where(Some("claude.ai, anthropic.com")).unwrap(),
+            " WHERE host_key LIKE '%claude.ai' OR host_key LIKE '%anthropic.com'"
+        );
+        assert!(build_where(Some("evil' OR 1=1 --")).is_err());
+    }
+
+    #[test]
+    fn epoch_conversion() {
+        assert_eq!(chrome_epoch_to_unix(0), None);
+        assert_eq!(chrome_epoch_to_unix(-5), None);
+        // 13380163200000000 us since 1601 == 2025-01-01T00:00:00Z (1735689600 unix)
+        assert_eq!(
+            chrome_epoch_to_unix(13_380_163_200_000_000),
+            Some(1_735_689_600.0)
+        );
+    }
+
+    #[test]
+    fn to_cdp_downgrades_samesite_none_without_secure() {
+        let row = CookieRow {
+            host_key: ".claude.ai".into(),
+            name: "x".into(),
+            encrypted_value: vec![],
+            path: "/".into(),
+            is_secure: false,
+            is_httponly: true,
+            samesite: 0, // None
+            expires_utc: 0,
+        };
+        let c = to_cdp_cookie(&row, "v".into());
+        assert_eq!(c["sameSite"], "Lax");
+        assert_eq!(c["httpOnly"], true);
+        assert_eq!(c.get("expires"), None);
+    }
+}

cli/src/doctor/chrome.rs

@@ -0,0 +1,156 @@
+//! Check the Chrome install: binary path, version, cache dirs, user-data
+//! dir, and the optional lightpanda engine.
+
+use std::env;
+use std::path::{Path, PathBuf};
+
+use super::helpers::which_exists;
+use super::{Check, Status};
+
+pub(super) fn check(checks: &mut Vec<Check>) {
+    let category = "Chrome";
+
+    let chrome = crate::native::cdp::chrome::find_chrome();
+    match chrome {
+        Some(path) => {
+            let label = path.display().to_string();
+            match query_chrome_version(&path) {
+                Some(version) => checks.push(Check::new(
+                    "chrome.installed",
+                    category,
+                    Status::Pass,
+                    format!("{} at {}", version, label),
+                )),
+                None => checks.push(Check::new(
+                    "chrome.installed",
+                    category,
+                    Status::Pass,
+                    format!("Chrome at {} (version unknown)", label),
+                )),
+            }
+        }
+        None => checks.push(
+            Check::new(
+                "chrome.installed",
+                category,
+                Status::Fail,
+                "No Chrome binary found",
+            )
+            .with_fix("chrome-use install"),
+        ),
+    }
+
+    let cache_dir = crate::install::get_browsers_dir();
+    if cache_dir.exists() {
+        checks.push(Check::new(
+            "chrome.cache_dir",
+            category,
+            Status::Info,
+            format!("Cache dir {}", cache_dir.display()),
+        ));
+    }
+
+    if let Some(puppeteer_dir) = puppeteer_cache_dir() {
+        if puppeteer_dir.exists() {
+            checks.push(Check::new(
+                "chrome.puppeteer_cache",
+                category,
+                Status::Info,
+                format!(
+                    "Puppeteer cache also present: {} (will be used as a fallback)",
+                    puppeteer_dir.display()
+                ),
+            ));
+        }
+    }
+
+    if let Some(user_data_dir) = crate::native::cdp::chrome::find_chrome_user_data_dir() {
+        let profiles = crate::native::cdp::chrome::list_chrome_profiles(&user_data_dir);
+        let count = profiles.len();
+        let dir_label = user_data_dir.display().to_string();
+        if count == 0 {
+            checks.push(Check::new(
+                "chrome.user_data_dir",
+                category,
+                Status::Info,
+                format!(
+                    "Chrome user data dir found ({}), no profiles parsed",
+                    dir_label
+                ),
+            ));
+        } else {
+            checks.push(Check::new(
+                "chrome.user_data_dir",
+                category,
+                Status::Info,
+                format!("{} Chrome profile(s) at {}", count, dir_label),
+            ));
+        }
+    }
+
+    if let Ok(engine) = env::var("AGENT_BROWSER_ENGINE") {
+        if engine == "lightpanda" {
+            // Best-effort PATH lookup; absence is FAIL only when the user
+            // explicitly opted into the lightpanda engine.
+            if which_exists("lightpanda") {
+                checks.push(Check::new(
+                    "chrome.engine_lightpanda",
+                    category,
+                    Status::Pass,
+                    "Lightpanda binary on PATH",
+                ));
+            } else {
+                checks.push(
+                    Check::new(
+                        "chrome.engine_lightpanda",
+                        category,
+                        Status::Fail,
+                        "AGENT_BROWSER_ENGINE=lightpanda but no lightpanda binary on PATH",
+                    )
+                    .with_fix("install lightpanda or unset AGENT_BROWSER_ENGINE"),
+                );
+            }
+        }
+    }
+}
+
+fn query_chrome_version(path: &Path) -> Option<String> {
+    let output = std::process::Command::new(path)
+        .arg("--version")
+        .output()
+        .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    let s = String::from_utf8_lossy(&output.stdout).trim().to_string();
+    if s.is_empty() {
+        None
+    } else {
+        Some(s)
+    }
+}
+
+pub(super) fn puppeteer_cache_dir() -> Option<PathBuf> {
+    if let Ok(p) = env::var("PUPPETEER_CACHE_DIR") {
+        return Some(PathBuf::from(p));
+    }
+    dirs::home_dir().map(|h| h.join(".cache").join("puppeteer"))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_puppeteer_cache_dir_returns_sensible_default() {
+        // When PUPPETEER_CACHE_DIR is unset, we fall back to
+        // ~/.cache/puppeteer. Mutating env vars here would race with other
+        // tests, so just verify the fallback path is shaped correctly.
+        if env::var("PUPPETEER_CACHE_DIR").is_err() {
+            let dir = puppeteer_cache_dir().expect("home dir should resolve in tests");
+            let s = dir.to_string_lossy();
+            assert!(s.contains(".cache"));
+            assert!(s.ends_with("puppeteer"));
+        }
+    }
+}

cli/src/doctor/config.rs

@@ -0,0 +1,90 @@
+//! Check user config files: `~/.chrome-use/config.json`,
+//! `./chrome-use.json`, and any file referenced by
+//! `AGENT_BROWSER_CONFIG`.
+
+use std::env;
+use std::path::PathBuf;
+
+use super::helpers::parse_json_file;
+use super::{Check, Status};
+
+pub(super) fn check(checks: &mut Vec<Check>) {
+    let category = "Config";
+
+    let user_path = dirs::home_dir().map(|d| d.join(".chrome-use").join("config.json"));
+    if let Some(p) = user_path {
+        if p.exists() {
+            match parse_json_file(&p) {
+                Ok(_) => checks.push(Check::new(
+                    "config.user",
+                    category,
+                    Status::Pass,
+                    format!("{} (valid JSON)", p.display()),
+                )),
+                Err(e) => checks.push(
+                    Check::new(
+                        "config.user",
+                        category,
+                        Status::Fail,
+                        format!("{}: {}", p.display(), e),
+                    )
+                    .with_fix(format!("edit {}", p.display())),
+                ),
+            }
+        }
+    }
+
+    let project_path = PathBuf::from("chrome-use.json");
+    if project_path.exists() {
+        match parse_json_file(&project_path) {
+            Ok(_) => checks.push(Check::new(
+                "config.project",
+                category,
+                Status::Pass,
+                format!("{} (valid JSON)", project_path.display()),
+            )),
+            Err(e) => checks.push(
+                Check::new(
+                    "config.project",
+                    category,
+                    Status::Fail,
+                    format!("{}: {}", project_path.display(), e),
+                )
+                .with_fix(format!("edit {}", project_path.display())),
+            ),
+        }
+    }
+
+    if let Ok(custom) = env::var("AGENT_BROWSER_CONFIG") {
+        let p = PathBuf::from(&custom);
+        if !p.exists() {
+            checks.push(
+                Check::new(
+                    "config.custom",
+                    category,
+                    Status::Fail,
+                    format!("AGENT_BROWSER_CONFIG points to missing file: {}", custom),
+                )
+                .with_fix("update or unset AGENT_BROWSER_CONFIG"),
+            );
+        } else {
+            match parse_json_file(&p) {
+                Ok(_) => checks.push(Check::new(
+                    "config.custom",
+                    category,
+                    Status::Pass,
+                    format!("AGENT_BROWSER_CONFIG: {} (valid JSON)", custom),
+                )),
+                Err(e) => checks.push(
+                    Check::new(
+                        "config.custom",
+                        category,
+                        Status::Fail,
+                        format!("AGENT_BROWSER_CONFIG: {}: {}", custom, e),
+                    )
+                    .with_fix(format!("edit {}", custom)),
+                ),
+            }
+        }
+    }
+}

cli/src/doctor/daemon.rs

@@ -0,0 +1,70 @@
+//! Check running daemons: inventory of sessions, version match with the
+//! CLI, and stale sidecar files cleaned up as a side effect of the walk.
+
+use super::{Check, Status};
+use crate::connection::{walk_daemons, CleanReason};
+
+pub(super) fn check(checks: &mut Vec<Check>) {
+    let category = "Daemons";
+    let cli_version = env!("CARGO_PKG_VERSION");
+
+    let inventory = walk_daemons();
+
+    for cleaned in &inventory.cleaned {
+        let reason = match cleaned.reason {
+            CleanReason::ProcessGone | CleanReason::DashboardGone => "process gone",
+            CleanReason::UnreadablePidFile => "unreadable pid file",
+            CleanReason::OrphanedSocket => "orphaned socket",
+        };
+        checks.push(Check::new(
+            format!("daemon.cleaned.{}", cleaned.name),
+            category,
+            Status::Warn,
+            format!("Cleaned stale files: {} ({})", cleaned.name, reason),
+        ));
+    }
+
+    if inventory.sessions.is_empty() {
+        checks.push(Check::new(
+            "daemon.active",
+            category,
+            Status::Pass,
+            "No active daemons",
+        ));
+    } else {
+        for session in &inventory.sessions {
+            let version_match = session.version.as_deref() == Some(cli_version);
+            let status = if version_match {
+                Status::Pass
+            } else {
+                Status::Warn
+            };
+            let suffix = if version_match {
+                String::new()
+            } else {
+                format!(" (version mismatch with CLI {})", cli_version)
+            };
+            let mut check = Check::new(
+                format!("daemon.session.{}", session.name),
+                category,
+                status,
+                format!("Session {} (pid {}){}", session.name, session.pid, suffix),
+            );
+            if !version_match {
+                check = check.with_fix(format!("chrome-use --session {} close", session.name));
+            }
+            checks.push(check);
+        }
+    }
+
+    if let Some(dashboard) = inventory.dashboard {
+        if dashboard.alive {
+            checks.push(Check::new(
+                "daemon.dashboard",
+                category,
+                Status::Pass,
+                format!("Dashboard server running (pid {})", dashboard.pid),
+            ));
+        }
+    }
+}

cli/src/doctor/environment.rs

@@ -0,0 +1,140 @@
+//! Check the local environment: CLI version, platform, state/socket dirs,
+//! and free disk space.
+
+use std::path::Path;
+
+use super::helpers::{disk_free_bytes, human_size, is_writable_dir};
+use super::{Check, Status};
+use crate::connection::get_socket_dir;
+use crate::native::state::get_state_dir;
+
+pub(super) fn check(checks: &mut Vec<Check>) {
+    let category = "Environment";
+
+    let version = env!("CARGO_PKG_VERSION");
+    let platform = format!("{} {}", std::env::consts::OS, std::env::consts::ARCH);
+    checks.push(Check::new(
+        "env.version",
+        category,
+        Status::Pass,
+        format!("CLI version {} ({})", version, platform),
+    ));
+
+    match dirs::home_dir() {
+        Some(home) => checks.push(Check::new(
+            "env.home",
+            category,
+            Status::Pass,
+            format!("Home directory {}", home.display()),
+        )),
+        None => checks.push(Check::new(
+            "env.home",
+            category,
+            Status::Fail,
+            "Could not determine home directory",
+        )),
+    }
+
+    let state_dir = get_state_dir();
+    let socket_dir = get_socket_dir();
+
+    // Under the default setup, state and socket dirs are the same
+    // (~/.chrome-use). Collapse to a single line when they match;
+    // split when XDG_RUNTIME_DIR or AGENT_BROWSER_SOCKET_DIR diverts
+    // sockets elsewhere.
+    if state_dir == socket_dir {
+        push_dir_check(
+            checks,
+            "env.state_dir",
+            category,
+            "State and socket directory",
+            &state_dir,
+        );
+    } else {
+        push_dir_check(
+            checks,
+            "env.state_dir",
+            category,
+            "State directory",
+            &state_dir,
+        );
+        push_dir_check(
+            checks,
+            "env.socket_dir",
+            category,
+            "Socket directory",
+            &socket_dir,
+        );
+    }
+
+    match disk_free_bytes(&state_dir) {
+        Some(bytes) => {
+            let mb = bytes / (1024 * 1024);
+            let human = human_size(bytes);
+            if mb < 500 {
+                checks.push(
+                    Check::new(
+                        "env.disk_free",
+                        category,
+                        Status::Warn,
+                        format!("Low disk space at state dir: {} free", human),
+                    )
+                    .with_fix("free up disk space; Chrome installs require ~500 MB"),
+                );
+            } else {
+                checks.push(Check::new(
+                    "env.disk_free",
+                    category,
+                    Status::Pass,
+                    format!("{} free at state dir", human),
+                ));
+            }
+        }
+        None => checks.push(Check::new(
+            "env.disk_free",
+            category,
+            Status::Info,
+            "Disk free check unavailable on this platform",
+        )),
+    }
+}
+
+fn push_dir_check(
+    checks: &mut Vec<Check>,
+    id: &'static str,
+    category: &'static str,
+    label: &str,
+    dir: &Path,
+) {
+    if dir.exists() {
+        if is_writable_dir(dir) {
+            checks.push(Check::new(
+                id,
+                category,
+                Status::Pass,
+                format!("{} {}", label, dir.display()),
+            ));
+        } else {
+            checks.push(
+                Check::new(
+                    id,
+                    category,
+                    Status::Fail,
+                    format!("{} not writable: {}", label, dir.display()),
+                )
+                .with_fix(format!("chmod u+rwx {}", dir.display())),
+            );
+        }
+    } else {
+        checks.push(Check::new(
+            id,
+            category,
+            Status::Info,
+            format!(
+                "{} does not exist yet (will be created on first use): {}",
+                label,
+                dir.display()
+            ),
+        ));
+    }
+}

cli/src/doctor/fix.rs

@@ -0,0 +1,247 @@
+//! Destructive repair actions behind `--fix`: reinstall Chrome, close
+//! version-mismatched daemons, purge expired state files, and generate a
+//! missing encryption key.
+
+use std::env;
+use std::fs;
+use std::path::Path;
+use std::time::{Duration, SystemTime};
+
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt;
+
+use serde_json::json;
+
+use super::helpers::new_id;
+use super::{Check, Status};
+use crate::connection::{cleanup_stale_files, send_command, walk_daemons};
+use crate::native::state::{get_sessions_dir, get_state_dir};
+
+pub(super) fn run(checks: &mut [Check], fixed: &mut Vec<String>) {
+    // `close_all_sessions` is expensive and closes every session at once, so
+    // only fire it on the first daemon.session.* Warn we encounter. Subsequent
+    // daemon.session.* Warn checks piggy-back on the same result.
+    let mut daemons_closed: Option<usize> = None;
+
+    for c in checks.iter_mut() {
+        match c.id.as_str() {
+            "chrome.installed" if c.status == Status::Fail => {
+                let installed = attempt_chrome_install();
+                if installed {
+                    fixed.push("Reinstalled Chrome".to_string());
+                    c.status = Status::Pass;
+                    c.message = format!("{} (fixed by --fix)", c.message);
+                    c.fix = None;
+                }
+            }
+            id if id.starts_with("daemon.session.") && c.status == Status::Warn => {
+                let killed = *daemons_closed.get_or_insert_with(|| {
+                    let n = close_all_sessions();
+                    if n > 0 {
+                        fixed.push(format!("Closed {} version-mismatched daemon(s)", n));
+                    }
+                    n
+                });
+                if killed > 0 {
+                    c.status = Status::Pass;
+                    c.message = format!("{} (fixed by --fix)", c.message);
+                    c.fix = None;
+                }
+            }
+            "security.state_count" if c.status == Status::Warn => {
+                let removed = purge_old_state();
+                if removed > 0 {
+                    fixed.push(format!("Deleted {} expired state file(s)", removed));
+                    c.status = Status::Pass;
+                    c.message = format!("{} (fixed by --fix)", c.message);
+                    c.fix = None;
+                }
+            }
+            "security.encryption_key" if c.status == Status::Info => {
+                let generated = create_encryption_key();
+                if generated {
+                    fixed.push("Generated encryption key".to_string());
+                    c.status = Status::Pass;
+                    c.message = format!("{} (fixed by --fix)", c.message);
+                    c.fix = None;
+                }
+            }
+            _ => {}
+        }
+    }
+}
+
+fn attempt_chrome_install() -> bool {
+    // run_install() uses process::exit on failure, so we shell out to ourselves
+    // to avoid taking down the doctor process if the install fails.
+    let exe = match std::env::current_exe() {
+        Ok(p) => p,
+        Err(_) => return false,
+    };
+    std::process::Command::new(exe)
+        .arg("install")
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(false)
+}
+
+fn close_all_sessions() -> usize {
+    let mut killed = 0;
+    for session in &walk_daemons().sessions {
+        let cmd = json!({ "id": new_id(), "action": "close" });
+        if send_command(cmd, &session.name).is_ok() {
+            killed += 1;
+        }
+        cleanup_stale_files(&session.name);
+    }
+    killed
+}
+
+fn purge_old_state() -> usize {
+    let dir = get_sessions_dir();
+    let expire_days = env::var("AGENT_BROWSER_STATE_EXPIRE_DAYS")
+        .ok()
+        .and_then(|s| s.parse::<u64>().ok())
+        .unwrap_or(30);
+    let cutoff = SystemTime::now()
+        .checked_sub(Duration::from_secs(expire_days * 86_400))
+        .unwrap_or(SystemTime::UNIX_EPOCH);
+    let mut removed = 0;
+    if let Ok(entries) = fs::read_dir(&dir) {
+        for entry in entries.flatten() {
+            if entry.file_type().map(|t| t.is_file()).unwrap_or(false) {
+                if let Ok(meta) = entry.metadata() {
+                    if let Ok(modified) = meta.modified() {
+                        if modified < cutoff && fs::remove_file(entry.path()).is_ok() {
+                            removed += 1;
+                        }
+                    }
+                }
+            }
+        }
+    }
+    removed
+}
+
+fn create_encryption_key() -> bool {
+    create_encryption_key_at(&get_state_dir())
+}
+
+fn create_encryption_key_at(dir: &Path) -> bool {
+    if fs::create_dir_all(dir).is_err() {
+        return false;
+    }
+    #[cfg(unix)]
+    {
+        let _ = fs::set_permissions(dir, fs::Permissions::from_mode(0o700));
+    }
+    let path = dir.join(".encryption-key");
+    if path.exists() {
+        return false;
+    }
+    let mut buf = [0u8; 32];
+    if getrandom::getrandom(&mut buf).is_err() {
+        return false;
+    }
+    let hex: String = buf.iter().map(|b| format!("{:02x}", b)).collect();
+    if fs::write(&path, format!("{}\n", hex)).is_err() {
+        return false;
+    }
+    #[cfg(unix)]
+    {
+        let _ = fs::set_permissions(&path, fs::Permissions::from_mode(0o600));
+    }
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+
+    #[test]
+    fn test_create_encryption_key_at_writes_64_char_hex_key() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().join("state");
+
+        assert!(create_encryption_key_at(&dir));
+
+        let key = dir.join(".encryption-key");
+        assert!(key.exists(), "key file should be created");
+
+        let contents = fs::read_to_string(&key).unwrap();
+        let trimmed = contents.trim();
+        assert_eq!(trimmed.len(), 64, "key should be 64 hex chars");
+        assert!(
+            trimmed.chars().all(|c| c.is_ascii_hexdigit()),
+            "key should be all hex digits"
+        );
+    }
+
+    #[test]
+    fn test_create_encryption_key_at_is_idempotent() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().join("state");
+        assert!(create_encryption_key_at(&dir));
+
+        let original = fs::read_to_string(dir.join(".encryption-key")).unwrap();
+
+        // Second call returns false and must not overwrite the existing key.
+        assert!(!create_encryption_key_at(&dir));
+        let after = fs::read_to_string(dir.join(".encryption-key")).unwrap();
+        assert_eq!(original, after);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn test_create_encryption_key_at_sets_0600_perms() {
+        let tmp = TempDir::new().unwrap();
+        let dir = tmp.path().join("state");
+
+        assert!(create_encryption_key_at(&dir));
+
+        let key = dir.join(".encryption-key");
+        let mode = fs::metadata(&key).unwrap().permissions().mode() & 0o777;
+        assert_eq!(mode, 0o600, "key file should be 0600, got {:o}", mode);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn test_run_fixes_generates_missing_encryption_key() {
+        // Reaches the Info-status arm in run_fixes that was previously
+        // unreachable due to an early-continue guard. Overrides HOME so
+        // get_state_dir() resolves under a temp dir.
+        let guard = crate::test_utils::EnvGuard::new(&["HOME"]);
+        let tmp = TempDir::new().unwrap();
+        guard.set("HOME", tmp.path().to_str().unwrap());
+
+        let mut checks = vec![Check::new(
+            "security.encryption_key",
+            "Security",
+            Status::Info,
+            "No encryption key set",
+        )
+        .with_fix("export AGENT_BROWSER_ENCRYPTION_KEY=...")];
+        let mut fixed = Vec::new();
+
+        run(&mut checks, &mut fixed);
+
+        assert_eq!(
+            checks[0].status,
+            Status::Pass,
+            "Info check should transition to Pass after --fix"
+        );
+        assert!(
+            checks[0].fix.is_none(),
+            "fix hint should be cleared after repair"
+        );
+        assert!(
+            fixed.iter().any(|s| s.contains("encryption key")),
+            "fixed summary should mention the key generation"
+        );
+        assert!(
+            tmp.path().join(".chrome-use/.encryption-key").exists(),
+            "key file should exist at ~/.chrome-use/.encryption-key"
+        );
+    }
+}

cli/src/doctor/helpers.rs

@@ -0,0 +1,185 @@
+//! Stateless helpers shared across doctor submodules.
+
+use std::fs;
+use std::path::Path;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::SystemTime;
+
+use serde_json::Value;
+
+pub(super) fn is_writable_dir(path: &Path) -> bool {
+    fs::metadata(path)
+        .map(|m| !m.permissions().readonly())
+        .unwrap_or(false)
+}
+
+pub(super) fn human_size(bytes: u64) -> String {
+    const UNITS: &[&str] = &["B", "KB", "MB", "GB", "TB"];
+    let mut value = bytes as f64;
+    let mut unit = 0;
+    while value >= 1024.0 && unit < UNITS.len() - 1 {
+        value /= 1024.0;
+        unit += 1;
+    }
+    if unit == 0 {
+        format!("{} {}", bytes, UNITS[0])
+    } else {
+        format!("{:.1} {}", value, UNITS[unit])
+    }
+}
+
+#[cfg(unix)]
+pub(super) fn disk_free_bytes(path: &Path) -> Option<u64> {
+    use std::ffi::CString;
+    use std::os::unix::ffi::OsStrExt;
+    use std::path::PathBuf;
+
+    // Walk up to the first existing ancestor (for fresh installs where the
+    // state dir hasn't been created yet).
+    let mut probe: PathBuf = path.to_path_buf();
+    while !probe.exists() {
+        match probe.parent() {
+            Some(p) => probe = p.to_path_buf(),
+            None => return None,
+        }
+    }
+    let c_path = CString::new(probe.as_os_str().as_bytes()).ok()?;
+    let mut stat: libc::statvfs = unsafe { std::mem::zeroed() };
+    if unsafe { libc::statvfs(c_path.as_ptr(), &mut stat) } != 0 {
+        return None;
+    }
+    Some(stat.f_bavail as u64 * stat.f_frsize)
+}
+
+#[cfg(windows)]
+pub(super) fn disk_free_bytes(_path: &Path) -> Option<u64> {
+    None
+}
+
+#[cfg(not(any(unix, windows)))]
+pub(super) fn disk_free_bytes(_path: &Path) -> Option<u64> {
+    None
+}
+
+pub(super) fn which_exists(name: &str) -> bool {
+    let probe = if cfg!(target_os = "windows") {
+        "where"
+    } else {
+        "which"
+    };
+    std::process::Command::new(probe)
+        .arg(name)
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .status()
+        .map(|s| s.success())
+        .unwrap_or(false)
+}
+
+pub(super) fn parse_json_file(path: &Path) -> Result<(), String> {
+    let content = fs::read_to_string(path).map_err(|e| format!("read failed: {}", e))?;
+    serde_json::from_str::<Value>(&content).map_err(|e| format!("invalid JSON: {}", e))?;
+    Ok(())
+}
+
+/// Generate a unique `doctor-<pid>-<micros>-<sequence>` id for JSON command envelopes.
+pub(super) fn new_id() -> String {
+    static NEXT_ID: AtomicU64 = AtomicU64::new(0);
+    let sequence = NEXT_ID.fetch_add(1, Ordering::Relaxed);
+
+    format!(
+        "doctor-{}-{}-{}",
+        std::process::id(),
+        SystemTime::now()
+            .duration_since(SystemTime::UNIX_EPOCH)
+            .map(|d| d.as_micros())
+            .unwrap_or(0),
+        sequence
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::TempDir;
+
+    #[test]
+    fn test_human_size_units() {
+        assert_eq!(human_size(0), "0 B");
+        assert_eq!(human_size(512), "512 B");
+        assert_eq!(human_size(1024), "1.0 KB");
+        assert_eq!(human_size(1024 * 1024), "1.0 MB");
+        assert_eq!(human_size(1024 * 1024 * 1024), "1.0 GB");
+        assert_eq!(human_size(1_500_000), "1.4 MB");
+    }
+
+    #[test]
+    fn test_disk_free_walks_up_to_existing_ancestor() {
+        let dir = TempDir::new().unwrap();
+        let nested = dir.path().join("a/b/c/d");
+        let bytes = disk_free_bytes(&nested);
+        if cfg!(unix) {
+            assert!(bytes.is_some());
+            assert!(bytes.unwrap() > 0);
+        }
+    }
+
+    #[test]
+    fn test_is_writable_dir_matches_metadata() {
+        let dir = TempDir::new().unwrap();
+        assert!(is_writable_dir(dir.path()));
+
+        let missing = dir.path().join("does-not-exist");
+        assert!(!is_writable_dir(&missing));
+    }
+
+    #[test]
+    fn test_which_exists_matches_common_binaries() {
+        // `sh` exists on every unix; `cmd` exists on windows.
+        let probe = if cfg!(target_os = "windows") {
+            "cmd"
+        } else {
+            "sh"
+        };
+        assert!(which_exists(probe));
+        assert!(!which_exists(
+            "chrome-use-this-does-not-exist-please-dont-install-it"
+        ));
+    }
+
+    #[test]
+    fn test_parse_json_file_valid_and_invalid() {
+        let dir = TempDir::new().unwrap();
+        let valid = dir.path().join("ok.json");
+        fs::write(&valid, r#"{"k": 1}"#).unwrap();
+        assert!(parse_json_file(&valid).is_ok());
+
+        let invalid = dir.path().join("bad.json");
+        fs::write(&invalid, "{not json}").unwrap();
+        let err = parse_json_file(&invalid).unwrap_err();
+        assert!(err.contains("invalid JSON"));
+
+        let missing = dir.path().join("nope.json");
+        let err = parse_json_file(&missing).unwrap_err();
+        assert!(err.contains("read failed"));
+    }
+
+    #[test]
+    fn test_parse_json_file_accepts_arrays() {
+        // The config parser rejects arrays at the Config type level, but
+        // doctor only checks syntactic JSON validity so it should accept
+        // both arrays and objects.
+        let dir = TempDir::new().unwrap();
+        let path = dir.path().join("arr.json");
+        fs::write(&path, r#"[1, 2, 3]"#).unwrap();
+        assert!(parse_json_file(&path).is_ok());
+    }
+
+    #[test]
+    fn test_new_id_is_unique_per_call() {
+        let a = new_id();
+        let b = new_id();
+        assert_ne!(a, b);
+        assert!(a.starts_with("doctor-"));
+    }
+}

cli/src/doctor/launch.rs

@@ -0,0 +1,188 @@
+//! Live launch test: spawn a scratch daemon session, launch headless
+//! Chrome, navigate to `about:blank`, then close. Skipped under `--quick`.
+//!
+//! A `LaunchGuard` Drop impl ensures the scratch session is closed and its
+//! sidecar files cleaned even on panic or early return.
+
+use std::env;
+use std::time::{Duration, Instant, SystemTime};
+
+use serde_json::{json, Value};
+
+use super::helpers::new_id;
+use super::{Check, Status};
+use crate::connection::{cleanup_stale_files, ensure_daemon, send_command, DaemonOptions};
+
+pub(super) fn check(checks: &mut Vec<Check>) {
+    let category = "Launch test";
+
+    if env::var("AGENT_BROWSER_PROVIDER").is_ok() {
+        checks.push(Check::new(
+            "launch.skipped.provider",
+            category,
+            Status::Info,
+            "Skipped (AGENT_BROWSER_PROVIDER is set; would consume cloud quota)",
+        ));
+        return;
+    }
+    if env::var("AGENT_BROWSER_CDP").is_ok() {
+        checks.push(Check::new(
+            "launch.skipped.cdp",
+            category,
+            Status::Info,
+            "Skipped (AGENT_BROWSER_CDP is set; would attach to a real browser)",
+        ));
+        return;
+    }
+
+    let session = format!(
+        "doctor-{}-{}",
+        std::process::id(),
+        SystemTime::now()
+            .duration_since(SystemTime::UNIX_EPOCH)
+            .map(|d| d.as_millis())
+            .unwrap_or(0)
+    );
+
+    // Armed after `ensure_daemon` succeeds so we don't send a stray `close`
+    // or delete sidecar files for a daemon that never started. On every early
+    // return past the `Some(...)` assignment below, Drop runs one close and
+    // one `cleanup_stale_files`.
+    let mut _guard: Option<LaunchGuard> = None;
+
+    let opts = DaemonOptions {
+        headed: false,
+        debug: false,
+        executable_path: None,
+        extensions: &[],
+        init_scripts: &[],
+        enable: &[],
+        args: None,
+        user_agent: None,
+        proxy: None,
+        proxy_bypass: None,
+        proxy_username: None,
+        proxy_password: None,
+        ignore_https_errors: false,
+        allow_file_access: false,
+        hide_scrollbars: true,
+        profile: None,
+        state: None,
+        provider: None,
+        device: None,
+        session_name: None,
+        download_path: None,
+        allowed_domains: None,
+        action_policy: None,
+        confirm_actions: None,
+        engine: None,
+        auto_connect: false,
+        force_launch: false,
+        idle_timeout: None,
+        default_timeout: None,
+        cdp: None,
+        no_auto_dialog: false,
+    };
+
+    let started = Instant::now();
+    if let Err(e) = ensure_daemon(&session, &opts) {
+        checks.push(
+            Check::new(
+                "launch.daemon",
+                category,
+                Status::Fail,
+                format!("Could not start daemon: {}", e),
+            )
+            .with_fix("check Chrome install and re-run with --debug"),
+        );
+        return;
+    }
+    _guard = Some(LaunchGuard {
+        session: session.clone(),
+    });
+
+    let launch_cmd = json!({
+        "id": new_id(),
+        "action": "launch",
+        "headless": true,
+    });
+    if let Err(e) = send_json(launch_cmd, &session) {
+        checks.push(
+            Check::new(
+                "launch.launch",
+                category,
+                Status::Fail,
+                format!("Browser launch failed: {}", e),
+            )
+            .with_fix("chrome-use install   # or check --debug output"),
+        );
+        return;
+    }
+
+    let open_cmd = json!({
+        "id": new_id(),
+        "action": "navigate",
+        "url": "about:blank",
+    });
+    if let Err(e) = send_json(open_cmd, &session) {
+        checks.push(
+            Check::new(
+                "launch.navigate",
+                category,
+                Status::Fail,
+                format!("Navigation to about:blank failed: {}", e),
+            )
+            .with_fix("re-run with --debug for full launch logs"),
+        );
+        return;
+    }
+
+    // Close + stale-file cleanup happen exactly once via LaunchGuard::drop at
+    // end of scope; no explicit close here.
+    let elapsed = started.elapsed();
+    let secs = elapsed.as_secs_f64();
+    if elapsed > Duration::from_secs(5) {
+        checks.push(Check::new(
+            "launch.elapsed",
+            category,
+            Status::Warn,
+            format!(
+                "Headless launch + about:blank in {:.2}s (slow; expected < 5s)",
+                secs
+            ),
+        ));
+    } else {
+        checks.push(Check::new(
+            "launch.elapsed",
+            category,
+            Status::Pass,
+            format!("Headless launch + about:blank in {:.2}s", secs),
+        ));
+    }
+}
+
+fn send_json(cmd: Value, session: &str) -> Result<(), String> {
+    match send_command(cmd, session) {
+        Ok(resp) => {
+            if resp.success {
+                Ok(())
+            } else {
+                Err(resp.error.unwrap_or_else(|| "unknown error".to_string()))
+            }
+        }
+        Err(e) => Err(e),
+    }
+}
+
+/// Best-effort cleanup when the launch test panics or returns early.
+struct LaunchGuard {
+    session: String,
+}
+
+impl Drop for LaunchGuard {
+    fn drop(&mut self) {
+        let close_cmd = json!({ "id": new_id(), "action": "close" });
+        let _ = send_command(close_cmd, &self.session);
+        cleanup_stale_files(&self.session);
+    }
+}

cli/src/doctor/mod.rs

@@ -0,0 +1,291 @@
+//! Diagnose an chrome-use installation.
+//!
+//! Runs a battery of checks across environment, Chrome install, daemon
+//! state, config files, encryption, providers, network reachability, and
+//! a live headless browser launch test.
+//!
+//! Auto-cleans stale daemon socket/pid/version sidecar files. Destructive
+//! repairs (reinstalling Chrome, purging old state files, generating a
+//! missing encryption key) are gated behind `--fix`.
+
+mod chrome;
+mod config;
+mod daemon;
+mod environment;
+mod fix;
+mod helpers;
+mod launch;
+mod network;
+mod providers;
+mod security;
+mod versions;
+
+use serde_json::{json, Value};
+
+use crate::color;
+
+#[derive(Default, Clone, Copy)]
+pub struct DoctorOptions {
+    pub offline: bool,
+    pub quick: bool,
+    pub fix: bool,
+    pub json: bool,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+#[repr(u8)]
+pub(crate) enum Status {
+    Pass,
+    Warn,
+    Fail,
+    Info,
+}
+
+impl Status {
+    fn as_str(&self) -> &'static str {
+        match self {
+            Status::Pass => "pass",
+            Status::Warn => "warn",
+            Status::Fail => "fail",
+            Status::Info => "info",
+        }
+    }
+
+    fn label(&self) -> String {
+        match self {
+            Status::Pass => color::green("pass"),
+            Status::Warn => color::yellow("warn"),
+            Status::Fail => color::red("fail"),
+            Status::Info => color::dim("info"),
+        }
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct Check {
+    pub id: String,
+    pub category: &'static str,
+    pub status: Status,
+    pub message: String,
+    pub fix: Option<String>,
+}
+
+impl Check {
+    fn new(
+        id: impl Into<String>,
+        category: &'static str,
+        status: Status,
+        message: impl Into<String>,
+    ) -> Self {
+        Self {
+            id: id.into(),
+            category,
+            status,
+            message: message.into(),
+            fix: None,
+        }
+    }
+
+    fn with_fix(mut self, fix: impl Into<String>) -> Self {
+        self.fix = Some(fix.into());
+        self
+    }
+}
+
+/// Run the doctor command. Returns the process exit code.
+pub fn run_doctor(opts: DoctorOptions) -> i32 {
+    let mut checks: Vec<Check> = Vec::new();
+    let mut fixed: Vec<String> = Vec::new();
+
+    environment::check(&mut checks);
+    versions::check(&mut checks);
+    chrome::check(&mut checks);
+    daemon::check(&mut checks);
+    config::check(&mut checks);
+    security::check(&mut checks);
+    providers::check(&mut checks);
+
+    if !opts.offline {
+        network::check(&mut checks);
+    }
+
+    if !opts.quick {
+        launch::check(&mut checks);
+    }
+
+    if opts.fix {
+        fix::run(&mut checks, &mut fixed);
+    }
+
+    let summary = summarize(&checks);
+    let exit_code = if summary.fail > 0 { 1 } else { 0 };
+
+    if opts.json {
+        print_json(&checks, &summary, &fixed, exit_code == 0);
+    } else {
+        print_text(&checks, &summary, &fixed, opts.fix);
+    }
+
+    exit_code
+}
+
+struct Summary {
+    pass: usize,
+    warn: usize,
+    fail: usize,
+}
+
+fn summarize(checks: &[Check]) -> Summary {
+    let mut s = Summary {
+        pass: 0,
+        warn: 0,
+        fail: 0,
+    };
+    for c in checks {
+        match c.status {
+            Status::Pass => s.pass += 1,
+            Status::Warn => s.warn += 1,
+            Status::Fail => s.fail += 1,
+            Status::Info => {}
+        }
+    }
+    s
+}
+
+fn print_text(checks: &[Check], summary: &Summary, fixed: &[String], fix_ran: bool) {
+    println!("{}", color::bold("chrome-use doctor"));
+
+    let mut current_category = "";
+    for c in checks {
+        if c.category != current_category {
+            current_category = c.category;
+            println!();
+            println!("{}", color::bold(current_category));
+        }
+        println!("  {}  {}", c.status.label(), c.message);
+        if let Some(fix) = &c.fix {
+            println!("        {} {}", color::dim("fix:"), fix);
+        }
+    }
+
+    if !fixed.is_empty() {
+        println!();
+        println!("{}", color::bold("Fixed"));
+        for line in fixed {
+            println!("  {}  {}", color::green("done"), line);
+        }
+    }
+
+    println!();
+    let line = format!(
+        "Summary: {} pass, {} warn, {} fail",
+        summary.pass, summary.warn, summary.fail
+    );
+    if summary.fail > 0 {
+        println!("{}", color::red(&line));
+    } else if summary.warn > 0 {
+        println!("{}", color::yellow(&line));
+    } else {
+        println!("{}", color::green(&line));
+    }
+
+    if !fix_ran && checks.iter().any(|c| c.fix.is_some()) {
+        println!();
+        println!(
+            "{} Run with {} to attempt repairs.",
+            color::dim("tip:"),
+            color::bold("--fix")
+        );
+    }
+}
+
+fn print_json(checks: &[Check], summary: &Summary, fixed: &[String], success: bool) {
+    let checks_json: Vec<Value> = checks
+        .iter()
+        .map(|c| {
+            let mut obj = json!({
+                "id": c.id,
+                "category": c.category,
+                "status": c.status.as_str(),
+                "message": c.message,
+            });
+            if let Some(fix) = &c.fix {
+                obj["fix"] = json!(fix);
+            }
+            obj
+        })
+        .collect();
+
+    let payload = json!({
+        "success": success,
+        "summary": {
+            "pass": summary.pass,
+            "warn": summary.warn,
+            "fail": summary.fail,
+        },
+        "checks": checks_json,
+        "fixed": fixed,
+    });
+    println!("{}", payload);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_summary_counts_each_status() {
+        let checks = vec![
+            Check::new("a", "Cat", Status::Pass, "ok"),
+            Check::new("b", "Cat", Status::Pass, "ok"),
+            Check::new("c", "Cat", Status::Warn, "meh"),
+            Check::new("d", "Cat", Status::Fail, "no"),
+            Check::new("e", "Cat", Status::Info, "fyi"),
+        ];
+        let s = summarize(&checks);
+        assert_eq!(s.pass, 2);
+        assert_eq!(s.warn, 1);
+        assert_eq!(s.fail, 1);
+    }
+
+    #[test]
+    fn test_summary_zeroes_when_only_info() {
+        let checks = vec![Check::new("a", "Cat", Status::Info, "ignored")];
+        let s = summarize(&checks);
+        assert_eq!(s.pass, 0);
+        assert_eq!(s.warn, 0);
+        assert_eq!(s.fail, 0);
+    }
+
+    #[test]
+    fn test_status_label_does_not_panic() {
+        for s in &[Status::Pass, Status::Warn, Status::Fail, Status::Info] {
+            assert!(!s.label().is_empty());
+            assert!(!s.as_str().is_empty());
+        }
+    }
+
+    #[test]
+    fn test_status_as_str_values() {
+        assert_eq!(Status::Pass.as_str(), "pass");
+        assert_eq!(Status::Warn.as_str(), "warn");
+        assert_eq!(Status::Fail.as_str(), "fail");
+        assert_eq!(Status::Info.as_str(), "info");
+    }
+
+    #[test]
+    fn test_check_new_and_with_fix() {
+        let c = Check::new("id", "cat", Status::Warn, "msg").with_fix("do thing");
+        assert_eq!(c.id, "id");
+        assert_eq!(c.category, "cat");
+        assert_eq!(c.status, Status::Warn);
+        assert_eq!(c.message, "msg");
+        assert_eq!(c.fix.as_deref(), Some("do thing"));
+    }
+
+    #[test]
+    fn test_check_new_no_fix_by_default() {
+        let c = Check::new("id", "cat", Status::Pass, "msg");
+        assert!(c.fix.is_none());
+    }
+}

cli/src/doctor/network.rs

@@ -0,0 +1,154 @@
+//! Probe reachability of the Chrome for Testing CDN, AI Gateway (if
+//! configured), and the currently-selected provider endpoint. Each probe
+//! has a 3-second timeout.
+
+use std::env;
+use std::time::{Duration, Instant};
+
+use super::{Check, Status};
+
+pub(super) fn check(checks: &mut Vec<Check>) {
+    let category = "Network";
+
+    let rt = match tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+    {
+        Ok(r) => r,
+        Err(e) => {
+            checks.push(Check::new(
+                "net.runtime",
+                category,
+                Status::Fail,
+                format!("Could not start tokio runtime for probes: {}", e),
+            ));
+            return;
+        }
+    };
+
+    let client = match reqwest::Client::builder()
+        .user_agent(format!("chrome-use/{}", env!("CARGO_PKG_VERSION")))
+        .timeout(Duration::from_secs(3))
+        .connect_timeout(Duration::from_secs(3))
+        .build()
+    {
+        Ok(c) => c,
+        Err(e) => {
+            checks.push(Check::new(
+                "net.client",
+                category,
+                Status::Fail,
+                format!("Could not build HTTP client: {}", e),
+            ));
+            return;
+        }
+    };
+
+    let chrome_url =
+        "https://googlechromelabs.github.io/chrome-for-testing/last-known-good-versions-with-downloads.json";
+    probe_url(
+        &rt,
+        &client,
+        checks,
+        category,
+        "net.chrome_cdn",
+        chrome_url,
+        "Chrome for Testing CDN",
+    );
+
+    if env::var("AI_GATEWAY_API_KEY").is_ok() {
+        let url = env::var("AI_GATEWAY_URL")
+            .unwrap_or_else(|_| "https://ai-gateway.vercel.sh".to_string());
+        probe_url(
+            &rt,
+            &client,
+            checks,
+            category,
+            "net.ai_gateway",
+            &url,
+            "AI Gateway",
+        );
+    }
+
+    if let Ok(provider) = env::var("AGENT_BROWSER_PROVIDER") {
+        let url: Option<String> = match provider.to_lowercase().as_str() {
+            "browserbase" => Some("https://api.browserbase.com".to_string()),
+            "browserless" => Some(
+                env::var("BROWSERLESS_API_URL")
+                    .unwrap_or_else(|_| "https://production-sfo.browserless.io".to_string()),
+            ),
+            "browseruse" | "browser-use" => Some("https://api.browser-use.com".to_string()),
+            "kernel" => Some(
+                env::var("KERNEL_ENDPOINT")
+                    .unwrap_or_else(|_| "https://api.onkernel.com".to_string()),
+            ),
+            _ => None,
+        };
+        if let Some(url) = url {
+            probe_url(
+                &rt,
+                &client,
+                checks,
+                category,
+                "net.provider",
+                &url,
+                &format!("Provider {}", provider),
+            );
+        }
+    }
+}
+
+fn probe_url(
+    rt: &tokio::runtime::Runtime,
+    client: &reqwest::Client,
+    checks: &mut Vec<Check>,
+    category: &'static str,
+    id: &'static str,
+    url: &str,
+    label: &str,
+) {
+    let started = Instant::now();
+    let result = rt.block_on(async { client.head(url).send().await });
+    let elapsed_ms = started.elapsed().as_millis();
+    match result {
+        Ok(resp) => {
+            let status = resp.status();
+            if status.is_success() || status.is_redirection() || status.as_u16() == 405 {
+                checks.push(Check::new(
+                    id,
+                    category,
+                    Status::Pass,
+                    format!(
+                        "{} reachable ({}ms, HTTP {})",
+                        label,
+                        elapsed_ms,
+                        status.as_u16()
+                    ),
+                ));
+            } else {
+                checks.push(Check::new(
+                    id,
+                    category,
+                    Status::Warn,
+                    format!(
+                        "{} returned HTTP {} after {}ms",
+                        label,
+                        status.as_u16(),
+                        elapsed_ms
+                    ),
+                ));
+            }
+        }
+        Err(e) => {
+            checks.push(
+                Check::new(
+                    id,
+                    category,
+                    Status::Fail,
+                    format!("{} unreachable after {}ms: {}", label, elapsed_ms, e),
+                )
+                .with_fix("check network connectivity / firewall / proxy settings"),
+            );
+        }
+    }
+}

cli/src/doctor/providers.rs

@@ -0,0 +1,128 @@
+//! Check remote browser providers: API key presence for Browserless,
+//! Browserbase, Browser Use, Kernel, AgentCore (AWS), Appium for iOS, and
+//! the AI Gateway chat key. Info-level unless the provider is selected
+//! via `AGENT_BROWSER_PROVIDER`.
+
+use std::env;
+
+use super::helpers::which_exists;
+use super::{Check, Status};
+
+pub(super) fn check(checks: &mut Vec<Check>) {
+    let category = "Providers";
+
+    let active = env::var("AGENT_BROWSER_PROVIDER").ok();
+    let normalized = active
+        .as_ref()
+        .map(|s| s.to_lowercase())
+        .unwrap_or_default();
+
+    let active_status = |provider: &str, ok: bool| -> Status {
+        if normalized == provider {
+            if ok {
+                Status::Pass
+            } else {
+                Status::Fail
+            }
+        } else {
+            Status::Info
+        }
+    };
+
+    let providers: &[(&str, &[&str], &str)] = &[
+        ("browserless", &["BROWSERLESS_API_KEY"], "Browserless"),
+        ("browserbase", &["BROWSERBASE_API_KEY"], "Browserbase"),
+        ("browseruse", &["BROWSER_USE_API_KEY"], "Browser Use"),
+        ("kernel", &["KERNEL_API_KEY"], "Kernel"),
+    ];
+
+    for (id, env_keys, label) in providers {
+        let present = env_keys.iter().any(|k| env::var(k).is_ok());
+        let provider_id = *id;
+        let status = active_status(provider_id, present);
+        let msg = if present {
+            format!("{}: API key present", label)
+        } else {
+            format!("{}: {} not set", label, env_keys.join(" / "))
+        };
+        let mut check = Check::new(format!("providers.{}", provider_id), category, status, msg);
+        if status == Status::Fail {
+            check = check.with_fix(format!(
+                "set {} (or unset AGENT_BROWSER_PROVIDER={})",
+                env_keys.first().copied().unwrap_or(""),
+                provider_id
+            ));
+        }
+        checks.push(check);
+    }
+
+    let aws_present = env::var("AWS_ACCESS_KEY_ID").is_ok()
+        || env::var("AWS_PROFILE").is_ok()
+        || env::var("AWS_SESSION_TOKEN").is_ok();
+    let agentcore_status = active_status("agentcore", aws_present);
+    let mut agentcore_check = Check::new(
+        "providers.agentcore",
+        category,
+        agentcore_status,
+        if aws_present {
+            "AgentCore: AWS credentials resolvable".to_string()
+        } else {
+            "AgentCore: no AWS credentials in env (AWS_ACCESS_KEY_ID / AWS_PROFILE)".to_string()
+        },
+    );
+    if agentcore_status == Status::Fail {
+        agentcore_check = agentcore_check
+            .with_fix("export AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY or AWS_PROFILE");
+    }
+    checks.push(agentcore_check);
+
+    if normalized == "ios" {
+        if which_exists("appium") {
+            checks.push(Check::new(
+                "providers.ios",
+                category,
+                Status::Pass,
+                "iOS: appium binary on PATH",
+            ));
+        } else {
+            checks.push(
+                Check::new(
+                    "providers.ios",
+                    category,
+                    Status::Fail,
+                    "iOS: appium binary not found on PATH",
+                )
+                .with_fix("npm install -g appium && appium driver install xcuitest"),
+            );
+        }
+    }
+
+    let chat_key_present = env::var("AI_GATEWAY_API_KEY").is_ok();
+    if chat_key_present {
+        checks.push(Check::new(
+            "providers.chat",
+            category,
+            Status::Info,
+            "AI_GATEWAY_API_KEY present (chat enabled)",
+        ));
+    } else {
+        checks.push(
+            Check::new(
+                "providers.chat",
+                category,
+                Status::Info,
+                "AI_GATEWAY_API_KEY not set (chat command disabled)",
+            )
+            .with_fix("export AI_GATEWAY_API_KEY=gw_..."),
+        );
+    }
+
+    if let Some(active) = active {
+        checks.push(Check::new(
+            "providers.active",
+            category,
+            Status::Info,
+            format!("AGENT_BROWSER_PROVIDER = {}", active),
+        ));
+    }
+}

cli/src/doctor/security.rs

@@ -0,0 +1,167 @@
+//! Check security posture: encryption key presence / permissions, saved
+//! state file age, and the optional action policy file.
+
+use std::env;
+use std::fs;
+use std::path::PathBuf;
+use std::time::{Duration, SystemTime};
+
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt;
+
+use super::helpers::parse_json_file;
+use super::{Check, Status};
+use crate::native::state::{get_sessions_dir, get_state_dir};
+
+pub(super) fn check(checks: &mut Vec<Check>) {
+    let category = "Security";
+
+    let key_env = env::var("AGENT_BROWSER_ENCRYPTION_KEY").ok();
+    let key_file = get_state_dir().join(".encryption-key");
+    if let Some(hex) = &key_env {
+        if hex.len() == 64 && hex.chars().all(|c| c.is_ascii_hexdigit()) {
+            checks.push(Check::new(
+                "security.encryption_key",
+                category,
+                Status::Pass,
+                "AGENT_BROWSER_ENCRYPTION_KEY set (64-char hex)",
+            ));
+        } else {
+            checks.push(
+                Check::new(
+                    "security.encryption_key",
+                    category,
+                    Status::Fail,
+                    "AGENT_BROWSER_ENCRYPTION_KEY is not a 64-char hex string",
+                )
+                .with_fix("export AGENT_BROWSER_ENCRYPTION_KEY=$(openssl rand -hex 32)"),
+            );
+        }
+    } else if key_file.exists() {
+        let mut msg = format!("Encryption key file present: {}", key_file.display());
+        let mut status = Status::Pass;
+        let mut fix: Option<String> = None;
+        #[cfg(unix)]
+        if let Ok(meta) = fs::metadata(&key_file) {
+            let mode = meta.permissions().mode() & 0o777;
+            if mode & 0o077 != 0 {
+                status = Status::Warn;
+                msg = format!(
+                    "Encryption key file is too permissive ({:o}): {}",
+                    mode,
+                    key_file.display()
+                );
+                fix = Some(format!("chmod 600 {}", key_file.display()));
+            }
+        }
+        let mut check = Check::new("security.encryption_key", category, status, msg);
+        if let Some(f) = fix {
+            check = check.with_fix(f);
+        }
+        checks.push(check);
+    } else {
+        checks.push(
+            Check::new(
+                "security.encryption_key",
+                category,
+                Status::Info,
+                "No encryption key set (will be auto-generated on first auth save)",
+            )
+            .with_fix("export AGENT_BROWSER_ENCRYPTION_KEY=$(openssl rand -hex 32)"),
+        );
+    }
+
+    let sessions_dir = get_sessions_dir();
+    if sessions_dir.exists() {
+        let expire_days = env::var("AGENT_BROWSER_STATE_EXPIRE_DAYS")
+            .ok()
+            .and_then(|s| s.parse::<u64>().ok())
+            .unwrap_or(30);
+        let cutoff = SystemTime::now()
+            .checked_sub(Duration::from_secs(expire_days * 86_400))
+            .unwrap_or(SystemTime::UNIX_EPOCH);
+        let mut total = 0usize;
+        let mut old = 0usize;
+        if let Ok(entries) = fs::read_dir(&sessions_dir) {
+            for entry in entries.flatten() {
+                if entry.file_type().map(|t| t.is_file()).unwrap_or(false) {
+                    total += 1;
+                    if let Ok(meta) = entry.metadata() {
+                        if let Ok(modified) = meta.modified() {
+                            if modified < cutoff {
+                                old += 1;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        if total == 0 {
+            checks.push(Check::new(
+                "security.state_count",
+                category,
+                Status::Info,
+                "No saved state files",
+            ));
+        } else if old > 0 {
+            checks.push(
+                Check::new(
+                    "security.state_count",
+                    category,
+                    Status::Warn,
+                    format!(
+                        "{} state file(s) older than {} days ({} total)",
+                        old, expire_days, total
+                    ),
+                )
+                .with_fix(format!(
+                    "chrome-use state clean --older-than {}",
+                    expire_days
+                )),
+            );
+        } else {
+            checks.push(Check::new(
+                "security.state_count",
+                category,
+                Status::Pass,
+                format!("{} saved state file(s)", total),
+            ));
+        }
+    }
+
+    if let Ok(policy_path) = env::var("AGENT_BROWSER_ACTION_POLICY") {
+        let p = PathBuf::from(&policy_path);
+        if !p.exists() {
+            checks.push(
+                Check::new(
+                    "security.action_policy",
+                    category,
+                    Status::Fail,
+                    format!(
+                        "AGENT_BROWSER_ACTION_POLICY points to missing file: {}",
+                        policy_path
+                    ),
+                )
+                .with_fix("update or unset AGENT_BROWSER_ACTION_POLICY"),
+            );
+        } else {
+            match parse_json_file(&p) {
+                Ok(_) => checks.push(Check::new(
+                    "security.action_policy",
+                    category,
+                    Status::Pass,
+                    format!("Action policy: {}", policy_path),
+                )),
+                Err(e) => checks.push(
+                    Check::new(
+                        "security.action_policy",
+                        category,
+                        Status::Fail,
+                        format!("Action policy: {}: {}", policy_path, e),
+                    )
+                    .with_fix(format!("edit {}", policy_path)),
+                ),
+            }
+        }
+    }
+}

cli/src/doctor/versions.rs

@@ -0,0 +1,89 @@
+//! Version-coherence checks across all four moving parts: the CLI binary, the
+//! per-session daemons (covered by `daemon.rs`), the connected `ab-connect`
+//! extension, and the bundled skill. The extension was previously a black box —
+//! nothing reported which build was live — so a user could sit on an old
+//! extension with no signal. The extension now reports its version over the
+//! relay (`hello`), the host records it, and this surfaces it in one place.
+
+use super::{Check, Status};
+use crate::{connect, upgrade};
+
+pub(super) fn check(checks: &mut Vec<Check>) {
+    let category = "Versions";
+    let cli_version = env!("CARGO_PKG_VERSION");
+
+    // CLI — compare against the latest seen by the background update check.
+    match upgrade::cached_latest_version() {
+        Some(latest) if upgrade::version_is_newer(&latest, cli_version) => {
+            checks.push(
+                Check::new(
+                    "versions.cli",
+                    category,
+                    Status::Warn,
+                    format!("CLI {cli_version} (newer available: {latest})"),
+                )
+                .with_fix("chrome-use upgrade".to_string()),
+            );
+        }
+        _ => {
+            checks.push(Check::new(
+                "versions.cli",
+                category,
+                Status::Pass,
+                format!("CLI {cli_version}"),
+            ));
+        }
+    }
+
+    // Extension — the build this CLI shipped alongside (embedded at compile time
+    // from the extension manifest) is what we expect to be running.
+    let expected_ext = env!("AB_CONNECT_VERSION");
+    match connect::relay_ext_version() {
+        Some(ext) if upgrade::version_is_newer(expected_ext, &ext) => {
+            checks.push(
+                Check::new(
+                    "versions.extension",
+                    category,
+                    Status::Warn,
+                    format!("extension {ext} is behind the bundled {expected_ext}"),
+                )
+                .with_fix(
+                    "update ab-connect in Chrome: chrome://extensions \u{2192} reload \
+                     (or wait for the Web Store auto-update)"
+                        .to_string(),
+                ),
+            );
+        }
+        Some(ext) => {
+            checks.push(Check::new(
+                "versions.extension",
+                category,
+                Status::Pass,
+                format!("extension {ext}"),
+            ));
+        }
+        None => {
+            checks.push(Check::new(
+                "versions.extension",
+                category,
+                Status::Info,
+                format!(
+                    "extension not connected (or it predates version reporting — \
+                     expected {expected_ext})"
+                ),
+            ));
+        }
+    }
+
+    // Skill — ships inside the same release artifact as the binary, so it's
+    // version-locked here. Copies made elsewhere via `skills add` aren't.
+    checks.push(Check::new(
+        "versions.skill",
+        category,
+        Status::Info,
+        format!(
+            "skills bundled with this CLI ({cli_version}); copies made via `skills add` \
+             elsewhere may be stale — re-run to refresh"
+        ),
+    ));
+}

cli/src/findurl.rs

@@ -0,0 +1,241 @@
+//! `find-url` — search the user's local Chrome/Edge **bookmarks** for pages they
+//! saved, by keyword. Borrowed from web-access's `find-url.mjs`; lets an agent
+//! locate an internal system or a previously-saved page that public search
+//! can't reach, without opening a browser.
+//!
+//! v1 covers bookmarks only (a zero-dependency JSON read). Visited-history lives
+//! in a locked SQLite DB and would need a SQLite dependency — not included yet.
+
+use std::path::PathBuf;
+
+use serde_json::Value;
+
+use crate::color;
+
+struct Hit {
+    name: String,
+    url: String,
+    folder: String,
+    date_added: i64,
+}
+
+/// Entry point for the `find-url` subcommand. `args` is the full cleaned argv
+/// (including the leading "find-url").
+pub fn run_find_url(args: &[String], json: bool) {
+    // Parse flags out of args[1..]; everything else is a keyword.
+    let mut browser = "chrome".to_string();
+    let mut profile = "Default".to_string();
+    let mut limit: usize = 20;
+    let mut keywords: Vec<String> = Vec::new();
+
+    let mut i = 1;
+    while i < args.len() {
+        match args[i].as_str() {
+            "--browser" => {
+                if let Some(v) = args.get(i + 1) {
+                    browser = v.to_lowercase();
+                    i += 1;
+                }
+            }
+            "--profile" => {
+                if let Some(v) = args.get(i + 1) {
+                    profile = v.clone();
+                    i += 1;
+                }
+            }
+            "--limit" => {
+                if let Some(v) = args.get(i + 1).and_then(|s| s.parse::<usize>().ok()) {
+                    limit = v;
+                    i += 1;
+                }
+            }
+            "--json" => {}
+            other if other.starts_with("--") => {}
+            other => keywords.push(other.to_lowercase()),
+        }
+        i += 1;
+    }
+
+    let path = match bookmarks_path(&browser, &profile) {
+        Some(p) => p,
+        None => {
+            emit_error(
+                json,
+                &format!("Could not locate {browser} bookmarks for profile '{profile}'"),
+            );
+            return;
+        }
+    };
+
+    let raw = match std::fs::read_to_string(&path) {
+        Ok(r) => r,
+        Err(e) => {
+            emit_error(json, &format!("Failed to read {}: {e}", path.display()));
+            return;
+        }
+    };
+    let root: Value = match serde_json::from_str(&raw) {
+        Ok(v) => v,
+        Err(e) => {
+            emit_error(json, &format!("Failed to parse bookmarks JSON: {e}"));
+            return;
+        }
+    };
+
+    let mut hits: Vec<Hit> = Vec::new();
+    if let Some(roots) = root.get("roots").and_then(|r| r.as_object()) {
+        for node in roots.values() {
+            walk(node, "", &keywords, &mut hits);
+        }
+    }
+
+    // Most-recently-added first (date_added is microseconds since 1601).
+    hits.sort_by_key(|b| std::cmp::Reverse(b.date_added));
+    hits.truncate(limit);
+
+    if json {
+        let arr: Vec<Value> = hits
+            .iter()
+            .map(|h| {
+                serde_json::json!({
+                    "name": h.name,
+                    "url": h.url,
+                    "folder": h.folder,
+                })
+            })
+            .collect();
+        println!(
+            "{}",
+            serde_json::to_string(&serde_json::json!({
+                "success": true,
+                "data": { "results": arr, "count": hits.len() },
+            }))
+            .unwrap_or_default()
+        );
+        return;
+    }
+
+    if hits.is_empty() {
+        let kw = if keywords.is_empty() {
+            String::new()
+        } else {
+            format!(" matching {:?}", keywords.join(" "))
+        };
+        println!("No {browser} bookmarks found{kw}.");
+        return;
+    }
+    for h in &hits {
+        if h.folder.is_empty() {
+            println!("{}\n  {}", h.name, h.url);
+        } else {
+            println!("{}  ({})\n  {}", h.name, h.folder, h.url);
+        }
+    }
+}
+
+/// Recursively walk a bookmark node, collecting URL entries that match every
+/// keyword (in name or url). Empty keyword list matches everything.
+fn walk(node: &Value, folder: &str, keywords: &[String], out: &mut Vec<Hit>) {
+    match node.get("type").and_then(|t| t.as_str()) {
+        Some("url") => {
+            let name = node.get("name").and_then(|v| v.as_str()).unwrap_or("");
+            let url = node.get("url").and_then(|v| v.as_str()).unwrap_or("");
+            // Skip non-navigable bookmarks: javascript: bookmarklets and data:
+            // URIs aren't pages you can visit, and their bodies can be huge.
+            if url.is_empty() || url.starts_with("javascript:") || url.starts_with("data:") {
+                return;
+            }
+            let hay = format!("{} {}", name.to_lowercase(), url.to_lowercase());
+            if keywords.iter().all(|k| hay.contains(k.as_str())) {
+                let date_added = node
+                    .get("date_added")
+                    .and_then(|v| v.as_str())
+                    .and_then(|s| s.parse::<i64>().ok())
+                    .unwrap_or(0);
+                out.push(Hit {
+                    name: name.to_string(),
+                    url: url.to_string(),
+                    folder: folder.to_string(),
+                    date_added,
+                });
+            }
+        }
+        Some("folder") => {
+            let fname = node.get("name").and_then(|v| v.as_str()).unwrap_or("");
+            let child_folder = if folder.is_empty() {
+                fname.to_string()
+            } else {
+                format!("{folder}/{fname}")
+            };
+            if let Some(children) = node.get("children").and_then(|c| c.as_array()) {
+                for child in children {
+                    walk(child, &child_folder, keywords, out);
+                }
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Resolve the Bookmarks file path for a browser + profile across platforms.
+fn bookmarks_path(browser: &str, profile: &str) -> Option<PathBuf> {
+    let base = browser_user_data_dir(browser)?;
+    let path = base.join(profile).join("Bookmarks");
+    if path.exists() {
+        Some(path)
+    } else {
+        None
+    }
+}
+
+/// The "User Data" directory that holds per-profile folders, per OS/browser.
+fn browser_user_data_dir(browser: &str) -> Option<PathBuf> {
+    let is_edge = browser == "edge" || browser == "msedge";
+
+    #[cfg(target_os = "macos")]
+    {
+        let app_support = dirs::config_dir()?; // ~/Library/Application Support
+        let sub = if is_edge {
+            "Microsoft Edge"
+        } else {
+            "Google/Chrome"
+        };
+        Some(app_support.join(sub))
+    }
+    #[cfg(target_os = "windows")]
+    {
+        let local = dirs::data_local_dir()?; // %LOCALAPPDATA%
+        let sub = if is_edge {
+            "Microsoft/Edge/User Data"
+        } else {
+            "Google/Chrome/User Data"
+        };
+        Some(local.join(sub))
+    }
+    #[cfg(all(unix, not(target_os = "macos")))]
+    {
+        let config = dirs::config_dir()?; // ~/.config
+        let sub = if is_edge {
+            "microsoft-edge"
+        } else {
+            "google-chrome"
+        };
+        Some(config.join(sub))
+    }
+}
+
+fn emit_error(json: bool, msg: &str) {
+    if json {
+        println!(
+            "{}",
+            serde_json::to_string(&serde_json::json!({
+                "success": false,
+                "error": msg,
+            }))
+            .unwrap_or_default()
+        );
+    } else {
+        eprintln!("{} {msg}", color::error_indicator());
+    }
+    std::process::exit(1);
+}

cli/src/flags.rs

@@ -4,21 +4,64 @@ use std::env;
 use std::fs;
 use std::path::{Path, PathBuf};
 
-const CONFIG_DIR: &str = ".agent-browser";
+const CONFIG_DIR: &str = ".chrome-use";
 const CONFIG_FILENAME: &str = "config.json";
-const PROJECT_CONFIG_FILENAME: &str = "agent-browser.json";
+const PROJECT_CONFIG_FILENAME: &str = "chrome-use.json";
+
+/// Parse idle timeout from user-friendly format.
+/// Supports: "10s" (seconds), "3m" (minutes), "1h" (hours), or raw milliseconds.
+fn parse_idle_timeout(s: &str) -> Result<String, String> {
+    let s = s.trim();
+    if s.is_empty() {
+        return Err("Empty idle timeout".to_string());
+    }
+
+    // If the value ends with a unit suffix, convert it to milliseconds.
+    if s.chars().last().is_some_and(|c| c.is_ascii_alphabetic()) {
+        let (num_str, unit) = s.split_at(s.len() - 1);
+        let num: u64 = num_str.parse().map_err(|_| "Invalid number")?;
+
+        let ms = match unit {
+            "s" => num * 1000,
+            "m" => num * 60 * 1000,
+            "h" => num * 60 * 60 * 1000,
+            _ => return Err("Invalid idle timeout unit (use s, m, h, or raw ms)".to_string()),
+        };
+        return Ok(ms.to_string());
+    }
+
+    // Pure numbers are already expressed in milliseconds.
+    s.parse::<u64>().map_err(|_| "Invalid idle timeout")?;
+    Ok(s.to_string())
+}
+
+fn parse_idle_timeout_value(value: Option<String>, source: &str) -> Option<String> {
+    value.and_then(|raw| match parse_idle_timeout(&raw) {
+        Ok(ms) => Some(ms),
+        Err(e) => {
+            eprintln!(
+                "{} invalid idle timeout from {}: {}",
+                color::warning_indicator(),
+                source,
+                e
+            );
+            None
+        }
+    })
+}
 
 #[derive(Debug, Default, Deserialize)]
 #[serde(default, rename_all = "camelCase")]
 pub struct Config {
     pub headed: Option<bool>,
     pub json: Option<bool>,
-    pub full: Option<bool>,
     pub debug: Option<bool>,
     pub session: Option<String>,
     pub session_name: Option<String>,
     pub executable_path: Option<String>,
     pub extensions: Option<Vec<String>>,
+    pub init_scripts: Option<Vec<String>>,
+    pub enable: Option<Vec<String>>,
     pub profile: Option<String>,
     pub state: Option<String>,
     pub proxy: Option<String>,
@@ -27,6 +70,7 @@ pub struct Config {
     pub user_agent: Option<String>,
     pub provider: Option<String>,
     pub device: Option<String>,
+    pub hide_scrollbars: Option<bool>,
     pub ignore_https_errors: Option<bool>,
     pub allow_file_access: Option<bool>,
     pub cdp: Option<String>,
@@ -41,7 +85,13 @@ pub struct Config {
     pub action_policy: Option<String>,
     pub confirm_actions: Option<String>,
     pub confirm_interactive: Option<bool>,
-    pub native: Option<bool>,
+    pub engine: Option<String>,
+    pub screenshot_dir: Option<String>,
+    pub screenshot_quality: Option<u32>,
+    pub screenshot_format: Option<String>,
+    pub idle_timeout: Option<String>,
+    pub no_auto_dialog: Option<bool>,
+    pub model: Option<String>,
 }
 
 impl Config {
@@ -49,7 +99,6 @@ impl Config {
         Config {
             headed: other.headed.or(self.headed),
             json: other.json.or(self.json),
-            full: other.full.or(self.full),
             debug: other.debug.or(self.debug),
             session: other.session.or(self.session),
             session_name: other.session_name.or(self.session_name),
@@ -61,6 +110,20 @@ impl Config {
                 }
                 (a, b) => b.or(a),
             },
+            init_scripts: match (self.init_scripts, other.init_scripts) {
+                (Some(mut a), Some(b)) => {
+                    a.extend(b);
+                    Some(a)
+                }
+                (a, b) => b.or(a),
+            },
+            enable: match (self.enable, other.enable) {
+                (Some(mut a), Some(b)) => {
+                    a.extend(b);
+                    Some(a)
+                }
+                (a, b) => b.or(a),
+            },
             profile: other.profile.or(self.profile),
             state: other.state.or(self.state),
             proxy: other.proxy.or(self.proxy),
@@ -69,6 +132,7 @@ impl Config {
             user_agent: other.user_agent.or(self.user_agent),
             provider: other.provider.or(self.provider),
             device: other.device.or(self.device),
+            hide_scrollbars: other.hide_scrollbars.or(self.hide_scrollbars),
             ignore_https_errors: other.ignore_https_errors.or(self.ignore_https_errors),
             allow_file_access: other.allow_file_access.or(self.allow_file_access),
             cdp: other.cdp.or(self.cdp),
@@ -83,7 +147,13 @@ impl Config {
             action_policy: other.action_policy.or(self.action_policy),
             confirm_actions: other.confirm_actions.or(self.confirm_actions),
             confirm_interactive: other.confirm_interactive.or(self.confirm_interactive),
-            native: other.native.or(self.native),
+            engine: other.engine.or(self.engine),
+            screenshot_dir: other.screenshot_dir.or(self.screenshot_dir),
+            screenshot_quality: other.screenshot_quality.or(self.screenshot_quality),
+            screenshot_format: other.screenshot_format.or(self.screenshot_format),
+            idle_timeout: other.idle_timeout.or(self.idle_timeout),
+            no_auto_dialog: other.no_auto_dialog.or(self.no_auto_dialog),
+            model: other.model.or(self.model),
         }
     }
 }
@@ -91,7 +161,13 @@ impl Config {
 fn read_config_file(path: &Path) -> Option<Config> {
     let content = fs::read_to_string(path).ok()?;
     match serde_json::from_str::<Config>(&content) {
-        Ok(config) => Some(config),
+        Ok(mut config) => {
+            config.idle_timeout = parse_idle_timeout_value(
+                config.idle_timeout.take(),
+                &format!("config file {}", path.display()),
+            );
+            Some(config)
+        }
         Err(e) => {
             eprintln!(
                 "{} invalid config file {}: {}",
@@ -113,6 +189,12 @@ fn env_var_is_truthy(name: &str) -> bool {
     }
 }
 
+fn env_var_bool(name: &str) -> Option<bool> {
+    env::var(name)
+        .ok()
+        .map(|val| !matches!(val.to_lowercase().as_str(), "0" | "false" | "no" | ""))
+}
+
 /// Parse an optional boolean value after a flag. Returns (value, consumed_next_arg).
 /// Recognizes "true" as true, "false" as false. Bare flag defaults to true.
 fn parse_bool_arg(args: &[String], i: usize) -> (bool, bool) {
@@ -142,6 +224,8 @@ fn extract_config_path(args: &[String]) -> Option<Option<String>> {
         "--executable-path",
         "--cdp",
         "--extension",
+        "--init-script",
+        "--enable",
         "--profile",
         "--state",
         "--proxy",
@@ -158,6 +242,13 @@ fn extract_config_path(args: &[String]) -> Option<Option<String>> {
         "--allowed-domains",
         "--action-policy",
         "--confirm-actions",
+        "--engine",
+        "--screenshot-dir",
+        "--screenshot-quality",
+        "--screenshot-format",
+        "--idle-timeout",
+        "--model",
+        "--humanize",
     ];
     let mut i = 0;
     while i < args.len() {
@@ -206,7 +297,6 @@ pub fn load_config(args: &[String]) -> Result<Config, String> {
 
 pub struct Flags {
     pub json: bool,
-    pub full: bool,
     pub headed: bool,
     pub debug: bool,
     pub session: String,
@@ -214,6 +304,8 @@ pub struct Flags {
     pub executable_path: Option<String>,
     pub cdp: Option<String>,
     pub extensions: Vec<String>,
+    pub init_scripts: Vec<String>,
+    pub enable: Vec<String>,
     pub profile: Option<String>,
     pub state: Option<String>,
     pub proxy: Option<String>,
@@ -223,8 +315,10 @@ pub struct Flags {
     pub provider: Option<String>,
     pub ignore_https_errors: bool,
     pub allow_file_access: bool,
+    pub hide_scrollbars: bool,
     pub device: Option<String>,
     pub auto_connect: bool,
+    pub force_launch: bool,
     pub session_name: Option<String>,
     pub annotate: bool,
     pub color_scheme: Option<String>,
@@ -235,12 +329,23 @@ pub struct Flags {
     pub action_policy: Option<String>,
     pub confirm_actions: Option<String>,
     pub confirm_interactive: bool,
-    pub native: bool,
+    pub engine: Option<String>,
+    pub screenshot_dir: Option<String>,
+    pub screenshot_quality: Option<u32>,
+    pub screenshot_format: Option<String>,
+    pub idle_timeout: Option<String>, // Canonical milliseconds string for AGENT_BROWSER_IDLE_TIMEOUT_MS
+    pub default_timeout: Option<u64>, // AGENT_BROWSER_DEFAULT_TIMEOUT in ms
+    pub no_auto_dialog: bool,
+    pub model: Option<String>,
+    pub verbose: bool,
+    pub quiet: bool,
 
     // Track which launch-time options were explicitly passed via CLI
     // (as opposed to being set only via environment variables)
     pub cli_executable_path: bool,
     pub cli_extensions: bool,
+    pub cli_init_scripts: bool,
+    pub cli_enable: bool,
     pub cli_profile: bool,
     pub cli_state: bool,
     pub cli_args: bool,
@@ -248,8 +353,10 @@ pub struct Flags {
     pub cli_proxy: bool,
     pub cli_proxy_bypass: bool,
     pub cli_allow_file_access: bool,
+    pub cli_hide_scrollbars: bool,
     pub cli_annotate: bool,
     pub cli_download_path: bool,
+    pub cli_headed: bool,
 }
 
 pub fn parse_flags(args: &[String]) -> Flags {
@@ -274,9 +381,40 @@ pub fn parse_flags(args: &[String]) -> Flags {
         config.extensions.unwrap_or_default()
     };
 
+    let init_scripts_env = env::var("AGENT_BROWSER_INIT_SCRIPTS")
+        .ok()
+        .map(|s| {
+            s.split(',')
+                .map(|p| p.trim().to_string())
+                .filter(|p| !p.is_empty())
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+
+    let init_scripts = if !init_scripts_env.is_empty() {
+        init_scripts_env
+    } else {
+        config.init_scripts.unwrap_or_default()
+    };
+
+    let enable_env = env::var("AGENT_BROWSER_ENABLE")
+        .ok()
+        .map(|s| {
+            s.split(',')
+                .map(|p| p.trim().to_string())
+                .filter(|p| !p.is_empty())
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+
+    let enable = if !enable_env.is_empty() {
+        enable_env
+    } else {
+        config.enable.unwrap_or_default()
+    };
+
     let mut flags = Flags {
         json: env_var_is_truthy("AGENT_BROWSER_JSON") || config.json.unwrap_or(false),
-        full: env_var_is_truthy("AGENT_BROWSER_FULL") || config.full.unwrap_or(false),
         headed: env_var_is_truthy("AGENT_BROWSER_HEADED") || config.headed.unwrap_or(false),
         debug: env_var_is_truthy("AGENT_BROWSER_DEBUG") || config.debug.unwrap_or(false),
         session: env::var("AGENT_BROWSER_SESSION")
@@ -289,12 +427,24 @@ pub fn parse_flags(args: &[String]) -> Flags {
             .or(config.executable_path),
         cdp: config.cdp,
         extensions,
+        init_scripts,
+        enable,
         profile: env::var("AGENT_BROWSER_PROFILE").ok().or(config.profile),
         state: env::var("AGENT_BROWSER_STATE").ok().or(config.state),
-        proxy: env::var("AGENT_BROWSER_PROXY").ok().or(config.proxy),
+        proxy: env::var("AGENT_BROWSER_PROXY")
+            .ok()
+            .or(config.proxy)
+            .or_else(|| env::var("HTTP_PROXY").ok())
+            .or_else(|| env::var("http_proxy").ok())
+            .or_else(|| env::var("HTTPS_PROXY").ok())
+            .or_else(|| env::var("https_proxy").ok())
+            .or_else(|| env::var("ALL_PROXY").ok())
+            .or_else(|| env::var("all_proxy").ok()),
         proxy_bypass: env::var("AGENT_BROWSER_PROXY_BYPASS")
             .ok()
-            .or(config.proxy_bypass),
+            .or(config.proxy_bypass)
+            .or_else(|| env::var("NO_PROXY").ok())
+            .or_else(|| env::var("no_proxy").ok()),
         args: env::var("AGENT_BROWSER_ARGS").ok().or(config.args),
         user_agent: env::var("AGENT_BROWSER_USER_AGENT")
             .ok()
@@ -304,9 +454,14 @@ pub fn parse_flags(args: &[String]) -> Flags {
             || config.ignore_https_errors.unwrap_or(false),
         allow_file_access: env_var_is_truthy("AGENT_BROWSER_ALLOW_FILE_ACCESS")
             || config.allow_file_access.unwrap_or(false),
+        hide_scrollbars: env_var_bool("AGENT_BROWSER_HIDE_SCROLLBARS")
+            .or(config.hide_scrollbars)
+            .unwrap_or(true),
         device: env::var("AGENT_BROWSER_IOS_DEVICE").ok().or(config.device),
-        auto_connect: env_var_is_truthy("AGENT_BROWSER_AUTO_CONNECT")
-            || config.auto_connect.unwrap_or(false),
+        auto_connect: !env_var_is_truthy("AGENT_BROWSER_NO_AUTO_CONNECT")
+            && (env_var_is_truthy("AGENT_BROWSER_AUTO_CONNECT")
+                || config.auto_connect.unwrap_or(true)),
+        force_launch: env_var_is_truthy("AGENT_BROWSER_FORCE_LAUNCH") || env::var("CI").is_ok(),
         session_name: env::var("AGENT_BROWSER_SESSION_NAME")
             .ok()
             .or(config.session_name),
@@ -340,9 +495,35 @@ pub fn parse_flags(args: &[String]) -> Flags {
             .or(config.confirm_actions),
         confirm_interactive: env_var_is_truthy("AGENT_BROWSER_CONFIRM_INTERACTIVE")
             || config.confirm_interactive.unwrap_or(false),
-        native: env_var_is_truthy("AGENT_BROWSER_NATIVE") || config.native.unwrap_or(false),
+        engine: env::var("AGENT_BROWSER_ENGINE").ok().or(config.engine),
+        screenshot_dir: env::var("AGENT_BROWSER_SCREENSHOT_DIR")
+            .ok()
+            .or(config.screenshot_dir),
+        screenshot_quality: env::var("AGENT_BROWSER_SCREENSHOT_QUALITY")
+            .ok()
+            .and_then(|s| s.parse().ok())
+            .or(config.screenshot_quality),
+        screenshot_format: env::var("AGENT_BROWSER_SCREENSHOT_FORMAT")
+            .ok()
+            .or(config.screenshot_format)
+            .filter(|s| s == "png" || s == "jpeg"),
+        idle_timeout: parse_idle_timeout_value(
+            env::var("AGENT_BROWSER_IDLE_TIMEOUT_MS").ok(),
+            "AGENT_BROWSER_IDLE_TIMEOUT_MS",
+        )
+        .or(config.idle_timeout),
+        default_timeout: env::var("AGENT_BROWSER_DEFAULT_TIMEOUT")
+            .ok()
+            .and_then(|s| s.parse::<u64>().ok()),
+        no_auto_dialog: env_var_is_truthy("AGENT_BROWSER_NO_AUTO_DIALOG")
+            || config.no_auto_dialog.unwrap_or(false),
+        model: env::var("AI_GATEWAY_MODEL").ok().or(config.model),
+        verbose: false,
+        quiet: false,
         cli_executable_path: false,
         cli_extensions: false,
+        cli_init_scripts: false,
+        cli_enable: false,
         cli_profile: false,
         cli_state: false,
         cli_args: false,
@@ -350,8 +531,10 @@ pub fn parse_flags(args: &[String]) -> Flags {
         cli_proxy: false,
         cli_proxy_bypass: false,
         cli_allow_file_access: false,
+        cli_hide_scrollbars: false,
         cli_annotate: false,
         cli_download_path: false,
+        cli_headed: false,
     };
 
     let mut i = 0;
@@ -364,16 +547,10 @@ pub fn parse_flags(args: &[String]) -> Flags {
                     i += 1;
                 }
             }
-            "--full" | "-f" => {
-                let (val, consumed) = parse_bool_arg(args, i);
-                flags.full = val;
-                if consumed {
-                    i += 1;
-                }
-            }
             "--headed" => {
                 let (val, consumed) = parse_bool_arg(args, i);
                 flags.headed = val;
+                flags.cli_headed = true;
                 if consumed {
                     i += 1;
                 }
@@ -391,6 +568,19 @@ pub fn parse_flags(args: &[String]) -> Flags {
                     i += 1;
                 }
             }
+            "--idle-timeout" => {
+                if let Some(s) = args.get(i + 1) {
+                    match parse_idle_timeout(s) {
+                        Ok(ms) => flags.idle_timeout = Some(ms),
+                        Err(e) => eprintln!(
+                            "{} Invalid --idle-timeout: {}",
+                            color::warning_indicator(),
+                            e
+                        ),
+                    }
+                    i += 1;
+                }
+            }
             "--headers" => {
                 if let Some(h) = args.get(i + 1) {
                     flags.headers = Some(h.clone());
@@ -411,6 +601,27 @@ pub fn parse_flags(args: &[String]) -> Flags {
                     i += 1;
                 }
             }
+            "--init-script" => {
+                if let Some(s) = args.get(i + 1) {
+                    flags.init_scripts.push(s.clone());
+                    flags.cli_init_scripts = true;
+                    i += 1;
+                }
+            }
+            "--enable" => {
+                if let Some(s) = args.get(i + 1) {
+                    // Allow either repeated --enable foo --enable bar, or
+                    // a single --enable foo,bar comma-list for convenience.
+                    for item in s.split(',') {
+                        let trimmed = item.trim();
+                        if !trimmed.is_empty() {
+                            flags.enable.push(trimmed.to_string());
+                        }
+                    }
+                    flags.cli_enable = true;
+                    i += 1;
+                }
+            }
             "--cdp" => {
                 if let Some(s) = args.get(i + 1) {
                     flags.cdp = Some(s.clone());
@@ -480,6 +691,14 @@ pub fn parse_flags(args: &[String]) -> Flags {
                     i += 1;
                 }
             }
+            "--hide-scrollbars" => {
+                let (val, consumed) = parse_bool_arg(args, i);
+                flags.hide_scrollbars = val;
+                flags.cli_hide_scrollbars = true;
+                if consumed {
+                    i += 1;
+                }
+            }
             "--device" => {
                 if let Some(d) = args.get(i + 1) {
                     flags.device = Some(d.clone());
@@ -489,10 +708,17 @@ pub fn parse_flags(args: &[String]) -> Flags {
             "--auto-connect" => {
                 let (val, consumed) = parse_bool_arg(args, i);
                 flags.auto_connect = val;
+                if !val {
+                    flags.force_launch = true;
+                }
                 if consumed {
                     i += 1;
                 }
             }
+            "--launch" | "--new" => {
+                flags.force_launch = true;
+                flags.auto_connect = false;
+            }
             "--session-name" => {
                 if let Some(s) = args.get(i + 1) {
                     flags.session_name = Some(s.clone());
@@ -565,13 +791,82 @@ pub fn parse_flags(args: &[String]) -> Flags {
                     i += 1;
                 }
             }
-            "--native" => {
+            "--engine" => {
+                if let Some(s) = args.get(i + 1) {
+                    flags.engine = Some(s.clone());
+                    i += 1;
+                }
+            }
+            "--humanize" => {
+                // Human-like input motion level (off|fast|human). Surface it as
+                // AGENT_BROWSER_HUMANIZE so the daemon — spawned as a child that
+                // inherits this process's env — picks it up and it overrides the
+                // adaptive detector. Applies when the session's daemon launches.
+                if let Some(s) = args.get(i + 1) {
+                    match crate::native::humanize::HumanizeLevel::parse(s) {
+                        Some(_) => std::env::set_var("AGENT_BROWSER_HUMANIZE", s),
+                        None => eprintln!(
+                            "warning: --humanize must be off|fast|human, got {s:?} (ignored)"
+                        ),
+                    }
+                    i += 1;
+                }
+            }
+            "--screenshot-dir" => {
+                if let Some(s) = args.get(i + 1) {
+                    flags.screenshot_dir = Some(s.clone());
+                    i += 1;
+                }
+            }
+            "--screenshot-quality" => {
+                if let Some(s) = args.get(i + 1) {
+                    if let Ok(n) = s.parse::<u32>() {
+                        if n <= 100 {
+                            flags.screenshot_quality = Some(n);
+                        } else {
+                            eprintln!(
+                                "{} --screenshot-quality must be 0-100, got {}",
+                                color::warning_indicator(),
+                                n
+                            );
+                        }
+                    }
+                    i += 1;
+                }
+            }
+            "--screenshot-format" => {
+                if let Some(s) = args.get(i + 1) {
+                    if s == "png" || s == "jpeg" {
+                        flags.screenshot_format = Some(s.clone());
+                    } else {
+                        eprintln!(
+                            "{} --screenshot-format must be png or jpeg, got '{}'",
+                            color::warning_indicator(),
+                            s
+                        );
+                    }
+                    i += 1;
+                }
+            }
+            "--no-auto-dialog" => {
                 let (val, consumed) = parse_bool_arg(args, i);
-                flags.native = val;
+                flags.no_auto_dialog = val;
                 if consumed {
                     i += 1;
                 }
             }
+            "--model" => {
+                if let Some(s) = args.get(i + 1) {
+                    flags.model = Some(s.clone());
+                    i += 1;
+                }
+            }
+            "-v" | "--verbose" => {
+                flags.verbose = true;
+            }
+            "-q" | "--quiet" => {
+                flags.quiet = true;
+            }
             "--config" => {
                 // Already handled by load_config(); skip the value
                 i += 1;
@@ -590,16 +885,26 @@ pub fn clean_args(args: &[String]) -> Vec<String> {
     // Boolean flags that optionally take true/false
     const GLOBAL_BOOL_FLAGS: &[&str] = &[
         "--json",
-        "--full",
         "--headed",
         "--debug",
         "--ignore-https-errors",
         "--allow-file-access",
+        "--hide-scrollbars",
         "--auto-connect",
+        "--launch",
+        "--new",
         "--annotate",
         "--content-boundaries",
         "--confirm-interactive",
-        "--native",
+        "--no-auto-dialog",
+        "-v",
+        "--verbose",
+        "-q",
+        "--quiet",
+        // doctor-specific flags; harmless on other commands (ignored)
+        "--offline",
+        "--quick",
+        "--fix",
     ];
     // Global flags that always take a value (need to skip the next arg too)
     const GLOBAL_FLAGS_WITH_VALUE: &[&str] = &[
@@ -608,6 +913,8 @@ pub fn clean_args(args: &[String]) -> Vec<String> {
         "--executable-path",
         "--cdp",
         "--extension",
+        "--init-script",
+        "--enable",
         "--profile",
         "--state",
         "--proxy",
@@ -625,6 +932,13 @@ pub fn clean_args(args: &[String]) -> Vec<String> {
         "--action-policy",
         "--confirm-actions",
         "--config",
+        "--engine",
+        "--screenshot-dir",
+        "--screenshot-quality",
+        "--screenshot-format",
+        "--idle-timeout",
+        "--model",
+        "--humanize",
     ];
 
     let mut i = 0;
@@ -640,7 +954,7 @@ pub fn clean_args(args: &[String]) -> Vec<String> {
             i += 1;
             continue;
         }
-        if GLOBAL_BOOL_FLAGS.contains(&arg.as_str()) || arg == "-f" {
+        if GLOBAL_BOOL_FLAGS.contains(&arg.as_str()) {
             if let Some(v) = args.get(i + 1) {
                 if matches!(v.as_str(), "true" | "false") {
                     i += 1;
@@ -658,6 +972,7 @@ pub fn clean_args(args: &[String]) -> Vec<String> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::test_utils::EnvGuard;
 
     fn args(s: &str) -> Vec<String> {
         s.split_whitespace().map(String::from).collect()
@@ -669,6 +984,36 @@ mod tests {
         assert_eq!(flags.headers, Some(r#"{"Auth":"token"}"#.to_string()));
     }
 
+    #[test]
+    fn test_parse_idle_timeout_raw_ms() {
+        assert_eq!(parse_idle_timeout("10").unwrap(), "10");
+    }
+
+    #[test]
+    fn test_parse_idle_timeout_seconds() {
+        assert_eq!(parse_idle_timeout("10s").unwrap(), "10000");
+    }
+
+    #[test]
+    fn test_parse_idle_timeout_minutes() {
+        assert_eq!(parse_idle_timeout("3m").unwrap(), "180000");
+    }
+
+    #[test]
+    fn test_parse_idle_timeout_hours() {
+        assert_eq!(parse_idle_timeout("1h").unwrap(), "3600000");
+    }
+
+    #[test]
+    fn test_parse_idle_timeout_rejects_capital_m() {
+        assert!(parse_idle_timeout("10M").is_err());
+    }
+
+    #[test]
+    fn test_parse_idle_timeout_rejects_unknown_unit() {
+        assert!(parse_idle_timeout("10x").is_err());
+    }
+
     #[test]
     fn test_parse_headers_flag_with_spaces() {
         // Headers JSON is passed as a single quoted argument in shell
@@ -764,6 +1109,18 @@ mod tests {
         assert_eq!(cleaned, vec!["open", "example.com"]);
     }
 
+    #[test]
+    fn test_clean_args_removes_idle_timeout_before_command() {
+        let cleaned = clean_args(&args("--idle-timeout 10s open example.com"));
+        assert_eq!(cleaned, vec!["open", "example.com"]);
+    }
+
+    #[test]
+    fn test_parse_idle_timeout_flag_converts_to_ms() {
+        let flags = parse_flags(&args("--idle-timeout 10s open example.com"));
+        assert_eq!(flags.idle_timeout.as_deref(), Some("10000"));
+    }
+
     #[test]
     fn test_parse_flags_with_session_and_executable_path() {
         let flags = parse_flags(&args(
@@ -846,7 +1203,6 @@ mod tests {
         let json = r#"{
             "headed": true,
             "json": true,
-            "full": true,
             "debug": true,
             "session": "test-session",
             "sessionName": "my-app",
@@ -860,6 +1216,7 @@ mod tests {
             "userAgent": "test-agent",
             "provider": "ios",
             "device": "iPhone 15",
+            "hideScrollbars": false,
             "ignoreHttpsErrors": true,
             "allowFileAccess": true,
             "cdp": "9222",
@@ -869,7 +1226,6 @@ mod tests {
         let config: Config = serde_json::from_str(json).unwrap();
         assert_eq!(config.headed, Some(true));
         assert_eq!(config.json, Some(true));
-        assert_eq!(config.full, Some(true));
         assert_eq!(config.debug, Some(true));
         assert_eq!(config.session.as_deref(), Some("test-session"));
         assert_eq!(config.session_name.as_deref(), Some("my-app"));
@@ -886,6 +1242,7 @@ mod tests {
         assert_eq!(config.user_agent.as_deref(), Some("test-agent"));
         assert_eq!(config.provider.as_deref(), Some("ios"));
         assert_eq!(config.device.as_deref(), Some("iPhone 15"));
+        assert_eq!(config.hide_scrollbars, Some(false));
         assert_eq!(config.ignore_https_errors, Some(true));
         assert_eq!(config.allow_file_access, Some(true));
         assert_eq!(config.cdp.as_deref(), Some("9222"));
@@ -969,9 +1326,25 @@ mod tests {
         let _ = fs::remove_dir(&dir);
     }
 
+    #[test]
+    fn test_load_config_from_file_parses_idle_timeout() {
+        use std::io::Write;
+        let dir = std::env::temp_dir().join("ab-test-idle-timeout-config");
+        let _ = fs::create_dir_all(&dir);
+        let config_path = dir.join("test-config.json");
+        let mut f = fs::File::create(&config_path).unwrap();
+        writeln!(f, r#"{{"idleTimeout": "10s"}}"#).unwrap();
+
+        let config = read_config_file(&config_path).unwrap();
+        assert_eq!(config.idle_timeout.as_deref(), Some("10000"));
+
+        let _ = fs::remove_file(&config_path);
+        let _ = fs::remove_dir(&dir);
+    }
+
     #[test]
     fn test_load_config_missing_file_returns_none() {
-        let result = read_config_file(&PathBuf::from("/nonexistent/agent-browser.json"));
+        let result = read_config_file(&PathBuf::from("/nonexistent/chrome-use.json"));
         assert!(result.is_none());
     }
 
@@ -1123,45 +1496,44 @@ mod tests {
         assert!(flags.cli_allow_file_access);
     }
 
+    #[test]
+    fn test_hide_scrollbars_default_true() {
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.remove("AGENT_BROWSER_HIDE_SCROLLBARS");
+        let flags = parse_flags(&args("open example.com"));
+        assert!(flags.hide_scrollbars);
+        assert!(!flags.cli_hide_scrollbars);
+    }
+
+    #[test]
+    fn test_hide_scrollbars_false() {
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.remove("AGENT_BROWSER_HIDE_SCROLLBARS");
+        let flags = parse_flags(&args("--hide-scrollbars false open"));
+        assert!(!flags.hide_scrollbars);
+        assert!(flags.cli_hide_scrollbars);
+    }
+
+    #[test]
+    fn test_hide_scrollbars_bare_defaults_true() {
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.remove("AGENT_BROWSER_HIDE_SCROLLBARS");
+        let flags = parse_flags(&args("--hide-scrollbars open"));
+        assert!(flags.hide_scrollbars);
+        assert!(flags.cli_hide_scrollbars);
+    }
+
     #[test]
     fn test_auto_connect_false() {
         let flags = parse_flags(&args("--auto-connect false open"));
         assert!(!flags.auto_connect);
     }
 
-    #[test]
-    fn test_full_bare_defaults_true() {
-        let flags = parse_flags(&args("--full open example.com"));
-        assert!(flags.full);
-    }
-
-    #[test]
-    fn test_full_false() {
-        let flags = parse_flags(&args("--full false open example.com"));
-        assert!(!flags.full);
-    }
-
-    #[test]
-    fn test_full_short_flag() {
-        let flags = parse_flags(&args("-f open example.com"));
-        assert!(flags.full);
-    }
-
-    #[test]
-    fn test_clean_args_removes_full_with_value() {
-        let cleaned = clean_args(&args("--full false open example.com"));
-        assert_eq!(cleaned, vec!["open", "example.com"]);
-    }
-
-    #[test]
-    fn test_clean_args_removes_short_full() {
-        let cleaned = clean_args(&args("-f open example.com"));
-        assert_eq!(cleaned, vec!["open", "example.com"]);
-    }
-
     #[test]
     fn test_clean_args_removes_bool_flag_with_value() {
-        let cleaned = clean_args(&args("--headed false --debug true open example.com"));
+        let cleaned = clean_args(&args(
+            "--headed false --debug true --hide-scrollbars false open example.com",
+        ));
         assert_eq!(cleaned, vec!["open", "example.com"]);
     }
 
@@ -1215,4 +1587,27 @@ mod tests {
         let merged = user.merge(project);
         assert_eq!(merged.extensions, Some(vec!["/ext2".to_string()]));
     }
+
+    #[test]
+    fn test_no_auto_dialog_flag() {
+        let flags = parse_flags(&args("open example.com --no-auto-dialog"));
+        assert!(flags.no_auto_dialog);
+    }
+
+    #[test]
+    fn test_no_auto_dialog_default_false() {
+        let flags = parse_flags(&args("open example.com"));
+        assert!(!flags.no_auto_dialog);
+    }
+
+    #[test]
+    fn test_clean_args_removes_no_auto_dialog() {
+        let input: Vec<String> = vec![
+            "open".to_string(),
+            "example.com".to_string(),
+            "--no-auto-dialog".to_string(),
+        ];
+        let clean = clean_args(&input);
+        assert_eq!(clean, vec!["open", "example.com"]);
+    }
 }

cli/src/native/adaptive.rs

@@ -0,0 +1,373 @@
+//! Adaptive @ref relocation.
+//!
+//! When a saved `@ref`'s DOM node is gone (stale `backendNodeId`) and the
+//! role/name/nth re-query also fails, we score the current page's candidate
+//! elements against the ref's stored [`ElementFingerprint`] and relocate to the
+//! best match — but ONLY when confident: the best candidate must clear a high
+//! absolute threshold AND beat the runner-up by a clear margin. This matches the
+//! project's "fail loudly rather than mis-click" posture (see the identity and
+//! occlusion guards in `element.rs`).
+//!
+//! Everything in this module is pure and browser-free so the scoring can be
+//! unit-tested directly.
+
+use std::collections::BTreeMap;
+
+/// Minimum absolute similarity (0..1) for a relocation candidate to be accepted.
+pub const ADAPTIVE_THRESHOLD: f64 = 0.70;
+/// Minimum gap between the best and second-best candidate to avoid ambiguity.
+pub const ADAPTIVE_MARGIN: f64 = 0.15;
+
+/// A structural/semantic fingerprint of an element, captured at snapshot time so
+/// a moved element can be re-identified after the page mutates.
+///
+/// Populated purely from the accessibility tree we already walk (`TreeNode`), so
+/// capturing it costs no extra CDP round-trips — `TreeNode` has no DOM tag or
+/// attributes (those would need an N×`DOM.describeNode` storm per snapshot), so
+/// `tag` holds the AX **role** and `attrs` holds discriminating AX properties
+/// (value/url/level/checked), not DOM `id`/`class`.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct ElementFingerprint {
+    /// AX role, e.g. "button" (used where a DOM tag would otherwise go).
+    pub tag: String,
+    /// Accessible name / visible text — the dominant identity signal.
+    pub text: String,
+    /// Discriminating AX properties: value, url, level, checked. Keyed by name.
+    pub attrs: BTreeMap<String, String>,
+    /// Ancestor role signatures from nearest to farthest, e.g. "form" / "list".
+    pub ancestors: Vec<String>,
+    /// Parent role.
+    pub parent_tag: String,
+    /// Parent accessible name / text.
+    pub parent_text: String,
+    /// Index among same-role siblings.
+    pub sibling_index: u32,
+    /// Count of same-role siblings.
+    pub sibling_count: u32,
+}
+
+/// Component weights. They sum to 1.0 so the total score lands in 0..1.
+/// Tuned for AX-derived fingerprints: the accessible name dominates, with role
+/// and tree structure carrying disambiguation when the name has changed (which
+/// is exactly when the exact role+name+nth fallback failed and we got here).
+const W_TAG: f64 = 0.20;
+const W_TEXT: f64 = 0.40;
+const W_ATTRS: f64 = 0.10;
+const W_ANCESTORS: f64 = 0.20;
+const W_PARENT_SIBLING: f64 = 0.10;
+
+/// Per-attribute importance for the attribute-overlap score. Strong identity
+/// signals (a link's url) outweigh weak ones (heading level).
+fn attr_weight(name: &str) -> f64 {
+    match name {
+        "url" | "value" => 3.0,
+        "checked" => 2.0,
+        _ => 1.0,
+    }
+}
+
+/// Levenshtein-based string similarity in 0..1 (1.0 = identical). Two empty
+/// strings are treated as a perfect match (consistent absence of text).
+pub fn string_similarity(a: &str, b: &str) -> f64 {
+    if a == b {
+        return 1.0;
+    }
+    let a: Vec<char> = a.chars().collect();
+    let b: Vec<char> = b.chars().collect();
+    let max_len = a.len().max(b.len());
+    if max_len == 0 {
+        return 1.0;
+    }
+    let dist = levenshtein(&a, &b);
+    1.0 - (dist as f64 / max_len as f64)
+}
+
+fn levenshtein(a: &[char], b: &[char]) -> usize {
+    if a.is_empty() {
+        return b.len();
+    }
+    if b.is_empty() {
+        return a.len();
+    }
+    let mut prev: Vec<usize> = (0..=b.len()).collect();
+    let mut cur = vec![0usize; b.len() + 1];
+    for (i, &ca) in a.iter().enumerate() {
+        cur[0] = i + 1;
+        for (j, &cb) in b.iter().enumerate() {
+            let cost = if ca == cb { 0 } else { 1 };
+            cur[j + 1] = (prev[j + 1] + 1).min(cur[j] + 1).min(prev[j] + cost);
+        }
+        std::mem::swap(&mut prev, &mut cur);
+    }
+    prev[b.len()]
+}
+
+/// Jaccard similarity over whitespace-separated tokens (used for `class`).
+fn token_jaccard(a: &str, b: &str) -> f64 {
+    let sa: std::collections::BTreeSet<&str> = a.split_whitespace().collect();
+    let sb: std::collections::BTreeSet<&str> = b.split_whitespace().collect();
+    if sa.is_empty() && sb.is_empty() {
+        return 1.0;
+    }
+    let inter = sa.intersection(&sb).count() as f64;
+    let union = sa.union(&sb).count() as f64;
+    if union == 0.0 {
+        1.0
+    } else {
+        inter / union
+    }
+}
+
+/// Length-ratio of the longest common subsequence over two ancestor sequences.
+fn lcs_ratio(a: &[String], b: &[String]) -> f64 {
+    if a.is_empty() && b.is_empty() {
+        return 1.0;
+    }
+    if a.is_empty() || b.is_empty() {
+        return 0.0;
+    }
+    let mut dp = vec![vec![0usize; b.len() + 1]; a.len() + 1];
+    for i in 0..a.len() {
+        for j in 0..b.len() {
+            dp[i + 1][j + 1] = if a[i] == b[j] {
+                dp[i][j] + 1
+            } else {
+                dp[i][j + 1].max(dp[i + 1][j])
+            };
+        }
+    }
+    let lcs = dp[a.len()][b.len()] as f64;
+    (2.0 * lcs) / (a.len() + b.len()) as f64
+}
+
+fn attr_score(base: &BTreeMap<String, String>, cand: &BTreeMap<String, String>) -> f64 {
+    let mut names: std::collections::BTreeSet<&str> = std::collections::BTreeSet::new();
+    names.extend(base.keys().map(|s| s.as_str()));
+    names.extend(cand.keys().map(|s| s.as_str()));
+    if names.is_empty() {
+        return 1.0; // no attributes on either side — neutral
+    }
+    let mut total = 0.0;
+    let mut got = 0.0;
+    for name in names {
+        let w = attr_weight(name);
+        total += w;
+        // present on only one side → no credit
+        if let (Some(a), Some(b)) = (base.get(name), cand.get(name)) {
+            if name == "class" {
+                got += w * token_jaccard(a, b);
+            } else if a == b {
+                got += w;
+            }
+        }
+    }
+    if total == 0.0 {
+        1.0
+    } else {
+        got / total
+    }
+}
+
+fn parent_sibling_score(base: &ElementFingerprint, cand: &ElementFingerprint) -> f64 {
+    // Split the 0.10 budget: parent tag 0.4, parent text 0.3, sibling pos 0.3.
+    let parent_tag = if base.parent_tag == cand.parent_tag {
+        1.0
+    } else {
+        0.0
+    };
+    let parent_text = string_similarity(&base.parent_text, &cand.parent_text);
+    let span = base.sibling_count.max(1) as f64;
+    let delta = (base.sibling_index as i64 - cand.sibling_index as i64).unsigned_abs() as f64;
+    let sibling = 1.0 - (delta / span).min(1.0);
+    0.4 * parent_tag + 0.3 * parent_text + 0.3 * sibling
+}
+
+/// Similarity score in 0..1 between a stored baseline and a candidate element.
+pub fn score(base: &ElementFingerprint, cand: &ElementFingerprint) -> f64 {
+    let tag = if base.tag == cand.tag { 1.0 } else { 0.0 };
+    let text = string_similarity(&base.text, &cand.text);
+    let attrs = attr_score(&base.attrs, &cand.attrs);
+    let ancestors = lcs_ratio(&base.ancestors, &cand.ancestors);
+    let parent_sibling = parent_sibling_score(base, cand);
+
+    W_TAG * tag
+        + W_TEXT * text
+        + W_ATTRS * attrs
+        + W_ANCESTORS * ancestors
+        + W_PARENT_SIBLING * parent_sibling
+}
+
+/// Why a relocation was rejected.
+#[derive(Debug, Clone, PartialEq)]
+pub enum RejectReason {
+    /// No candidates to score.
+    NoCandidates,
+    /// Best score below [`ADAPTIVE_THRESHOLD`].
+    LowScore { best: f64 },
+    /// Best score too close to the runner-up (below [`ADAPTIVE_MARGIN`]).
+    Ambiguous { best: f64, second: f64 },
+}
+
+/// A successful relocation decision.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Relocation {
+    /// Chosen candidate's backend node id.
+    pub backend_node_id: i64,
+    /// Winning score.
+    pub score: f64,
+    /// Runner-up score (0.0 when there was only one candidate).
+    pub second_score: f64,
+}
+
+/// Pick the best candidate, accepting only when confident. `candidates` is a
+/// list of `(backend_node_id, fingerprint)` for the current page.
+pub fn pick_best(
+    base: &ElementFingerprint,
+    candidates: &[(i64, ElementFingerprint)],
+    threshold: f64,
+    margin: f64,
+) -> Result<Relocation, RejectReason> {
+    if candidates.is_empty() {
+        return Err(RejectReason::NoCandidates);
+    }
+    let mut scored: Vec<(i64, f64)> = candidates
+        .iter()
+        .map(|(id, fp)| (*id, score(base, fp)))
+        .collect();
+    // Highest score first; stable enough for deterministic ties.
+    scored.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+
+    let (best_id, best) = scored[0];
+    let second = scored.get(1).map(|(_, s)| *s).unwrap_or(0.0);
+
+    if best < threshold {
+        return Err(RejectReason::LowScore { best });
+    }
+    if best - second < margin {
+        return Err(RejectReason::Ambiguous { best, second });
+    }
+    Ok(Relocation {
+        backend_node_id: best_id,
+        score: best,
+        second_score: second,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn fp(tag: &str, text: &str, attrs: &[(&str, &str)]) -> ElementFingerprint {
+        ElementFingerprint {
+            tag: tag.to_string(),
+            text: text.to_string(),
+            attrs: attrs
+                .iter()
+                .map(|(k, v)| (k.to_string(), v.to_string()))
+                .collect(),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn identical_fingerprints_score_one() {
+        let a = fp(
+            "button",
+            "Submit",
+            &[("id", "go"), ("class", "btn primary")],
+        );
+        assert!((score(&a, &a) - 1.0).abs() < 1e-9);
+    }
+
+    #[test]
+    fn different_tag_caps_score_below_threshold() {
+        let a = fp("button", "Submit", &[("id", "go")]);
+        let b = fp("a", "Submit", &[("id", "go")]);
+        // Same text + same attrs but different role: must lose the role weight
+        // (W_TAG = 0.20), landing around 0.80 and below a perfect match.
+        let s = score(&a, &b);
+        assert!(s < 0.85 && s > 0.75, "got {s}");
+    }
+
+    #[test]
+    fn string_similarity_basics() {
+        assert_eq!(string_similarity("abc", "abc"), 1.0);
+        assert_eq!(string_similarity("", ""), 1.0);
+        assert!(string_similarity("Submit", "Submit now") > 0.5);
+        assert!(string_similarity("Add post", "Post all") < 0.6);
+    }
+
+    #[test]
+    fn class_uses_token_overlap() {
+        let a = fp("div", "", &[("class", "card primary big")]);
+        let b = fp("div", "", &[("class", "card primary")]);
+        // partial class overlap should still score high (tag+text match, attrs partial)
+        let s = score(&a, &b);
+        assert!(s > 0.85, "got {s}");
+    }
+
+    #[test]
+    fn ancestors_lcs() {
+        let mut a = fp("button", "OK", &[]);
+        let mut b = fp("button", "OK", &[]);
+        a.ancestors = vec!["form#f".into(), "div.col".into(), "body".into()];
+        // b wrapped in an extra div — DOM path changed but mostly preserved
+        b.ancestors = vec![
+            "form#f".into(),
+            "div.wrap".into(),
+            "div.col".into(),
+            "body".into(),
+        ];
+        let s = score(&a, &b);
+        assert!(s > 0.85, "got {s}");
+    }
+
+    #[test]
+    fn pick_best_accepts_clear_winner() {
+        let base = fp("button", "Submit", &[("id", "go")]);
+        let winner = fp("button", "Submit", &[("id", "go")]);
+        let other = fp("a", "Home", &[("href", "/")]);
+        let out = pick_best(
+            &base,
+            &[(10, other), (20, winner)],
+            ADAPTIVE_THRESHOLD,
+            ADAPTIVE_MARGIN,
+        )
+        .expect("should accept");
+        assert_eq!(out.backend_node_id, 20);
+        assert!(out.score > out.second_score);
+    }
+
+    #[test]
+    fn pick_best_rejects_ambiguous_twins() {
+        let base = fp("button", "Delete", &[("class", "btn danger")]);
+        // Two near-identical delete buttons — must refuse to guess.
+        let twin_a = fp("button", "Delete", &[("class", "btn danger")]);
+        let twin_b = fp("button", "Delete", &[("class", "btn danger")]);
+        let err = pick_best(
+            &base,
+            &[(1, twin_a), (2, twin_b)],
+            ADAPTIVE_THRESHOLD,
+            ADAPTIVE_MARGIN,
+        )
+        .unwrap_err();
+        assert!(matches!(err, RejectReason::Ambiguous { .. }), "got {err:?}");
+    }
+
+    #[test]
+    fn pick_best_rejects_low_score() {
+        let base = fp("button", "Submit order", &[("id", "checkout")]);
+        let junk = fp("span", "unrelated footer text", &[("class", "muted")]);
+        let err = pick_best(&base, &[(1, junk)], ADAPTIVE_THRESHOLD, ADAPTIVE_MARGIN).unwrap_err();
+        assert!(matches!(err, RejectReason::LowScore { .. }), "got {err:?}");
+    }
+
+    #[test]
+    fn pick_best_no_candidates() {
+        let base = fp("button", "x", &[]);
+        assert_eq!(
+            pick_best(&base, &[], ADAPTIVE_THRESHOLD, ADAPTIVE_MARGIN).unwrap_err(),
+            RejectReason::NoCandidates
+        );
+    }
+}

cli/src/native/auth.rs

@@ -1,11 +1,13 @@
 use aes_gcm::{aead::Aead, aead::KeyInit, Aes256Gcm};
+use base64::{engine::general_purpose::STANDARD, Engine};
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
-use sha2::{Digest, Sha256};
 use std::fs;
+use std::io::Write;
 use std::path::PathBuf;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
 pub struct AuthProfile {
     pub name: String,
     pub url: String,
@@ -17,6 +19,10 @@ pub struct AuthProfile {
     pub password_selector: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub submit_selector: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub created_at: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub last_login_at: Option<String>,
 }
 
 // Keep legacy Credential alias for backward compatibility
@@ -38,9 +44,9 @@ fn validate_profile_name(name: &str) -> Result<(), String> {
 
 fn get_auth_dir() -> PathBuf {
     if let Some(home) = dirs::home_dir() {
-        home.join(".agent-browser").join("auth")
+        home.join(".chrome-use").join("auth")
     } else {
-        std::env::temp_dir().join("agent-browser").join("auth")
+        std::env::temp_dir().join("chrome-use").join("auth")
     }
 }
 
@@ -48,79 +54,203 @@ fn get_profile_path(name: &str) -> PathBuf {
     get_auth_dir().join(format!("{}.json", name))
 }
 
-fn derive_encryption_key() -> Vec<u8> {
-    let hostname = std::env::var("HOSTNAME")
-        .or_else(|_| std::env::var("COMPUTERNAME"))
-        .unwrap_or_else(|_| {
-            #[cfg(unix)]
-            {
-                let mut buf = [0u8; 256];
-                let len = unsafe { libc::gethostname(buf.as_mut_ptr() as *mut _, buf.len()) };
-                if len == 0 {
-                    let end = buf.iter().position(|&b| b == 0).unwrap_or(buf.len());
-                    String::from_utf8_lossy(&buf[..end]).to_string()
-                } else {
-                    "unknown-host".to_string()
-                }
-            }
-            #[cfg(not(unix))]
-            {
-                "unknown-host".to_string()
-            }
-        });
-    let username = std::env::var("USER")
-        .or_else(|_| std::env::var("USERNAME"))
-        .unwrap_or_else(|_| "unknown-user".to_string());
-    let mut hasher = Sha256::new();
-    hasher.update(format!("agent-browser:{}:{}", hostname, username).as_bytes());
-    hasher.finalize().to_vec()
+const ENCRYPTION_KEY_ENV: &str = "AGENT_BROWSER_ENCRYPTION_KEY";
+const KEY_FILE_NAME: &str = ".encryption-key";
+
+fn get_agent_browser_dir() -> PathBuf {
+    if let Some(home) = dirs::home_dir() {
+        home.join(".chrome-use")
+    } else {
+        std::env::temp_dir().join("chrome-use")
+    }
 }
 
-fn encrypt_profile(profile: &AuthProfile) -> Result<Vec<u8>, String> {
-    let key = derive_encryption_key();
+fn get_key_file_path() -> PathBuf {
+    get_agent_browser_dir().join(KEY_FILE_NAME)
+}
+
+fn parse_key_hex(hex_str: &str) -> Option<Vec<u8>> {
+    let hex_str = hex_str.trim();
+    if hex_str.len() != 64 || !hex_str.chars().all(|c| c.is_ascii_hexdigit()) {
+        return None;
+    }
+    let bytes: Vec<u8> = (0..32)
+        .map(|i| u8::from_str_radix(&hex_str[i * 2..i * 2 + 2], 16).unwrap())
+        .collect();
+    Some(bytes)
+}
+
+/// Read the encryption key from AGENT_BROWSER_ENCRYPTION_KEY env var or
+/// ~/.chrome-use/.encryption-key file (matching the Node.js implementation).
+fn get_encryption_key() -> Result<Vec<u8>, String> {
+    if let Ok(key_hex) = std::env::var(ENCRYPTION_KEY_ENV) {
+        return parse_key_hex(&key_hex).ok_or_else(|| {
+            format!(
+                "{} should be a 64-character hex string (256 bits). Generate one with: openssl rand -hex 32",
+                ENCRYPTION_KEY_ENV
+            )
+        });
+    }
+
+    let key_file = get_key_file_path();
+    if key_file.exists() {
+        let hex = fs::read_to_string(&key_file)
+            .map_err(|e| format!("Failed to read encryption key file: {}", e))?;
+        return parse_key_hex(&hex).ok_or_else(|| {
+            format!(
+                "Invalid encryption key in {}. Expected 64-character hex string.",
+                key_file.display()
+            )
+        });
+    }
+
+    Err(format!(
+        "Encryption key required. Set {} or ensure {} exists.",
+        ENCRYPTION_KEY_ENV,
+        key_file.display()
+    ))
+}
+
+/// Ensure an encryption key exists, auto-generating one if needed.
+fn ensure_encryption_key() -> Result<Vec<u8>, String> {
+    if let Ok(key) = get_encryption_key() {
+        return Ok(key);
+    }
+
+    let mut key = [0u8; 32];
+    getrandom::getrandom(&mut key).map_err(|e| format!("Failed to generate key: {}", e))?;
+    let key_hex = key.iter().map(|b| format!("{:02x}", b)).collect::<String>();
+
+    let dir = get_agent_browser_dir();
+    fs::create_dir_all(&dir).map_err(|e| format!("Failed to create directory: {}", e))?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = fs::set_permissions(&dir, fs::Permissions::from_mode(0o700));
+    }
+
+    let key_file = get_key_file_path();
+    fs::write(&key_file, format!("{}\n", key_hex))
+        .map_err(|e| format!("Failed to write encryption key: {}", e))?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = fs::set_permissions(&key_file, fs::Permissions::from_mode(0o600));
+    }
+
+    let _ = writeln!(
+        std::io::stderr(),
+        "[chrome-use] Auto-generated encryption key at {} -- back up this file or set {}",
+        key_file.display(),
+        ENCRYPTION_KEY_ENV
+    );
+
+    Ok(key.to_vec())
+}
+
+/// Encrypt a profile to the JSON+base64 format compatible with Node.js.
+fn encrypt_profile(profile: &AuthProfile) -> Result<String, String> {
+    let key = ensure_encryption_key()?;
     let cipher =
         Aes256Gcm::new_from_slice(&key).map_err(|e| format!("Encryption key error: {}", e))?;
 
     let plaintext = serde_json::to_string(profile)
         .map_err(|e| format!("Failed to serialize profile: {}", e))?;
 
-    let mut nonce = [0u8; 12];
-    getrandom::getrandom(&mut nonce).map_err(|e| format!("Failed to generate nonce: {}", e))?;
-    let ciphertext = cipher
-        .encrypt(aes_gcm::Nonce::from_slice(&nonce), plaintext.as_bytes())
+    let mut iv = [0u8; 12];
+    getrandom::getrandom(&mut iv).map_err(|e| format!("Failed to generate IV: {}", e))?;
+
+    // aes_gcm appends the 16-byte auth tag to the ciphertext
+    let encrypted = cipher
+        .encrypt(aes_gcm::Nonce::from_slice(&iv), plaintext.as_bytes())
         .map_err(|e| format!("Encryption failed: {}", e))?;
 
-    let mut result = Vec::with_capacity(12 + ciphertext.len());
-    result.extend_from_slice(&nonce);
-    result.extend_from_slice(&ciphertext);
-    Ok(result)
+    let tag_offset = encrypted.len() - 16;
+    let ciphertext = &encrypted[..tag_offset];
+    let auth_tag = &encrypted[tag_offset..];
+
+    let payload = json!({
+        "version": 1,
+        "encrypted": true,
+        "iv": STANDARD.encode(iv),
+        "authTag": STANDARD.encode(auth_tag),
+        "data": STANDARD.encode(ciphertext),
+    });
+
+    serde_json::to_string_pretty(&payload)
+        .map_err(|e| format!("Failed to serialize payload: {}", e))
+}
+
+/// JSON envelope written by Node.js encryption (src/encryption.ts).
+#[derive(Deserialize)]
+struct EncryptedPayload {
+    #[allow(dead_code)]
+    version: u32,
+    #[allow(dead_code)]
+    encrypted: bool,
+    iv: String,
+    #[serde(rename = "authTag")]
+    auth_tag: String,
+    data: String,
 }
 
 fn decrypt_profile(data: &[u8]) -> Result<AuthProfile, String> {
-    if data.len() < 13 {
-        return Err("Encrypted data too short".to_string());
+    let text = std::str::from_utf8(data).map_err(|_| {
+        "Profile is not valid UTF-8 -- it may use an older incompatible binary format".to_string()
+    })?;
+
+    if let Ok(payload) = serde_json::from_str::<EncryptedPayload>(text) {
+        let key = get_encryption_key()?;
+
+        let iv = STANDARD
+            .decode(&payload.iv)
+            .map_err(|e| format!("Invalid base64 iv: {}", e))?;
+        let auth_tag = STANDARD
+            .decode(&payload.auth_tag)
+            .map_err(|e| format!("Invalid base64 authTag: {}", e))?;
+        let ciphertext = STANDARD
+            .decode(&payload.data)
+            .map_err(|e| format!("Invalid base64 data: {}", e))?;
+
+        // aes_gcm expects ciphertext || auth_tag as input to decrypt
+        let mut combined = Vec::with_capacity(ciphertext.len() + auth_tag.len());
+        combined.extend_from_slice(&ciphertext);
+        combined.extend_from_slice(&auth_tag);
+
+        let cipher =
+            Aes256Gcm::new_from_slice(&key).map_err(|e| format!("Decryption key error: {}", e))?;
+        let plaintext = cipher
+            .decrypt(aes_gcm::Nonce::from_slice(&iv), combined.as_slice())
+            .map_err(|e| format!("Decryption failed: {}", e))?;
+
+        let json_str = String::from_utf8(plaintext)
+            .map_err(|e| format!("Decrypted data is not valid UTF-8: {}", e))?;
+        return serde_json::from_str(&json_str).map_err(|e| format!("Invalid profile data: {}", e));
     }
-    let (nonce_bytes, ciphertext) = data.split_at(12);
 
-    let key = derive_encryption_key();
-    let cipher =
-        Aes256Gcm::new_from_slice(&key).map_err(|e| format!("Decryption key error: {}", e))?;
-    let plaintext = cipher
-        .decrypt(aes_gcm::Nonce::from_slice(nonce_bytes), ciphertext)
-        .map_err(|e| format!("Decryption failed: {}", e))?;
-
-    let json_str = String::from_utf8(plaintext)
-        .map_err(|e| format!("Decrypted data is not valid UTF-8: {}", e))?;
-    serde_json::from_str(&json_str).map_err(|e| format!("Invalid profile data: {}", e))
+    // Fallback: try as plain unencrypted JSON profile
+    serde_json::from_str::<AuthProfile>(text)
+        .map_err(|_| "Profile is not a valid encrypted or unencrypted payload".to_string())
 }
 
 fn save_profile(profile: &AuthProfile) -> Result<(), String> {
     let dir = get_auth_dir();
-    let _ = fs::create_dir_all(&dir);
+    fs::create_dir_all(&dir).map_err(|e| format!("Failed to create auth dir: {}", e))?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = fs::set_permissions(&dir, fs::Permissions::from_mode(0o700));
+    }
 
-    let encrypted = encrypt_profile(profile)?;
+    let encrypted_json = encrypt_profile(profile)?;
     let path = get_profile_path(&profile.name);
-    fs::write(&path, &encrypted).map_err(|e| format!("Failed to write profile: {}", e))
+    fs::write(&path, &encrypted_json).map_err(|e| format!("Failed to write profile: {}", e))?;
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = fs::set_permissions(&path, fs::Permissions::from_mode(0o600));
+    }
+    Ok(())
 }
 
 fn load_profile(name: &str) -> Result<AuthProfile, String> {
@@ -147,6 +277,8 @@ pub fn credentials_set(
         username_selector: None,
         password_selector: None,
         submit_selector: None,
+        created_at: None,
+        last_login_at: None,
     };
     save_profile(&profile)?;
     Ok(json!({ "saved": name }))
@@ -170,6 +302,8 @@ pub fn auth_save(
         username_selector: username_selector.map(String::from),
         password_selector: password_selector.map(String::from),
         submit_selector: submit_selector.map(String::from),
+        created_at: None,
+        last_login_at: None,
     };
     save_profile(&profile)?;
     Ok(json!({ "saved": name }))
@@ -252,10 +386,27 @@ pub fn auth_show(name: &str) -> Result<Value, String> {
     }))
 }
 
+#[cfg(test)]
+pub(crate) static AUTH_TEST_MUTEX: std::sync::Mutex<()> = std::sync::Mutex::new(());
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    fn with_test_key<F: FnOnce()>(f: F) {
+        let _lock = AUTH_TEST_MUTEX.lock().unwrap();
+        let original = std::env::var(ENCRYPTION_KEY_ENV).ok();
+        let test_key = "a".repeat(64);
+        // SAFETY: TEST_MUTEX serializes all test access so no concurrent mutation.
+        unsafe { std::env::set_var(ENCRYPTION_KEY_ENV, &test_key) };
+        f();
+        // SAFETY: TEST_MUTEX serializes all test access so no concurrent mutation.
+        match original {
+            Some(val) => unsafe { std::env::set_var(ENCRYPTION_KEY_ENV, val) },
+            None => unsafe { std::env::remove_var(ENCRYPTION_KEY_ENV) },
+        }
+    }
+
     #[test]
     fn test_validate_profile_name() {
         assert!(validate_profile_name("github").is_ok());
@@ -277,6 +428,8 @@ mod tests {
             username_selector: None,
             password_selector: None,
             submit_selector: Some("button[type=submit]".to_string()),
+            created_at: None,
+            last_login_at: None,
         };
         let json = serde_json::to_string(&profile).unwrap();
         let parsed: AuthProfile = serde_json::from_str(&json).unwrap();
@@ -290,26 +443,114 @@ mod tests {
 
     #[test]
     fn test_encrypt_decrypt_roundtrip() {
-        let profile = AuthProfile {
-            name: "roundtrip".to_string(),
-            url: "https://example.com".to_string(),
-            username: "user".to_string(),
-            password: "s3cret!".to_string(),
-            username_selector: None,
-            password_selector: None,
-            submit_selector: None,
-        };
-        let encrypted = encrypt_profile(&profile).unwrap();
-        let decrypted = decrypt_profile(&encrypted).unwrap();
-        assert_eq!(decrypted.name, "roundtrip");
-        assert_eq!(decrypted.password, "s3cret!");
+        with_test_key(|| {
+            let profile = AuthProfile {
+                name: "roundtrip".to_string(),
+                url: "https://example.com".to_string(),
+                username: "user".to_string(),
+                password: "s3cret!".to_string(),
+                username_selector: None,
+                password_selector: None,
+                submit_selector: None,
+                created_at: None,
+                last_login_at: None,
+            };
+            let encrypted_json = encrypt_profile(&profile).unwrap();
+            let decrypted = decrypt_profile(encrypted_json.as_bytes()).unwrap();
+            assert_eq!(decrypted.name, "roundtrip");
+            assert_eq!(decrypted.password, "s3cret!");
+        });
     }
 
     #[test]
-    fn test_derive_encryption_key_is_stable() {
-        let k1 = derive_encryption_key();
-        let k2 = derive_encryption_key();
-        assert_eq!(k1, k2);
-        assert_eq!(k1.len(), 32);
+    fn test_get_encryption_key_from_env() {
+        with_test_key(|| {
+            let key = get_encryption_key().unwrap();
+            assert_eq!(key.len(), 32);
+            assert!(key.iter().all(|&b| b == 0xaa));
+        });
+    }
+
+    #[test]
+    fn test_parse_key_hex_valid() {
+        let hex = "ab".repeat(32);
+        let key = parse_key_hex(&hex).unwrap();
+        assert_eq!(key.len(), 32);
+        assert!(key.iter().all(|&b| b == 0xab));
+    }
+
+    #[test]
+    fn test_parse_key_hex_invalid() {
+        assert!(parse_key_hex("too_short").is_none());
+        assert!(parse_key_hex(&"g".repeat(64)).is_none());
+        assert!(parse_key_hex("").is_none());
+    }
+
+    #[test]
+    fn test_decrypt_json_payload_format() {
+        with_test_key(|| {
+            let key = get_encryption_key().unwrap();
+            let profile = AuthProfile {
+                name: "json-test".to_string(),
+                url: "https://example.com/login".to_string(),
+                username: "admin".to_string(),
+                password: "hunter2".to_string(),
+                username_selector: Some("#email".to_string()),
+                password_selector: None,
+                submit_selector: None,
+                created_at: None,
+                last_login_at: None,
+            };
+
+            // Encrypt with aes_gcm, then manually build the JSON payload
+            // to simulate what Node.js would produce
+            let cipher = Aes256Gcm::new_from_slice(&key).unwrap();
+            let mut iv = [0u8; 12];
+            getrandom::getrandom(&mut iv).unwrap();
+            let plaintext = serde_json::to_string(&profile).unwrap();
+            let encrypted = cipher
+                .encrypt(aes_gcm::Nonce::from_slice(&iv), plaintext.as_bytes())
+                .unwrap();
+
+            let tag_offset = encrypted.len() - 16;
+            let ciphertext = &encrypted[..tag_offset];
+            let auth_tag = &encrypted[tag_offset..];
+
+            let payload = format!(
+                r#"{{"version":1,"encrypted":true,"iv":"{}","authTag":"{}","data":"{}"}}"#,
+                STANDARD.encode(iv),
+                STANDARD.encode(auth_tag),
+                STANDARD.encode(ciphertext),
+            );
+
+            let decrypted = decrypt_profile(payload.as_bytes()).unwrap();
+            assert_eq!(decrypted.name, "json-test");
+            assert_eq!(decrypted.password, "hunter2");
+            assert_eq!(decrypted.username_selector, Some("#email".to_string()));
+        });
+    }
+
+    #[test]
+    fn test_encrypted_output_is_json_format() {
+        with_test_key(|| {
+            let profile = AuthProfile {
+                name: "format-check".to_string(),
+                url: "https://example.com".to_string(),
+                username: "user".to_string(),
+                password: "pass".to_string(),
+                username_selector: None,
+                password_selector: None,
+                submit_selector: None,
+                created_at: None,
+                last_login_at: None,
+            };
+            let encrypted = encrypt_profile(&profile).unwrap();
+            let parsed: Value = serde_json::from_str(&encrypted).unwrap();
+            assert_eq!(parsed["version"], 1);
+            assert_eq!(parsed["encrypted"], true);
+            assert!(parsed["iv"].is_string());
+            assert!(parsed["authTag"].is_string());
+            assert!(parsed["data"].is_string());
+        });
     }
 }

cli/src/native/cdp/client.rs

@@ -1,17 +1,31 @@
 use std::collections::HashMap;
+use std::io::Write;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Arc;
 
 use futures_util::{SinkExt, StreamExt};
 use serde_json::Value;
 use tokio::sync::{broadcast, oneshot, Mutex};
-use tokio_tungstenite::connect_async;
+use tokio_tungstenite::tungstenite::client::IntoClientRequest;
+use tokio_tungstenite::tungstenite::protocol::WebSocketConfig;
 use tokio_tungstenite::tungstenite::Message;
 
 use super::types::{CdpCommand, CdpEvent, CdpMessage};
 
 type PendingMap = Arc<Mutex<HashMap<u64, oneshot::Sender<CdpMessage>>>>;
 
+/// Interval between WebSocket ping frames sent to keep the connection alive
+/// through intermediate proxies (reverse proxies, load balancers, service meshes).
+const WS_KEEPALIVE_INTERVAL_SECS: u64 = 30;
+
+/// Raw incoming CDP message (text) broadcast to all subscribers.
+/// Used by the inspect proxy to forward responses and events to DevTools.
+#[derive(Debug, Clone)]
+pub struct RawCdpMessage {
+    pub text: String,
+    pub session_id: Option<String>,
+}
+
 pub struct CdpClient {
     ws_tx: Arc<
         Mutex<
@@ -26,35 +40,110 @@ pub struct CdpClient {
     next_id: AtomicU64,
     pending: PendingMap,
     event_tx: broadcast::Sender<CdpEvent>,
+    raw_tx: broadcast::Sender<RawCdpMessage>,
     _reader_handle: tokio::task::JoinHandle<()>,
+    _keepalive_handle: tokio::task::JoinHandle<()>,
 }
 
 impl CdpClient {
     pub async fn connect(url: &str) -> Result<Self, String> {
-        let (ws_stream, _) = connect_async(url)
-            .await
-            .map_err(|e| format!("CDP WebSocket connect failed: {}", e))?;
+        Self::connect_with_headers(url, None).await
+    }
+
+    pub async fn connect_with_headers(
+        url: &str,
+        headers: Option<Vec<(String, String)>>,
+    ) -> Result<Self, String> {
+        let mut request = url
+            .into_client_request()
+            .map_err(|e| format!("Invalid WebSocket URL: {}", e))?;
+
+        if let Some(hdrs) = headers {
+            let req_headers = request.headers_mut();
+            for (key, value) in hdrs {
+                if let (Ok(name), Ok(val)) = (
+                    key.parse::<tokio_tungstenite::tungstenite::http::header::HeaderName>(),
+                    value.parse::<tokio_tungstenite::tungstenite::http::header::HeaderValue>(),
+                ) {
+                    req_headers.insert(name, val);
+                }
+            }
+        }
+
+        let ws_config = WebSocketConfig {
+            max_message_size: None,
+            max_frame_size: None,
+            ..Default::default()
+        };
+
+        let (ws_stream, _) =
+            tokio_tungstenite::connect_async_with_config(request, Some(ws_config), false)
+                .await
+                .map_err(|e| format!("CDP WebSocket connect failed: {}", e))?;
+
+        enable_tcp_keepalive(ws_stream.get_ref());
 
         let (ws_tx, mut ws_rx) = ws_stream.split();
         let ws_tx = Arc::new(Mutex::new(ws_tx));
 
         let pending: PendingMap = Arc::new(Mutex::new(HashMap::new()));
-        let (event_tx, _) = broadcast::channel(256);
+        let (event_tx, _) = broadcast::channel(4096);
+        let (raw_tx, _) = broadcast::channel(4096);
 
         let pending_clone = pending.clone();
         let event_tx_clone = event_tx.clone();
+        let raw_tx_clone = raw_tx.clone();
+
+        // Notify used to stop the keepalive task when the reader loop exits.
+        let (cancel_tx, mut cancel_rx) = tokio::sync::watch::channel(false);
 
         let reader_handle = tokio::spawn(async move {
             while let Some(msg) = ws_rx.next().await {
+                // Accept both Text and Binary frames — remote CDP proxies
+                // (e.g. Browserless) may send responses as Binary frames.
                 let msg = match msg {
                     Ok(Message::Text(text)) => text,
-                    Ok(Message::Close(_)) => break,
+                    Ok(Message::Binary(data)) => match String::from_utf8(data) {
+                        Ok(text) => text,
+                        Err(_) => continue,
+                    },
+                    Ok(Message::Close(frame)) => {
+                        if std::env::var("AGENT_BROWSER_DEBUG").is_ok() {
+                            let reason = frame
+                                .as_ref()
+                                .map(|f| format!("code={}, reason={}", f.code, f.reason))
+                                .unwrap_or_else(|| "no frame".to_string());
+                            let _ =
+                                writeln!(std::io::stderr(), "[cdp] WebSocket Close: {}", reason);
+                        }
+                        break;
+                    }
+                    Ok(Message::Pong(_)) => continue,
                     Ok(_) => continue,
-                    Err(_) => break,
+                    Err(e) => {
+                        if std::env::var("AGENT_BROWSER_DEBUG").is_ok() {
+                            let _ = writeln!(std::io::stderr(), "[cdp] WebSocket Error: {}", e);
+                        }
+                        break;
+                    }
                 };
 
+                // Broadcast raw message for inspect proxy subscribers before typed parse,
+                // so messages with negative IDs (used by the inspect proxy) are still delivered.
+                if raw_tx_clone.receiver_count() > 0 {
+                    let session_id = serde_json::from_str::<serde_json::Value>(&msg)
+                        .ok()
+                        .and_then(|v| v.get("sessionId")?.as_str().map(String::from));
+                    let _ = raw_tx_clone.send(RawCdpMessage {
+                        text: msg.clone(),
+                        session_id,
+                    });
+                }
+
                 let parsed: CdpMessage = match serde_json::from_str(&msg) {
                     Ok(m) => m,
+                    // Expected for inspect proxy messages with negative IDs
+                    // (CdpMessage.id is u64); handled via raw broadcast above.
                     Err(_) => continue,
                 };
 
@@ -74,6 +163,33 @@ impl CdpClient {
                     let _ = event_tx_clone.send(event);
                 }
             }
+
+            // Reader loop exited (connection closed or error). Drop all pending
+            // command senders so callers get an immediate channel-closed error
+            // instead of waiting for the 30-second timeout.
+            pending_clone.lock().await.clear();
+
+            // Stop the keepalive task — the connection is gone.
+            let _ = cancel_tx.send(true);
+        });
+
+        // Spawn a keepalive task that sends WebSocket Ping frames at a regular
+        // interval. This prevents intermediate proxies (Envoy, nginx, OpenResty,
+        // cloud load balancers) from closing idle WebSocket connections. If the
+        // send fails, the connection is dead and we stop pinging.
+        let keepalive_tx = ws_tx.clone();
+        let keepalive_handle = tokio::spawn(async move {
+            let interval = std::time::Duration::from_secs(WS_KEEPALIVE_INTERVAL_SECS);
+            loop {
+                tokio::select! {
+                    _ = tokio::time::sleep(interval) => {}
+                    _ = cancel_rx.changed() => break,
+                }
+                let mut tx = keepalive_tx.lock().await;
+                if tx.send(Message::Ping(Vec::new())).await.is_err() {
+                    break;
+                }
+            }
         });
 
         Ok(Self {
@@ -81,7 +197,9 @@ impl CdpClient {
             next_id: AtomicU64::new(1),
             pending,
             event_tx,
+            raw_tx,
             _reader_handle: reader_handle,
+            _keepalive_handle: keepalive_handle,
         })
     }
 
@@ -97,7 +215,7 @@ impl CdpClient {
             id,
             method: method.to_string(),
             params,
-            session_id: session_id.map(|s| s.to_string()),
+            session_id: session_id.filter(|s| !s.is_empty()).map(|s| s.to_string()),
         };
 
         let json = serde_json::to_string(&cmd)
@@ -138,6 +256,21 @@ impl CdpClient {
         self.event_tx.subscribe()
     }
 
+    /// Subscribe to all raw incoming CDP messages (responses + events).
+    /// Used by the inspect proxy to forward traffic to the DevTools frontend.
+    pub fn subscribe_raw(&self) -> broadcast::Receiver<RawCdpMessage> {
+        self.raw_tx.subscribe()
+    }
+
+    /// Create a lightweight handle for the inspect WebSocket proxy.
+    /// Contains only what's needed to forward messages bidirectionally.
+    pub fn inspect_handle(&self) -> InspectProxyHandle {
+        InspectProxyHandle {
+            ws_tx: self.ws_tx.clone(),
+            raw_tx: self.raw_tx.clone(),
+        }
+    }
+
     pub async fn send_command_typed<P: serde::Serialize, R: serde::de::DeserializeOwned>(
         &self,
         method: &str,
@@ -160,4 +293,69 @@ impl CdpClient {
     ) -> Result<Value, String> {
         self.send_command(method, None, session_id).await
     }
+
+    /// Send raw JSON through the WebSocket without tracking a response.
+    /// Used by the inspect proxy to forward DevTools frontend messages.
+    pub async fn send_raw(&self, json: String) -> Result<(), String> {
+        let mut ws_tx = self.ws_tx.lock().await;
+        ws_tx
+            .send(Message::Text(json))
+            .await
+            .map_err(|e| format!("Failed to send raw CDP message: {}", e))
+    }
+}
+
+type WsTx = Arc<
+    Mutex<
+        futures_util::stream::SplitSink<
+            tokio_tungstenite::WebSocketStream<
+                tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
+            >,
+            Message,
+        >,
+    >,
+>;
+
+/// Lightweight handle for the inspect WebSocket proxy, holding only
+/// the cloneable parts of CdpClient needed for bidirectional message forwarding.
+pub struct InspectProxyHandle {
+    ws_tx: WsTx,
+    raw_tx: broadcast::Sender<RawCdpMessage>,
+}
+
+impl InspectProxyHandle {
+    pub async fn send_raw(&self, json: String) -> Result<(), String> {
+        let mut ws_tx = self.ws_tx.lock().await;
+        ws_tx
+            .send(Message::Text(json))
+            .await
+            .map_err(|e| format!("Failed to send raw CDP message: {}", e))
+    }
+
+    pub fn subscribe_raw(&self) -> broadcast::Receiver<RawCdpMessage> {
+        self.raw_tx.subscribe()
+    }
+}
+
+/// Enable TCP SO_KEEPALIVE on the underlying socket of a WebSocket connection.
+/// This is best-effort: failures are silently ignored since the WebSocket-level
+/// Ping keepalive provides the primary connection liveness mechanism.
+fn enable_tcp_keepalive(stream: &tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>) {
+    let tcp_stream = match stream {
+        tokio_tungstenite::MaybeTlsStream::Plain(s) => s,
+        tokio_tungstenite::MaybeTlsStream::Rustls(s) => s.get_ref().0,
+        _ => return,
+    };
+
+    // SockRef borrows the fd without taking ownership.
+    let sock = socket2::SockRef::from(tcp_stream);
+    let keepalive = socket2::TcpKeepalive::new().with_time(std::time::Duration::from_secs(30));
+
+    // with_interval sets TCP_KEEPINTVL — the time between probes after the
+    // first keepalive probe goes unanswered. Available on most platforms
+    // (Linux, macOS, Windows, FreeBSD, etc.) but not OpenBSD or Haiku.
+    #[cfg(not(any(target_os = "openbsd", target_os = "haiku")))]
+    let keepalive = keepalive.with_interval(std::time::Duration::from_secs(10));
+
+    let _ = sock.set_tcp_keepalive(&keepalive);
 }

cli/src/native/cdp/discovery.rs

@@ -0,0 +1,391 @@
+use std::time::Duration;
+
+use futures_util::{SinkExt, StreamExt};
+use tokio_tungstenite::tungstenite::Message;
+
+use super::types::BrowserVersionInfo;
+
+/// Default timeout for CDP discovery HTTP requests.
+const DEFAULT_DISCOVERY_TIMEOUT: Duration = Duration::from_secs(2);
+
+/// Discover the CDP WebSocket URL for the given host and port.
+///
+/// Tries three methods in order: `/json/version`, `/json/list`, and a direct
+/// WebSocket connection to `/devtools/browser`. The returned URL has its
+/// host/port rewritten to match the requested target.
+///
+/// An optional `query` string (without the leading `?`) is appended to the
+/// final WebSocket URL so that user-supplied URL parameters (e.g.
+/// `?mode=Hello`) are forwarded to the remote endpoint.
+pub async fn discover_cdp_url(
+    host: &str,
+    port: u16,
+    query: Option<&str>,
+) -> Result<String, String> {
+    discover_cdp_url_with_timeout(host, port, query, DEFAULT_DISCOVERY_TIMEOUT).await
+}
+
+/// Like [`discover_cdp_url`] but with a custom request timeout.
+pub async fn discover_cdp_url_with_timeout(
+    host: &str,
+    port: u16,
+    query: Option<&str>,
+    timeout: Duration,
+) -> Result<String, String> {
+    // Primary: /json/version (standard path)
+    let version_err = match fetch_cdp_info(host, port, timeout).await {
+        Ok(info) => {
+            if let Some(ws_url) = info.web_socket_debugger_url {
+                return Ok(append_query(&rewrite_ws_host(&ws_url, host, port), query));
+            }
+            format!(
+                "No webSocketDebuggerUrl in /json/version at {}:{}",
+                host, port
+            )
+        }
+        Err(e) => e,
+    };
+
+    // Fallback: /json/list (returns target list; look for the browser target)
+    let list_err = match fetch_cdp_list(host, port, timeout).await {
+        Ok(ws_url) => return Ok(append_query(&rewrite_ws_host(&ws_url, host, port), query)),
+        Err(e) => e,
+    };
+
+    // Final fallback: direct WebSocket at /devtools/browser.
+    // Chrome 136+ with UI-based remote debugging (chrome://inspect) exposes
+    // CDP over WebSocket but does not serve HTTP discovery endpoints.
+    match discover_cdp_ws(host, port, timeout).await {
+        Ok(ws_url) => Ok(append_query(&ws_url, query)),
+        Err(ws_err) => Err(format!(
+            "All CDP discovery methods failed for {host}:{port}. \
+             Note: Chrome 136+ no longer serves the HTTP discovery endpoints \
+             (/json/version, /json/list), so `--cdp <port>` cannot find the target — \
+             use the default auto-connect (just `chrome-use open <url>`), which reads \
+             DevToolsActivePort and attaches over WebSocket. \
+             (details: /json/version: {version_err}; /json/list: {list_err}; WebSocket: {ws_err})"
+        )),
+    }
+}
+
+/// Bracket an IPv6 address for use in URLs. No-op for IPv4 or already-bracketed addresses.
+fn bracket_ipv6(host: &str) -> String {
+    if host.contains(':') && !host.starts_with('[') {
+        format!("[{}]", host)
+    } else {
+        host.to_string()
+    }
+}
+
+/// Fetch `/json/version` from the given host:port and parse the response.
+async fn fetch_cdp_info(
+    host: &str,
+    port: u16,
+    timeout: Duration,
+) -> Result<BrowserVersionInfo, String> {
+    let url = format!("http://{}:{}/json/version", bracket_ipv6(host), port);
+
+    let body = tokio::time::timeout(timeout, reqwest_get_string(&url))
+        .await
+        .map_err(|_| format!("Timeout connecting to CDP at {}:{}", host, port))?
+        .map_err(|e| format!("Failed to connect to CDP at {}:{}: {}", host, port, e))?;
+
+    serde_json::from_str(&body).map_err(|e| format!("Invalid /json/version response: {}", e))
+}
+
+/// Rewrite the host and port in a WebSocket URL to match the target we
+/// actually connected to. Chrome's `/json/version` always returns
+/// `ws://127.0.0.1:<local-port>/...` which is unreachable when the
+/// browser is on a remote machine or behind a port-forward.
+fn rewrite_ws_host(ws_url: &str, host: &str, port: u16) -> String {
+    if let Ok(mut parsed) = url::Url::parse(ws_url) {
+        let _ = parsed.set_host(Some(&bracket_ipv6(host)));
+        let _ = parsed.set_port(Some(port));
+        parsed.to_string()
+    } else {
+        ws_url.to_string()
+    }
+}
+
+/// Append a query string to a URL, preserving any existing query parameters.
+fn append_query(url: &str, query: Option<&str>) -> String {
+    match query {
+        Some(q) if !q.is_empty() => {
+            if let Ok(mut parsed) = url::Url::parse(url) {
+                {
+                    let mut pairs = parsed.query_pairs_mut();
+                    pairs.extend_pairs(url::form_urlencoded::parse(q.as_bytes()));
+                }
+                parsed.to_string()
+            } else {
+                // Fallback: raw string append
+                if url.contains('?') {
+                    format!("{}&{}", url, q)
+                } else {
+                    format!("{}?{}", url, q)
+                }
+            }
+        }
+        _ => url.to_string(),
+    }
+}
+
+/// Fetch `/json/list` and extract the `webSocketDebuggerUrl` from the first
+/// target with `type == "browser"`, or the first target if none has that type.
+async fn fetch_cdp_list(host: &str, port: u16, timeout: Duration) -> Result<String, String> {
+    let url = format!("http://{}:{}/json/list", bracket_ipv6(host), port);
+
+    let body = tokio::time::timeout(timeout, reqwest_get_string(&url))
+        .await
+        .map_err(|_| format!("Timeout connecting to /json/list at {}:{}", host, port))?
+        .map_err(|e| {
+            format!(
+                "Failed to connect to /json/list at {}:{}: {}",
+                host, port, e
+            )
+        })?;
+
+    let targets: Vec<serde_json::Value> =
+        serde_json::from_str(&body).map_err(|e| format!("Invalid /json/list response: {}", e))?;
+
+    // Prefer targets with type "browser", fall back to first target with a ws URL
+    let browser_target = targets
+        .iter()
+        .find(|t| t.get("type").and_then(|v| v.as_str()) == Some("browser"));
+
+    let target = browser_target.or_else(|| targets.first());
+
+    target
+        .and_then(|t| t.get("webSocketDebuggerUrl"))
+        .and_then(|v| v.as_str())
+        .map(|s| s.to_string())
+        .ok_or_else(|| "No webSocketDebuggerUrl found in /json/list targets".to_string())
+}
+
+/// Discover a CDP endpoint by connecting directly to `ws://host:port/devtools/browser`
+/// and verifying it responds to `Browser.getVersion`.
+/// Returns the WebSocket URL on success.
+async fn discover_cdp_ws(host: &str, port: u16, timeout: Duration) -> Result<String, String> {
+    let ws_url = format!("ws://{}:{}/devtools/browser", bracket_ipv6(host), port);
+
+    tokio::time::timeout(timeout, async {
+        let (mut ws_stream, _) = tokio_tungstenite::connect_async(&ws_url)
+            .await
+            .map_err(|e| format!("WebSocket connect failed at {}: {}", ws_url, e))?;
+
+        let cmd = r#"{"id":1,"method":"Browser.getVersion"}"#;
+        ws_stream
+            .send(Message::Text(cmd.into()))
+            .await
+            .map_err(|e| format!("Failed to send command: {}", e))?;
+
+        #[derive(serde::Deserialize)]
+        struct CdpReply {
+            id: u64,
+        }
+
+        let mut result: Result<(), String> = Err("No valid CDP response received".to_string());
+        while let Some(msg) = ws_stream.next().await {
+            match msg {
+                Ok(Message::Text(text)) => {
+                    if serde_json::from_str::<CdpReply>(&text).is_ok_and(|r| r.id == 1) {
+                        result = Ok(());
+                        break;
+                    }
+                }
+                Ok(Message::Close(_)) | Err(_) => break,
+                _ => continue,
+            }
+        }
+
+        let _ = ws_stream.close(None).await;
+        result
+    })
+    .await
+    .map_err(|_| format!("Timeout connecting to WebSocket at {}", ws_url))?
+    .map(|()| ws_url)
+}
+
+async fn reqwest_get_string(url: &str) -> Result<String, String> {
+    let resp = reqwest::get(url).await.map_err(|e| e.to_string())?;
+    resp.text().await.map_err(|e| e.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    use tokio::net::TcpListener;
+
+    const HTTP_404: &str =
+        "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n";
+
+    fn http_200(body: &str) -> String {
+        format!(
+            "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\nContent-Type: application/json\r\n\r\n{}",
+            body.len(), body
+        )
+    }
+
+    async fn accept_http(listener: &TcpListener, response: &str) {
+        let (mut s, _) = listener.accept().await.unwrap();
+        let mut buf = [0u8; 1024];
+        let _ = s.read(&mut buf).await;
+        s.write_all(response.as_bytes()).await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn discovers_ws_url_from_json_version() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let server = tokio::spawn(async move {
+            accept_http(
+                &listener,
+                &http_200(r#"{"webSocketDebuggerUrl":"ws://127.0.0.1:1234/"}"#),
+            )
+            .await;
+        });
+
+        let ws_url = discover_cdp_url("127.0.0.1", port, None).await.unwrap();
+        assert_eq!(ws_url, format!("ws://127.0.0.1:{}/", port));
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn returns_error_when_version_returns_invalid_json() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let server = tokio::spawn(async move {
+            accept_http(&listener, &http_200("not-json")).await;
+            // /json/list and ws fallback both fail (server closes)
+        });
+
+        let err = discover_cdp_url("127.0.0.1", port, None).await.unwrap_err();
+        assert!(err.contains("Invalid /json/version response"));
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn falls_back_to_json_list_on_version_404() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let server = tokio::spawn(async move {
+            accept_http(&listener, HTTP_404).await;
+            accept_http(
+                &listener,
+                &http_200(r#"[{"type":"browser","webSocketDebuggerUrl":"ws://127.0.0.1:1234/devtools/browser/abc"}]"#),
+            ).await;
+        });
+
+        let ws_url = discover_cdp_url("127.0.0.1", port, None).await.unwrap();
+        assert!(ws_url.contains("/devtools/browser/abc"));
+        assert!(ws_url.contains(&port.to_string()));
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn falls_back_to_ws_when_http_returns_404() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let server = tokio::spawn(async move {
+            // /json/version -> 404, /json/list -> 404
+            accept_http(&listener, HTTP_404).await;
+            accept_http(&listener, HTTP_404).await;
+
+            // WebSocket handshake + respond to Browser.getVersion
+            let (stream, _) = listener.accept().await.unwrap();
+            let mut ws = tokio_tungstenite::accept_async(stream).await.unwrap();
+            if let Some(Ok(Message::Text(text))) = ws.next().await {
+                let req: serde_json::Value = serde_json::from_str(&text).unwrap();
+                let id = req.get("id").unwrap();
+                let reply = format!(
+                    r#"{{"id":{},"result":{{"protocolVersion":"1.3","product":"Chrome/136"}}}}"#,
+                    id
+                );
+                ws.send(Message::Text(reply)).await.unwrap();
+            }
+            let _ = ws.close(None).await;
+        });
+
+        let ws_url = discover_cdp_url("127.0.0.1", port, None).await.unwrap();
+        assert_eq!(ws_url, format!("ws://127.0.0.1:{}/devtools/browser", port));
+        server.await.unwrap();
+    }
+
+    #[test]
+    fn rewrite_ws_host_replaces_host_and_port() {
+        let original = "ws://127.0.0.1:9222/devtools/browser/abc";
+        let rewritten = rewrite_ws_host(original, "10.211.55.12", 9223);
+        assert_eq!(rewritten, "ws://10.211.55.12:9223/devtools/browser/abc");
+    }
+
+    #[test]
+    fn rewrite_ws_host_handles_ipv6() {
+        let original = "ws://127.0.0.1:9222/devtools/browser/abc";
+        let rewritten = rewrite_ws_host(original, "::1", 9222);
+        assert_eq!(rewritten, "ws://[::1]:9222/devtools/browser/abc");
+    }
+
+    #[test]
+    fn append_query_adds_params_to_url_without_query() {
+        let url = "ws://127.0.0.1:9222/devtools/browser/abc";
+        let result = append_query(url, Some("mode=Hello"));
+        assert_eq!(
+            result,
+            "ws://127.0.0.1:9222/devtools/browser/abc?mode=Hello"
+        );
+    }
+
+    #[test]
+    fn append_query_merges_with_existing_query() {
+        let url = "ws://127.0.0.1:9222/devtools/browser/abc?token=xyz";
+        let result = append_query(url, Some("mode=Hello"));
+        assert_eq!(
+            result,
+            "ws://127.0.0.1:9222/devtools/browser/abc?token=xyz&mode=Hello"
+        );
+    }
+
+    #[test]
+    fn append_query_noop_for_none() {
+        let url = "ws://127.0.0.1:9222/devtools/browser/abc";
+        let result = append_query(url, None);
+        assert_eq!(result, url);
+    }
+
+    #[test]
+    fn append_query_noop_for_empty() {
+        let url = "ws://127.0.0.1:9222/devtools/browser/abc";
+        let result = append_query(url, Some(""));
+        assert_eq!(result, url);
+    }
+
+    #[test]
+    fn append_query_handles_multiple_params() {
+        let url = "ws://127.0.0.1:9222/devtools/browser/abc";
+        let result = append_query(url, Some("mode=Hello&token=abc"));
+        assert_eq!(
+            result,
+            "ws://127.0.0.1:9222/devtools/browser/abc?mode=Hello&token=abc"
+        );
+    }
+
+    #[tokio::test]
+    async fn discover_preserves_query_params() {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        let server = tokio::spawn(async move {
+            accept_http(
+                &listener,
+                &http_200(r#"{"webSocketDebuggerUrl":"ws://127.0.0.1:1234/"}"#),
+            )
+            .await;
+        });
+
+        let ws_url = discover_cdp_url("127.0.0.1", port, Some("mode=Hello"))
+            .await
+            .unwrap();
+        assert_eq!(ws_url, format!("ws://127.0.0.1:{}/?mode=Hello", port));
+        server.await.unwrap();
+    }
+}

cli/src/native/cdp/lightpanda.rs

@@ -0,0 +1,500 @@
+use std::collections::VecDeque;
+use std::io::{BufRead, BufReader};
+use std::net::TcpListener;
+use std::path::PathBuf;
+use std::process::{Child, Command, Stdio};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use super::discovery::discover_cdp_url_with_timeout;
+
+const LIGHTPANDA_STARTUP_TIMEOUT: Duration = Duration::from_secs(10);
+const LIGHTPANDA_POLL_INTERVAL: Duration = Duration::from_millis(100);
+const LIGHTPANDA_DISCOVERY_TIMEOUT: Duration = Duration::from_millis(500);
+const LIGHTPANDA_SESSION_TIMEOUT_SECS: u64 = 604800; // 1 week, the documented maximum
+const MAX_LOG_LINES: usize = 40;
+
+pub struct LightpandaProcess {
+    child: Child,
+    pub ws_url: String,
+    _log_drainers: Vec<std::thread::JoinHandle<()>>,
+}
+
+impl LightpandaProcess {
+    pub fn kill(&mut self) {
+        let _ = self.child.kill();
+        let _ = self.child.wait();
+    }
+}
+
+impl Drop for LightpandaProcess {
+    fn drop(&mut self) {
+        self.kill();
+    }
+}
+
+#[derive(Default)]
+pub struct LightpandaLaunchOptions {
+    pub executable_path: Option<String>,
+    pub proxy: Option<String>,
+    pub port: Option<u16>,
+}
+
+fn build_lightpanda_serve_args(port: u16, proxy: Option<&str>) -> Vec<String> {
+    let mut args = vec![
+        "serve".to_string(),
+        "--host".to_string(),
+        "127.0.0.1".to_string(),
+        "--port".to_string(),
+        port.to_string(),
+        "--timeout".to_string(),
+        LIGHTPANDA_SESSION_TIMEOUT_SECS.to_string(),
+    ];
+
+    if let Some(proxy) = proxy {
+        args.push("--http_proxy".to_string());
+        args.push(proxy.to_string());
+    }
+
+    args
+}
+
+#[derive(Clone, Default)]
+struct LaunchLogBuffer {
+    stdout: Arc<Mutex<VecDeque<String>>>,
+    stderr: Arc<Mutex<VecDeque<String>>>,
+}
+
+impl LaunchLogBuffer {
+    fn push_stdout(&self, line: String) {
+        push_bounded(&self.stdout, line);
+    }
+
+    fn push_stderr(&self, line: String) {
+        push_bounded(&self.stderr, line);
+    }
+
+    fn snapshot_stdout(&self) -> Vec<String> {
+        self.stdout
+            .lock()
+            .expect("stdout log buffer poisoned")
+            .iter()
+            .cloned()
+            .collect()
+    }
+
+    fn snapshot_stderr(&self) -> Vec<String> {
+        self.stderr
+            .lock()
+            .expect("stderr log buffer poisoned")
+            .iter()
+            .cloned()
+            .collect()
+    }
+}
+
+fn push_bounded(buffer: &Mutex<VecDeque<String>>, line: String) {
+    let mut guard = buffer.lock().expect("log buffer poisoned");
+    if guard.len() >= MAX_LOG_LINES {
+        guard.pop_front();
+    }
+    guard.push_back(line);
+}
+
+pub fn find_lightpanda() -> Option<PathBuf> {
+    #[cfg(unix)]
+    {
+        if let Ok(output) = Command::new("which").arg("lightpanda").output() {
+            if output.status.success() {
+                let path = String::from_utf8_lossy(&output.stdout).trim().to_string();
+                if !path.is_empty() {
+                    return Some(PathBuf::from(path));
+                }
+            }
+        }
+    }
+
+    #[cfg(windows)]
+    {
+        if let Ok(output) = Command::new("where").arg("lightpanda").output() {
+            if output.status.success() {
+                let path = String::from_utf8_lossy(&output.stdout)
+                    .lines()
+                    .next()
+                    .unwrap_or("")
+                    .trim()
+                    .to_string();
+                if !path.is_empty() {
+                    return Some(PathBuf::from(path));
+                }
+            }
+        }
+    }
+
+    if let Some(home) = dirs::home_dir() {
+        let candidates = [
+            home.join(".lightpanda/lightpanda"),
+            home.join(".local/bin/lightpanda"),
+        ];
+        for c in &candidates {
+            if c.exists() {
+                return Some(c.clone());
+            }
+        }
+    }
+
+    None
+}
+
+pub async fn launch_lightpanda(
+    options: &LightpandaLaunchOptions,
+) -> Result<LightpandaProcess, String> {
+    let binary_path = match &options.executable_path {
+        Some(p) => PathBuf::from(p),
+        None => find_lightpanda().ok_or(
+            "Lightpanda not found. Install it from https://lightpanda.io/docs/open-source/installation or use --executable-path.",
+        )?,
+    };
+
+    let port = match options.port {
+        Some(p) => p,
+        None => TcpListener::bind("127.0.0.1:0")
+            .and_then(|l| l.local_addr())
+            .map(|a| a.port())
+            .map_err(|e| format!("Failed to find an available port for Lightpanda: {}", e))?,
+    };
+    let args = build_lightpanda_serve_args(port, options.proxy.as_deref());
+
+    let mut child = Command::new(&binary_path)
+        .args(&args)
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .map_err(|e| format!("Failed to launch Lightpanda at {:?}: {}", binary_path, e))?;
+
+    let (log_buffer, log_drainers) = start_log_drainers(&mut child)?;
+
+    let ws_url =
+        match wait_for_lightpanda_ready(&mut child, port, &log_buffer, LIGHTPANDA_STARTUP_TIMEOUT)
+            .await
+        {
+            Ok(url) => url,
+            Err(e) => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return Err(e);
+            }
+        };
+
+    Ok(LightpandaProcess {
+        child,
+        ws_url,
+        _log_drainers: log_drainers,
+    })
+}
+
+fn start_log_drainers(
+    child: &mut Child,
+) -> Result<(LaunchLogBuffer, Vec<std::thread::JoinHandle<()>>), String> {
+    let stdout = child.stdout.take().ok_or_else(|| {
+        let _ = child.kill();
+        "Failed to capture Lightpanda stdout".to_string()
+    })?;
+    let stderr = child.stderr.take().ok_or_else(|| {
+        let _ = child.kill();
+        "Failed to capture Lightpanda stderr".to_string()
+    })?;
+
+    let logs = LaunchLogBuffer::default();
+    let stdout_logs = logs.clone();
+    let stderr_logs = logs.clone();
+
+    let stdout_handle =
+        std::thread::spawn(move || drain_reader(stdout, move |line| stdout_logs.push_stdout(line)));
+    let stderr_handle =
+        std::thread::spawn(move || drain_reader(stderr, move |line| stderr_logs.push_stderr(line)));
+
+    Ok((logs, vec![stdout_handle, stderr_handle]))
+}
+
+fn drain_reader<R, F>(reader: R, mut push: F)
+where
+    R: std::io::Read,
+    F: FnMut(String),
+{
+    for line in BufReader::new(reader).lines() {
+        match line {
+            Ok(line) => push(line),
+            Err(_) => break,
+        }
+    }
+}
+
+async fn wait_for_lightpanda_ready(
+    child: &mut Child,
+    port: u16,
+    logs: &LaunchLogBuffer,
+    startup_timeout: Duration,
+) -> Result<String, String> {
+    let deadline = std::time::Instant::now() + startup_timeout;
+    let mut last_probe_error = None;
+
+    loop {
+        if let Ok(Some(status)) = child.try_wait() {
+            // Give the drainer threads a brief window to flush the last log lines
+            // before we snapshot them.  This is best-effort: lines written just
+            // before exit may still be missing, but the most useful output (early
+            // startup errors) will already be in the buffer.
+            tokio::time::sleep(Duration::from_millis(25)).await;
+            return Err(lightpanda_launch_error(
+                &format!(
+                    "Lightpanda exited before CDP became ready (status: {})",
+                    status
+                ),
+                logs,
+                last_probe_error.as_deref(),
+            ));
+        }
+
+        match discover_cdp_url_with_timeout("127.0.0.1", port, None, LIGHTPANDA_DISCOVERY_TIMEOUT)
+            .await
+        {
+            Ok(ws_url) => return Ok(ws_url),
+            Err(err) => last_probe_error = Some(err),
+        }
+
+        if std::time::Instant::now() >= deadline {
+            return Err(lightpanda_launch_error(
+                &format!(
+                    "Timed out after {}ms waiting for Lightpanda CDP endpoint on port {}",
+                    startup_timeout.as_millis(),
+                    port
+                ),
+                logs,
+                last_probe_error.as_deref(),
+            ));
+        }
+
+        tokio::time::sleep(LIGHTPANDA_POLL_INTERVAL).await;
+    }
+}
+
+fn lightpanda_launch_error(
+    message: &str,
+    logs: &LaunchLogBuffer,
+    last_probe_error: Option<&str>,
+) -> String {
+    let stdout_lines = logs.snapshot_stdout();
+    let stderr_lines = logs.snapshot_stderr();
+    let mut details = Vec::new();
+
+    if let Some(err) = last_probe_error {
+        details.push(format!("Last probe error: {}", err));
+    }
+
+    if !stderr_lines.is_empty() {
+        details.push(format!(
+            "Lightpanda stderr (last {} lines):\n  {}",
+            stderr_lines.len(),
+            stderr_lines.join("\n  ")
+        ));
+    }
+
+    if !stdout_lines.is_empty() {
+        details.push(format!(
+            "Lightpanda stdout (last {} lines):\n  {}",
+            stdout_lines.len(),
+            stdout_lines.join("\n  ")
+        ));
+    }
+
+    if details.is_empty() {
+        format!("{} (no stdout/stderr output from Lightpanda)", message)
+    } else {
+        format!("{}\n{}", message, details.join("\n"))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    use tokio::net::TcpListener as TokioTcpListener;
+
+    fn unused_port() -> u16 {
+        std::net::TcpListener::bind("127.0.0.1:0")
+            .unwrap()
+            .local_addr()
+            .unwrap()
+            .port()
+    }
+
+    async fn serve_json_version_once_after_delay(port: u16, delay_ms: u64, body: &'static str) {
+        tokio::time::sleep(Duration::from_millis(delay_ms)).await;
+        let listener = TokioTcpListener::bind(("127.0.0.1", port)).await.unwrap();
+        let (mut socket, _) = listener.accept().await.unwrap();
+        let mut buf = [0u8; 1024];
+        let _ = socket.read(&mut buf).await;
+        let response = format!(
+            "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nConnection: close\r\nContent-Type: application/json\r\n\r\n{}",
+            body.len(),
+            body
+        );
+        socket.write_all(response.as_bytes()).await.unwrap();
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    // Spawns a real child process and binds a TCP server with timing-based
+    // readiness assumptions; flaky under CI load (intermittent "exited before
+    // CDP became ready" / connection-refused races). Run locally with
+    // `--ignored` when touching lightpanda startup.
+    #[ignore = "process spawn + socket timing race, flaky in CI"]
+    async fn waits_for_ready_without_logs() {
+        let port = unused_port();
+        tokio::spawn(serve_json_version_once_after_delay(
+            port,
+            150,
+            r#"{"webSocketDebuggerUrl":"ws://127.0.0.1:9222/"}"#,
+        ));
+
+        let mut child = Command::new("/bin/sh")
+            .args(["-c", "sleep 5"])
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+
+        let (logs, _drainers) = start_log_drainers(&mut child).unwrap();
+        let ws_url = wait_for_lightpanda_ready(&mut child, port, &logs, LIGHTPANDA_STARTUP_TIMEOUT)
+            .await
+            .unwrap();
+
+        assert_eq!(ws_url, format!("ws://127.0.0.1:{}/", port));
+        let _ = child.kill();
+        let _ = child.wait();
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn child_exit_surfaces_logs() {
+        let port = unused_port();
+        let mut child = Command::new("/bin/sh")
+            .args(["-c", "echo boom >&2; sleep 0.1; exit 23"])
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+
+        let (logs, _drainers) = start_log_drainers(&mut child).unwrap();
+        let err = wait_for_lightpanda_ready(&mut child, port, &logs, LIGHTPANDA_STARTUP_TIMEOUT)
+            .await
+            .unwrap_err();
+
+        assert!(err.contains("Lightpanda exited before CDP became ready"));
+        assert!(err.contains("boom"));
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn timeout_reports_last_probe_error() {
+        let port = unused_port();
+        let mut child = Command::new("/bin/sh")
+            .args(["-c", "sleep 30"])
+            .stdin(Stdio::null())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+
+        let timeout = Duration::from_millis(300);
+        let (logs, _drainers) = start_log_drainers(&mut child).unwrap();
+        let err = tokio::time::timeout(
+            Duration::from_secs(2),
+            wait_for_lightpanda_ready(&mut child, port, &logs, timeout),
+        )
+        .await
+        .expect("ready wait should return before outer timeout")
+        .unwrap_err();
+
+        assert!(err.contains("Timed out after 300ms waiting for Lightpanda CDP endpoint"));
+        assert!(
+            err.contains("Failed to connect to CDP") || err.contains("Timeout connecting to CDP")
+        );
+
+        let _ = child.kill();
+        let _ = child.wait();
+    }
+
+    #[test]
+    fn test_find_lightpanda_returns_none_when_missing() {
+        let _ = find_lightpanda();
+    }
+
+    #[test]
+    fn test_lightpanda_launch_error_no_logs() {
+        let logs = LaunchLogBuffer::default();
+        let msg = lightpanda_launch_error("Lightpanda exited", &logs, None);
+        assert!(msg.contains("no stdout/stderr output"));
+    }
+
+    #[test]
+    fn test_lightpanda_launch_error_with_lines() {
+        let logs = LaunchLogBuffer::default();
+        logs.push_stdout("stdout line".to_string());
+        logs.push_stderr("stderr line".to_string());
+        let msg = lightpanda_launch_error("Lightpanda exited", &logs, Some("connect failed"));
+        assert!(msg.contains("stdout line"));
+        assert!(msg.contains("stderr line"));
+        assert!(msg.contains("Last probe error: connect failed"));
+    }
+
+    #[test]
+    fn test_default_options() {
+        let opts = LightpandaLaunchOptions::default();
+        assert!(opts.executable_path.is_none());
+        assert!(opts.proxy.is_none());
+        assert!(opts.port.is_none());
+    }
+
+    #[test]
+    fn test_build_lightpanda_serve_args_sets_explicit_session_timeout() {
+        let args = build_lightpanda_serve_args(9222, None);
+
+        assert_eq!(
+            args,
+            vec![
+                "serve".to_string(),
+                "--host".to_string(),
+                "127.0.0.1".to_string(),
+                "--port".to_string(),
+                "9222".to_string(),
+                "--timeout".to_string(),
+                "604800".to_string(),
+            ]
+        );
+    }
+
+    #[test]
+    fn test_build_lightpanda_serve_args_with_proxy() {
+        let args = build_lightpanda_serve_args(9333, Some("http://127.0.0.1:8080"));
+
+        assert_eq!(
+            args,
+            vec![
+                "serve".to_string(),
+                "--host".to_string(),
+                "127.0.0.1".to_string(),
+                "--port".to_string(),
+                "9333".to_string(),
+                "--timeout".to_string(),
+                "604800".to_string(),
+                "--http_proxy".to_string(),
+                "http://127.0.0.1:8080".to_string(),
+            ]
+        );
+    }
+}

cli/src/native/cdp/mod.rs

@@ -1,3 +1,5 @@
 pub mod chrome;
 pub mod client;
+pub mod discovery;
+pub mod lightpanda;
 pub mod types;

cli/src/native/cdp/types.rs

@@ -1,6 +1,51 @@
-use serde::{Deserialize, Serialize};
+use serde::{Deserialize, Deserializer, Serialize};
 use serde_json::Value;
 
+/// Deserialize a value that may be either a string or an integer into a String.
+/// Lightpanda sends numeric nodeIds/childIds in AX tree responses, while Chrome
+/// sends strings. This accepts both.
+fn string_or_int<'de, D>(deserializer: D) -> Result<String, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let v = Value::deserialize(deserializer)?;
+    match v {
+        Value::String(s) => Ok(s),
+        Value::Number(n) => Ok(n.to_string()),
+        other => Err(serde::de::Error::custom(format!(
+            "expected string or integer, got {}",
+            other
+        ))),
+    }
+}
+
+/// Deserialize an optional Vec where each element may be a string or integer.
+fn opt_vec_string_or_int<'de, D>(deserializer: D) -> Result<Option<Vec<String>>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let opt: Option<Vec<Value>> = Option::deserialize(deserializer)?;
+    match opt {
+        None => Ok(None),
+        Some(vec) => {
+            let mut result = Vec::with_capacity(vec.len());
+            for v in vec {
+                match v {
+                    Value::String(s) => result.push(s),
+                    Value::Number(n) => result.push(n.to_string()),
+                    other => {
+                        return Err(serde::de::Error::custom(format!(
+                            "expected string or integer in array, got {}",
+                            other
+                        )))
+                    }
+                }
+            }
+            Ok(Some(result))
+        }
+    }
+}
+
 // ---------------------------------------------------------------------------
 // CDP message envelope
 // ---------------------------------------------------------------------------
@@ -61,7 +106,13 @@ pub struct TargetInfo {
     pub target_id: String,
     #[serde(rename = "type")]
     pub target_type: String,
+    // Tolerate minimal targetInfo: the ab-connect relay's synthesized
+    // Target.attachedToTarget (re-announce path) omits title/url, and real CDP
+    // occasionally omits them too. Default to empty rather than fail the whole
+    // Target.getTargets deserialize.
+    #[serde(default)]
     pub title: String,
+    #[serde(default)]
     pub url: String,
     pub attached: Option<bool>,
     pub browser_context_id: Option<String>,
@@ -96,6 +147,18 @@ pub struct SetDiscoverTargetsParams {
 #[serde(rename_all = "camelCase")]
 pub struct CreateTargetParams {
     pub url: String,
+    /// Non-CDP hint consumed only by the `ab-connect` extension: the Chrome
+    /// tab-group name to drop the new tab into (per-session grouping on the
+    /// shared real Chrome). `None` on the normal CDP path so a strict real-Chrome
+    /// endpoint never receives an unknown parameter.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub agent_group: Option<String>,
+    /// Create the tab in the background so opening it never steals the user's
+    /// foreground tab (silent operation). Standard CDP param; the ab-connect
+    /// extension creates its tabs `active: false` regardless, so this only
+    /// affects the raw-CDP (no extension) path.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub background: Option<bool>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -215,6 +278,7 @@ pub struct RemoteObject {
     pub object_id: Option<String>,
     pub class_name: Option<String>,
     pub unserializable_value: Option<String>,
+    pub preview: Option<Value>,
 }
 
 #[derive(Debug, Clone, Deserialize)]
@@ -257,12 +321,14 @@ pub struct GetFullAXTreeResult {
 #[derive(Debug, Clone, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct AXNode {
+    #[serde(deserialize_with = "string_or_int")]
     pub node_id: String,
     pub role: Option<AXValue>,
     pub name: Option<AXValue>,
     pub value: Option<AXValue>,
     pub description: Option<AXValue>,
     pub properties: Option<Vec<AXProperty>>,
+    #[serde(default, deserialize_with = "opt_vec_string_or_int")]
     pub child_ids: Option<Vec<String>>,
     pub backend_d_o_m_node_id: Option<i64>,
     pub ignored: Option<bool>,
@@ -532,6 +598,7 @@ pub struct BrowserVersionInfo {
 /// Chromium source) into `cli/cdp-protocol/` and rebuild.
 ///
 /// Usage: `use super::cdp::types::generated::cdp_page::*;`
+#[allow(clippy::upper_case_acronyms)]
 pub mod generated {
     include!(concat!(env!("OUT_DIR"), "/cdp_generated.rs"));
 }

cli/src/native/cookies.rs

@@ -24,6 +24,19 @@ pub struct Cookie {
     pub same_site: Option<String>,
 }
 
+pub async fn get_all_cookies(client: &CdpClient, session_id: &str) -> Result<Vec<Cookie>, String> {
+    let result = client
+        .send_command_no_params("Network.getAllCookies", Some(session_id))
+        .await?;
+
+    let cookies: Vec<Cookie> = result
+        .get("cookies")
+        .and_then(|v| serde_json::from_value(v.clone()).ok())
+        .unwrap_or_default();
+
+    Ok(cookies)
+}
+
 pub async fn get_cookies(
     client: &CdpClient,
     session_id: &str,

cli/src/native/daemon.rs

@@ -1,30 +1,108 @@
 use serde_json::Value;
 use std::env;
 use std::fs;
+use std::io::Write;
 use std::path::PathBuf;
 use std::process;
+use std::sync::Arc;
+use std::time::Duration;
 
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::signal;
+use tokio::sync::{mpsc, Notify, RwLock};
 
 use super::actions::{execute_command, DaemonState};
+use super::cdp::client::CdpClient;
 use super::state;
+use super::stream::StreamServer;
 
 pub async fn run_daemon(session: &str) {
+    // Record this daemon's session so tabs it opens on the shared real Chrome
+    // (via the ab-connect extension) land in a per-session Chrome tab group.
+    let _ = super::browser::DAEMON_SESSION.set(session.to_string());
+
+    // Bootstrap / refresh the site-adapter pack in the background (first-run +
+    // periodic TTL). This populates ~/.chrome-use/sites/.index.json so navigation
+    // can auto-suggest `site` commands for the page you land on, with zero added
+    // latency to any command. Best-effort; offline is a no-op.
+    if crate::site::needs_refresh() {
+        tokio::spawn(async {
+            let _ = crate::site::update().await;
+        });
+    }
+
     let socket_dir = get_daemon_socket_dir();
     if !socket_dir.exists() {
         let _ = fs::create_dir_all(&socket_dir);
     }
 
+    // When debug mode is on, redirect stderr to a log file so daemon
+    // output can be inspected (the daemon normally has stderr piped to its
+    // parent which drops the read end after startup).
+    #[cfg(unix)]
+    if env::var("AGENT_BROWSER_DEBUG").is_ok() {
+        let log_path = socket_dir.join(format!("{}.log", session));
+        if let Ok(file) = fs::File::create(&log_path) {
+            use std::os::unix::io::IntoRawFd;
+            let fd = file.into_raw_fd();
+            unsafe {
+                libc::dup2(fd, 2);
+                libc::close(fd);
+            }
+            let _ = writeln!(
+                std::io::stderr(),
+                "[daemon] Debug logging started for session: {}",
+                session
+            );
+        }
+    } else {
+        // Redirect stderr to /dev/null to prevent daemon crash when the
+        // parent CLI drops the piped stderr handle after startup.  Cloud
+        // providers (AgentCore, Browserbase, etc.) may write to stderr
+        // during connection setup; a broken pipe would kill the daemon.
+        #[cfg(unix)]
+        {
+            use std::os::unix::io::IntoRawFd;
+            if let Ok(devnull) = fs::File::create("/dev/null") {
+                let fd = devnull.into_raw_fd();
+                unsafe {
+                    libc::dup2(fd, 2);
+                    libc::close(fd);
+                }
+            }
+        }
+    }
+
+    // Sweep temp Chrome profiles leaked by hard-killed daemons (Drop doesn't
+    // run on kill -9). Only removes dirs no live process references.
+    super::cdp::chrome::cleanup_orphaned_chrome_profiles();
+
     let pid_path = socket_dir.join(format!("{}.pid", session));
     let _ = fs::write(&pid_path, process::id().to_string());
 
+    let version_path = socket_dir.join(format!("{}.version", session));
+    let _ = fs::write(&version_path, env!("CARGO_PKG_VERSION"));
+
+    // On Unix the daemon listens on a Unix domain socket; on Windows it uses
+    // TCP, so there is no .sock file — only a .port file written by the server.
     let socket_path = socket_dir.join(format!("{}.sock", session));
 
+    #[cfg(unix)]
     if socket_path.exists() {
         let _ = fs::remove_file(&socket_path);
     }
 
+    #[cfg(windows)]
+    {
+        let _ = fs::remove_file(socket_dir.join(format!("{}.port", session)));
+    }
+
+    let stream_path = socket_dir.join(format!("{}.stream", session));
+    let _ = fs::remove_file(&stream_path);
+    let _ = fs::remove_file(socket_dir.join(format!("{}.engine", session)));
+    let _ = fs::remove_file(socket_dir.join(format!("{}.provider", session)));
+    let _ = fs::remove_file(socket_dir.join(format!("{}.extensions", session)));
+
     if let Ok(days_str) = env::var("AGENT_BROWSER_STATE_EXPIRE_DAYS") {
         if let Ok(days) = days_str.parse::<u64>() {
             if days > 0 {
@@ -33,28 +111,108 @@ pub async fn run_daemon(session: &str) {
         }
     }
 
-    let result = run_socket_server(&socket_path, session).await;
+    let mut stream_client: Option<Arc<RwLock<Option<Arc<CdpClient>>>>> = None;
+    let mut stream_server_instance: Option<Arc<StreamServer>> = None;
+    let preferred_port = env::var("AGENT_BROWSER_STREAM_PORT")
+        .ok()
+        .and_then(|s| s.parse::<u16>().ok())
+        .unwrap_or(0);
+    match StreamServer::start_without_client(preferred_port, session.to_string(), true).await {
+        Ok((stream_server, client_slot)) => {
+            stream_client = Some(client_slot.clone());
+            if let Err(e) = fs::write(&stream_path, stream_server.port().to_string()) {
+                let _ = writeln!(std::io::stderr(), "Failed to write .stream file: {}", e);
+            }
+            stream_server_instance = Some(Arc::new(stream_server));
+        }
+        Err(e) => {
+            let _ = writeln!(std::io::stderr(), "Stream server failed to start: {}", e);
+        }
+    }
 
-    let _ = fs::remove_file(&socket_path);
+    // Auto-shutdown the daemon after this many ms of inactivity (no commands
+    // received). On shutdown the daemon closes the tabs IT created (its per-session
+    // tab group), so an agent that finishes a task and just stops — without ever
+    // calling `close` — no longer leaves a pile of scratch tabs and a lingering
+    // tab group in the user's Chrome. The timer resets on every command, so active
+    // sessions are never interrupted; only genuinely-idle ones clean up.
+    //
+    // Defaults to 10 minutes. Set AGENT_BROWSER_IDLE_TIMEOUT_MS to override, or 0
+    // to disable (keep the daemon alive forever — the old behaviour). Adopted
+    // tabs (the user's own, via `adopt`) are never closed: only `created_targets`.
+    const DEFAULT_IDLE_TIMEOUT_MS: u64 = 600_000;
+    let idle_timeout_ms = match env::var("AGENT_BROWSER_IDLE_TIMEOUT_MS") {
+        Ok(s) => s.trim().parse::<u64>().ok().filter(|&ms| ms > 0),
+        Err(_) => Some(DEFAULT_IDLE_TIMEOUT_MS),
+    };
+
+    let result = run_socket_server(
+        &socket_path,
+        session,
+        stream_client,
+        stream_server_instance,
+        idle_timeout_ms,
+    )
+    .await;
+
+    #[cfg(unix)]
+    {
+        let _ = fs::remove_file(&socket_path);
+    }
+    #[cfg(windows)]
+    {
+        let _ = fs::remove_file(socket_dir.join(format!("{}.port", session)));
+    }
     let _ = fs::remove_file(&pid_path);
-    let stream_path = socket_dir.join(format!("{}.stream", session));
+    let _ = fs::remove_file(&version_path);
     let _ = fs::remove_file(&stream_path);
+    let _ = fs::remove_file(socket_dir.join(format!("{}.engine", session)));
+    let _ = fs::remove_file(socket_dir.join(format!("{}.provider", session)));
+    let _ = fs::remove_file(socket_dir.join(format!("{}.extensions", session)));
 
     if let Err(e) = result {
-        eprintln!("Daemon error: {}", e);
+        let _ = writeln!(std::io::stderr(), "Daemon error: {}", e);
         process::exit(1);
     }
 }
 
 #[cfg(unix)]
-async fn run_socket_server(socket_path: &PathBuf, _session: &str) -> Result<(), String> {
+async fn run_socket_server(
+    socket_path: &PathBuf,
+    session: &str,
+    stream_client: Option<Arc<RwLock<Option<Arc<CdpClient>>>>>,
+    stream_server: Option<Arc<StreamServer>>,
+    idle_timeout_ms: Option<u64>,
+) -> Result<(), String> {
     use tokio::net::UnixListener;
 
     let listener =
         UnixListener::bind(socket_path).map_err(|e| format!("Failed to bind socket: {}", e))?;
 
-    let state: std::sync::Arc<tokio::sync::Mutex<DaemonState>> =
-        std::sync::Arc::new(tokio::sync::Mutex::new(DaemonState::new()));
+    let stream_file: Option<PathBuf> = if stream_server.is_some() {
+        let dir = socket_path.parent().unwrap_or(std::path::Path::new("."));
+        Some(dir.join(format!("{}.stream", session)))
+    } else {
+        None
+    };
+
+    let state: std::sync::Arc<tokio::sync::Mutex<DaemonState>> = std::sync::Arc::new(
+        tokio::sync::Mutex::new(DaemonState::new_with_stream(stream_client, stream_server)),
+    );
+
+    let (reset_tx, mut reset_rx) = mpsc::channel::<()>(64);
+    let reset_tx = idle_timeout_ms.map(|_| Arc::new(reset_tx));
+
+    // Notifier used by handle_connection to signal the daemon loop to exit
+    // after a "close" command, instead of calling process::exit() which skips
+    // destructors and can leave Chrome processes orphaned (issue #1113).
+    let close_notify = Arc::new(Notify::new());
+
+    let mut drain_interval = tokio::time::interval(Duration::from_millis(100));
+    drain_interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+
+    let idle_sleep = idle_timeout_ms.map(|ms| tokio::time::sleep(Duration::from_millis(ms)));
+    let mut idle_sleep_pin = idle_sleep.map(Box::pin);
 
     loop {
         tokio::select! {
@@ -62,15 +220,54 @@ async fn run_socket_server(socket_path: &PathBuf, _session: &str) -> Result<(),
                 match accept_result {
                     Ok((stream, _)) => {
                         let state = state.clone();
+                        let reset_tx = reset_tx.clone();
+                        let sf = stream_file.clone();
+                        let cn = close_notify.clone();
                         tokio::spawn(async move {
-                            handle_connection(stream, state).await;
+                            handle_connection(stream, state, reset_tx, sf, cn).await;
                         });
                     }
                     Err(e) => {
-                        eprintln!("Accept error: {}", e);
+                        let _ = writeln!(std::io::stderr(), "Accept error: {}", e);
                     }
                 }
             }
+            _ = drain_interval.tick() => {
+                let mut s = state.lock().await;
+                if let Some(ref mut mgr) = s.browser {
+                    if mgr.has_process_exited() {
+                        let _ = mgr.close().await;
+                        s.browser = None;
+                        s.screencasting = false;
+                        s.update_stream_client().await;
+                    } else {
+                        s.drain_cdp_events_background().await;
+                    }
+                }
+            }
+            _ = async {
+                match idle_sleep_pin {
+                    Some(ref mut s) => s.as_mut().await,
+                    None => std::future::pending::<()>().await,
+                }
+            }, if idle_timeout_ms.is_some() => {
+                let mut s = state.lock().await;
+                if let Some(ref mut mgr) = s.browser {
+                    let _ = mgr.close().await;
+                }
+                break;
+            }
+            _ = reset_rx.recv(), if idle_timeout_ms.is_some() => {
+                idle_sleep_pin = idle_timeout_ms
+                    .map(|ms| Box::pin(tokio::time::sleep(Duration::from_millis(ms))));
+                continue;
+            }
+            _ = close_notify.notified() => {
+                // "close" command was handled; browser already closed by
+                // handle_close(). Break to run cleanup and exit gracefully
+                // so destructors fire.
+                break;
+            }
             _ = shutdown_signal() => {
                 let mut s = state.lock().await;
                 if let Some(ref mut mgr) = s.browser {
@@ -85,20 +282,50 @@ async fn run_socket_server(socket_path: &PathBuf, _session: &str) -> Result<(),
 }
 
 #[cfg(windows)]
-async fn run_socket_server(socket_path: &PathBuf, session: &str) -> Result<(), String> {
+async fn run_socket_server(
+    socket_path: &PathBuf,
+    session: &str,
+    stream_client: Option<Arc<RwLock<Option<Arc<CdpClient>>>>>,
+    stream_server: Option<Arc<StreamServer>>,
+    idle_timeout_ms: Option<u64>,
+) -> Result<(), String> {
     use tokio::net::TcpListener;
 
-    let port = get_port_for_session(session);
-    let listener = TcpListener::bind(format!("127.0.0.1:{}", port))
-        .await
-        .map_err(|e| format!("Failed to bind TCP: {}", e))?;
+    let preferred_port = get_port_for_session(session);
+    // Try the hash-derived port first; if it is blocked (e.g. Windows Hyper-V
+    // excluded port range), fall back to an OS-assigned ephemeral port.
+    let listener = match TcpListener::bind(format!("127.0.0.1:{}", preferred_port)).await {
+        Ok(l) => l,
+        Err(_) => TcpListener::bind("127.0.0.1:0")
+            .await
+            .map_err(|e| format!("Failed to bind TCP: {}", e))?,
+    };
+    let actual_port = listener
+        .local_addr()
+        .map_err(|e| format!("Failed to get local address: {}", e))?
+        .port();
 
     let socket_dir = socket_path.parent().unwrap_or(std::path::Path::new("."));
     let port_path = socket_dir.join(format!("{}.port", session));
-    let _ = fs::write(&port_path, port.to_string());
+    let _ = fs::write(&port_path, actual_port.to_string());
 
-    let state: std::sync::Arc<tokio::sync::Mutex<DaemonState>> =
-        std::sync::Arc::new(tokio::sync::Mutex::new(DaemonState::new()));
+    let stream_file: Option<PathBuf> = if stream_server.is_some() {
+        Some(socket_dir.join(format!("{}.stream", session)))
+    } else {
+        None
+    };
+
+    let state: std::sync::Arc<tokio::sync::Mutex<DaemonState>> = std::sync::Arc::new(
+        tokio::sync::Mutex::new(DaemonState::new_with_stream(stream_client, stream_server)),
+    );
+
+    let (reset_tx, mut reset_rx) = mpsc::channel::<()>(64);
+    let reset_tx = idle_timeout_ms.map(|_| Arc::new(reset_tx));
+
+    let close_notify = Arc::new(Notify::new());
+
+    let idle_sleep = idle_timeout_ms.map(|ms| tokio::time::sleep(Duration::from_millis(ms)));
+    let mut idle_sleep_pin = idle_sleep.map(Box::pin);
 
     loop {
         tokio::select! {
@@ -106,15 +333,40 @@ async fn run_socket_server(socket_path: &PathBuf, session: &str) -> Result<(), S
                 match accept_result {
                     Ok((stream, _)) => {
                         let state = state.clone();
+                        let reset_tx = reset_tx.clone();
+                        let sf = stream_file.clone();
+                        let cn = close_notify.clone();
                         tokio::spawn(async move {
-                            handle_connection(stream, state).await;
+                            handle_connection(stream, state, reset_tx, sf, cn).await;
                         });
                     }
                     Err(e) => {
-                        eprintln!("Accept error: {}", e);
+                        let _ = writeln!(std::io::stderr(), "Accept error: {}", e);
                     }
                 }
             }
+            _ = async {
+                match idle_sleep_pin {
+                    Some(ref mut s) => s.as_mut().await,
+                    None => std::future::pending::<()>().await,
+                }
+            }, if idle_timeout_ms.is_some() => {
+                let mut s = state.lock().await;
+                if let Some(ref mut mgr) = s.browser {
+                    let _ = mgr.close().await;
+                }
+                let _ = fs::remove_file(&port_path);
+                break;
+            }
+            _ = reset_rx.recv(), if idle_timeout_ms.is_some() => {
+                idle_sleep_pin = idle_timeout_ms
+                    .map(|ms| Box::pin(tokio::time::sleep(Duration::from_millis(ms))));
+                continue;
+            }
+            _ = close_notify.notified() => {
+                let _ = fs::remove_file(&port_path);
+                break;
+            }
             _ = shutdown_signal() => {
                 let mut s = state.lock().await;
                 if let Some(ref mut mgr) = s.browser {
@@ -129,8 +381,13 @@ async fn run_socket_server(socket_path: &PathBuf, session: &str) -> Result<(), S
     Ok(())
 }
 
-async fn handle_connection<S>(stream: S, state: std::sync::Arc<tokio::sync::Mutex<DaemonState>>)
-where
+async fn handle_connection<S>(
+    stream: S,
+    state: std::sync::Arc<tokio::sync::Mutex<DaemonState>>,
+    idle_reset_tx: Option<Arc<mpsc::Sender<()>>>,
+    stream_file_cleanup: Option<PathBuf>,
+    close_notify: Arc<Notify>,
+) where
     S: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin,
 {
     let (reader, mut writer) = tokio::io::split(stream);
@@ -165,6 +422,10 @@ where
                     }
                 };
 
+                if let Some(ref tx) = idle_reset_tx {
+                    let _ = tx.try_send(());
+                }
+
                 let is_close = cmd.get("action").and_then(|v| v.as_str()) == Some("close");
 
                 let response = {
@@ -179,8 +440,15 @@ where
                 }
 
                 if is_close {
+                    if let Some(ref path) = stream_file_cleanup {
+                        let _ = fs::remove_file(path);
+                    }
+                    // Signal the daemon loop to exit gracefully instead of
+                    // calling process::exit(), which skips destructors and
+                    // can leave Chrome processes orphaned (issue #1113).
                     tokio::time::sleep(tokio::time::Duration::from_millis(100)).await;
-                    process::exit(0);
+                    close_notify.notify_one();
+                    return;
                 }
             }
             Err(_) => break,
@@ -201,21 +469,25 @@ async fn shutdown_signal() {
         let mut sigint = match signal::unix::signal(signal::unix::SignalKind::interrupt()) {
             Ok(s) => s,
             Err(e) => {
-                eprintln!("Failed to install SIGINT handler: {}", e);
+                let _ = writeln!(std::io::stderr(), "Failed to install SIGINT handler: {}", e);
                 process::exit(1);
             }
         };
         let mut sigterm = match signal::unix::signal(signal::unix::SignalKind::terminate()) {
             Ok(s) => s,
             Err(e) => {
-                eprintln!("Failed to install SIGTERM handler: {}", e);
+                let _ = writeln!(
+                    std::io::stderr(),
+                    "Failed to install SIGTERM handler: {}",
+                    e
+                );
                 process::exit(1);
             }
         };
         let mut sighup = match signal::unix::signal(signal::unix::SignalKind::hangup()) {
             Ok(s) => s,
             Err(e) => {
-                eprintln!("Failed to install SIGHUP handler: {}", e);
+                let _ = writeln!(std::io::stderr(), "Failed to install SIGHUP handler: {}", e);
                 process::exit(1);
             }
         };
@@ -230,7 +502,7 @@ async fn shutdown_signal() {
     #[cfg(windows)]
     {
         if let Err(e) = signal::ctrl_c().await {
-            eprintln!("Failed to install Ctrl+C handler: {}", e);
+            let _ = writeln!(std::io::stderr(), "Failed to install Ctrl+C handler: {}", e);
             process::exit(1);
         }
     }
@@ -245,22 +517,190 @@ fn get_daemon_socket_dir() -> PathBuf {
 
     if let Ok(xdg) = env::var("XDG_RUNTIME_DIR") {
         if !xdg.is_empty() {
-            return PathBuf::from(xdg).join("agent-browser");
+            return PathBuf::from(xdg).join("chrome-use");
         }
     }
 
     if let Some(home) = dirs::home_dir() {
-        return home.join(".agent-browser");
+        return home.join(".chrome-use");
     }
 
-    std::env::temp_dir().join("agent-browser")
+    std::env::temp_dir().join("chrome-use")
 }
 
 #[cfg(windows)]
 fn get_port_for_session(session: &str) -> u16 {
-    let mut hash: i64 = 0;
-    for b in session.bytes() {
-        hash = hash.wrapping_mul(31).wrapping_add(b as i64);
+    let mut hash: i32 = 0;
+    for c in session.chars() {
+        hash = ((hash << 5).wrapping_sub(hash)).wrapping_add(c as i32);
+    }
+    49152 + ((hash.unsigned_abs() as u32 % 16383) as u16)
+}
+
+#[cfg(test)]
+mod tests {
+    #[allow(unused_imports)]
+    use super::*;
+
+    #[cfg(windows)]
+    #[test]
+    fn test_port_matches_client_algorithm() {
+        assert_eq!(get_port_for_session("default"), 50838);
+        assert_eq!(get_port_for_session("my-session"), 63105);
+        assert_eq!(get_port_for_session("work"), 51184);
+        assert_eq!(get_port_for_session(""), 49152);
+    }
+
+    /// Guard against re-introducing `waitpid(-1)` in daemon code.
+    ///
+    /// Issue #1035: a SIGCHLD handler that called `waitpid(-1, WNOHANG)` was
+    /// added in v0.22.3 to reap zombie Chrome processes. This races with
+    /// Rust's `Child::try_wait()` / `Child::wait()` because `waitpid(-1)`
+    /// reaps *any* child, stealing the exit status before Rust can collect
+    /// it. The result is ECHILD errors in `BrowserManager::has_process_exited()`
+    /// and `ChromeProcess::kill()`, which can leave the daemon in a broken
+    /// state or cause hangs on certain Linux configurations.
+    ///
+    /// The fix uses the existing 500ms drain interval to call
+    /// `has_process_exited()` (which delegates to `Child::try_wait()`)
+    /// for targeted, race-free zombie detection.
+    #[test]
+    fn test_no_waitpid_minus_one_in_daemon() {
+        let source = include_str!("daemon.rs");
+        // Only check production code (everything before `#[cfg(test)]`)
+        let production_code = source.split("#[cfg(test)]").next().unwrap_or(source);
+        assert!(
+            !production_code.contains("waitpid(-1"),
+            "daemon.rs production code must not call waitpid(-1, ...). \
+             Use Child::try_wait() via has_process_exited() instead. \
+             See issue #1035."
+        );
+    }
+
+    /// Verify that `Child::try_wait()` correctly detects a crashed child
+    /// without needing a global SIGCHLD handler or `waitpid(-1)`.
+    /// This is what `has_process_exited()` uses in the fixed code.
+    #[cfg(unix)]
+    #[test]
+    fn test_child_try_wait_detects_exit_without_sigchld_handler() {
+        use std::process::{Command, Stdio};
+
+        let mut child = Command::new("/bin/sh")
+            .args(["-c", "exit 42"])
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .spawn()
+            .expect("failed to spawn child");
+
+        std::thread::sleep(std::time::Duration::from_millis(200));
+
+        match child.try_wait() {
+            Ok(Some(status)) => {
+                assert!(
+                    !status.success(),
+                    "child exited with code 42, should not be success"
+                );
+            }
+            Ok(None) => panic!("try_wait() returned None but child should have exited"),
+            Err(e) => panic!("try_wait() should succeed without waitpid(-1): {}", e),
+        }
+    }
+
+    /// Regression test for #1101: idle timeout must fire even while the
+    /// drain interval ticks every 500 ms.  The bug was that `sleep_future`
+    /// was created **inside** the loop, so each drain tick dropped the
+    /// in-progress sleep and replaced it with a fresh one – the timer
+    /// could never reach its deadline.
+    #[tokio::test]
+    async fn test_idle_timeout_fires_despite_drain_interval() {
+        use tokio::sync::mpsc;
+
+        let idle_timeout_ms: u64 = 1000;
+        let mut drain_interval = tokio::time::interval(Duration::from_millis(500));
+        drain_interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+
+        let (_reset_tx, mut reset_rx) = mpsc::channel::<()>(64);
+
+        let start = tokio::time::Instant::now();
+
+        let exited = tokio::time::timeout(Duration::from_secs(5), async {
+            let mut idle_sleep_pin = Some(Box::pin(tokio::time::sleep(Duration::from_millis(
+                idle_timeout_ms,
+            ))));
+
+            loop {
+                tokio::select! {
+                    _ = drain_interval.tick() => {}
+                    _ = async {
+                        match idle_sleep_pin {
+                            Some(ref mut s) => s.as_mut().await,
+                            None => std::future::pending::<()>().await,
+                        }
+                    } => {
+                        break;
+                    }
+                    _ = reset_rx.recv() => {
+                        idle_sleep_pin = Some(Box::pin(
+                            tokio::time::sleep(Duration::from_millis(idle_timeout_ms)),
+                        ));
+                        continue;
+                    }
+                }
+            }
+        })
+        .await;
+
+        let elapsed = start.elapsed();
+
+        assert!(
+            exited.is_ok(),
+            "idle timeout never fired – loop ran for >5 s (bug #1101)"
+        );
+        assert!(
+            elapsed < Duration::from_millis(idle_timeout_ms + 500),
+            "idle timeout took too long: {:?} (expected ~{} ms)",
+            elapsed,
+            idle_timeout_ms,
+        );
+    }
+
+    /// Verify that `ChromeProcess::has_exited()` (which uses `Child::try_wait()`)
+    /// correctly detects a killed child, the same way the drain interval does
+    /// in the fixed daemon code. This ensures crash detection works without
+    /// a SIGCHLD handler.
+    #[cfg(unix)]
+    #[test]
+    fn test_has_exited_detects_killed_process() {
+        use std::process::{Command, Stdio};
+
+        let mut child = Command::new("/bin/sh")
+            .args(["-c", "sleep 60"])
+            .stdin(Stdio::null())
+            .stdout(Stdio::null())
+            .stderr(Stdio::null())
+            .spawn()
+            .expect("failed to spawn child");
+
+        // Process should be running
+        match child.try_wait() {
+            Ok(None) => {} // expected
+            other => panic!("expected Ok(None) for running process, got {:?}", other),
+        }
+
+        // Kill it (simulates Chrome crash)
+        child.kill().expect("failed to kill child");
+        std::thread::sleep(std::time::Duration::from_millis(100));
+
+        // try_wait should detect the exit
+        match child.try_wait() {
+            Ok(Some(_)) => {} // expected: detected the crash
+            other => panic!(
+                "expected Ok(Some(_)) after kill, got {:?}. \
+                 Crash detection via try_wait() must work for the drain \
+                 interval fix (issue #1035) to function correctly.",
+                other
+            ),
+        }
     }
-    49152 + (hash.unsigned_abs() % 16383) as u16
 }

cli/src/native/diff.rs

@@ -101,6 +101,21 @@ pub fn diff_screenshot(
 
 /// Compute a snapshot diff using the Myers algorithm via the `similar` crate.
 pub fn diff_snapshots(before: &str, after: &str) -> SnapshotDiffResult {
+    // Fast path: identical inputs.
+    // This avoids constructing the `similar` TextDiff object and running the diff
+    // iteration when agents compare a snapshot to itself (common in retry/loop
+    // workloads).
+    if before == after {
+        let unchanged = before.lines().count();
+        return SnapshotDiffResult {
+            diff: String::new(),
+            additions: 0,
+            removals: 0,
+            unchanged,
+            changed: false,
+        };
+    }
+
     let text_diff = TextDiff::from_lines(before, after);
 
     let mut additions = 0usize;
@@ -192,4 +207,68 @@ mod tests {
         assert_eq!(result.unchanged, 1);
         assert!(!result.diff.is_empty());
     }
+
+    #[test]
+    fn test_diff_snapshots_identical_fast_path() {
+        let input = "hello\nworld\n";
+        let result = diff_snapshots(input, input);
+        assert!(!result.changed);
+        assert_eq!(result.additions, 0);
+        assert_eq!(result.removals, 0);
+        assert_eq!(result.unchanged, input.lines().count());
+        assert!(result.diff.is_empty());
+    }
+
+    #[test]
+    #[ignore]
+    fn bench_diff_snapshots_identical_and_changed() {
+        use std::hint::black_box;
+        use std::time::Instant;
+
+        let identical_a = (0..200)
+            .map(|i| format!("line {i}"))
+            .collect::<Vec<_>>()
+            .join("\n");
+        let identical_b = identical_a.clone();
+
+        let changed_a = identical_a.clone();
+        let changed_b = (0..200)
+            .map(|i| {
+                if i == 123 {
+                    format!("line {i} changed")
+                } else {
+                    format!("line {i}")
+                }
+            })
+            .collect::<Vec<_>>()
+            .join("\n");
+
+        // Keep the iteration count high enough to measure, but low enough
+        // to avoid long CI times when someone runs `--ignored`.
+        let iters = 50_000usize;
+
+        let start = Instant::now();
+        let mut acc_changed = 0usize;
+        for _ in 0..iters {
+            let r = diff_snapshots(black_box(&identical_a), black_box(&identical_b));
+            acc_changed ^= r.unchanged;
+        }
+        let identical_ms = start.elapsed().as_secs_f64() * 1000.0;
+
+        let start = Instant::now();
+        let mut acc_changed2 = 0usize;
+        for _ in 0..iters {
+            let r = diff_snapshots(black_box(&changed_a), black_box(&changed_b));
+            acc_changed2 ^= r.additions;
+        }
+        let changed_ms = start.elapsed().as_secs_f64() * 1000.0;
+
+        // Prevent the compiler from optimizing everything away.
+        black_box(acc_changed);
+        black_box(acc_changed2);
+
+        println!(
+            "bench_diff_snapshots_identical_and_changed: iters={iters} identical_ms={identical_ms:.2} changed_ms={changed_ms:.2}"
+        );
+    }
 }

cli/src/native/humanize.rs

@@ -0,0 +1,517 @@
+//! Human-like input behaviour for stealth.
+//!
+//! When chrome-use drives a real Chrome over CDP, the input events it
+//! dispatches are already `isTrusted` — but a click that teleports the cursor
+//! straight to an element's exact centre, with no approach path and zero delay
+//! between move/press/release, is a behavioural tell that advanced anti-bot
+//! vendors (Akamai, PerimeterX, DataDome) look for.
+//!
+//! This module produces **human-like motion plans** — curved, eased cursor
+//! trajectories and variable keystroke timing — as *pure data*. It performs no
+//! I/O and knows nothing about CDP: callers turn the returned steps into
+//! `Input.dispatchMouseEvent` / `dispatchKeyEvent` calls. Keeping the maths pure
+//! makes the easing/jitter/detection logic unit-testable and deterministic
+//! (every randomised value comes from a caller-supplied seed).
+//!
+//! Design (see brainstorm 2026-06-11):
+//! - Three levels: [`HumanizeLevel::Off`] (instant, today's behaviour),
+//!   `Fast` (a few cheap eased steps), `Human` (full curved trajectory + jitter).
+//! - Baseline is `Off`; the daemon escalates a session to `Human` when
+//!   [`detect_level`] spots a known anti-bot vendor on the page. `--humanize` /
+//!   `AGENT_BROWSER_HUMANIZE` force a fixed level.
+//! - Humanization only changes *how* the cursor reaches a target, never *which*
+//!   element is hit: the landing jitter stays inside the caller-provided bounds.
+
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{Mutex, OnceLock};
+use std::time::Duration;
+
+// ---- daemon-wide runtime state -------------------------------------------
+//
+// The pure motion maths above are stateless. The daemon drives one active page
+// at a time, so we keep the *current* humanize level and last cursor position
+// in process-global slots rather than threading them through every call site.
+// (The adaptive detector flips the level per navigation; `dispatch_click` reads
+// the level + cursor here, so no signature in the click/type call graph has to
+// change.)
+
+/// `AGENT_BROWSER_HUMANIZE` forces a fixed level, overriding the adaptive
+/// detector. Parsed once.
+fn env_override() -> Option<HumanizeLevel> {
+    static OVERRIDE: OnceLock<Option<HumanizeLevel>> = OnceLock::new();
+    *OVERRIDE.get_or_init(|| {
+        std::env::var("AGENT_BROWSER_HUMANIZE")
+            .ok()
+            .and_then(|s| HumanizeLevel::parse(&s))
+    })
+}
+
+fn session_level() -> &'static Mutex<HumanizeLevel> {
+    static LEVEL: OnceLock<Mutex<HumanizeLevel>> = OnceLock::new();
+    LEVEL.get_or_init(|| Mutex::new(HumanizeLevel::Off))
+}
+
+fn last_cursor_slot() -> &'static Mutex<(f64, f64)> {
+    static CURSOR: OnceLock<Mutex<(f64, f64)>> = OnceLock::new();
+    CURSOR.get_or_init(|| Mutex::new((0.0, 0.0)))
+}
+
+/// The level that should apply right now: the env override if set, else the
+/// level the detector last chose for the active page.
+pub fn active_level() -> HumanizeLevel {
+    env_override().unwrap_or_else(|| *session_level().lock().unwrap())
+}
+
+/// Set by the adaptive detector after navigation. Ignored while an env override
+/// is in force (so `--humanize` always wins).
+pub fn set_detected_level(level: HumanizeLevel) {
+    *session_level().lock().unwrap() = level;
+}
+
+/// Where the virtual cursor currently sits, so the next move starts from there
+/// instead of teleporting.
+pub fn last_cursor() -> (f64, f64) {
+    *last_cursor_slot().lock().unwrap()
+}
+
+/// Record the cursor landing point after a move/click.
+pub fn set_last_cursor(p: (f64, f64)) {
+    *last_cursor_slot().lock().unwrap() = p;
+}
+
+/// A fresh seed per action so repeated clicks on the same point still vary,
+/// without touching the wall clock or a global RNG (both would break replay).
+pub fn next_seed() -> u64 {
+    static COUNTER: AtomicU64 = AtomicU64::new(0x1234_5678);
+    COUNTER
+        .fetch_add(0x9E37_79B9_7F4A_7C15, Ordering::Relaxed)
+        .rotate_left(17)
+}
+
+/// How human-like input motion should be.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub enum HumanizeLevel {
+    /// Instant: a single move to the exact point, no delays. Original behaviour.
+    #[default]
+    Off,
+    /// A few eased steps with small delays — cheap cover for ordinary sites.
+    Fast,
+    /// Full curved, decelerating trajectory with landing jitter and press
+    /// dwell — for pages guarded by behavioural anti-bot systems.
+    Human,
+}
+
+impl HumanizeLevel {
+    /// Parse a user-supplied level (`--humanize` / `AGENT_BROWSER_HUMANIZE`).
+    pub fn parse(s: &str) -> Option<Self> {
+        match s.trim().to_ascii_lowercase().as_str() {
+            "off" | "none" | "instant" | "0" => Some(Self::Off),
+            "fast" | "light" | "low" => Some(Self::Fast),
+            "human" | "full" | "high" | "max" => Some(Self::Human),
+            _ => None,
+        }
+    }
+
+    fn is_off(self) -> bool {
+        matches!(self, Self::Off)
+    }
+}
+
+/// One step of a humanized cursor move: dispatch `mouseMoved` to (`x`, `y`),
+/// then sleep for `delay` before the next step. The final step's point is where
+/// the press/release should land.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct MoveStep {
+    pub x: f64,
+    pub y: f64,
+    pub delay: Duration,
+}
+
+/// Tiny deterministic PRNG (xorshift64*). Seeded by the caller so trajectories
+/// are reproducible in tests; we avoid pulling in the `rand` crate and never
+/// call a wall-clock/global RNG (which would also break workflow replay).
+struct Rng(u64);
+
+impl Rng {
+    fn new(seed: u64) -> Self {
+        // Avoid the zero state, which xorshift cannot escape.
+        Rng(seed ^ 0x9E37_79B9_7F4A_7C15)
+    }
+
+    fn next_u64(&mut self) -> u64 {
+        let mut x = self.0;
+        x ^= x >> 12;
+        x ^= x << 25;
+        x ^= x >> 27;
+        self.0 = x;
+        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
+    }
+
+    /// Uniform in [0, 1).
+    fn unit(&mut self) -> f64 {
+        // Top 53 bits → f64 mantissa.
+        (self.next_u64() >> 11) as f64 / (1u64 << 53) as f64
+    }
+
+    /// Uniform in [-1, 1).
+    fn signed(&mut self) -> f64 {
+        self.unit() * 2.0 - 1.0
+    }
+}
+
+/// Smootherstep ease (zero velocity at both ends) — used to bias the per-step
+/// timing so the cursor accelerates away from the start and decelerates into
+/// the target, the way a hand does.
+fn ease(t: f64) -> f64 {
+    let t = t.clamp(0.0, 1.0);
+    t * t * t * (t * (t * 6.0 - 15.0) + 10.0)
+}
+
+/// Cubic Bézier point at parameter `t`.
+fn bezier(p0: (f64, f64), p1: (f64, f64), p2: (f64, f64), p3: (f64, f64), t: f64) -> (f64, f64) {
+    let u = 1.0 - t;
+    let (a, b, c, d) = (u * u * u, 3.0 * u * u * t, 3.0 * u * t * t, t * t * t);
+    (
+        a * p0.0 + b * p1.0 + c * p2.0 + d * p3.0,
+        a * p0.1 + b * p1.1 + c * p2.1 + d * p3.1,
+    )
+}
+
+/// Pick a landing point inside `bbox` (`x`, `y`, `width`, `height`). `Off`
+/// returns the exact centre; `Fast`/`Human` jitter around the centre but stay
+/// well inside the element so the click still lands on it.
+pub fn landing_point(bbox: (f64, f64, f64, f64), level: HumanizeLevel, seed: u64) -> (f64, f64) {
+    let (bx, by, bw, bh) = bbox;
+    let cx = bx + bw / 2.0;
+    let cy = by + bh / 2.0;
+    if level.is_off() || bw <= 1.0 || bh <= 1.0 {
+        return (cx, cy);
+    }
+    // Keep within the inner 60% so jitter never lands on a neighbouring element
+    // or the element's padding/edge.
+    let spread = match level {
+        HumanizeLevel::Human => 0.30,
+        _ => 0.15,
+    };
+    let mut rng = Rng::new(seed);
+    (
+        cx + rng.signed() * bw * spread,
+        cy + rng.signed() * bh * spread,
+    )
+}
+
+/// Build the cursor path from `from` to `to`. The last [`MoveStep`] is the
+/// landing point. `Off` yields a single zero-delay step at `to` (today's
+/// teleport), so callers can use one code path for every level.
+pub fn move_path(
+    from: (f64, f64),
+    to: (f64, f64),
+    level: HumanizeLevel,
+    seed: u64,
+) -> Vec<MoveStep> {
+    if level.is_off() {
+        return vec![MoveStep {
+            x: to.0,
+            y: to.1,
+            delay: Duration::ZERO,
+        }];
+    }
+
+    let dist = (to.0 - from.0).hypot(to.1 - from.1);
+    if dist < 1.0 {
+        return vec![MoveStep {
+            x: to.0,
+            y: to.1,
+            delay: Duration::ZERO,
+        }];
+    }
+
+    let (steps, total_ms, arc) = match level {
+        HumanizeLevel::Fast => {
+            let s = ((dist / 120.0).round() as usize).clamp(3, 6);
+            (s, (dist * 0.35).clamp(40.0, 130.0), 0.06)
+        }
+        // Off handled above.
+        _ => {
+            let s = ((dist / 45.0).round() as usize).clamp(8, 24);
+            (s, (dist * 0.9).clamp(140.0, 650.0), 0.16)
+        }
+    };
+
+    let mut rng = Rng::new(seed);
+
+    // Two control points along the line, pushed perpendicular to it to bow the
+    // path into a gentle, slightly asymmetric arc.
+    let (dx, dy) = (to.0 - from.0, to.1 - from.1);
+    let (nx, ny) = (-dy / dist, dx / dist); // unit normal
+    let bow = dist * arc * rng.signed();
+    let ctrl = |frac: f64, jitter: f64, rng: &mut Rng| {
+        let base = (from.0 + dx * frac, from.1 + dy * frac);
+        let off = bow * (1.0 + jitter * rng.signed());
+        (base.0 + nx * off, base.1 + ny * off)
+    };
+    let p1 = ctrl(0.33, 0.4, &mut rng);
+    let p2 = ctrl(0.66, 0.4, &mut rng);
+
+    let mut out = Vec::with_capacity(steps);
+    let mut prev_ease = 0.0;
+    for i in 1..=steps {
+        let t = i as f64 / steps as f64;
+        // Ease maps wall-time progress so most points cluster near the ends
+        // (slow start, slow finish, fast middle).
+        let te = ease(t);
+        let (x, y) = bezier(from, p1, p2, to, te);
+        let frac = te - prev_ease;
+        prev_ease = te;
+        out.push(MoveStep {
+            x,
+            y,
+            delay: Duration::from_micros((total_ms * frac * 1000.0).max(0.0) as u64),
+        });
+    }
+    // Guarantee the final point is exactly the target.
+    if let Some(last) = out.last_mut() {
+        last.x = to.0;
+        last.y = to.1;
+    }
+    out
+}
+
+/// Split a wheel scroll of (`total_dx`, `total_dy`) into eased segments. `Off`
+/// returns a single instant segment (today's one-shot scroll); `Fast`/`Human`
+/// break it into several accelerate-then-decelerate chunks with small,
+/// jittered inter-segment delays, the way a trackpad/wheel flick actually
+/// lands. The segment deltas always sum to the requested total.
+pub fn scroll_segments(
+    total_dx: f64,
+    total_dy: f64,
+    level: HumanizeLevel,
+    seed: u64,
+) -> Vec<(f64, f64, Duration)> {
+    if level.is_off() {
+        return vec![(total_dx, total_dy, Duration::ZERO)];
+    }
+    let (segs, base_ms) = match level {
+        HumanizeLevel::Fast => (4usize, 18.0),
+        _ => (9usize, 28.0),
+    };
+    let mut rng = Rng::new(seed);
+    let mut out = Vec::with_capacity(segs);
+    let mut prev = 0.0;
+    for i in 1..=segs {
+        let f = ease(i as f64 / segs as f64);
+        let frac = f - prev;
+        prev = f;
+        let jitter = 1.0 + 0.3 * rng.signed();
+        out.push((
+            total_dx * frac,
+            total_dy * frac,
+            Duration::from_millis((base_ms * jitter).max(4.0) as u64),
+        ));
+    }
+    out
+}
+
+/// Dwell between `mousePressed` and `mouseReleased` (a real click isn't
+/// instantaneous). Zero for `Off`.
+pub fn press_dwell(level: HumanizeLevel, seed: u64) -> Duration {
+    match level {
+        HumanizeLevel::Off => Duration::ZERO,
+        HumanizeLevel::Fast => Duration::from_millis(20 + (seed % 30)),
+        HumanizeLevel::Human => Duration::from_millis(50 + (seed % 90)),
+    }
+}
+
+/// Per-character delays for typing `len` characters. `Off` is all-zero (use a
+/// single `Input.insertText`); `Fast`/`Human` produce variable inter-keystroke
+/// gaps with the occasional longer "think" pause, like a real typist.
+pub fn keystroke_delays(len: usize, level: HumanizeLevel, seed: u64) -> Vec<Duration> {
+    if level.is_off() || len == 0 {
+        return vec![Duration::ZERO; len];
+    }
+    let (mean, jitter, pause_chance, pause_extra) = match level {
+        HumanizeLevel::Fast => (25.0, 15.0, 0.0, 0.0),
+        _ => (95.0, 55.0, 0.06, 220.0),
+    };
+    let mut rng = Rng::new(seed);
+    (0..len)
+        .map(|_| {
+            let mut ms = (mean + rng.signed() * jitter).max(8.0);
+            if pause_chance > 0.0 && rng.unit() < pause_chance {
+                ms += rng.unit() * pause_extra;
+            }
+            Duration::from_millis(ms as u64)
+        })
+        .collect()
+}
+
+/// Page signals sampled after navigation, used to decide whether to escalate a
+/// session to [`HumanizeLevel::Human`]. All strings are matched case-insensitively.
+#[derive(Debug, Default, Clone)]
+pub struct DetectSignals {
+    /// Cookie names present on the document (e.g. `_abck`, `datadome`).
+    pub cookie_names: Vec<String>,
+    /// `src` of loaded scripts.
+    pub script_urls: Vec<String>,
+    /// Names of suspicious globals on `window` (e.g. `_px`, `bmak`).
+    pub window_globals: Vec<String>,
+}
+
+/// Known behavioural anti-bot fingerprints: (substring, vendor). Matched against
+/// cookie names, script URLs, and window globals.
+const VENDOR_MARKERS: &[(&str, &str)] = &[
+    ("_abck", "akamai"),
+    ("bm_sz", "akamai"),
+    ("ak_bmsc", "akamai"),
+    ("bmak", "akamai"),
+    ("_px", "perimeterx"),
+    ("perimeterx", "perimeterx"),
+    ("px-cloud", "perimeterx"),
+    ("datadome", "datadome"),
+    ("kpsdk", "kasada"),
+    ("incap_ses", "imperva"),
+    ("visid_incap", "imperva"),
+    ("reese84", "imperva"),
+    ("__cf_bm", "cloudflare-bot-mgmt"),
+];
+
+/// Decide the level for a page. Returns `Human` if any known anti-bot vendor is
+/// present, otherwise `baseline`. Misses just stay at baseline and false hits
+/// only cost a little latency, so matching is deliberately liberal.
+pub fn detect_level(signals: &DetectSignals, baseline: HumanizeLevel) -> HumanizeLevel {
+    let hay: Vec<String> = signals
+        .cookie_names
+        .iter()
+        .chain(signals.script_urls.iter())
+        .chain(signals.window_globals.iter())
+        .map(|s| s.to_ascii_lowercase())
+        .collect();
+    let matched = VENDOR_MARKERS
+        .iter()
+        .any(|(marker, _)| hay.iter().any(|h| h.contains(marker)));
+    if matched {
+        HumanizeLevel::Human
+    } else {
+        baseline
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_accepts_known_levels_and_rejects_junk() {
+        assert_eq!(HumanizeLevel::parse("off"), Some(HumanizeLevel::Off));
+        assert_eq!(HumanizeLevel::parse(" FAST "), Some(HumanizeLevel::Fast));
+        assert_eq!(HumanizeLevel::parse("Human"), Some(HumanizeLevel::Human));
+        assert_eq!(HumanizeLevel::parse("max"), Some(HumanizeLevel::Human));
+        assert_eq!(HumanizeLevel::parse("wat"), None);
+    }
+
+    #[test]
+    fn off_level_teleports_in_one_step() {
+        let path = move_path((0.0, 0.0), (100.0, 50.0), HumanizeLevel::Off, 1);
+        assert_eq!(path.len(), 1);
+        assert_eq!((path[0].x, path[0].y), (100.0, 50.0));
+        assert_eq!(path[0].delay, Duration::ZERO);
+    }
+
+    #[test]
+    fn humanized_path_is_multi_step_and_lands_exactly_on_target() {
+        let to = (640.0, 480.0);
+        let path = move_path((10.0, 10.0), to, HumanizeLevel::Human, 42);
+        assert!(path.len() >= 8, "human path should have many steps");
+        let last = path.last().unwrap();
+        assert_eq!((last.x, last.y), to, "final point must equal the target");
+        // Path must actually leave the straight line at some point (it's a curve).
+        let straight = path.iter().all(|s| {
+            let t = (s.x - 10.0) / (to.0 - 10.0);
+            (s.y - (10.0 + t * (to.1 - 10.0))).abs() < 0.5
+        });
+        assert!(!straight, "human path should bow off the straight line");
+    }
+
+    #[test]
+    fn fast_path_is_shorter_than_human() {
+        let fast = move_path((0.0, 0.0), (500.0, 500.0), HumanizeLevel::Fast, 7);
+        let human = move_path((0.0, 0.0), (500.0, 500.0), HumanizeLevel::Human, 7);
+        assert!(fast.len() < human.len());
+        assert!((3..=6).contains(&fast.len()));
+    }
+
+    #[test]
+    fn move_path_is_deterministic_for_a_seed() {
+        let a = move_path((1.0, 2.0), (300.0, 400.0), HumanizeLevel::Human, 99);
+        let b = move_path((1.0, 2.0), (300.0, 400.0), HumanizeLevel::Human, 99);
+        assert_eq!(a, b);
+        let c = move_path((1.0, 2.0), (300.0, 400.0), HumanizeLevel::Human, 100);
+        assert_ne!(a, c, "different seeds should differ");
+    }
+
+    #[test]
+    fn landing_point_stays_inside_bounds_and_centres_when_off() {
+        let bbox = (100.0, 100.0, 40.0, 20.0);
+        assert_eq!(landing_point(bbox, HumanizeLevel::Off, 1), (120.0, 110.0));
+        for seed in 0..200 {
+            let (x, y) = landing_point(bbox, HumanizeLevel::Human, seed);
+            assert!(x > 100.0 && x < 140.0, "x {x} escaped bbox");
+            assert!(y > 100.0 && y < 120.0, "y {y} escaped bbox");
+        }
+    }
+
+    #[test]
+    fn keystroke_delays_zero_when_off_and_positive_otherwise() {
+        assert!(keystroke_delays(5, HumanizeLevel::Off, 1)
+            .iter()
+            .all(|d| *d == Duration::ZERO));
+        let human = keystroke_delays(20, HumanizeLevel::Human, 3);
+        assert_eq!(human.len(), 20);
+        assert!(human.iter().all(|d| *d >= Duration::from_millis(8)));
+    }
+
+    #[test]
+    fn scroll_segments_sum_to_total_and_single_when_off() {
+        let off = scroll_segments(0.0, 600.0, HumanizeLevel::Off, 1);
+        assert_eq!(off.len(), 1);
+        assert_eq!((off[0].0, off[0].1), (0.0, 600.0));
+        assert_eq!(off[0].2, Duration::ZERO);
+
+        let human = scroll_segments(0.0, 600.0, HumanizeLevel::Human, 5);
+        assert!(human.len() >= 5);
+        let total_dy: f64 = human.iter().map(|s| s.1).sum();
+        assert!(
+            (total_dy - 600.0).abs() < 1e-6,
+            "segments must sum to total"
+        );
+        assert!(human.iter().all(|s| s.2 >= Duration::from_millis(4)));
+    }
+
+    #[test]
+    fn detect_escalates_on_known_vendor_else_baseline() {
+        let mut s = DetectSignals::default();
+        assert_eq!(detect_level(&s, HumanizeLevel::Off), HumanizeLevel::Off);
+
+        s.cookie_names = vec!["sessionid".into(), "_abck".into()];
+        assert_eq!(detect_level(&s, HumanizeLevel::Off), HumanizeLevel::Human);
+
+        let s2 = DetectSignals {
+            script_urls: vec!["https://cdn.example.com/DataDome-tags.js".into()],
+            ..Default::default()
+        };
+        assert_eq!(detect_level(&s2, HumanizeLevel::Off), HumanizeLevel::Human);
+
+        let s3 = DetectSignals {
+            window_globals: vec!["_pxAppId".into()],
+            ..Default::default()
+        };
+        assert_eq!(detect_level(&s3, HumanizeLevel::Fast), HumanizeLevel::Human);
+
+        // Unknown signals keep the baseline.
+        let s4 = DetectSignals {
+            cookie_names: vec!["cart".into(), "theme".into()],
+            ..Default::default()
+        };
+        assert_eq!(detect_level(&s4, HumanizeLevel::Fast), HumanizeLevel::Fast);
+    }
+}

cli/src/native/inspect_server.rs

@@ -0,0 +1,362 @@
+use std::io::Write;
+use std::sync::atomic::{AtomicI64, Ordering};
+use std::sync::Arc;
+
+use futures_util::{SinkExt, StreamExt};
+use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt, BufReader};
+use tokio::net::TcpListener;
+use tokio::sync::Mutex;
+use tokio_tungstenite::tungstenite::Message;
+
+use super::cdp::client::InspectProxyHandle;
+
+/// Counter for unique attach IDs so concurrent connections don't collide.
+static ATTACH_ID: AtomicI64 = AtomicI64::new(-1000);
+
+/// Lightweight HTTP + WebSocket server for `chrome-use inspect`.
+///
+/// Serves two purposes:
+/// - `GET /` redirects to Chrome's built-in DevTools frontend with `ws=` pointing to this server
+/// - WebSocket connections create a dedicated CDP session via `Target.attachToTarget` and proxy
+///   CDP messages through the daemon's existing browser-level connection, injecting/stripping
+///   `sessionId` so the DevTools frontend sees a page-level view
+pub struct InspectServer {
+    port: u16,
+    _handle: tokio::task::JoinHandle<()>,
+}
+
+impl InspectServer {
+    /// Start the inspect proxy server.
+    ///
+    /// - `proxy_handle`: lightweight handle for sending/receiving raw CDP messages
+    /// - `target_id`: the CDP target ID of the page to inspect
+    /// - `chrome_host_port`: the Chrome debug server address (e.g. "127.0.0.1:9222")
+    pub async fn start(
+        proxy_handle: InspectProxyHandle,
+        target_id: String,
+        chrome_host_port: String,
+    ) -> Result<Self, String> {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .map_err(|e| format!("Failed to bind inspect server: {}", e))?;
+        let port = listener
+            .local_addr()
+            .map_err(|e| format!("Failed to get local addr: {}", e))?
+            .port();
+
+        let proxy = Arc::new(proxy_handle);
+
+        let handle = tokio::spawn(accept_loop(
+            listener,
+            proxy,
+            target_id,
+            chrome_host_port,
+            port,
+        ));
+
+        Ok(Self {
+            port,
+            _handle: handle,
+        })
+    }
+
+    pub fn port(&self) -> u16 {
+        self.port
+    }
+
+    pub fn shutdown(self) {
+        self._handle.abort();
+    }
+}
+
+async fn accept_loop(
+    listener: TcpListener,
+    proxy: Arc<InspectProxyHandle>,
+    target_id: String,
+    chrome_host_port: String,
+    proxy_port: u16,
+) {
+    loop {
+        let (stream, _) = match listener.accept().await {
+            Ok(s) => s,
+            Err(_) => continue,
+        };
+
+        let proxy = proxy.clone();
+        let tid = target_id.clone();
+        let chp = chrome_host_port.clone();
+
+        tokio::spawn(async move {
+            if let Err(e) = handle_connection(stream, proxy, tid, chp, proxy_port).await {
+                let _ = writeln!(std::io::stderr(), "[inspect] connection error: {}", e);
+            }
+        });
+    }
+}
+
+async fn handle_connection(
+    stream: tokio::net::TcpStream,
+    proxy: Arc<InspectProxyHandle>,
+    target_id: String,
+    chrome_host_port: String,
+    proxy_port: u16,
+) -> Result<(), String> {
+    // Peek at the request line to determine routing WITHOUT consuming bytes.
+    // This is critical: tokio_tungstenite::accept_async needs to read the full
+    // HTTP upgrade request itself, so we must not consume anything for WS paths.
+    let mut peek_buf = [0u8; 32];
+    let n = stream
+        .peek(&mut peek_buf)
+        .await
+        .map_err(|e| e.to_string())?;
+    let peek = String::from_utf8_lossy(&peek_buf[..n]);
+
+    if peek.starts_with("GET /ws") {
+        return handle_ws_proxy(stream, proxy, target_id).await;
+    }
+
+    if peek.starts_with("GET / ") {
+        let buf_reader = BufReader::new(stream);
+        return handle_http_redirect(buf_reader, chrome_host_port, proxy_port).await;
+    }
+
+    // Unknown request -- consume and respond 404
+    let mut stream = stream;
+    let mut discard = [0u8; 4096];
+    let _ = stream.read(&mut discard).await;
+    let resp = "HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n";
+    stream
+        .write_all(resp.as_bytes())
+        .await
+        .map_err(|e| e.to_string())?;
+    Ok(())
+}
+
+const MAX_HEADER_BYTES: usize = 8192;
+
+async fn handle_http_redirect(
+    buf_reader: BufReader<tokio::net::TcpStream>,
+    chrome_host_port: String,
+    proxy_port: u16,
+) -> Result<(), String> {
+    let mut br = buf_reader;
+    let mut total_bytes = 0usize;
+    loop {
+        let mut line = String::new();
+        let n = br.read_line(&mut line).await.map_err(|e| e.to_string())?;
+        total_bytes += n;
+        if line == "\r\n" || line == "\n" || line.is_empty() || total_bytes > MAX_HEADER_BYTES {
+            break;
+        }
+    }
+
+    let location = format!(
+        "http://{}/devtools/devtools_app.html?ws=127.0.0.1:{}/ws",
+        chrome_host_port, proxy_port
+    );
+    let body = format!(
+        "<html><body>Redirecting to <a href=\"{url}\">{url}</a></body></html>",
+        url = location
+    );
+    let resp = format!(
+        "HTTP/1.1 302 Found\r\nLocation: {}\r\nContent-Type: text/html\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
+        location,
+        body.len(),
+        body
+    );
+    let mut stream = br.into_inner();
+    stream
+        .write_all(resp.as_bytes())
+        .await
+        .map_err(|e| e.to_string())?;
+    Ok(())
+}
+
+async fn handle_ws_proxy(
+    stream: tokio::net::TcpStream,
+    proxy: Arc<InspectProxyHandle>,
+    target_id: String,
+) -> Result<(), String> {
+    let ws_stream = tokio_tungstenite::accept_async(stream)
+        .await
+        .map_err(|e| format!("WebSocket handshake failed: {}", e))?;
+
+    // Create a dedicated CDP session for this DevTools connection.
+    // Each connection gets its own session so domain enablements (DOM.enable, etc.)
+    // always trigger fresh initial state dumps from Chrome.
+    let attach_id = ATTACH_ID.fetch_sub(1, Ordering::SeqCst);
+    let attach_cmd = format!(
+        r#"{{"id":{},"method":"Target.attachToTarget","params":{{"targetId":"{}","flatten":true}}}}"#,
+        attach_id, target_id
+    );
+
+    // Subscribe BEFORE sending so we don't miss the response (tokio broadcast
+    // receivers only deliver messages to receivers that already exist).
+    let mut raw_rx = proxy.subscribe_raw();
+
+    proxy
+        .send_raw(attach_cmd)
+        .await
+        .map_err(|e| format!("Failed to send attachToTarget: {}", e))?;
+
+    // Wait for the attachToTarget response to extract the session ID
+    let session_id = tokio::time::timeout(std::time::Duration::from_secs(5), async {
+        while let Ok(raw_msg) = raw_rx.recv().await {
+            if let Ok(val) = serde_json::from_str::<serde_json::Value>(&raw_msg.text) {
+                if val.get("id").and_then(|v| v.as_i64()) == Some(attach_id) {
+                    if let Some(sid) = val
+                        .get("result")
+                        .and_then(|r| r.get("sessionId"))
+                        .and_then(|s| s.as_str())
+                    {
+                        return Ok(sid.to_string());
+                    }
+                    return Err("attachToTarget failed".to_string());
+                }
+            }
+        }
+        Err("raw message channel closed".to_string())
+    })
+    .await
+    .map_err(|_| "Timed out waiting for attachToTarget response".to_string())?
+    .map_err(|e| format!("Failed to create DevTools session: {}", e))?;
+
+    let (ws_tx, mut ws_rx) = ws_stream.split();
+    let ws_tx = Arc::new(Mutex::new(ws_tx));
+
+    let mut raw_rx = proxy.subscribe_raw();
+    let ws_tx_clone = ws_tx.clone();
+    let session_id_clone = session_id.clone();
+
+    // Chrome -> DevTools: forward messages matching our session, strip sessionId
+    let mut chrome_to_devtools = tokio::spawn(async move {
+        loop {
+            let raw_msg = match raw_rx.recv().await {
+                Ok(msg) => msg,
+                Err(tokio::sync::broadcast::error::RecvError::Lagged(n)) => {
+                    let _ = writeln!(
+                        std::io::stderr(),
+                        "[inspect] warning: dropped {} CDP messages (channel lag)",
+                        n
+                    );
+                    continue;
+                }
+                Err(_) => break,
+            };
+
+            if raw_msg.session_id.as_deref() != Some(&session_id_clone) {
+                continue;
+            }
+
+            let stripped = strip_session_id(&raw_msg.text);
+
+            let mut tx = ws_tx_clone.lock().await;
+            if tx.send(Message::Text(stripped)).await.is_err() {
+                break;
+            }
+        }
+    });
+
+    // DevTools -> Chrome: inject sessionId and forward
+    let proxy_for_send = proxy.clone();
+    let session_id_for_send = session_id.clone();
+    let mut devtools_to_chrome = tokio::spawn(async move {
+        while let Some(Ok(msg)) = ws_rx.next().await {
+            let text = match msg {
+                Message::Text(t) => t,
+                Message::Close(_) => break,
+                _ => continue,
+            };
+
+            let injected = inject_session_id(&text, &session_id_for_send);
+            if proxy_for_send.send_raw(injected).await.is_err() {
+                break;
+            }
+        }
+    });
+
+    tokio::select! {
+        _ = &mut chrome_to_devtools => {
+            devtools_to_chrome.abort();
+        },
+        _ = &mut devtools_to_chrome => {
+            chrome_to_devtools.abort();
+        },
+    }
+
+    // Clean up the CDP session so Chrome doesn't leak attached targets
+    let detach_cmd = format!(
+        r#"{{"id":{},"method":"Target.detachFromTarget","params":{{"sessionId":"{}"}}}}"#,
+        ATTACH_ID.fetch_sub(1, Ordering::SeqCst),
+        session_id
+    );
+    let _ = proxy.send_raw(detach_cmd).await;
+
+    Ok(())
+}
+
+fn inject_session_id(json: &str, session_id: &str) -> String {
+    if let Ok(mut val) = serde_json::from_str::<serde_json::Value>(json) {
+        if let Some(obj) = val.as_object_mut() {
+            obj.insert(
+                "sessionId".to_string(),
+                serde_json::Value::String(session_id.to_string()),
+            );
+        }
+        serde_json::to_string(&val).unwrap_or_else(|_| json.to_string())
+    } else {
+        json.to_string()
+    }
+}
+
+fn strip_session_id(json: &str) -> String {
+    if let Ok(mut val) = serde_json::from_str::<serde_json::Value>(json) {
+        if let Some(obj) = val.as_object_mut() {
+            obj.remove("sessionId");
+        }
+        serde_json::to_string(&val).unwrap_or_else(|_| json.to_string())
+    } else {
+        json.to_string()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_inject_session_id() {
+        let input = r#"{"id":1,"method":"DOM.getDocument"}"#;
+        let result = inject_session_id(input, "abc123");
+        let parsed: serde_json::Value = serde_json::from_str(&result).expect("valid JSON");
+        assert_eq!(parsed["sessionId"], "abc123");
+        assert_eq!(parsed["method"], "DOM.getDocument");
+        assert_eq!(parsed["id"], 1);
+    }
+
+    #[test]
+    fn test_inject_session_id_empty_object() {
+        let result = inject_session_id("{}", "abc");
+        let parsed: serde_json::Value = serde_json::from_str(&result).expect("valid JSON");
+        assert_eq!(parsed["sessionId"], "abc");
+    }
+
+    #[test]
+    fn test_strip_session_id() {
+        let input = r#"{"id":1,"result":{},"sessionId":"abc123"}"#;
+        let result = strip_session_id(input);
+        let parsed: serde_json::Value = serde_json::from_str(&result).expect("valid JSON");
+        assert!(parsed.get("sessionId").is_none());
+        assert_eq!(parsed["id"], 1);
+    }
+
+    #[test]
+    fn test_inject_then_strip_roundtrip() {
+        let input = r#"{"id":42,"method":"Runtime.evaluate"}"#;
+        let injected = inject_session_id(input, "sess1");
+        let stripped = strip_session_id(&injected);
+        let original: serde_json::Value = serde_json::from_str(input).unwrap();
+        let result: serde_json::Value = serde_json::from_str(&stripped).unwrap();
+        assert_eq!(original, result);
+    }
+}

cli/src/native/mod.rs

@@ -1,6 +1,8 @@
 #[allow(dead_code)]
 pub mod actions;
 #[allow(dead_code)]
+pub mod adaptive;
+#[allow(dead_code)]
 pub mod auth;
 #[allow(dead_code)]
 pub mod browser;
@@ -15,6 +17,10 @@ pub mod diff;
 #[allow(dead_code)]
 pub mod element;
 #[allow(dead_code)]
+pub mod humanize;
+#[allow(dead_code)]
+pub mod inspect_server;
+#[allow(dead_code)]
 pub mod interaction;
 #[allow(dead_code)]
 pub mod network;
@@ -23,14 +29,20 @@ pub mod policy;
 #[allow(dead_code)]
 pub mod providers;
 #[allow(dead_code)]
+pub mod react;
+#[allow(dead_code)]
 pub mod recording;
 #[allow(dead_code)]
+pub mod relay;
+#[allow(dead_code)]
 pub mod screenshot;
 #[allow(dead_code)]
 pub mod snapshot;
 #[allow(dead_code)]
 pub mod state;
 #[allow(dead_code)]
+pub mod stealth;
+#[allow(dead_code)]
 pub mod storage;
 #[allow(dead_code)]
 pub mod stream;

cli/src/native/network.rs

@@ -184,7 +184,7 @@ pub async fn install_domain_filter_script(
             const OrigWS = window.WebSocket;
             window.WebSocket = function(url, protocols) {{
                 try {{
-                    const u = new URL(url);
+                    const u = new URL(url, location.href);
                     if (!_isDomainAllowed(u.hostname)) throw new DOMException('WebSocket blocked: ' + u.hostname, 'SecurityError');
                 }} catch(e) {{ if (e instanceof DOMException) throw e; }}
                 return new OrigWS(url, protocols);
@@ -233,15 +233,16 @@ pub async fn install_domain_filter_script(
 pub async fn install_domain_filter_fetch(
     client: &CdpClient,
     session_id: &str,
+    handle_auth_requests: bool,
 ) -> Result<(), String> {
+    let mut params = json!({
+        "patterns": [{ "urlPattern": "*" }]
+    });
+    if handle_auth_requests {
+        params["handleAuthRequests"] = json!(true);
+    }
     client
-        .send_command(
-            "Fetch.enable",
-            Some(json!({
-                "patterns": [{ "urlPattern": "*" }]
-            })),
-            Some(session_id),
-        )
+        .send_command("Fetch.enable", Some(params), Some(session_id))
         .await?;
     Ok(())
 }
@@ -253,12 +254,103 @@ pub async fn install_domain_filter(
     client: &CdpClient,
     session_id: &str,
     allowed_domains: &[String],
+    handle_auth_requests: bool,
 ) -> Result<(), String> {
     install_domain_filter_script(client, session_id, allowed_domains).await?;
-    install_domain_filter_fetch(client, session_id).await?;
+    install_domain_filter_fetch(client, session_id, handle_auth_requests).await?;
     Ok(())
 }
 
+// ---------------------------------------------------------------------------
+// Console arg formatting (CDP RemoteObject → human-readable string)
+// ---------------------------------------------------------------------------
+
+/// Format a single CDP RemoteObject arg into a human-readable string.
+/// Priority: value → preview → description.
+pub fn format_console_arg(arg: &Value) -> Option<String> {
+    let obj_type = arg.get("type").and_then(|v| v.as_str()).unwrap_or("");
+    let subtype = arg.get("subtype").and_then(|v| v.as_str());
+
+    if obj_type == "undefined" {
+        return Some("undefined".to_string());
+    }
+
+    if subtype == Some("null") {
+        return Some("null".to_string());
+    }
+
+    // Primitive value
+    if let Some(v) = arg.get("value") {
+        return Some(match v {
+            Value::String(s) => s.clone(),
+            Value::Null => "null".to_string(),
+            other => other.to_string(),
+        });
+    }
+
+    // Skip preview for Map/Set — their description ("Map(1)", "Set(3)") is more useful
+    // than their preview properties (which only show "size")
+    if let Some(preview) = arg.get("preview") {
+        let preview_subtype = preview.get("subtype").and_then(|v| v.as_str());
+        if matches!(preview_subtype, Some("map" | "set" | "weakmap" | "weakset")) {
+            return arg
+                .get("description")
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string());
+        }
+        let is_array = subtype == Some("array") || preview_subtype == Some("array");
+        if let Some(props) = preview.get("properties").and_then(|v| v.as_array()) {
+            let overflow = preview
+                .get("overflow")
+                .and_then(|v| v.as_bool())
+                .unwrap_or(false);
+            let formatted_props: Vec<String> = props
+                .iter()
+                .filter_map(|p| {
+                    let value_str = p.get("value").and_then(|v| v.as_str())?;
+                    let prop_type = p.get("type").and_then(|v| v.as_str()).unwrap_or("");
+                    let formatted_value = if prop_type == "string" {
+                        format!("\"{}\"", value_str)
+                    } else {
+                        value_str.to_string()
+                    };
+                    if is_array {
+                        Some(formatted_value)
+                    } else {
+                        let name = p.get("name").and_then(|v| v.as_str()).unwrap_or("?");
+                        Some(format!("{}: {}", name, formatted_value))
+                    }
+                })
+                .collect();
+
+            let inner = if overflow {
+                format!("{}, ...", formatted_props.join(", "))
+            } else {
+                formatted_props.join(", ")
+            };
+
+            return if is_array {
+                Some(format!("[{}]", inner))
+            } else {
+                Some(format!("{{{}}}", inner))
+            };
+        }
+    }
+
+    // Fallback to description
+    arg.get("description")
+        .and_then(|v| v.as_str())
+        .map(|s| s.to_string())
+}
+
+/// Format an array of CDP RemoteObject args into a single space-separated string.
+pub fn format_console_args(args: &[Value]) -> String {
+    args.iter()
+        .filter_map(format_console_arg)
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
 // ---------------------------------------------------------------------------
 // Console and error tracking
 // ---------------------------------------------------------------------------
@@ -267,6 +359,7 @@ pub async fn install_domain_filter(
 pub struct ConsoleEntry {
     pub level: String,
     pub text: String,
+    pub args: Vec<Value>,
 }
 
 #[derive(Debug, Clone)]
@@ -292,13 +385,14 @@ impl EventTracker {
         }
     }
 
-    pub fn add_console(&mut self, level: &str, text: &str) {
+    pub fn add_console(&mut self, level: &str, text: &str, args: Vec<Value>) {
         if self.console_entries.len() >= self.max_entries {
             self.console_entries.remove(0);
         }
         self.console_entries.push(ConsoleEntry {
             level: level.to_string(),
             text: text.to_string(),
+            args,
         });
     }
 
@@ -320,13 +414,25 @@ impl EventTracker {
         });
     }
 
+    pub fn clear_console(&mut self) {
+        self.console_entries.clear();
+    }
+
     pub fn get_console_json(&self) -> Value {
-        let entries: Vec<Value> = self
+        let messages: Vec<Value> = self
             .console_entries
             .iter()
-            .map(|e| json!({ "level": e.level, "text": e.text }))
+            .map(|e| {
+                let mut msg = json!({ "type": e.level, "text": e.text });
+                if !e.args.is_empty() {
+                    msg.as_object_mut()
+                        .unwrap()
+                        .insert("args".to_string(), Value::Array(e.args.clone()));
+                }
+                msg
+            })
             .collect();
-        json!({ "entries": entries })
+        json!({ "messages": messages })
     }
 
     pub fn get_errors_json(&self) -> Value {
@@ -390,10 +496,177 @@ mod tests {
     #[test]
     fn test_event_tracker() {
         let mut tracker = EventTracker::new();
-        tracker.add_console("log", "hello");
+        tracker.add_console("log", "hello", vec![]);
         tracker.add_error("oops", Some("test.js"), Some(1), Some(5));
 
         assert_eq!(tracker.console_entries.len(), 1);
         assert_eq!(tracker.error_entries.len(), 1);
     }
+
+    #[test]
+    fn test_console_json_includes_args() {
+        let mut tracker = EventTracker::new();
+        let raw_args = vec![
+            json!({"type": "string", "value": "hello"}),
+            json!({"type": "number", "value": 42}),
+        ];
+        tracker.add_console("log", "hello 42", raw_args);
+
+        let result = tracker.get_console_json();
+        let messages = result.get("messages").unwrap().as_array().unwrap();
+        assert_eq!(messages.len(), 1);
+        assert_eq!(messages[0].get("text").unwrap(), "hello 42");
+        let args = messages[0].get("args").unwrap().as_array().unwrap();
+        assert_eq!(args.len(), 2);
+        assert_eq!(args[0], json!({"type": "string", "value": "hello"}));
+        assert_eq!(args[1], json!({"type": "number", "value": 42}));
+    }
+
+    #[test]
+    fn test_console_json_empty_args_omits_field() {
+        let mut tracker = EventTracker::new();
+        tracker.add_console("log", "text only", vec![]);
+
+        let result = tracker.get_console_json();
+        let messages = result.get("messages").unwrap().as_array().unwrap();
+        assert!(messages[0].get("args").is_none());
+    }
+
+    // -- format_console_arg: primitives --
+
+    #[test]
+    fn test_format_arg_string() {
+        let arg = json!({"type": "string", "value": "hello"});
+        assert_eq!(format_console_arg(&arg), Some("hello".to_string()));
+    }
+
+    #[test]
+    fn test_format_arg_number() {
+        let arg = json!({"type": "number", "value": 42});
+        assert_eq!(format_console_arg(&arg), Some("42".to_string()));
+    }
+
+    #[test]
+    fn test_format_arg_null() {
+        let arg = json!({"type": "object", "subtype": "null", "value": null});
+        assert_eq!(format_console_arg(&arg), Some("null".to_string()));
+    }
+
+    #[test]
+    fn test_format_arg_undefined() {
+        let arg = json!({"type": "undefined"});
+        assert_eq!(format_console_arg(&arg), Some("undefined".to_string()));
+    }
+
+    // -- format_console_arg: objects with preview --
+
+    #[test]
+    fn test_format_arg_object_preview() {
+        let arg = json!({
+            "type": "object",
+            "preview": {
+                "properties": [
+                    {"name": "userId", "type": "string", "value": "abc123"},
+                    {"name": "count", "type": "number", "value": "42"}
+                ],
+                "overflow": false
+            }
+        });
+        assert_eq!(
+            format_console_arg(&arg),
+            Some("{userId: \"abc123\", count: 42}".to_string())
+        );
+    }
+
+    #[test]
+    fn test_format_arg_object_preview_overflow() {
+        let arg = json!({
+            "type": "object",
+            "preview": {
+                "properties": [
+                    {"name": "a", "type": "number", "value": "1"}
+                ],
+                "overflow": true
+            }
+        });
+        assert_eq!(format_console_arg(&arg), Some("{a: 1, ...}".to_string()));
+    }
+
+    // -- format_console_arg: arrays with preview --
+
+    #[test]
+    fn test_format_arg_array_preview() {
+        let arg = json!({
+            "type": "object",
+            "subtype": "array",
+            "preview": {
+                "subtype": "array",
+                "properties": [
+                    {"name": "0", "type": "number", "value": "1"},
+                    {"name": "1", "type": "number", "value": "2"},
+                    {"name": "2", "type": "number", "value": "3"}
+                ],
+                "overflow": false
+            }
+        });
+        assert_eq!(format_console_arg(&arg), Some("[1, 2, 3]".to_string()));
+    }
+
+    // -- format_console_arg: map/set use description --
+
+    #[test]
+    fn test_format_arg_map_uses_description() {
+        let arg = json!({
+            "type": "object",
+            "subtype": "map",
+            "description": "Map(1)",
+            "preview": {
+                "subtype": "map",
+                "properties": [{"name": "size", "type": "number", "value": "1"}]
+            }
+        });
+        assert_eq!(format_console_arg(&arg), Some("Map(1)".to_string()));
+    }
+
+    // -- format_console_arg: fallback --
+
+    #[test]
+    fn test_format_arg_description_fallback() {
+        let arg = json!({"type": "object", "description": "RegExp"});
+        assert_eq!(format_console_arg(&arg), Some("RegExp".to_string()));
+    }
+
+    #[test]
+    fn test_format_arg_no_value_no_preview_no_description() {
+        let arg = json!({"type": "object"});
+        assert_eq!(format_console_arg(&arg), None);
+    }
+
+    // -- format_console_args --
+
+    #[test]
+    fn test_format_console_args_join() {
+        let args = vec![
+            json!({"type": "string", "value": "user"}),
+            json!({
+                "type": "object",
+                "preview": {
+                    "properties": [{"name": "id", "type": "number", "value": "1"}],
+                    "overflow": false
+                }
+            }),
+        ];
+        assert_eq!(format_console_args(&args), "user {id: 1}");
+    }
+
+    #[test]
+    fn test_format_console_args_filters_none() {
+        // An arg that returns None should be skipped, not produce empty string
+        let args = vec![
+            json!({"type": "string", "value": "before"}),
+            json!({"type": "object"}), // no value, preview, or description → None
+            json!({"type": "string", "value": "after"}),
+        ];
+        assert_eq!(format_console_args(&args), "before after");
+    }
 }

cli/src/native/parity_tests.rs

@@ -9,6 +9,38 @@ use serde_json::{json, Value};
 
 use super::actions::{execute_command, DaemonState};
 
+const ENCRYPTION_KEY_ENV: &str = "AGENT_BROWSER_ENCRYPTION_KEY";
+
+struct TestKeyGuard {
+    _lock: std::sync::MutexGuard<'static, ()>,
+    original: Option<String>,
+}
+
+impl TestKeyGuard {
+    fn new() -> Self {
+        let lock = super::auth::AUTH_TEST_MUTEX
+            .lock()
+            .unwrap_or_else(|e| e.into_inner());
+        let original = std::env::var(ENCRYPTION_KEY_ENV).ok();
+        // SAFETY: AUTH_TEST_MUTEX serializes all test access so no concurrent mutation.
+        unsafe { std::env::set_var(ENCRYPTION_KEY_ENV, "a".repeat(64)) };
+        Self {
+            _lock: lock,
+            original,
+        }
+    }
+}
+
+impl Drop for TestKeyGuard {
+    fn drop(&mut self) {
+        // SAFETY: AUTH_TEST_MUTEX is held via _lock.
+        match &self.original {
+            Some(val) => unsafe { std::env::set_var(ENCRYPTION_KEY_ENV, val) },
+            None => unsafe { std::env::remove_var(ENCRYPTION_KEY_ENV) },
+        }
+    }
+}
+
 /// All documented action names that should be implemented.
 const DOCUMENTED_ACTIONS: &[&str] = &[
     "launch",
@@ -140,6 +172,7 @@ const DOCUMENTED_ACTIONS: &[&str] = &[
     "route",
     "unroute",
     "requests",
+    "request_detail",
     "credentials",
     "auth_save",
     "auth_login",
@@ -311,7 +344,7 @@ fn minimal_command(action: &str, id: &str) -> Value {
             obj.insert("script".to_string(), json!("h => h"));
         }
         "drag" => {
-            obj.insert("selector".to_string(), json!("body"));
+            obj.insert("source".to_string(), json!("body"));
             obj.insert("target".to_string(), json!("body"));
         }
         "swipe" => {
@@ -424,6 +457,7 @@ async fn test_credentials_list_without_browser() {
 #[tokio::test]
 async fn test_auth_profile_name_validation() {
     use super::auth;
+    let _key_guard = TestKeyGuard::new();
     let valid = auth::credentials_set("valid-name_123", "u", "p", None);
     assert!(valid.is_ok());
     let invalid = auth::credentials_set("invalid/name", "u", "p", None);
@@ -439,6 +473,7 @@ async fn test_auth_profile_name_validation() {
 #[tokio::test]
 async fn test_auth_save_and_show() {
     use super::auth;
+    let _key_guard = TestKeyGuard::new();
     let result = auth::auth_save(
         "parity-roundtrip",
         "https://example.com",
@@ -499,6 +534,7 @@ async fn test_daemon_state_new_defaults() {
     assert!(state.tracked_requests.is_empty());
     assert!(state.active_frame_id.is_none());
     assert!(state.webdriver_backend.is_none());
+    assert!(state.stream_client.is_none());
 }
 
 #[tokio::test]
@@ -510,6 +546,11 @@ async fn test_tracked_request_struct() {
         headers: json!({"Accept": "text/html"}),
         timestamp: 12345,
         resource_type: "Document".to_string(),
+        request_id: "1.1".to_string(),
+        post_data: None,
+        status: Some(200),
+        response_headers: None,
+        mime_type: Some("text/html".to_string()),
     };
     let serialized = serde_json::to_value(&tr).unwrap();
     assert_eq!(serialized["url"], "https://example.com/api");
@@ -530,6 +571,11 @@ async fn test_request_tracking_state() {
         headers: json!({}),
         timestamp: 1,
         resource_type: "Document".to_string(),
+        request_id: "1.1".to_string(),
+        post_data: None,
+        status: None,
+        response_headers: None,
+        mime_type: None,
     });
     state.tracked_requests.push(super::actions::TrackedRequest {
         url: "https://other.com".to_string(),
@@ -537,6 +583,11 @@ async fn test_request_tracking_state() {
         headers: json!({}),
         timestamp: 2,
         resource_type: "XHR".to_string(),
+        request_id: "1.2".to_string(),
+        post_data: None,
+        status: None,
+        response_headers: None,
+        mime_type: None,
     });
     assert_eq!(state.tracked_requests.len(), 2);
 
@@ -554,6 +605,30 @@ async fn test_request_tracking_state() {
     assert!(state.tracked_requests.is_empty());
 }
 
+#[test]
+fn test_matches_status_filter() {
+    use super::actions::matches_status_filter;
+
+    // Exact match
+    assert!(matches_status_filter(Some(200), "200"));
+    assert!(!matches_status_filter(Some(201), "200"));
+
+    // Class match (Nxx)
+    assert!(matches_status_filter(Some(200), "2xx"));
+    assert!(matches_status_filter(Some(299), "2xx"));
+    assert!(!matches_status_filter(Some(301), "2xx"));
+    assert!(matches_status_filter(Some(404), "4xx"));
+
+    // Range match
+    assert!(matches_status_filter(Some(400), "400-499"));
+    assert!(matches_status_filter(Some(499), "400-499"));
+    assert!(!matches_status_filter(Some(500), "400-499"));
+
+    // None status
+    assert!(!matches_status_filter(None, "200"));
+    assert!(!matches_status_filter(None, "2xx"));
+}
+
 #[tokio::test]
 async fn test_addscript_and_addinitscript_separate_dispatch() {
     let mut state = DaemonState::new();

cli/src/native/policy.rs

@@ -135,6 +135,7 @@ impl ActionPolicy {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::test_utils::EnvGuard;
 
     #[test]
     fn test_policy_allow_whitelist() {
@@ -205,12 +206,12 @@ mod tests {
 
     #[test]
     fn test_confirm_actions_from_env() {
-        env::set_var("AGENT_BROWSER_CONFIRM_ACTIONS", "navigate,click,fill");
+        let _guard = EnvGuard::new(&["AGENT_BROWSER_CONFIRM_ACTIONS"]);
+        _guard.set("AGENT_BROWSER_CONFIRM_ACTIONS", "navigate,click,fill");
         let ca = ConfirmActions::from_env().unwrap();
         assert!(ca.requires_confirmation("navigate"));
         assert!(ca.requires_confirmation("click"));
         assert!(ca.requires_confirmation("fill"));
         assert!(!ca.requires_confirmation("screenshot"));
-        env::remove_var("AGENT_BROWSER_CONFIRM_ACTIONS");
     }
 }

cli/src/native/providers.rs

@@ -1,28 +1,72 @@
 //! Browser provider connections for remote CDP sessions.
 //!
-//! Supports Browserbase, Browser Use, and Kernel providers. Each provider
-//! returns a CDP WebSocket URL for connecting via BrowserManager.
+//! Supports AgentCore, Browserbase, Browserless, Browser Use, and Kernel providers.
+//! Each provider returns a CDP WebSocket URL for connecting via BrowserManager.
 
 use serde_json::{json, Value};
 use std::env;
 
 /// Provider session info for cleanup on failure.
+#[derive(Debug)]
 pub struct ProviderSession {
     pub provider: String,
     pub session_id: String,
 }
 
+#[derive(Debug)]
+pub struct ProviderConnection {
+    pub ws_url: String,
+    pub session: Option<ProviderSession>,
+    /// If true, the WebSocket IS the page session (no Target.* commands).
+    pub direct_page: bool,
+}
+
 /// Connects to the specified browser provider and returns a CDP WebSocket URL
 /// along with session info for cleanup on failure.
-pub async fn connect_provider(
-    provider_name: &str,
-) -> Result<(String, Option<ProviderSession>), String> {
+pub async fn connect_provider(provider_name: &str) -> Result<ProviderConnection, String> {
     match provider_name.to_lowercase().as_str() {
-        "browserbase" => connect_browserbase().await,
-        "browser-use" | "browseruse" => connect_browser_use().await,
-        "kernel" => connect_kernel().await,
+        "browserbase" => {
+            let (url, session) = connect_browserbase().await?;
+            Ok(ProviderConnection {
+                ws_url: url,
+                session,
+                direct_page: false,
+            })
+        }
+        "browserless" => {
+            let (url, session) = connect_browserless().await?;
+            Ok(ProviderConnection {
+                ws_url: url,
+                session,
+                direct_page: false,
+            })
+        }
+        "browser-use" | "browseruse" => {
+            let (url, session) = connect_browser_use().await?;
+            Ok(ProviderConnection {
+                ws_url: url,
+                session,
+                direct_page: false,
+            })
+        }
+        "kernel" => {
+            let (url, session) = connect_kernel().await?;
+            Ok(ProviderConnection {
+                ws_url: url,
+                session,
+                direct_page: false,
+            })
+        }
+        "agentcore" => {
+            let (url, session) = connect_agentcore().await?;
+            Ok(ProviderConnection {
+                ws_url: url,
+                session,
+                direct_page: false,
+            })
+        }
         _ => Err(format!(
-            "Unknown provider '{}'. Supported: browserbase, browser-use, kernel",
+            "Unknown provider '{}'. Supported: browserbase, browserless, browser-use, kernel, agentcore",
             provider_name
         )),
     }
@@ -35,11 +79,13 @@ pub async fn close_provider_session(session: &ProviderSession) {
         "browserbase" => {
             if let Ok(api_key) = env::var("BROWSERBASE_API_KEY") {
                 let _ = client
-                    .delete(format!(
+                    .post(format!(
                         "https://api.browserbase.com/v1/sessions/{}",
                         session.session_id
                     ))
+                    .header("Content-Type", "application/json")
                     .header("X-BB-API-Key", &api_key)
+                    .json(&serde_json::json!({ "status": "REQUEST_RELEASE" }))
                     .send()
                     .await;
             }
@@ -58,6 +104,10 @@ pub async fn close_provider_session(session: &ProviderSession) {
                     .await;
             }
         }
+        "browserless" => {
+            // session_id holds the stop URL for browserless
+            let _ = client.delete(&session.session_id).send().await;
+        }
         "kernel" => {
             if let Ok(api_key) = env::var("KERNEL_API_KEY") {
                 let endpoint = env::var("KERNEL_ENDPOINT")
@@ -73,6 +123,10 @@ pub async fn close_provider_session(session: &ProviderSession) {
                     .await;
             }
         }
+        "agentcore" => {
+            // AgentCore session cleanup is handled via signed DELETE request
+            let _ = close_agentcore_session(&session.session_id).await;
+        }
         _ => {}
     }
 }
@@ -80,15 +134,13 @@ pub async fn close_provider_session(session: &ProviderSession) {
 async fn connect_browserbase() -> Result<(String, Option<ProviderSession>), String> {
     let api_key = env::var("BROWSERBASE_API_KEY")
         .map_err(|_| "BROWSERBASE_API_KEY environment variable is not set")?;
-    let project_id = env::var("BROWSERBASE_PROJECT_ID")
-        .map_err(|_| "BROWSERBASE_PROJECT_ID environment variable is not set")?;
 
     let client = reqwest::Client::new();
     let response = client
         .post("https://api.browserbase.com/v1/sessions")
-        .header("Content-Type", "application/json")
-        .header("X-BB-API-Key", &api_key)
-        .json(&json!({ "projectId": project_id }))
+        .header("content-type", "application/json")
+        .header("x-bb-api-key", &api_key)
+        .body("{}")
         .send()
         .await
         .map_err(|e| format!("Browserbase request failed: {}", e))?;
@@ -131,62 +183,98 @@ async fn connect_browserbase() -> Result<(String, Option<ProviderSession>), Stri
     ))
 }
 
-async fn connect_browser_use() -> Result<(String, Option<ProviderSession>), String> {
-    let api_key = env::var("BROWSER_USE_API_KEY")
-        .map_err(|_| "BROWSER_USE_API_KEY environment variable is not set")?;
+async fn connect_browserless() -> Result<(String, Option<ProviderSession>), String> {
+    let api_key = env::var("BROWSERLESS_API_KEY")
+        .map_err(|_| "BROWSERLESS_API_KEY environment variable is not set")?;
+
+    let api_url = env::var("BROWSERLESS_API_URL")
+        .unwrap_or_else(|_| "https://production-sfo.browserless.io".to_string());
+    let browser_type =
+        env::var("BROWSERLESS_BROWSER_TYPE").unwrap_or_else(|_| "chromium".to_string());
+
+    let supported = ["chromium", "chrome"];
+    if !supported.contains(&browser_type.as_str()) {
+        return Err(format!(
+            "BROWSERLESS_BROWSER_TYPE \"{}\" is not supported. Only {} are allowed.",
+            browser_type,
+            supported.join(", ")
+        ));
+    }
+
+    let ttl: u64 = env::var("BROWSERLESS_TTL")
+        .ok()
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(300000);
+    let stealth = env::var("BROWSERLESS_STEALTH")
+        .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+        .unwrap_or(true);
+
+    let url = format!("{}/session", api_url.trim_end_matches('/'));
 
     let client = reqwest::Client::new();
     let response = client
-        .post("https://api.browser-use.com/api/v2/browsers")
+        .post(&url)
+        .query(&[("token", &api_key)])
         .header("Content-Type", "application/json")
-        .header("X-Browser-Use-API-Key", &api_key)
-        .json(&json!({}))
+        .json(&json!({
+            "ttl": ttl,
+            "stealth": stealth,
+            "browser": browser_type,
+        }))
         .send()
         .await
-        .map_err(|e| format!("Browser Use request failed: {}", e))?;
+        .map_err(|e| format!("Browserless request failed: {}", e))?;
 
     let status = response.status();
     let body = response
         .text()
         .await
-        .map_err(|e| format!("Failed to read Browser Use response: {}", e))?;
+        .map_err(|e| format!("Failed to read Browserless response: {}", e))?;
 
     if !status.is_success() {
         return Err(format!(
-            "Browser Use API error ({}): {}",
+            "Browserless API error ({}): {}",
             status.as_u16(),
             body
         ));
     }
 
     let json: Value =
-        serde_json::from_str(&body).map_err(|e| format!("Invalid Browser Use response: {}", e))?;
+        serde_json::from_str(&body).map_err(|e| format!("Invalid Browserless response: {}", e))?;
 
-    let session_id = json
-        .get("id")
-        .and_then(|v| v.as_str())
-        .unwrap_or("")
-        .to_string();
-
-    let ws_url = json
-        .get("cdp_url")
-        .or_else(|| json.get("cdpUrl"))
+    let connect_url = json
+        .get("connect")
         .and_then(|v| v.as_str())
         .map(String::from)
-        .ok_or_else(|| "Browser Use response missing cdp_url or cdpUrl".to_string())?;
+        .ok_or_else(|| "Browserless response missing 'connect' URL".to_string())?;
+
+    let stop_url = json
+        .get("stop")
+        .and_then(|v| v.as_str())
+        .map(String::from)
+        .ok_or_else(|| "Browserless response missing 'stop' URL".to_string())?;
 
     Ok((
-        ws_url,
+        connect_url,
         Some(ProviderSession {
-            provider: "browser-use".to_string(),
-            session_id,
+            provider: "browserless".to_string(),
+            // Store the stop URL as the session_id for cleanup
+            session_id: stop_url,
         }),
     ))
 }
 
+async fn connect_browser_use() -> Result<(String, Option<ProviderSession>), String> {
+    let api_key = env::var("BROWSER_USE_API_KEY")
+        .map_err(|_| "BROWSER_USE_API_KEY environment variable is not set")?;
+
+    let ws_url = format!("wss://connect.browser-use.com?apiKey={}", api_key);
+
+    Ok((ws_url, None))
+}
+
 async fn connect_kernel() -> Result<(String, Option<ProviderSession>), String> {
-    let api_key =
-        env::var("KERNEL_API_KEY").map_err(|_| "KERNEL_API_KEY environment variable is not set")?;
+    let api_key = env::var("KERNEL_API_KEY").ok();
     let endpoint =
         env::var("KERNEL_ENDPOINT").unwrap_or_else(|_| "https://api.onkernel.com".to_string());
 
@@ -218,10 +306,11 @@ async fn connect_kernel() -> Result<(String, Option<ProviderSession>), String> {
     }
 
     let client = reqwest::Client::new();
-    let response = client
-        .post(&url)
-        .header("Content-Type", "application/json")
-        .header("Authorization", format!("Bearer {}", api_key))
+    let mut request = client.post(&url).header("Content-Type", "application/json");
+    if let Some(ref key) = api_key {
+        request = request.header("Authorization", format!("Bearer {}", key));
+    }
+    let response = request
         .json(&body)
         .send()
         .await
@@ -272,3 +361,456 @@ async fn connect_kernel() -> Result<(String, Option<ProviderSession>), String> {
         }),
     ))
 }
+
+// ============================================================================
+// AgentCore Provider (AWS Bedrock AgentCore Browser)
+// ============================================================================
+
+mod agentcore {
+    use super::*;
+
+    /// AgentCore-specific session info for Live View URL
+    pub struct AgentCoreSessionInfo {
+        pub session_id: String,
+        pub browser_identifier: String,
+        pub region: String,
+        pub live_view_url: String,
+    }
+
+    thread_local! {
+        static AGENTCORE_INFO: std::cell::RefCell<Option<AgentCoreSessionInfo>> = const { std::cell::RefCell::new(None) };
+        static AGENTCORE_WS_HEADERS: std::cell::RefCell<Option<Vec<(String, String)>>> = const { std::cell::RefCell::new(None) };
+    }
+
+    pub fn set_agentcore_info(info: AgentCoreSessionInfo) {
+        AGENTCORE_INFO.with(|cell| *cell.borrow_mut() = Some(info));
+    }
+
+    pub fn get_agentcore_info() -> Option<AgentCoreSessionInfo> {
+        AGENTCORE_INFO.with(|cell| {
+            cell.borrow().as_ref().map(|i| AgentCoreSessionInfo {
+                session_id: i.session_id.clone(),
+                browser_identifier: i.browser_identifier.clone(),
+                region: i.region.clone(),
+                live_view_url: i.live_view_url.clone(),
+            })
+        })
+    }
+
+    pub fn set_agentcore_ws_headers(headers: Vec<(String, String)>) {
+        AGENTCORE_WS_HEADERS.with(|cell| *cell.borrow_mut() = Some(headers));
+    }
+
+    pub fn take_agentcore_ws_headers() -> Option<Vec<(String, String)>> {
+        AGENTCORE_WS_HEADERS.with(|cell| cell.borrow_mut().take())
+    }
+
+    pub async fn connect() -> Result<(String, Option<ProviderSession>), String> {
+        let region = env::var("AGENTCORE_REGION")
+            .or_else(|_| env::var("AWS_REGION"))
+            .or_else(|_| env::var("AWS_DEFAULT_REGION"))
+            .unwrap_or_else(|_| "us-east-1".to_string());
+        let browser_id =
+            env::var("AGENTCORE_BROWSER_ID").unwrap_or_else(|_| "aws.browser.v1".to_string());
+        let timeout_secs: u64 = env::var("AGENTCORE_SESSION_TIMEOUT")
+            .ok()
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(3600);
+
+        let host = format!("bedrock-agentcore.{}.amazonaws.com", region);
+        let path = format!(
+            "/browsers/{}/sessions/start",
+            urlencoding::encode(&browser_id)
+        );
+        let url = format!("https://{}{}", host, path);
+
+        // Generate a unique session name
+        let session_name = format!("chrome-use-{}", &uuid::Uuid::new_v4().to_string()[..8]);
+
+        let mut body_json = json!({
+            "name": session_name,
+            "sessionTimeoutSeconds": timeout_secs
+        });
+        if let Ok(profile_id) = env::var("AGENTCORE_PROFILE_ID") {
+            if !profile_id.is_empty() {
+                body_json.as_object_mut().unwrap().insert(
+                    "profileConfiguration".to_string(),
+                    json!({ "profileIdentifier": profile_id }),
+                );
+            }
+        }
+        let body = serde_json::to_string(&body_json)
+            .map_err(|e| format!("Failed to serialize request body: {}", e))?;
+
+        let signed_headers = sign_request("PUT", &url, &region, Some(&body)).await?;
+
+        let client = reqwest::Client::new();
+        let mut req = client.put(&url).body(body.clone());
+        for (key, value) in &signed_headers {
+            req = req.header(key.as_str(), value.as_str());
+        }
+
+        let response = req
+            .send()
+            .await
+            .map_err(|e| format!("AgentCore request failed: {}", e))?;
+
+        let status = response.status();
+        let resp_body = response
+            .text()
+            .await
+            .map_err(|e| format!("Failed to read AgentCore response: {}", e))?;
+
+        if !status.is_success() {
+            return Err(format!(
+                "AgentCore API error ({}): {}",
+                status.as_u16(),
+                resp_body
+            ));
+        }
+
+        let json: Value = serde_json::from_str(&resp_body)
+            .map_err(|e| format!("Invalid AgentCore response: {}", e))?;
+
+        let session_id = json
+            .get("sessionId")
+            .and_then(|v| v.as_str())
+            .ok_or_else(|| "AgentCore response missing sessionId".to_string())?
+            .to_string();
+
+        let browser_identifier = json
+            .get("browserIdentifier")
+            .and_then(|v| v.as_str())
+            .unwrap_or(&browser_id)
+            .to_string();
+
+        let live_view_url = format!(
+            "https://{}.console.aws.amazon.com/bedrock-agentcore/browser/{}/session/{}#",
+            region, browser_identifier, session_id
+        );
+
+        set_agentcore_info(AgentCoreSessionInfo {
+            session_id: session_id.clone(),
+            browser_identifier: browser_identifier.clone(),
+            region: region.clone(),
+            live_view_url: live_view_url.clone(),
+        });
+
+        eprintln!("Session: {}", session_id);
+        eprintln!("Live View: {}", live_view_url);
+
+        let ws_path = format!(
+            "/browser-streams/{}/sessions/{}/automation",
+            browser_identifier, session_id
+        );
+        let ws_url = format!("wss://{}{}", host, ws_path);
+
+        let ws_headers = sign_request(
+            "GET",
+            &format!("https://{}{}", host, ws_path),
+            &region,
+            None,
+        )
+        .await?;
+        set_agentcore_ws_headers(ws_headers);
+
+        Ok((
+            ws_url,
+            Some(ProviderSession {
+                provider: "agentcore".to_string(),
+                session_id,
+            }),
+        ))
+    }
+
+    /// Get AWS credentials from environment variables or AWS CLI
+    fn get_aws_credentials() -> Result<(String, String, Option<String>), String> {
+        // First try environment variables
+        if let (Ok(access_key), Ok(secret_key)) = (
+            env::var("AWS_ACCESS_KEY_ID"),
+            env::var("AWS_SECRET_ACCESS_KEY"),
+        ) {
+            return Ok((access_key, secret_key, env::var("AWS_SESSION_TOKEN").ok()));
+        }
+
+        // Fall back to AWS CLI
+        let mut cmd = std::process::Command::new("aws");
+        cmd.args(["configure", "export-credentials", "--format", "env"]);
+
+        // Honor AWS_PROFILE
+        if let Ok(profile) = env::var("AWS_PROFILE") {
+            cmd.args(["--profile", &profile]);
+        }
+
+        let output = cmd.output()
+            .map_err(|e| format!("Failed to run aws CLI: {}. Install AWS CLI or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY", e))?;
+
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            return Err(format!(
+                "AWS CLI failed: {}. Run 'aws sso login' or set credentials",
+                stderr.trim()
+            ));
+        }
+
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        let mut access_key = None;
+        let mut secret_key = None;
+        let mut session_token = None;
+
+        for line in stdout.lines() {
+            if let Some(val) = line.strip_prefix("export AWS_ACCESS_KEY_ID=") {
+                access_key = Some(val.to_string());
+            } else if let Some(val) = line.strip_prefix("export AWS_SECRET_ACCESS_KEY=") {
+                secret_key = Some(val.to_string());
+            } else if let Some(val) = line.strip_prefix("export AWS_SESSION_TOKEN=") {
+                session_token = Some(val.to_string());
+            }
+        }
+
+        match (access_key, secret_key) {
+            (Some(ak), Some(sk)) => Ok((ak, sk, session_token)),
+            _ => Err("Failed to parse credentials from AWS CLI output".to_string()),
+        }
+    }
+
+    async fn sign_request(
+        method: &str,
+        url: &str,
+        region: &str,
+        body: Option<&str>,
+    ) -> Result<Vec<(String, String)>, String> {
+        use hmac::{Hmac, Mac};
+        use sha2::{Digest, Sha256};
+
+        // Get credentials from environment or AWS CLI
+        let (access_key, secret_key, session_token) = get_aws_credentials()?;
+
+        let parsed_url = url::Url::parse(url).map_err(|e| format!("Invalid URL: {}", e))?;
+        let host = parsed_url.host_str().unwrap_or("");
+
+        // Get current time
+        let now = chrono::Utc::now();
+        let amz_date = now.format("%Y%m%dT%H%M%SZ").to_string();
+        let date_stamp = now.format("%Y%m%d").to_string();
+
+        // Create canonical request
+        let payload_hash = if let Some(b) = body {
+            let mut hasher = Sha256::new();
+            hasher.update(b.as_bytes());
+            hex::encode(hasher.finalize())
+        } else {
+            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855".to_string()
+            // empty string hash
+        };
+
+        let canonical_uri = parsed_url.path();
+        let canonical_querystring = parsed_url.query().unwrap_or("");
+
+        let mut signed_headers = "content-type;host;x-amz-date".to_string();
+        let mut canonical_headers = format!(
+            "content-type:application/json\nhost:{}\nx-amz-date:{}\n",
+            host, amz_date
+        );
+
+        if let Some(ref token) = session_token {
+            signed_headers = "content-type;host;x-amz-date;x-amz-security-token".to_string();
+            canonical_headers = format!(
+                "content-type:application/json\nhost:{}\nx-amz-date:{}\nx-amz-security-token:{}\n",
+                host, amz_date, token
+            );
+        }
+
+        let canonical_request = format!(
+            "{}\n{}\n{}\n{}\n{}\n{}",
+            method,
+            canonical_uri,
+            canonical_querystring,
+            canonical_headers,
+            signed_headers,
+            payload_hash
+        );
+
+        // Create string to sign
+        let algorithm = "AWS4-HMAC-SHA256";
+        let credential_scope = format!("{}/{}/bedrock-agentcore/aws4_request", date_stamp, region);
+
+        let mut hasher = Sha256::new();
+        hasher.update(canonical_request.as_bytes());
+        let canonical_request_hash = hex::encode(hasher.finalize());
+
+        let string_to_sign = format!(
+            "{}\n{}\n{}\n{}",
+            algorithm, amz_date, credential_scope, canonical_request_hash
+        );
+
+        // Calculate signature
+        type HmacSha256 = Hmac<Sha256>;
+
+        let k_date = HmacSha256::new_from_slice(format!("AWS4{}", secret_key).as_bytes())
+            .unwrap()
+            .chain_update(date_stamp.as_bytes())
+            .finalize()
+            .into_bytes();
+
+        let k_region = HmacSha256::new_from_slice(&k_date)
+            .unwrap()
+            .chain_update(region.as_bytes())
+            .finalize()
+            .into_bytes();
+
+        let k_service = HmacSha256::new_from_slice(&k_region)
+            .unwrap()
+            .chain_update(b"bedrock-agentcore")
+            .finalize()
+            .into_bytes();
+
+        let k_signing = HmacSha256::new_from_slice(&k_service)
+            .unwrap()
+            .chain_update(b"aws4_request")
+            .finalize()
+            .into_bytes();
+
+        let signature = hex::encode(
+            HmacSha256::new_from_slice(&k_signing)
+                .unwrap()
+                .chain_update(string_to_sign.as_bytes())
+                .finalize()
+                .into_bytes(),
+        );
+
+        // Build authorization header
+        let authorization = format!(
+            "{} Credential={}/{}, SignedHeaders={}, Signature={}",
+            algorithm, access_key, credential_scope, signed_headers, signature
+        );
+
+        let mut headers = vec![
+            ("host".to_string(), host.to_string()),
+            ("content-type".to_string(), "application/json".to_string()),
+            ("x-amz-date".to_string(), amz_date),
+            ("authorization".to_string(), authorization),
+        ];
+
+        if let Some(token) = session_token {
+            headers.push(("x-amz-security-token".to_string(), token));
+        }
+
+        Ok(headers)
+    }
+
+    pub async fn close_session(session_id: &str) -> Result<(), String> {
+        let info = get_agentcore_info();
+        let (region, browser_id) = match &info {
+            Some(i) => (i.region.clone(), i.browser_identifier.clone()),
+            None => {
+                let region = env::var("AGENTCORE_REGION")
+                    .or_else(|_| env::var("AWS_REGION"))
+                    .or_else(|_| env::var("AWS_DEFAULT_REGION"))
+                    .unwrap_or_else(|_| "us-east-1".to_string());
+                let browser_id = env::var("AGENTCORE_BROWSER_ID")
+                    .unwrap_or_else(|_| "aws.browser.v1".to_string());
+                (region, browser_id)
+            }
+        };
+
+        let host = format!("bedrock-agentcore.{}.amazonaws.com", region);
+        let path = format!(
+            "/browsers/{}/sessions/stop",
+            urlencoding::encode(&browser_id)
+        );
+        let url = format!("https://{}{}", host, path);
+
+        let body = serde_json::to_string(&json!({ "sessionId": session_id }))
+            .map_err(|e| format!("Failed to serialize close request: {}", e))?;
+
+        let signed_headers = sign_request("PUT", &url, &region, Some(&body)).await?;
+
+        let client = reqwest::Client::new();
+        let mut req = client.put(&url).body(body);
+        for (key, value) in &signed_headers {
+            req = req.header(key.as_str(), value.as_str());
+        }
+
+        let _ = req.send().await;
+        Ok(())
+    }
+}
+
+pub use agentcore::{get_agentcore_info, take_agentcore_ws_headers};
+
+async fn connect_agentcore() -> Result<(String, Option<ProviderSession>), String> {
+    agentcore::connect().await
+}
+
+async fn close_agentcore_session(session_id: &str) -> Result<(), String> {
+    agentcore::close_session(session_id).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_connect_provider_unknown() {
+        let rt = tokio::runtime::Runtime::new().unwrap();
+        let result = rt.block_on(connect_provider("unknown-provider"));
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("Unknown provider"));
+    }
+
+    #[test]
+    fn test_agentcore_env_defaults() {
+        // Test that default values are used when env vars not set
+        std::env::remove_var("AGENTCORE_REGION");
+        std::env::remove_var("AGENTCORE_BROWSER_ID");
+        std::env::remove_var("AGENTCORE_SESSION_TIMEOUT");
+
+        // These would be used in connect() - just verify they don't panic
+        let region = std::env::var("AGENTCORE_REGION")
+            .or_else(|_| std::env::var("AWS_REGION"))
+            .unwrap_or_else(|_| "us-east-1".to_string());
+        assert_eq!(region, "us-east-1");
+
+        let browser_id =
+            std::env::var("AGENTCORE_BROWSER_ID").unwrap_or_else(|_| "aws.browser.v1".to_string());
+        assert_eq!(browser_id, "aws.browser.v1");
+    }
+
+    #[test]
+    fn test_agentcore_session_info_storage() {
+        let info = agentcore::AgentCoreSessionInfo {
+            session_id: "test-session".to_string(),
+            browser_identifier: "aws.browser.v1".to_string(),
+            region: "us-east-1".to_string(),
+            live_view_url: "https://example.com".to_string(),
+        };
+
+        agentcore::set_agentcore_info(info);
+        let retrieved = get_agentcore_info();
+        assert!(retrieved.is_some());
+        let retrieved = retrieved.unwrap();
+        assert_eq!(retrieved.session_id, "test-session");
+        assert_eq!(retrieved.region, "us-east-1");
+    }
+
+    #[test]
+    fn test_agentcore_ws_headers_storage() {
+        let headers = vec![
+            (
+                "Authorization".to_string(),
+                "AWS4-HMAC-SHA256...".to_string(),
+            ),
+            ("X-Amz-Date".to_string(), "20260304T180000Z".to_string()),
+        ];
+
+        agentcore::set_agentcore_ws_headers(headers);
+        let taken = take_agentcore_ws_headers();
+        assert!(taken.is_some());
+        assert_eq!(taken.unwrap().len(), 2);
+
+        // Should be None after take
+        let taken_again = take_agentcore_ws_headers();
+        assert!(taken_again.is_none());
+    }
+}

cli/src/native/react/mod.rs

@@ -0,0 +1,31 @@
+//! React/web introspection primitives.
+//!
+//! Scripts and handlers for the `react` subcommands (tree, inspect, renders,
+//! suspense) plus the universal `vitals` verb and the generic `pushstate`
+//! SPA-navigation action. These primitives are framework-agnostic: React-side
+//! commands only require the `__REACT_DEVTOOLS_GLOBAL_HOOK__` to be installed,
+//! and `vitals` / `pushstate` are pure web-standard APIs.
+//!
+//! The React DevTools `installHook.js` is vendored from the React DevTools
+//! Chrome extension (MIT, facebook/react). It's registered via
+//! `addScriptToEvaluateOnNewDocument` before any page JS runs when the user
+//! passes `--enable react-devtools` at launch.
+
+pub mod scripts;
+
+mod renders;
+mod suspense;
+mod tree;
+mod vitals;
+
+pub use renders::{format_renders_report, RendersData};
+pub use suspense::{format_suspense_report, Boundary};
+pub use tree::{format_tree, TreeNode};
+pub use vitals::{format_vitals_report, VitalsData};
+
+/// React DevTools hook script (MIT, from facebook/react).
+/// Registered via `addScriptToEvaluateOnNewDocument` to install
+/// `window.__REACT_DEVTOOLS_GLOBAL_HOOK__` before any page JS runs. React
+/// detects the hook on boot and registers its renderers against it, which
+/// enables every `react …` command.
+pub const INSTALL_HOOK_JS: &str = include_str!("installHook.js");

cli/src/native/react/renders.rs

@@ -0,0 +1,169 @@
+//! React fiber render profiler report formatter.
+//!
+//! Default output is the
+//! full agent-readable report (summary, FPS, component table, per-component
+//! "change details (prev -> next)"). `--json` emits the raw structured data
+//! instead.
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct RendersData {
+    pub elapsed: f64,
+    pub fps: FpsStats,
+    #[serde(rename = "totalRenders")]
+    pub total_renders: i64,
+    #[serde(rename = "totalMounts")]
+    pub total_mounts: i64,
+    #[serde(rename = "totalReRenders")]
+    pub total_re_renders: i64,
+    #[serde(rename = "totalComponents")]
+    pub total_components: i64,
+    pub components: Vec<Component>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct FpsStats {
+    pub avg: i64,
+    pub min: i64,
+    pub max: i64,
+    pub drops: i64,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct Component {
+    pub name: String,
+    pub count: i64,
+    pub mounts: i64,
+    #[serde(rename = "reRenders")]
+    pub re_renders: i64,
+    #[serde(rename = "instanceCount")]
+    pub instance_count: i64,
+    #[serde(rename = "totalTime")]
+    pub total_time: f64,
+    #[serde(rename = "selfTime")]
+    pub self_time: f64,
+    #[serde(rename = "domMutations")]
+    pub dom_mutations: i64,
+    pub changes: Vec<Change>,
+    #[serde(rename = "changeSummary")]
+    pub change_summary: std::collections::HashMap<String, i64>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct Change {
+    #[serde(rename = "type")]
+    pub change_type: String,
+    pub name: Option<String>,
+    pub prev: Option<String>,
+    pub next: Option<String>,
+}
+
+pub fn format_renders_report(d: &RendersData) -> String {
+    if d.components.is_empty() {
+        return "(no renders captured)".to_string();
+    }
+
+    let mut lines: Vec<String> = Vec::new();
+    lines.push(format!("# Render Profile - {}s recording", d.elapsed));
+    lines.push(format!(
+        "# {} renders ({} mounts + {} re-renders) across {} components",
+        d.total_renders, d.total_mounts, d.total_re_renders, d.total_components
+    ));
+    lines.push(format!(
+        "# FPS: avg {}, min {}, max {}, drops (<30fps): {}",
+        d.fps.avg, d.fps.min, d.fps.max, d.fps.drops
+    ));
+    lines.push(String::new());
+    lines.push("## Components by total render time".to_string());
+
+    let top: Vec<&Component> = d.components.iter().take(50).collect();
+    let name_w = top.iter().map(|c| c.name.len()).max().unwrap_or(9).max(9);
+
+    lines.push(format!(
+        "| {:<name_w$} | Insts | Mounts | Re-renders | Total    | Self     | DOM   | Top change reason          |",
+        "Component",
+        name_w = name_w
+    ));
+    lines.push(format!(
+        "| {:-<name_w$} | ----- | ------ | ---------- | -------- | -------- | ----- | -------------------------- |",
+        "",
+        name_w = name_w
+    ));
+    for c in &top {
+        let total = if c.total_time > 0.0 {
+            format!("{}ms", c.total_time)
+        } else {
+            "-".to_string()
+        };
+        let self_time = if c.self_time > 0.0 {
+            format!("{}ms", c.self_time)
+        } else {
+            "-".to_string()
+        };
+        let dom = format!("{}/{}", c.dom_mutations, c.count);
+        let top_change = c
+            .change_summary
+            .iter()
+            .max_by_key(|(_, v)| *v)
+            .map(|(k, _)| k.as_str())
+            .unwrap_or("-");
+        lines.push(format!(
+            "| {:<name_w$} | {:>5} | {:>6} | {:>10} | {:>8} | {:>8} | {:>5} | {:<26} |",
+            c.name,
+            c.instance_count,
+            c.mounts,
+            c.re_renders,
+            total,
+            self_time,
+            dom,
+            top_change,
+            name_w = name_w
+        ));
+    }
+    if d.components.len() > 50 {
+        lines.push(format!("... and {} more", d.components.len() - 50));
+    }
+
+    let detailed: Vec<&Component> = d
+        .components
+        .iter()
+        .filter(|c| {
+            c.changes
+                .iter()
+                .any(|ch| ch.change_type != "mount" && ch.change_type != "parent")
+        })
+        .take(15)
+        .collect();
+    if !detailed.is_empty() {
+        lines.push(String::new());
+        lines.push("## Change details (prev -> next)".to_string());
+        for c in &detailed {
+            lines.push(format!("  {}", c.name));
+            let mut seen = std::collections::HashSet::new();
+            for ch in &c.changes {
+                if ch.change_type == "mount" || ch.change_type == "parent" {
+                    continue;
+                }
+                let name = ch.name.clone().unwrap_or_default();
+                let key = format!("{}:{}", ch.change_type, name);
+                if !seen.insert(key) {
+                    continue;
+                }
+                let label = match ch.change_type.as_str() {
+                    "props" => format!("props.{}", name),
+                    "state" => format!("state ({})", name),
+                    _ => format!("context ({})", name),
+                };
+                lines.push(format!(
+                    "    {}: {} -> {}",
+                    label,
+                    ch.prev.clone().unwrap_or_else(|| "?".into()),
+                    ch.next.clone().unwrap_or_else(|| "?".into())
+                ));
+            }
+        }
+    }
+
+    lines.join("\n")
+}

cli/src/native/react/scripts.rs

@@ -0,0 +1,745 @@
+//! Browser-side evaluation scripts for React/web introspection.
+//!
+//! These are JavaScript strings evaluated in the page context via
+//! `Runtime.evaluate`. They assume the React DevTools hook is already
+//! installed (via `--enable react-devtools`) except for `VITALS_INIT` and
+//! `PUSHSTATE`, which only use standard Web APIs.
+//!
+//! Kept as raw strings rather than TS/JS files because the daemon is a single
+//! Rust binary with no filesystem vendor step at runtime.
+
+/// Build a no-argument async IIFE page-eval that returns the component tree as
+/// JSON.
+pub const TREE_SNAPSHOT: &str = r#"
+(async () => {
+  const hook = window.__REACT_DEVTOOLS_GLOBAL_HOOK__;
+  if (!hook) throw new Error("React DevTools hook not installed - relaunch with --enable react-devtools");
+  const ri = hook.rendererInterfaces && hook.rendererInterfaces.get && hook.rendererInterfaces.get(1);
+  if (!ri) throw new Error("No React renderer attached - the page has not booted React yet");
+
+  const batches = await new Promise((resolve) => {
+    const out = [];
+    const origEmit = hook.emit;
+    hook.emit = function (event, payload) {
+      if (event === "operations") out.push(Array.from(payload));
+      return origEmit.apply(hook, arguments);
+    };
+    ri.flushInitialOperations();
+    setTimeout(() => {
+      hook.emit = origEmit;
+      resolve(out);
+    }, 50);
+  });
+
+  const nodes = batches.flatMap((ops) => {
+    let i = 2;
+    const strings = [null];
+    const tableEnd = ++i + ops[i - 1];
+    while (i < tableEnd) {
+      const len = ops[i++];
+      strings.push(String.fromCodePoint(...ops.slice(i, i + len)));
+      i += len;
+    }
+    const out = [];
+    while (i < ops.length) {
+      const op = ops[i];
+      if (op === 1) {
+        const id = ops[i + 1];
+        const type = ops[i + 2];
+        i += 3;
+        if (type === 11) {
+          out.push({ id, type, name: null, key: null, parent: 0 });
+          i += 4;
+        } else {
+          out.push({
+            id,
+            type,
+            name: strings[ops[i + 2]] || null,
+            key: strings[ops[i + 3]] || null,
+            parent: ops[i],
+          });
+          i += 5;
+        }
+      } else {
+        i += skip(op, ops, i);
+      }
+    }
+    return out;
+
+    function skip(op, ops, i) {
+      if (op === 2) return 2 + ops[i + 1];
+      if (op === 3) return 3 + ops[i + 2];
+      if (op === 4) return 3;
+      if (op === 5) return 4;
+      if (op === 6) return 1;
+      if (op === 7) return 3;
+      if (op === 8) return 6 + rects(ops[i + 5]);
+      if (op === 9) return 2 + ops[i + 1];
+      if (op === 10) return 3 + ops[i + 2];
+      if (op === 11) return 3 + rects(ops[i + 2]);
+      if (op === 12) return suspenders(ops, i);
+      if (op === 13) return 2;
+      return 1;
+    }
+    function rects(n) {
+      return n === -1 ? 0 : n * 4;
+    }
+    function suspenders(ops, i) {
+      let j = i + 2;
+      for (let c = 0; c < ops[i + 1]; c++) j += 5 + ops[j + 4];
+      return j - i;
+    }
+  });
+
+  return JSON.stringify(nodes);
+})()
+"#;
+
+/// Template for `inspect` — replace {{ID}} with the numeric fiber id.
+pub const TREE_INSPECT: &str = r#"
+(() => {
+  const id = {{ID}};
+  const hook = window.__REACT_DEVTOOLS_GLOBAL_HOOK__;
+  const ri = hook && hook.rendererInterfaces && hook.rendererInterfaces.get && hook.rendererInterfaces.get(1);
+  if (!ri) throw new Error("No React renderer attached");
+  if (!ri.hasElementWithId(id)) throw new Error("element " + id + " not found (page reloaded?)");
+  const result = ri.inspectElement(1, id, null, true);
+  if (!result || result.type !== "full-data") {
+    throw new Error("inspect failed: " + (result && result.type));
+  }
+  const v = result.value;
+  const name = ri.getDisplayNameForElementID(id);
+  const lines = [name + " #" + id];
+  if (v.key != null) lines.push("key: " + JSON.stringify(v.key));
+  section("props", v.props);
+  section("hooks", v.hooks);
+  section("state", v.state);
+  section("context", v.context);
+  if (v.owners && v.owners.length) {
+    lines.push("rendered by: " + v.owners.map((o) => o.displayName).join(" > "));
+  }
+  const source = Array.isArray(v.source)
+    ? [v.source[1], v.source[2], v.source[3]]
+    : null;
+  return JSON.stringify({ text: lines.join("\n"), source });
+
+  function section(label, payload) {
+    const data = (payload && payload.data) || payload;
+    if (data == null) return;
+    if (Array.isArray(data)) {
+      if (data.length === 0) return;
+      lines.push(label + ":");
+      for (const h of data) lines.push("  " + hookLine(h));
+    } else if (typeof data === "object") {
+      const entries = Object.entries(data);
+      if (entries.length === 0) return;
+      lines.push(label + ":");
+      for (const [k, val] of entries) lines.push("  " + k + ": " + preview(val));
+    }
+  }
+  function hookLine(h) {
+    const idx = h.id != null ? "[" + h.id + "] " : "";
+    const sub = h.subHooks && h.subHooks.length ? " (" + h.subHooks.length + " sub)" : "";
+    return idx + h.name + ": " + preview(h.value) + sub;
+  }
+  function preview(v) {
+    if (v == null) return String(v);
+    if (typeof v !== "object") return JSON.stringify(v);
+    if (v.type === "undefined") return "undefined";
+    if (v.preview_long) return v.preview_long;
+    if (v.preview_short) return v.preview_short;
+    if (Array.isArray(v)) return "[" + v.map(preview).join(", ") + "]";
+    const entries = Object.entries(v).map((e) => e[0] + ": " + preview(e[1]));
+    return "{" + entries.join(", ") + "}";
+  }
+})()
+"#;
+
+/// Fiber profiler init script. Registered via `addScriptToEvaluateOnNewDocument`
+/// so it survives navigations; also evaluated immediately on the current page
+/// by `react renders start`.
+pub const RENDERS_INIT: &str = r#"
+(() => {
+  const hook = window.__REACT_DEVTOOLS_GLOBAL_HOOK__;
+  if (!hook || window.__AB_RENDERS_ACTIVE__) return;
+
+  const MAX_COMPONENTS = 200;
+  const data = {};
+  const fps = { frames: [], last: 0, rafId: 0 };
+
+  window.__AB_RENDERS__ = data;
+  window.__AB_RENDERS_FPS__ = fps;
+  window.__AB_RENDERS_START__ = performance.now();
+  window.__AB_RENDERS_ACTIVE__ = true;
+
+  function fpsLoop(now) {
+    if (fps.last > 0) fps.frames.push(now - fps.last);
+    fps.last = now;
+    fps.rafId = requestAnimationFrame(fpsLoop);
+  }
+  fps.rafId = requestAnimationFrame(fpsLoop);
+
+  const origOnCommit = hook.onCommitFiberRoot;
+  window.__AB_RENDERS_ORIG_COMMIT__ = origOnCommit;
+
+  hook.onCommitFiberRoot = function (rendererID, root) {
+    try { walkFiber(root.current); } catch {}
+    if (typeof origOnCommit === "function") {
+      return origOnCommit.apply(hook, arguments);
+    }
+  };
+
+  function getName(fiber) {
+    if (!fiber.type || typeof fiber.type === "string") return null;
+    return fiber.type.displayName || fiber.type.name || null;
+  }
+
+  function brief(val) {
+    if (val === undefined) return "undefined";
+    if (val === null) return "null";
+    if (typeof val === "function") return "fn()";
+    if (typeof val === "string") return val.length > 60 ? '"' + val.slice(0, 57) + '..."' : '"' + val + '"';
+    if (typeof val === "number" || typeof val === "boolean") return String(val);
+    if (Array.isArray(val)) return "Array(" + val.length + ")";
+    if (typeof val === "object") {
+      try {
+        const keys = Object.keys(val);
+        return keys.length <= 3 ? "{" + keys.join(", ") + "}" : "{" + keys.slice(0, 3).join(", ") + ", ...}";
+      } catch { return "{...}"; }
+    }
+    return String(val).slice(0, 40);
+  }
+
+  function getChanges(fiber) {
+    const changes = [];
+    const alt = fiber.alternate;
+    if (!alt) { changes.push({ type: "mount" }); return changes; }
+    if (fiber.memoizedProps !== alt.memoizedProps) {
+      const curr = fiber.memoizedProps || {};
+      const prev = alt.memoizedProps || {};
+      const allKeys = new Set([...Object.keys(curr), ...Object.keys(prev)]);
+      for (const k of allKeys) {
+        if (k !== "children" && curr[k] !== prev[k]) {
+          changes.push({ type: "props", name: k, prev: brief(prev[k]), next: brief(curr[k]) });
+        }
+      }
+    }
+    if (fiber.memoizedState !== alt.memoizedState) {
+      let curr = fiber.memoizedState;
+      let prev = alt.memoizedState;
+      let hookIdx = 0;
+      while (curr || prev) {
+        if ((curr && curr.memoizedState) !== (prev && prev.memoizedState)) {
+          changes.push({
+            type: "state",
+            name: "hook #" + hookIdx,
+            prev: brief(prev && prev.memoizedState),
+            next: brief(curr && curr.memoizedState),
+          });
+        }
+        curr = curr && curr.next;
+        prev = prev && prev.next;
+        hookIdx++;
+      }
+    }
+    if (fiber.dependencies && fiber.dependencies.firstContext) {
+      let ctx = fiber.dependencies.firstContext;
+      let altCtx = alt.dependencies && alt.dependencies.firstContext;
+      while (ctx) {
+        if (!altCtx || ctx.memoizedValue !== (altCtx && altCtx.memoizedValue)) {
+          const ctxName =
+            (ctx.context && ctx.context.displayName) ||
+            (ctx.context && ctx.context.Provider && ctx.context.Provider.displayName) ||
+            "unknown";
+          changes.push({
+            type: "context",
+            name: ctxName,
+            prev: brief(altCtx && altCtx.memoizedValue),
+            next: brief(ctx.memoizedValue),
+          });
+        }
+        ctx = ctx.next;
+        altCtx = altCtx && altCtx.next;
+      }
+    }
+    if (changes.length === 0) {
+      let parent = fiber.return;
+      while (parent) {
+        const pName = getName(parent);
+        if (pName) {
+          const suffix = !parent.alternate ? " (mount)" : "";
+          changes.push({ type: "parent", name: pName + suffix });
+          break;
+        }
+        parent = parent.return;
+      }
+      if (changes.length === 0) changes.push({ type: "parent", name: "unknown" });
+    }
+    return changes;
+  }
+
+  function childrenTime(fiber) {
+    let t = 0;
+    let child = fiber.child;
+    while (child) {
+      if (typeof child.actualDuration === "number") t += child.actualDuration;
+      child = child.sibling;
+    }
+    return t;
+  }
+
+  function hasDomMutation(fiber) {
+    if (!fiber.alternate) return true;
+    let child = fiber.child;
+    while (child) {
+      if (typeof child.type === "string" && (child.flags & 6) > 0) return true;
+      child = child.sibling;
+    }
+    return false;
+  }
+
+  function walkFiber(fiber) {
+    if (!fiber) return;
+    const tag = fiber.tag;
+    if (tag === 0 || tag === 1 || tag === 2 || tag === 11 || tag === 15) {
+      const didRender =
+        fiber.alternate === null ||
+        fiber.flags > 0 ||
+        fiber.memoizedProps !== (fiber.alternate && fiber.alternate.memoizedProps) ||
+        fiber.memoizedState !== (fiber.alternate && fiber.alternate.memoizedState);
+      if (didRender) {
+        const name = getName(fiber);
+        if (name) {
+          if (!(name in data) && Object.keys(data).length >= MAX_COMPONENTS) {
+            // at cap - skip
+          } else {
+            if (!data[name]) {
+              data[name] = {
+                count: 0, mounts: 0, totalTime: 0, selfTime: 0,
+                domMutations: 0, changes: [], _instances: new Set(),
+              };
+            }
+            data[name].count++;
+            if (!fiber.alternate) data[name].mounts++;
+            if (!data[name]._instances.has(fiber)) {
+              data[name]._instances.add(fiber);
+              if (fiber.alternate) data[name]._instances.add(fiber.alternate);
+            }
+            if (typeof fiber.actualDuration === "number") {
+              data[name].totalTime += fiber.actualDuration;
+              data[name].selfTime += Math.max(0, fiber.actualDuration - childrenTime(fiber));
+            }
+            if (hasDomMutation(fiber)) data[name].domMutations++;
+            const ch = getChanges(fiber);
+            for (const c of ch) {
+              if (data[name].changes.length < 50) data[name].changes.push(c);
+            }
+          }
+        }
+      }
+    }
+    walkFiber(fiber.child);
+    walkFiber(fiber.sibling);
+  }
+})()
+"#;
+
+/// Stop script for fiber profiler. Returns the collected profile as JSON.
+pub const RENDERS_STOP: &str = r#"
+(() => {
+  const active = window.__AB_RENDERS_ACTIVE__;
+  if (!active) throw new Error("renders recording not active - run `react renders start` first");
+
+  const data = window.__AB_RENDERS__;
+  const startTime = window.__AB_RENDERS_START__;
+  const elapsed = performance.now() - startTime;
+
+  const fpsData = window.__AB_RENDERS_FPS__;
+  let fpsStats = { avg: 0, min: 0, max: 0, drops: 0 };
+  if (fpsData) {
+    cancelAnimationFrame(fpsData.rafId);
+    if (fpsData.frames.length > 0) {
+      const fpsSamples = fpsData.frames.map((dt) => (dt > 0 ? 1000 / dt : 0));
+      const sum = fpsSamples.reduce((a, b) => a + b, 0);
+      fpsStats = {
+        avg: Math.round(sum / fpsSamples.length),
+        min: Math.round(Math.min(...fpsSamples)),
+        max: Math.round(Math.max(...fpsSamples)),
+        drops: fpsSamples.filter((f) => f < 30).length,
+      };
+    }
+  }
+
+  const hook = window.__REACT_DEVTOOLS_GLOBAL_HOOK__;
+  const orig = window.__AB_RENDERS_ORIG_COMMIT__;
+  if (hook) hook.onCommitFiberRoot = orig || undefined;
+
+  delete window.__AB_RENDERS__;
+  delete window.__AB_RENDERS_START__;
+  delete window.__AB_RENDERS_ACTIVE__;
+  delete window.__AB_RENDERS_ORIG_COMMIT__;
+  delete window.__AB_RENDERS_FPS__;
+
+  if (!data) {
+    return JSON.stringify({
+      elapsed: 0, fps: fpsStats, totalRenders: 0, totalMounts: 0,
+      totalReRenders: 0, totalComponents: 0, components: [],
+    });
+  }
+
+  const round = (n) => Math.round(n * 100) / 100;
+  const components = Object.entries(data)
+    .map(([name, entry]) => {
+      const summary = {};
+      for (const c of entry.changes) {
+        const key = c.type === "props" ? "props." + c.name
+          : c.type === "state" ? "state (" + c.name + ")"
+          : c.type === "context" ? "context (" + c.name + ")"
+          : c.type === "parent" ? "parent (" + c.name + ")"
+          : c.type;
+        summary[key] = (summary[key] || 0) + 1;
+      }
+      return {
+        name,
+        count: entry.count,
+        mounts: entry.mounts,
+        reRenders: entry.count - entry.mounts,
+        instanceCount: entry._instances.size,
+        totalTime: round(entry.totalTime),
+        selfTime: round(entry.selfTime),
+        domMutations: entry.domMutations,
+        changes: entry.changes,
+        changeSummary: summary,
+      };
+    })
+    .sort((a, b) => b.totalTime - a.totalTime || b.count - a.count);
+
+  return JSON.stringify({
+    elapsed: round(elapsed / 1000),
+    fps: fpsStats,
+    totalRenders: components.reduce((s, c) => s + c.count, 0),
+    totalMounts: components.reduce((s, c) => s + c.mounts, 0),
+    totalReRenders: components.reduce((s, c) => s + c.reRenders, 0),
+    totalComponents: components.length,
+    components,
+  });
+})()
+"#;
+
+/// Suspense boundary walker. Returns boundaries with suspendedBy metadata as JSON.
+pub const SUSPENSE_WALK: &str = r#"
+(async () => {
+  const hook = window.__REACT_DEVTOOLS_GLOBAL_HOOK__;
+  if (!hook) throw new Error("React DevTools hook not installed - relaunch with --enable react-devtools");
+  const ri = hook.rendererInterfaces && hook.rendererInterfaces.get && hook.rendererInterfaces.get(1);
+  if (!ri) throw new Error("No React renderer attached");
+
+  const batches = await new Promise((resolve) => {
+    const out = [];
+    const origEmit = hook.emit;
+    hook.emit = function (event, payload) {
+      if (event === "operations") out.push(payload);
+      return origEmit.apply(this, arguments);
+    };
+    ri.flushInitialOperations();
+    setTimeout(() => {
+      hook.emit = origEmit;
+      resolve(out);
+    }, 50);
+  });
+
+  const boundaryMap = new Map();
+  for (const ops of batches) decodeSuspenseOps(ops, boundaryMap);
+
+  const results = [];
+  for (const b of boundaryMap.values()) {
+    if (b.parentID === 0) continue;
+    const boundary = {
+      id: b.id,
+      parentID: b.parentID,
+      name: b.name,
+      isSuspended: b.isSuspended,
+      environments: b.environments,
+      suspendedBy: [],
+      unknownSuspenders: null,
+      owners: [],
+      jsxSource: null,
+    };
+    if (ri.hasElementWithId(b.id)) {
+      const displayName = ri.getDisplayNameForElementID(b.id);
+      if (displayName) boundary.name = displayName;
+      const result = ri.inspectElement(1, b.id, null, true);
+      if (result && result.type === "full-data") {
+        parseInspection(boundary, result.value);
+      }
+    }
+    results.push(boundary);
+  }
+  return JSON.stringify(results);
+
+  function decodeSuspenseOps(ops, map) {
+    let i = 2;
+    const strings = [null];
+    const tableEnd = ++i + ops[i - 1];
+    while (i < tableEnd) {
+      const len = ops[i++];
+      strings.push(String.fromCodePoint(...ops.slice(i, i + len)));
+      i += len;
+    }
+    while (i < ops.length) {
+      const op = ops[i];
+      if (op === 1) {
+        const type = ops[i + 2];
+        i += 3 + (type === 11 ? 4 : 5);
+      } else if (op === 2) {
+        i += 2 + ops[i + 1];
+      } else if (op === 3) {
+        i += 3 + ops[i + 2];
+      } else if (op === 4) {
+        i += 3;
+      } else if (op === 5) {
+        i += 4;
+      } else if (op === 6) {
+        i++;
+      } else if (op === 7) {
+        i += 3;
+      } else if (op === 8) {
+        const id = ops[i + 1];
+        const parentID = ops[i + 2];
+        const nameStrID = ops[i + 3];
+        const isSuspended = ops[i + 4] === 1;
+        const numRects = ops[i + 5];
+        i += 6;
+        if (numRects !== -1) i += numRects * 4;
+        map.set(id, { id, parentID, name: strings[nameStrID] || null, isSuspended, environments: [] });
+      } else if (op === 9) {
+        i += 2 + ops[i + 1];
+      } else if (op === 10) {
+        i += 3 + ops[i + 2];
+      } else if (op === 11) {
+        const numRects = ops[i + 2];
+        i += 3;
+        if (numRects !== -1) i += numRects * 4;
+      } else if (op === 12) {
+        i++;
+        const changeLen = ops[i++];
+        for (let c = 0; c < changeLen; c++) {
+          const id = ops[i++];
+          i++;
+          i++;
+          const isSuspended = ops[i++] === 1;
+          const envLen = ops[i++];
+          const envs = [];
+          for (let e = 0; e < envLen; e++) {
+            const n = strings[ops[i++]];
+            if (n != null) envs.push(n);
+          }
+          const node = map.get(id);
+          if (node) {
+            node.isSuspended = isSuspended;
+            for (const env of envs) {
+              if (!node.environments.includes(env)) node.environments.push(env);
+            }
+          }
+        }
+      } else if (op === 13) {
+        i += 2;
+      } else {
+        i++;
+      }
+    }
+  }
+
+  function parseInspection(boundary, data) {
+    const rawSuspendedBy = data.suspendedBy;
+    const rawSuspenders = Array.isArray(rawSuspendedBy)
+      ? rawSuspendedBy
+      : rawSuspendedBy && Array.isArray(rawSuspendedBy.data) ? rawSuspendedBy.data : null;
+    if (rawSuspenders) {
+      for (const entry of rawSuspenders) {
+        const awaited = entry && entry.awaited;
+        if (!awaited) continue;
+        const desc = preview(awaited.description) || preview(awaited.value);
+        boundary.suspendedBy.push({
+          name: awaited.name || "unknown",
+          description: desc,
+          duration: awaited.end && awaited.start ? Math.round(awaited.end - awaited.start) : 0,
+          env: awaited.env || (entry && entry.env) || null,
+          ownerName: (awaited.owner && awaited.owner.displayName) || null,
+          ownerStack: parseStack((awaited.owner && awaited.owner.stack) || awaited.stack),
+          awaiterName: (entry && entry.owner && entry.owner.displayName) || null,
+          awaiterStack: parseStack((entry && entry.owner && entry.owner.stack) || (entry && entry.stack)),
+        });
+      }
+    }
+    if (data.unknownSuspenders && data.unknownSuspenders !== 0) {
+      const reasons = {
+        1: "production build (no debug info)",
+        2: "old React version (missing tracking)",
+        3: "thrown Promise (library using throw instead of use())",
+      };
+      boundary.unknownSuspenders = reasons[data.unknownSuspenders] || "unknown reason";
+    }
+    if (Array.isArray(data.owners)) {
+      for (const o of data.owners) {
+        if (o && o.displayName) {
+          const src = Array.isArray(o.stack) && o.stack.length > 0 && Array.isArray(o.stack[0])
+            ? [o.stack[0][1] || "(unknown)", o.stack[0][2], o.stack[0][3]]
+            : null;
+          boundary.owners.push({ name: o.displayName, env: o.env || null, source: src });
+        }
+      }
+    }
+    if (Array.isArray(data.stack) && data.stack.length > 0) {
+      const frame = data.stack[0];
+      if (Array.isArray(frame) && frame.length >= 4) {
+        boundary.jsxSource = [frame[1] || "(unknown)", frame[2], frame[3]];
+      }
+    }
+  }
+
+  function parseStack(raw) {
+    if (!Array.isArray(raw) || raw.length === 0) return null;
+    return raw
+      .filter((f) => Array.isArray(f) && f.length >= 4)
+      .map((f) => [f[0] || "", f[1] || "", f[2] || 0, f[3] || 0]);
+  }
+
+  function preview(v) {
+    if (v == null) return "";
+    if (typeof v === "string") return v;
+    if (typeof v !== "object") return String(v);
+    if (typeof v.preview_long === "string") return v.preview_long;
+    if (typeof v.preview_short === "string") return v.preview_short;
+    if (typeof v.value === "string") return v.value;
+    try {
+      const s = JSON.stringify(v);
+      return s.length > 80 ? s.slice(0, 77) + "..." : s;
+    } catch {
+      return "";
+    }
+  }
+})()
+"#;
+
+/// Init script for Core Web Vitals + React hydration timing capture. Installs
+/// PerformanceObservers for LCP/CLS and intercepts `console.timeStamp` to
+/// capture React's profiling reconciler timings. Idempotent.
+pub const VITALS_INIT: &str = r#"
+(() => {
+  if (window.__AB_VITALS_INSTALLED__) return;
+  window.__AB_VITALS_INSTALLED__ = true;
+
+  const cwv = { lcp: null, cls: 0, clsEntries: [], fcp: null, inp: null };
+  window.__AB_VITALS__ = cwv;
+
+  try {
+    new PerformanceObserver((list) => {
+      const entries = list.getEntries();
+      if (entries.length > 0) {
+        const last = entries[entries.length - 1];
+        cwv.lcp = {
+          startTime: Math.round(last.startTime * 100) / 100,
+          size: last.size,
+          element: last.element && last.element.tagName ? last.element.tagName.toLowerCase() : null,
+          url: last.url || null,
+        };
+      }
+    }).observe({ type: "largest-contentful-paint", buffered: true });
+  } catch {}
+
+  try {
+    new PerformanceObserver((list) => {
+      for (const entry of list.getEntries()) {
+        if (!entry.hadRecentInput) {
+          cwv.cls += entry.value;
+          cwv.clsEntries.push({
+            value: Math.round(entry.value * 10000) / 10000,
+            startTime: Math.round(entry.startTime * 100) / 100,
+          });
+        }
+      }
+    }).observe({ type: "layout-shift", buffered: true });
+  } catch {}
+
+  try {
+    new PerformanceObserver((list) => {
+      for (const entry of list.getEntries()) {
+        if (entry.name === "first-contentful-paint") {
+          cwv.fcp = Math.round(entry.startTime * 100) / 100;
+        }
+      }
+    }).observe({ type: "paint", buffered: true });
+  } catch {}
+
+  try {
+    new PerformanceObserver((list) => {
+      let worst = cwv.inp || 0;
+      for (const entry of list.getEntries()) {
+        if (entry.duration > worst) worst = entry.duration;
+      }
+      if (worst > 0) cwv.inp = Math.round(worst * 100) / 100;
+    }).observe({ type: "event", buffered: true, durationThreshold: 40 });
+  } catch {}
+
+  // React profiling build emits console.timeStamp(label, start, end, track, trackGroup, color)
+  // for reconciler phases and per-component hydration timing. Intercept and collect.
+  const timing = [];
+  window.__AB_REACT_TIMING__ = timing;
+  const orig = console.timeStamp;
+  console.timeStamp = function (label) {
+    const args = arguments;
+    if (typeof label === "string" && args.length >= 3 && typeof args[1] === "number") {
+      timing.push({
+        label,
+        startTime: args[1],
+        endTime: args[2],
+        track: args[3] || "",
+        trackGroup: args[4] || "",
+        color: args[5] || "",
+      });
+    }
+    return orig.apply(console, args);
+  };
+})()
+"#;
+
+/// Read script for vitals — collects observed metrics plus Navigation Timing
+/// TTFB and any React hydration phases. Returns JSON.
+pub const VITALS_READ: &str = r#"
+(() => {
+  const cwv = window.__AB_VITALS__ || {};
+  const timing = window.__AB_REACT_TIMING__ || [];
+  const nav = performance.getEntriesByType("navigation")[0];
+  const ttfb = nav
+    ? Math.round((nav.responseStart - nav.requestStart) * 100) / 100
+    : null;
+  return JSON.stringify({ cwv, timing, ttfb });
+})()
+"#;
+
+/// SPA client-side navigation. Tries the framework router first so Next.js
+/// app/pages router triggers an RSC fetch (pure `history.pushState` would
+/// be shallow routing and bypass data loading). Falls back to
+/// `history.pushState` + popstate/navigate events for vanilla pages and
+/// routers that listen to history events (React Router, TanStack Router,
+/// Solid Router, Vue Router).
+pub const PUSHSTATE: &str = r#"
+((url) => {
+  const before = location.href;
+  const absolute = new URL(url, before).href;
+  if (absolute === before) return before;
+
+  // Next.js pages + app router expose window.next.router with a `push`
+  // method that triggers the RSC fetch and re-render pipeline.
+  const r = typeof window.next === "object" && window.next && window.next.router;
+  if (r && typeof r.push === "function") {
+    try { r.push(url); return location.href; } catch {}
+  }
+
+  history.pushState(null, "", absolute);
+  try { dispatchEvent(new PopStateEvent("popstate", { state: null })); } catch {}
+  try { dispatchEvent(new Event("navigate")); } catch {}
+  return location.href;
+})({{URL}})
+"#;

cli/src/native/react/suspense.rs

@@ -0,0 +1,633 @@
+//! React Suspense boundary introspection: walker data types, classifier, and
+//! human-readable report.
+//!
+//! The classifier labels and recommendations are React-Suspense-general —
+//! they describe what kind of thing is making a boundary suspend (`client-hook`,
+//! `request-api`, `server-fetch`, `cache`, `stream`, `framework`, `unknown`)
+//! and a high-level direction for fixing it. Framework-specific reasoning
+//! (e.g. Next.js PPR push vs goto semantics) is left to the caller.
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+pub type StackFrame = (String, String, i64, i64);
+
+#[derive(Debug, Deserialize, Serialize, Clone)]
+pub struct Boundary {
+    pub id: i64,
+    #[serde(rename = "parentID")]
+    pub parent_id: i64,
+    pub name: Option<String>,
+    #[serde(rename = "isSuspended")]
+    pub is_suspended: bool,
+    pub environments: Vec<String>,
+    #[serde(rename = "suspendedBy")]
+    pub suspended_by: Vec<Suspender>,
+    #[serde(rename = "unknownSuspenders")]
+    pub unknown_suspenders: Option<String>,
+    pub owners: Vec<Owner>,
+    #[serde(rename = "jsxSource")]
+    pub jsx_source: Option<(String, i64, i64)>,
+}
+
+#[derive(Debug, Deserialize, Serialize, Clone)]
+pub struct Owner {
+    pub name: String,
+    pub env: Option<String>,
+    pub source: Option<(String, i64, i64)>,
+}
+
+#[derive(Debug, Deserialize, Serialize, Clone)]
+pub struct Suspender {
+    pub name: String,
+    pub description: String,
+    pub duration: i64,
+    pub env: Option<String>,
+    #[serde(rename = "ownerName")]
+    pub owner_name: Option<String>,
+    #[serde(rename = "ownerStack")]
+    pub owner_stack: Option<Vec<StackFrame>>,
+    #[serde(rename = "awaiterName")]
+    pub awaiter_name: Option<String>,
+    #[serde(rename = "awaiterStack")]
+    pub awaiter_stack: Option<Vec<StackFrame>>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BlockerKind {
+    ClientHook,
+    RequestApi,
+    ServerFetch,
+    Stream,
+    Cache,
+    Framework,
+    Unknown,
+}
+
+impl BlockerKind {
+    fn label(self) -> &'static str {
+        match self {
+            Self::ClientHook => "client-hook",
+            Self::RequestApi => "request-api",
+            Self::ServerFetch => "server-fetch",
+            Self::Stream => "stream",
+            Self::Cache => "cache",
+            Self::Framework => "framework",
+            Self::Unknown => "unknown",
+        }
+    }
+
+    fn weight(self) -> i32 {
+        match self {
+            Self::ClientHook => 7,
+            Self::RequestApi => 6,
+            Self::ServerFetch => 5,
+            Self::Cache => 4,
+            Self::Stream => 3,
+            Self::Unknown => 2,
+            Self::Framework => 1,
+        }
+    }
+
+    fn actionability(self) -> i32 {
+        match self {
+            Self::ClientHook => 90,
+            Self::RequestApi => 88,
+            Self::ServerFetch => 82,
+            Self::Cache => 74,
+            Self::Stream => 60,
+            Self::Unknown => 35,
+            Self::Framework => 18,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BoundaryKind {
+    RouteSegment,
+    ExplicitSuspense,
+    Component,
+}
+
+impl BoundaryKind {
+    fn label(self) -> &'static str {
+        match self {
+            Self::RouteSegment => "route-segment",
+            Self::ExplicitSuspense => "explicit-suspense",
+            Self::Component => "component",
+        }
+    }
+
+    fn weight(self) -> i32 {
+        match self {
+            Self::RouteSegment => 3,
+            Self::ExplicitSuspense => 2,
+            Self::Component => 1,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct ActionableBlocker {
+    pub key: String,
+    pub name: String,
+    pub kind: BlockerKind,
+    pub env: Option<String>,
+    pub description: String,
+    pub owner_name: Option<String>,
+    pub awaiter_name: Option<String>,
+    pub source_frame: Option<StackFrame>,
+    pub owner_frame: Option<StackFrame>,
+    pub awaiter_frame: Option<StackFrame>,
+    pub actionability: i32,
+    pub suggestion: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct BoundaryInsight {
+    pub id: i64,
+    pub name: Option<String>,
+    pub boundary_kind: BoundaryKind,
+    pub environments: Vec<String>,
+    pub source: Option<(String, i64, i64)>,
+    pub rendered_by: Vec<Owner>,
+    pub primary_blocker: Option<ActionableBlocker>,
+    pub blockers: Vec<ActionableBlocker>,
+    pub unknown_suspenders: Option<String>,
+    pub actionability: i32,
+    pub recommendation: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct RootCauseGroup {
+    pub kind: BlockerKind,
+    pub name: String,
+    pub source_frame: Option<StackFrame>,
+    pub boundary_names: Vec<String>,
+    pub count: usize,
+    pub actionability: i32,
+    pub suggestion: String,
+}
+
+pub struct AnalysisReport {
+    pub total_boundaries: usize,
+    pub dynamic_hole_count: usize,
+    pub static_count: usize,
+    pub holes: Vec<BoundaryInsight>,
+    pub statics: Vec<StaticBoundarySummary>,
+    pub root_causes: Vec<RootCauseGroup>,
+    pub files_to_read: Vec<String>,
+}
+
+#[derive(Debug, Clone)]
+pub struct StaticBoundarySummary {
+    pub name: Option<String>,
+    pub source: Option<(String, i64, i64)>,
+    pub rendered_by: Vec<Owner>,
+}
+
+pub fn format_suspense_report(boundaries: &[Boundary], only_dynamic: bool) -> String {
+    let report = analyze_boundaries(boundaries);
+    format_report(&report, only_dynamic)
+}
+
+fn analyze_boundaries(boundaries: &[Boundary]) -> AnalysisReport {
+    let mut holes: Vec<&Boundary> = Vec::new();
+    let mut statics_raw: Vec<&Boundary> = Vec::new();
+
+    for b in boundaries {
+        if b.parent_id == 0 {
+            continue;
+        }
+        let has_blocker = !b.suspended_by.is_empty() || b.unknown_suspenders.is_some();
+        if b.is_suspended || has_blocker {
+            holes.push(b);
+        } else {
+            statics_raw.push(b);
+        }
+    }
+
+    let mut hole_insights: Vec<BoundaryInsight> = holes.iter().map(|b| build_insight(b)).collect();
+    hole_insights.sort_by(|a, b| {
+        b.actionability.cmp(&a.actionability).then_with(|| {
+            b.boundary_kind
+                .weight()
+                .cmp(&a.boundary_kind.weight())
+                .then_with(|| b.blockers.len().cmp(&a.blockers.len()))
+                .then_with(|| {
+                    a.name
+                        .as_deref()
+                        .unwrap_or("")
+                        .cmp(b.name.as_deref().unwrap_or(""))
+                })
+        })
+    });
+
+    let static_summaries: Vec<StaticBoundarySummary> = statics_raw
+        .iter()
+        .map(|b| StaticBoundarySummary {
+            name: b.name.clone(),
+            source: b.jsx_source.clone(),
+            rendered_by: b.owners.clone(),
+        })
+        .collect();
+
+    let root_causes = build_root_causes(&hole_insights);
+    let files_to_read = collect_files_to_read(&hole_insights, &root_causes);
+
+    AnalysisReport {
+        total_boundaries: hole_insights.len() + static_summaries.len(),
+        dynamic_hole_count: hole_insights.len(),
+        static_count: static_summaries.len(),
+        holes: hole_insights,
+        statics: static_summaries,
+        root_causes,
+        files_to_read,
+    }
+}
+
+fn build_insight(b: &Boundary) -> BoundaryInsight {
+    let boundary_kind = infer_boundary_kind(b);
+    let mut blockers: Vec<ActionableBlocker> = b
+        .suspended_by
+        .iter()
+        .map(build_actionable_blocker)
+        .collect();
+    blockers.sort_by(|a, b| {
+        b.actionability.cmp(&a.actionability).then_with(|| {
+            b.kind
+                .weight()
+                .cmp(&a.kind.weight())
+                .then_with(|| a.name.cmp(&b.name))
+        })
+    });
+    let primary = blockers.first().cloned();
+    let recommendation = recommend_fix(
+        boundary_kind,
+        primary.as_ref(),
+        b.unknown_suspenders.as_deref(),
+    );
+    let primary_action = primary.as_ref().map(|p| p.actionability).unwrap_or(0);
+    let base_action = if boundary_kind == BoundaryKind::RouteSegment {
+        55
+    } else {
+        0
+    };
+
+    BoundaryInsight {
+        id: b.id,
+        name: b.name.clone(),
+        boundary_kind,
+        environments: b.environments.clone(),
+        source: b.jsx_source.clone(),
+        rendered_by: b.owners.clone(),
+        primary_blocker: primary,
+        blockers,
+        unknown_suspenders: b.unknown_suspenders.clone(),
+        actionability: primary_action.max(base_action),
+        recommendation,
+    }
+}
+
+fn build_actionable_blocker(s: &Suspender) -> ActionableBlocker {
+    let owner_frame = pick_preferred_frame(s.owner_stack.as_deref());
+    let awaiter_frame = pick_preferred_frame(s.awaiter_stack.as_deref());
+    let source_frame = owner_frame.clone().or_else(|| awaiter_frame.clone());
+    let kind = classify_blocker(s, source_frame.as_ref());
+    let suggestion = suggest_blocker_fix(kind);
+    let mut actionability = kind.actionability();
+    if let Some(ref frame) = source_frame {
+        if !is_frameworkish_path(&frame.1) {
+            actionability += 8;
+        }
+    }
+    if s.owner_name.is_some() || s.awaiter_name.is_some() {
+        actionability += 4;
+    }
+    if actionability > 100 {
+        actionability = 100;
+    }
+    let key = build_blocker_key(&s.name, kind, source_frame.as_ref());
+
+    ActionableBlocker {
+        key,
+        name: s.name.clone(),
+        kind,
+        env: s.env.clone(),
+        description: s.description.clone(),
+        owner_name: s.owner_name.clone(),
+        awaiter_name: s.awaiter_name.clone(),
+        source_frame,
+        owner_frame,
+        awaiter_frame,
+        actionability,
+        suggestion,
+    }
+}
+
+fn infer_boundary_kind(b: &Boundary) -> BoundaryKind {
+    let owner_names: Vec<&str> = b.owners.iter().map(|o| o.name.as_str()).collect();
+    let name_ends_slash = b.name.as_ref().is_some_and(|n| n.ends_with('/'));
+    if name_ends_slash
+        || owner_names.contains(&"LoadingBoundary")
+        || owner_names.contains(&"OuterLayoutRouter")
+    {
+        return BoundaryKind::RouteSegment;
+    }
+    let name_has_suspense = b.name.as_ref().is_some_and(|n| n.contains("Suspense"));
+    if name_has_suspense || owner_names.iter().any(|n| n.contains("Suspense")) {
+        return BoundaryKind::ExplicitSuspense;
+    }
+    BoundaryKind::Component
+}
+
+fn classify_blocker(s: &Suspender, source_frame: Option<&StackFrame>) -> BlockerKind {
+    let name = s.name.to_lowercase();
+    match name.as_str() {
+        "usepathname"
+        | "useparams"
+        | "usesearchparams"
+        | "useselectedlayoutsegments"
+        | "useselectedlayoutsegment"
+        | "userouter" => return BlockerKind::ClientHook,
+        "cookies" | "headers" | "connection" | "params" | "searchparams" | "draftmode" => {
+            return BlockerKind::RequestApi
+        }
+        _ => {}
+    }
+    if name == "rsc stream" {
+        return BlockerKind::Stream;
+    }
+    if name.contains("fetch") {
+        return BlockerKind::ServerFetch;
+    }
+    if name.contains("cache") || s.description.to_lowercase().contains("cache") {
+        return BlockerKind::Cache;
+    }
+    if name.starts_with("use") {
+        return BlockerKind::ClientHook;
+    }
+    if let Some(frame) = source_frame {
+        if is_frameworkish_path(&frame.1) {
+            return BlockerKind::Framework;
+        }
+    }
+    BlockerKind::Unknown
+}
+
+fn suggest_blocker_fix(kind: BlockerKind) -> String {
+    match kind {
+        BlockerKind::ClientHook => "Move route hooks behind a smaller client Suspense or provide a real non-null loading fallback for this segment.",
+        BlockerKind::RequestApi => "Push request-bound reads to a smaller server leaf, or cache around them so the parent shell can stay static.",
+        BlockerKind::ServerFetch => "Split static shell content from data widgets, then push the fetch into smaller Suspense leaves or cache it.",
+        BlockerKind::Cache => "This looks cache-related; check whether \"use cache\" or runtime prefetch can eliminate the suspension.",
+        BlockerKind::Stream => "A stream is still pending here; extract static siblings outside the boundary and push the stream consumer deeper.",
+        BlockerKind::Framework => "This currently looks framework-driven; find the nearest user-owned caller above it before changing code.",
+        BlockerKind::Unknown => "Inspect the nearest user-owned owner/awaiter frame and verify whether this suspender really belongs at this boundary.",
+    }.to_string()
+}
+
+fn recommend_fix(
+    boundary_kind: BoundaryKind,
+    primary: Option<&ActionableBlocker>,
+    unknown_suspenders: Option<&str>,
+) -> String {
+    if boundary_kind == BoundaryKind::RouteSegment
+        && primary.is_some_and(|p| p.kind == BlockerKind::ClientHook)
+    {
+        return "This route segment is suspending on client hooks. Check loading.tsx first; if it is null or visually empty, fix the fallback before chasing deeper push-down work.".to_string();
+    }
+    if let Some(p) = primary {
+        match p.kind {
+            BlockerKind::ClientHook => {
+                return "Push the hook-using client UI behind a smaller local Suspense boundary so the parent shell can prerender.".to_string();
+            }
+            BlockerKind::RequestApi | BlockerKind::ServerFetch => {
+                return "Push the request-bound async work into a smaller leaf or split static siblings out of this boundary.".to_string();
+            }
+            BlockerKind::Cache => {
+                return "Check whether caching or runtime prefetch can move this personalized content into the shell.".to_string();
+            }
+            BlockerKind::Stream => {
+                return "Keep the stream behind Suspense, but extract any static shell content outside the boundary.".to_string();
+            }
+            BlockerKind::Framework => {
+                return "The top blocker still looks framework-heavy. Find the nearest user-owned caller before changing boundary placement.".to_string();
+            }
+            _ => {}
+        }
+    }
+    if let Some(reason) = unknown_suspenders {
+        return format!(
+            "React could not identify the suspender ({}). Investigate the nearest user-owned owner or awaiter frame.",
+            reason
+        );
+    }
+    "No primary blocker was identified. Inspect the boundary source and owner chain directly."
+        .to_string()
+}
+
+fn pick_preferred_frame(stack: Option<&[StackFrame]>) -> Option<StackFrame> {
+    let s = stack?;
+    if s.is_empty() {
+        return None;
+    }
+    s.iter()
+        .find(|f| !is_frameworkish_path(&f.1))
+        .cloned()
+        .or_else(|| s.first().cloned())
+}
+
+fn is_frameworkish_path(file: &str) -> bool {
+    file.contains("/node_modules/")
+}
+
+fn build_blocker_key(name: &str, kind: BlockerKind, source_frame: Option<&StackFrame>) -> String {
+    match source_frame {
+        None => format!("{}:{}:unknown", kind.label(), name),
+        Some(f) => format!("{}:{}:{}:{}", kind.label(), name, f.1, f.2),
+    }
+}
+
+fn build_root_causes(holes: &[BoundaryInsight]) -> Vec<RootCauseGroup> {
+    let mut groups: HashMap<String, RootCauseGroup> = HashMap::new();
+    for hole in holes {
+        let Some(blocker) = &hole.primary_blocker else {
+            continue;
+        };
+        let display_name = hole
+            .name
+            .clone()
+            .unwrap_or_else(|| format!("boundary-{}", hole.id));
+        groups
+            .entry(blocker.key.clone())
+            .and_modify(|existing| {
+                existing.boundary_names.push(display_name.clone());
+                existing.count += 1;
+                if blocker.actionability > existing.actionability {
+                    existing.actionability = blocker.actionability;
+                }
+            })
+            .or_insert_with(|| RootCauseGroup {
+                kind: blocker.kind,
+                name: blocker.name.clone(),
+                source_frame: blocker.source_frame.clone(),
+                boundary_names: vec![display_name],
+                count: 1,
+                actionability: blocker.actionability,
+                suggestion: blocker.suggestion.clone(),
+            });
+    }
+    let mut out: Vec<RootCauseGroup> = groups.into_values().collect();
+    out.sort_by(|a, b| {
+        let score_a = (a.count as i32) * a.actionability;
+        let score_b = (b.count as i32) * b.actionability;
+        score_b.cmp(&score_a).then_with(|| a.name.cmp(&b.name))
+    });
+    out
+}
+
+fn collect_files_to_read(holes: &[BoundaryInsight], root_causes: &[RootCauseGroup]) -> Vec<String> {
+    let mut counts: HashMap<String, i32> = HashMap::new();
+    let mut add = |f: Option<&str>| {
+        if let Some(path) = f {
+            if !path.is_empty() {
+                *counts.entry(path.to_string()).or_insert(0) += 1;
+            }
+        }
+    };
+    for hole in holes {
+        add(hole.source.as_ref().map(|s| s.0.as_str()));
+        if let Some(pb) = &hole.primary_blocker {
+            add(pb.source_frame.as_ref().map(|f| f.1.as_str()));
+        }
+        for owner in &hole.rendered_by {
+            add(owner.source.as_ref().map(|s| s.0.as_str()));
+        }
+    }
+    for cause in root_causes {
+        add(cause.source_frame.as_ref().map(|f| f.1.as_str()));
+    }
+
+    let mut entries: Vec<(String, i32)> = counts.into_iter().collect();
+    entries.sort_by(|a, b| b.1.cmp(&a.1).then_with(|| a.0.cmp(&b.0)));
+    entries.into_iter().take(12).map(|(f, _)| f).collect()
+}
+
+fn escape_cell(s: &str) -> String {
+    s.replace('|', "\\|")
+}
+
+fn format_report(report: &AnalysisReport, only_dynamic: bool) -> String {
+    let mut lines: Vec<String> = Vec::new();
+    lines.push("# Suspense Boundary Analysis".to_string());
+    if only_dynamic {
+        lines.push(format!(
+            "# {} dynamic holes (static boundaries hidden; pass without --only-dynamic to see them)",
+            report.dynamic_hole_count
+        ));
+    } else {
+        lines.push(format!(
+            "# {} boundaries: {} dynamic holes, {} static",
+            report.total_boundaries, report.dynamic_hole_count, report.static_count
+        ));
+    }
+    lines.push(String::new());
+
+    if !report.holes.is_empty() {
+        lines.push("## Summary".to_string());
+        if let Some(top) = report.holes.first() {
+            if let Some(blocker) = &top.primary_blocker {
+                lines.push(format!(
+                    "- Top actionable hole: {} - {} ({})",
+                    top.name.clone().unwrap_or_else(|| "(unnamed)".into()),
+                    blocker.name,
+                    blocker.kind.label()
+                ));
+                lines.push(format!("- Suggested next step: {}", top.recommendation));
+            }
+        }
+        if let Some(root) = report.root_causes.first() {
+            lines.push(format!(
+                "- Most common root cause: {} ({}) affecting {} boundar{}",
+                root.name,
+                root.kind.label(),
+                root.count,
+                if root.count == 1 { "y" } else { "ies" }
+            ));
+        }
+        lines.push(String::new());
+
+        lines.push("## Quick Reference".to_string());
+        lines.push(
+            "| Boundary | Type | Primary blocker | Source | Suggested next step |".to_string(),
+        );
+        lines.push("| --- | --- | --- | --- | --- |".to_string());
+        for hole in &report.holes {
+            let blocker = &hole.primary_blocker;
+            let source = match blocker.as_ref().and_then(|b| b.source_frame.as_ref()) {
+                Some(f) => format!("{}:{}", f.1, f.2),
+                None => match &hole.source {
+                    Some((f, l, _)) => format!("{}:{}", f, l),
+                    None => "unknown".to_string(),
+                },
+            };
+            let blocker_text = match blocker {
+                Some(b) => format!("{} ({})", b.name, b.kind.label()),
+                None => "unknown".to_string(),
+            };
+            lines.push(format!(
+                "| {} | {} | {} | {} | {} |",
+                escape_cell(hole.name.as_deref().unwrap_or("(unnamed)")),
+                hole.boundary_kind.label(),
+                escape_cell(&blocker_text),
+                escape_cell(&source),
+                escape_cell(&hole.recommendation),
+            ));
+        }
+        lines.push(String::new());
+
+        if !report.files_to_read.is_empty() {
+            lines.push("## Files to Read".to_string());
+            for file in &report.files_to_read {
+                lines.push(format!("- {}", file));
+            }
+            lines.push(String::new());
+        }
+
+        if !report.root_causes.is_empty() {
+            lines.push("## Root Causes".to_string());
+            for cause in &report.root_causes {
+                let source = match &cause.source_frame {
+                    Some(f) => format!("{}:{}", f.1, f.2),
+                    None => "unknown".to_string(),
+                };
+                lines.push(format!(
+                    "- {} ({}) at {} - affects {} boundar{}",
+                    cause.name,
+                    cause.kind.label(),
+                    source,
+                    cause.count,
+                    if cause.count == 1 { "y" } else { "ies" }
+                ));
+                lines.push(format!("  next step: {}", cause.suggestion));
+                lines.push(format!("  boundaries: {}", cause.boundary_names.join(", ")));
+            }
+            lines.push(String::new());
+        }
+    }
+
+    if !only_dynamic && !report.statics.is_empty() {
+        lines.push("## Static (not suspended)".to_string());
+        for b in &report.statics {
+            let name = b.name.clone().unwrap_or_else(|| "(unnamed)".into());
+            let src = match &b.source {
+                Some(s) => format!(" at {}:{}:{}", s.0, s.1, s.2),
+                None => String::new(),
+            };
+            lines.push(format!("  {}{}", name, src));
+        }
+    }
+
+    lines.join("\n")
+}

cli/src/native/react/tree.rs

@@ -0,0 +1,67 @@
+//! React component tree snapshot and formatter.
+
+use serde::Deserialize;
+
+#[derive(Debug, Deserialize)]
+pub struct TreeNode {
+    pub id: i64,
+    #[serde(rename = "type")]
+    pub node_type: i64,
+    pub name: Option<String>,
+    pub key: Option<String>,
+    pub parent: i64,
+}
+
+const HEADER: &str = "# React component tree\n# Columns: depth id parent name [key=...]\n# Use `react inspect <id>` for props/hooks/state. IDs valid until next navigation.";
+
+pub fn format_tree(nodes: &[TreeNode]) -> String {
+    use std::collections::HashMap;
+    let mut children: HashMap<i64, Vec<&TreeNode>> = HashMap::new();
+    for n in nodes {
+        children.entry(n.parent).or_default().push(n);
+    }
+
+    let mut lines: Vec<String> = vec![HEADER.to_string()];
+    if let Some(roots) = children.get(&0) {
+        for root in roots {
+            walk(root, 0, &children, &mut lines);
+        }
+    }
+    lines.join("\n")
+}
+
+fn walk<'a>(
+    node: &'a TreeNode,
+    depth: usize,
+    children: &std::collections::HashMap<i64, Vec<&'a TreeNode>>,
+    lines: &mut Vec<String>,
+) {
+    let name = node
+        .name
+        .clone()
+        .unwrap_or_else(|| type_name(node.node_type));
+    let key = match &node.key {
+        Some(k) => format!(" key={:?}", k),
+        None => String::new(),
+    };
+    let parent = if node.parent == 0 {
+        "-".to_string()
+    } else {
+        node.parent.to_string()
+    };
+    lines.push(format!("{} {} {} {}{}", depth, node.id, parent, name, key));
+    if let Some(cs) = children.get(&node.id) {
+        for c in cs {
+            walk(c, depth + 1, children, lines);
+        }
+    }
+}
+
+fn type_name(t: i64) -> String {
+    match t {
+        11 => "Root".to_string(),
+        12 => "Suspense".to_string(),
+        13 => "SuspenseList".to_string(),
+        _ => format!("({})", t),
+    }
+}

cli/src/native/react/vitals.rs

@@ -0,0 +1,160 @@
+//! Core Web Vitals + React hydration timing report.
+//!
+//! Universal web-standard metrics (LCP/CLS/TTFB/FCP/INP) via PerformanceObserver
+//! and Navigation Timing. When the React profiling build is detected (via
+//! `console.timeStamp` entries), also reports hydration phases and per-component
+//! hydration timing.
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct VitalsData {
+    pub url: String,
+    pub ttfb: Option<f64>,
+    pub lcp: Option<Lcp>,
+    pub cls: Cls,
+    pub fcp: Option<f64>,
+    pub inp: Option<f64>,
+    pub hydration: Option<HydrationRange>,
+    pub phases: Vec<Phase>,
+    #[serde(rename = "hydratedComponents")]
+    pub hydrated_components: Vec<HydratedComponent>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct Lcp {
+    #[serde(rename = "startTime")]
+    pub start_time: f64,
+    pub size: Option<i64>,
+    pub element: Option<String>,
+    pub url: Option<String>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct Cls {
+    pub score: f64,
+    pub entries: Vec<ClsEntry>,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct ClsEntry {
+    pub value: f64,
+    #[serde(rename = "startTime")]
+    pub start_time: f64,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct HydrationRange {
+    #[serde(rename = "startTime")]
+    pub start_time: f64,
+    #[serde(rename = "endTime")]
+    pub end_time: f64,
+    pub duration: f64,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct Phase {
+    pub label: String,
+    #[serde(rename = "startTime")]
+    pub start_time: f64,
+    #[serde(rename = "endTime")]
+    pub end_time: f64,
+    pub duration: f64,
+}
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct HydratedComponent {
+    pub name: String,
+    #[serde(rename = "startTime")]
+    pub start_time: f64,
+    #[serde(rename = "endTime")]
+    pub end_time: f64,
+    pub duration: f64,
+}
+
+pub fn format_vitals_report(d: &VitalsData) -> String {
+    let mut lines: Vec<String> = Vec::new();
+    lines.push(format!("# Page Load Profile - {}", d.url));
+    lines.push(String::new());
+    lines.push("## Core Web Vitals".to_string());
+
+    let ttfb_str = match d.ttfb {
+        Some(t) => format!("{}ms", t),
+        None => "-".to_string(),
+    };
+    lines.push(format!("  TTFB {:>10}", ttfb_str));
+
+    match &d.lcp {
+        Some(lcp) => {
+            let label = match (&lcp.element, &lcp.url) {
+                (Some(el), Some(url)) => {
+                    let url_trunc: String = url.chars().take(60).collect();
+                    format!(" ({}: {})", el, url_trunc)
+                }
+                (Some(el), None) => format!(" ({})", el),
+                _ => String::new(),
+            };
+            lines.push(format!(
+                "  LCP {:>10}{}",
+                format!("{}ms", lcp.start_time),
+                label
+            ));
+        }
+        None => lines.push("  LCP        -".to_string()),
+    }
+
+    lines.push(format!("  CLS {:>10}", d.cls.score));
+
+    if let Some(fcp) = d.fcp {
+        lines.push(format!("  FCP {:>10}", format!("{}ms", fcp)));
+    }
+    if let Some(inp) = d.inp {
+        lines.push(format!("  INP {:>10}", format!("{}ms", inp)));
+    }
+
+    lines.push(String::new());
+    match &d.hydration {
+        Some(h) => lines.push(format!(
+            "## React Hydration - {}ms ({}ms -> {}ms)",
+            h.duration, h.start_time, h.end_time
+        )),
+        None => {
+            lines.push("## React Hydration - no data (requires React profiling build)".to_string())
+        }
+    }
+
+    if !d.phases.is_empty() {
+        for p in &d.phases {
+            lines.push(format!(
+                "  {:<28} {:>10} ({} -> {})",
+                p.label,
+                format!("{}ms", p.duration),
+                p.start_time,
+                p.end_time
+            ));
+        }
+        lines.push(String::new());
+    }
+
+    if !d.hydrated_components.is_empty() {
+        lines.push(format!(
+            "## Hydrated components ({} total, sorted by duration)",
+            d.hydrated_components.len()
+        ));
+        for c in d.hydrated_components.iter().take(30) {
+            lines.push(format!(
+                "  {:<40} {:>10}",
+                c.name,
+                format!("{}ms", c.duration)
+            ));
+        }
+        if d.hydrated_components.len() > 30 {
+            lines.push(format!(
+                "  ... and {} more",
+                d.hydrated_components.len() - 30
+            ));
+        }
+    }
+
+    lines.join("\n")
+}

cli/src/native/recording.rs

@@ -1,12 +1,24 @@
 use serde_json::{json, Value};
-use std::path::PathBuf;
-use std::process::Command;
+use std::process::Stdio;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
+use tokio::io::AsyncWriteExt;
+use tokio::sync::oneshot;
+
+use super::cdp::client::CdpClient;
+use super::cdp::types::{CaptureScreenshotParams, CaptureScreenshotResult};
+
+const CAPTURE_INTERVAL_MS: u64 = 100;
+const CAPTURE_FPS: u32 = 10;
 
 pub struct RecordingState {
     pub active: bool,
     pub output_path: String,
-    pub temp_dir: PathBuf,
     pub frame_count: u64,
+    pub capture_task: Option<tokio::task::JoinHandle<Result<(), String>>>,
+    pub shared_frame_count: Option<Arc<AtomicU64>>,
+    pub cancel_tx: Option<oneshot::Sender<()>>,
 }
 
 impl RecordingState {
@@ -14,8 +26,10 @@ impl RecordingState {
         Self {
             active: false,
             output_path: String::new(),
-            temp_dir: PathBuf::new(),
             frame_count: 0,
+            capture_task: None,
+            shared_frame_count: None,
+            cancel_tx: None,
         }
     }
 }
@@ -25,34 +39,13 @@ pub fn recording_start(state: &mut RecordingState, path: &str) -> Result<Value,
         return Err("Recording already active".to_string());
     }
 
-    let timestamp = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .unwrap_or_default()
-        .as_millis();
-
-    let temp_dir = std::env::temp_dir().join(format!("agent-browser-recording-{}", timestamp));
-    let _ = std::fs::create_dir_all(&temp_dir);
-
     state.active = true;
     state.output_path = path.to_string();
-    state.temp_dir = temp_dir;
     state.frame_count = 0;
 
     Ok(json!({ "started": true, "path": path }))
 }
 
-pub fn recording_add_frame(state: &mut RecordingState, frame_data: &[u8]) {
-    if !state.active {
-        return;
-    }
-
-    let frame_path = state
-        .temp_dir
-        .join(format!("frame_{:06}.jpg", state.frame_count));
-    let _ = std::fs::write(&frame_path, frame_data);
-    state.frame_count += 1;
-}
-
 pub fn recording_stop(state: &mut RecordingState) -> Result<Value, String> {
     if !state.active {
         return Err("No recording in progress".to_string());
@@ -61,55 +54,183 @@ pub fn recording_stop(state: &mut RecordingState) -> Result<Value, String> {
     state.active = false;
 
     if state.frame_count == 0 {
-        let _ = std::fs::remove_dir_all(&state.temp_dir);
         return Err("No frames captured".to_string());
     }
 
-    let frame_pattern = state
-        .temp_dir
-        .join("frame_%06d.jpg")
-        .to_string_lossy()
-        .to_string();
+    Ok(json!({ "path": &state.output_path, "frames": state.frame_count }))
+}
 
-    let output = &state.output_path;
+pub fn recording_restart(state: &mut RecordingState, path: &str) -> Result<Value, String> {
+    let previous = if state.active {
+        let stop_result = recording_stop(state);
+        stop_result
+            .ok()
+            .and_then(|v| v.get("path").and_then(|p| p.as_str()).map(String::from))
+    } else {
+        None
+    };
 
-    // Encode with ffmpeg
-    let result = Command::new("ffmpeg")
+    recording_start(state, path)?;
+
+    Ok(json!({
+        "restarted": true,
+        "previousPath": previous,
+        "path": path,
+    }))
+}
+
+fn build_ffmpeg_command(output_path: &str) -> tokio::process::Command {
+    let mut cmd = tokio::process::Command::new("ffmpeg");
+
+    cmd.args(["-y"])
+        .args(["-avioflags", "direct"])
         .args([
-            "-y",
-            "-framerate",
-            "30",
-            "-i",
-            &frame_pattern,
-            "-c:v",
-            "libx264",
-            "-pix_fmt",
-            "yuv420p",
-            "-preset",
-            "fast",
-            output,
+            "-fpsprobesize",
+            "0",
+            "-probesize",
+            "32",
+            "-analyzeduration",
+            "0",
         ])
-        .output();
+        .args([
+            "-f",
+            "image2pipe",
+            "-c:v",
+            "mjpeg",
+            "-framerate",
+            &CAPTURE_FPS.to_string(),
+            "-i",
+            "pipe:0",
+        ])
+        .args(["-vf", "pad=ceil(iw/2)*2:ceil(ih/2)*2"]);
 
-    let _ = std::fs::remove_dir_all(&state.temp_dir);
-
-    match result {
-        Ok(output_result) => {
-            if output_result.status.success() {
-                Ok(json!({ "path": output, "frames": state.frame_count }))
-            } else {
-                let stderr = String::from_utf8_lossy(&output_result.stderr);
-                Err(format!(
-                    "ffmpeg failed: {}",
-                    stderr.chars().take(200).collect::<String>()
-                ))
-            }
-        }
-        Err(e) => Err(format!(
-            "ffmpeg not found or failed to execute: {}. Install ffmpeg to enable recording.",
-            e
-        )),
+    if output_path.ends_with(".webm") {
+        cmd.args(["-c:v", "libvpx", "-crf", "30", "-b:v", "1M"]);
+    } else {
+        cmd.args(["-c:v", "libx264", "-preset", "ultrafast"]);
     }
+
+    cmd.args(["-pix_fmt", "yuv420p", "-threads", "1"])
+        .arg(output_path)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::null())
+        .stderr(Stdio::piped())
+        .kill_on_drop(true);
+
+    cmd
+}
+
+/// Spawn a background task that captures screenshots at a fixed interval
+/// and pipes them to ffmpeg in real-time.
+pub fn spawn_recording_task(
+    client: Arc<CdpClient>,
+    session_id: String,
+    output_path: String,
+    shared_count: Arc<AtomicU64>,
+    cancel_rx: oneshot::Receiver<()>,
+) -> tokio::task::JoinHandle<Result<(), String>> {
+    tokio::spawn(async move {
+        let mut cancel_rx = std::pin::pin!(cancel_rx);
+
+        let mut ffmpeg = build_ffmpeg_command(&output_path).spawn().map_err(|e| {
+            format!(
+                "ffmpeg not found or failed to execute: {}. Install ffmpeg to enable recording.",
+                e
+            )
+        })?;
+
+        let mut stdin = ffmpeg
+            .stdin
+            .take()
+            .ok_or_else(|| "Failed to open ffmpeg stdin".to_string())?;
+
+        let mut interval = tokio::time::interval(Duration::from_millis(CAPTURE_INTERVAL_MS));
+        interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+
+        let params = CaptureScreenshotParams {
+            format: Some("jpeg".to_string()),
+            quality: Some(80),
+            clip: None,
+            from_surface: Some(true),
+            capture_beyond_viewport: None,
+        };
+
+        loop {
+            tokio::select! {
+                _ = &mut cancel_rx => break,
+                _ = interval.tick() => {}
+            }
+
+            let result: Result<CaptureScreenshotResult, _> = client
+                .send_command_typed("Page.captureScreenshot", &params, Some(&session_id))
+                .await;
+
+            let screenshot = match result {
+                Ok(s) => s,
+                Err(e) => {
+                    if e.contains("Target closed") || e.contains("not found") {
+                        break;
+                    }
+                    continue;
+                }
+            };
+
+            let bytes = match base64::Engine::decode(
+                &base64::engine::general_purpose::STANDARD,
+                &screenshot.data,
+            ) {
+                Ok(b) => b,
+                Err(_) => continue,
+            };
+
+            if stdin.write_all(&bytes).await.is_err() {
+                break;
+            }
+            shared_count.fetch_add(1, Ordering::Relaxed);
+        }
+
+        drop(stdin);
+
+        let output = ffmpeg
+            .wait_with_output()
+            .await
+            .map_err(|e| format!("ffmpeg wait failed: {}", e))?;
+
+        if !output.status.success() {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            return Err(format!(
+                "ffmpeg failed: {}",
+                stderr.chars().take(300).collect::<String>()
+            ));
+        }
+
+        Ok(())
+    })
+}
+
+pub async fn stop_recording_task(state: &mut RecordingState) -> Result<(), String> {
+    if let Some(tx) = state.cancel_tx.take() {
+        let _ = tx.send(());
+    }
+
+    let counter = state.shared_frame_count.take();
+    let handle = state.capture_task.take();
+
+    let result = if let Some(h) = handle {
+        match h.await {
+            Ok(Ok(())) => Ok(()),
+            Ok(Err(e)) => Err(e),
+            Err(e) => Err(format!("Recording task panicked: {}", e)),
+        }
+    } else {
+        Ok(())
+    };
+
+    if let Some(c) = counter {
+        state.frame_count = c.load(Ordering::Relaxed);
+    }
+
+    result
 }
 
 #[cfg(test)]
@@ -132,19 +253,15 @@ mod tests {
         assert!(state.active);
         assert_eq!(state.output_path, "/tmp/test.mp4");
         assert_eq!(state.frame_count, 0);
-        // Cleanup
-        let _ = std::fs::remove_dir_all(&state.temp_dir);
     }
 
     #[test]
     fn test_recording_start_while_active() {
         let mut state = RecordingState::new();
         recording_start(&mut state, "/tmp/test1.mp4").unwrap();
-        let temp_dir = state.temp_dir.clone();
         let result = recording_start(&mut state, "/tmp/test2.mp4");
         assert!(result.is_err());
         assert!(result.unwrap_err().contains("already active"));
-        let _ = std::fs::remove_dir_all(&temp_dir);
     }
 
     #[test]
@@ -166,38 +283,41 @@ mod tests {
     }
 
     #[test]
-    fn test_recording_add_frame_inactive() {
+    fn test_recording_restart_while_inactive() {
         let mut state = RecordingState::new();
-        recording_add_frame(&mut state, b"fake-frame");
-        assert_eq!(state.frame_count, 0);
+        let result = recording_restart(&mut state, "/tmp/new.webm");
+        assert!(result.is_ok());
+        assert!(state.active);
+        assert_eq!(state.output_path, "/tmp/new.webm");
     }
 
     #[test]
-    fn test_recording_add_frame_active() {
+    fn test_recording_restart_while_active() {
         let mut state = RecordingState::new();
-        recording_start(&mut state, "/tmp/test.mp4").unwrap();
-        recording_add_frame(&mut state, b"fake-frame-1");
-        recording_add_frame(&mut state, b"fake-frame-2");
-        assert_eq!(state.frame_count, 2);
-        let _ = std::fs::remove_dir_all(&state.temp_dir);
+        recording_start(&mut state, "/tmp/old.webm").unwrap();
+        state.frame_count = 10;
+        let result = recording_restart(&mut state, "/tmp/new.webm").unwrap();
+        assert!(state.active);
+        assert_eq!(state.output_path, "/tmp/new.webm");
+        assert_eq!(state.frame_count, 0);
+        assert_eq!(result["previousPath"], "/tmp/old.webm");
+    }
+
+    #[test]
+    fn test_build_ffmpeg_command_webm() {
+        let cmd = build_ffmpeg_command("/tmp/out.webm");
+        let args: Vec<&std::ffi::OsStr> = cmd.as_std().get_args().collect();
+        let args_str: Vec<&str> = args.iter().filter_map(|a| a.to_str()).collect();
+        assert!(args_str.contains(&"libvpx"));
+        assert!(args_str.contains(&"/tmp/out.webm"));
+    }
+
+    #[test]
+    fn test_build_ffmpeg_command_mp4() {
+        let cmd = build_ffmpeg_command("/tmp/out.mp4");
+        let args: Vec<&std::ffi::OsStr> = cmd.as_std().get_args().collect();
+        let args_str: Vec<&str> = args.iter().filter_map(|a| a.to_str()).collect();
+        assert!(args_str.contains(&"libx264"));
+        assert!(args_str.contains(&"/tmp/out.mp4"));
     }
 }
-
-pub fn recording_restart(state: &mut RecordingState, path: &str) -> Result<Value, String> {
-    let previous = if state.active {
-        let stop_result = recording_stop(state);
-        stop_result
-            .ok()
-            .and_then(|v| v.get("path").and_then(|p| p.as_str()).map(String::from))
-    } else {
-        None
-    };
-
-    recording_start(state, path)?;
-
-    Ok(json!({
-        "restarted": true,
-        "previousPath": previous,
-        "path": path,
-    }))
-}

cli/src/native/relay.rs

@@ -0,0 +1,829 @@
+//! Relay between the `ab-connect` browser extension and the daemon's `CdpClient`.
+//!
+//! The extension speaks a small CDP-over-WebSocket "envelope" protocol (adapted
+//! from openclaw-browser-relay) and drives the user's real tabs via per-tab
+//! `chrome.debugger`. The daemon's `CdpClient`, however, expects a **browser-
+//! level** CDP endpoint (`Target.getTargets` / `Target.attachToTarget` → a
+//! `sessionId`, then per-session commands). This relay bridges the two: it
+//! tracks the targets the extension reports, answers the browser-level
+//! `Target.*` discovery commands LOCALLY, and forwards everything else to the
+//! extension as `forwardCDPCommand`. That keeps `CdpClient` and `browser.rs`
+//! unchanged.
+//!
+//! ## Multiple clients (concurrent agents on one shared browser)
+//!
+//! Several chrome-use daemons (one per `--session`) can connect to the same
+//! relay/Chrome at once. The extension is a single peer, so the relay must
+//! demultiplex: every forwarded command is re-keyed to a relay-global id mapped
+//! back to the originating client, and the extension's reply is routed to **only
+//! that client** (with its original id restored). Command ids from different
+//! clients therefore never collide, and one client never sees another's command
+//! replies. CDP *events* (no id) fan out to all clients, which ignore events for
+//! sessions they didn't attach.
+//!
+//! This module is the pure translation core (no I/O) so the protocol can be
+//! unit-tested; the tokio WebSocket server that drives it lives alongside.
+
+use std::collections::HashMap;
+
+use serde_json::{json, Value};
+
+/// Protocol version advertised in the connect handshake (matches the extension).
+pub const RELAY_PROTOCOL: i64 = 3;
+
+/// Identifies one connected CDP client (chrome-use daemon) for routing.
+pub type ClientId = u64;
+
+/// One target (tab) the extension has attached, as the relay tracks it.
+#[derive(Clone)]
+struct TargetEntry {
+    session_id: String,
+    target_info: Value,
+}
+
+/// Relay translation state: the targets the extension exposes, plus the
+/// in-flight command map used to route extension replies back to the right
+/// client.
+#[derive(Default)]
+pub struct RelayState {
+    /// targetId -> entry
+    targets: HashMap<String, TargetEntry>,
+    /// relay-global command id -> (client that sent it, its original id)
+    pending: HashMap<i64, (ClientId, Value)>,
+    /// monotonic source of relay-global command ids
+    next_global_id: i64,
+    /// Group-scoped isolation (issue #40). A tab group belongs to exactly one
+    /// agent/session; the relay scopes `Target.getTargets` per client to its own
+    /// group so the daemon can safely adopt new tabs (follow-popup, cross-session
+    /// adopt) without ever seeing the user's or another agent's tabs.
+    ///
+    /// clientId -> group name. A client that never announced a group (older
+    /// daemon) is absent here and gets the full, UNSCOPED target list — so this
+    /// is fully backward-compatible.
+    client_groups: HashMap<ClientId, String>,
+    /// targetId -> group name. Created tabs are tagged from `Target.createTarget`'s
+    /// `agentGroup`; an explicitly adopted tab is tagged to the adopter; a pop-up
+    /// inherits its opener's group (needs the extension to report `openerTargetId`).
+    target_group: HashMap<String, String>,
+    /// relay-global id of an in-flight `Target.createTarget` -> the `agentGroup`
+    /// it carried, so the reply's `targetId` can be tagged with that group.
+    pending_create: HashMap<i64, String>,
+}
+
+/// What to do with a raw CDP command received from a `CdpClient`.
+#[derive(Debug, PartialEq)]
+pub enum ClientRoute {
+    /// Answer locally; the value is a raw CDP response `{id, result}` to send
+    /// back to the originating client only.
+    Local(Value),
+    /// Forward to the extension; the value is a `forwardCDPCommand` envelope
+    /// already re-keyed to a relay-global id.
+    Forward(Value),
+}
+
+/// An output the relay emits while handling an extension message.
+#[derive(Debug, PartialEq)]
+pub enum RelayOut {
+    /// Send this raw CDP message to clients. `to = Some(id)` targets one client
+    /// (a command reply); `to = None` broadcasts (a CDP event).
+    ToClient { to: Option<ClientId>, msg: Value },
+    /// Send this envelope message back to the extension.
+    ToExt(Value),
+}
+
+impl RelayState {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// The challenge the relay sends to the extension as soon as it connects,
+    /// kicking off the connect handshake.
+    pub fn connect_challenge(nonce: &str) -> Value {
+        json!({ "type": "event", "event": "connect.challenge", "payload": { "nonce": nonce } })
+    }
+
+    /// A keepalive ping for the extension.
+    pub fn ping() -> Value {
+        json!({ "method": "ping" })
+    }
+
+    /// Forget a disconnected client's in-flight commands so its orphaned
+    /// `pending` entries don't leak.
+    pub fn drop_client(&mut self, client_id: ClientId) {
+        self.pending.retain(|_, (cid, _)| *cid != client_id);
+        self.client_groups.remove(&client_id);
+    }
+
+    /// Route a raw CDP command `{id, method, params?, sessionId?}` from a
+    /// `CdpClient`: answer browser-level `Target.*` discovery locally, forward
+    /// the rest to the extension under a relay-global id keyed to `client_id`.
+    pub fn route_client_command(&mut self, client_id: ClientId, raw: &Value) -> ClientRoute {
+        let id = raw.get("id").cloned().unwrap_or(Value::Null);
+        let method = raw.get("method").and_then(|m| m.as_str()).unwrap_or("");
+        let params = raw.get("params").cloned().unwrap_or_else(|| json!({}));
+        let session_id = raw.get("sessionId").and_then(|s| s.as_str());
+
+        match method {
+            // Browser-level command the daemon uses as its liveness probe
+            // (`is_connection_alive` → `Browser.getVersion`). The extension only
+            // speaks per-tab `chrome.debugger`, so forwarding it errors → the
+            // daemon would deem the connection dead and reconnect+re-discover on
+            // EVERY command, resetting the active tab (eval/screenshot drift).
+            // Answer it locally so the relay connection reads as alive.
+            "Browser.getVersion" => ClientRoute::Local(json!({
+                "id": id,
+                "result": {
+                    "protocolVersion": "1.3",
+                    "product": "Chrome/ab-connect-relay",
+                    "revision": "",
+                    "userAgent": "",
+                    "jsVersion": ""
+                }
+            })),
+            // Non-CDP control message: a daemon announces which tab group
+            // (session) it owns, so getTargets can be scoped to it (issue #40).
+            "ABRelay.setGroup" => {
+                if let Some(g) = params.get("group").and_then(|g| g.as_str()) {
+                    if !g.is_empty() {
+                        self.client_groups.insert(client_id, g.to_string());
+                    }
+                }
+                ClientRoute::Local(json!({ "id": id, "result": {} }))
+            }
+            // Discovery is best-effort and event-driven in real CDP; abs only
+            // reads the getTargets result, so an empty ack is enough here.
+            "Target.setDiscoverTargets" | "Target.setAutoAttach" => {
+                ClientRoute::Local(json!({ "id": id, "result": {} }))
+            }
+            // Unscoped discovery for EXPLICIT cross-group adoption (`chrome-use
+            // adopt`): returns every target the extension has attached, ignoring
+            // group scoping, so an agent can find a specific pre-existing tab (the
+            // user's, another session's) by URL/targetId and adopt it. Isolation
+            // is preserved because the daemon only acts on the one tab it then
+            // attaches (which the relay re-tags into the adopter's group).
+            "ABRelay.getAllTargets" => {
+                let infos: Vec<Value> = self
+                    .targets
+                    .values()
+                    .map(|t| t.target_info.clone())
+                    .collect();
+                ClientRoute::Local(json!({ "id": id, "result": { "targetInfos": infos } }))
+            }
+            "Target.getTargets" => {
+                // Scope to the client's own group when it announced one; an
+                // un-announced (legacy) client gets the full list (back-compat).
+                let scoped = self.client_groups.get(&client_id).cloned();
+                let infos: Vec<Value> = self
+                    .targets
+                    .iter()
+                    .filter(|(tid, _)| match &scoped {
+                        Some(g) => self
+                            .target_group
+                            .get(*tid)
+                            .map(|tg| tg == g)
+                            .unwrap_or(false),
+                        None => true,
+                    })
+                    .map(|(_, t)| t.target_info.clone())
+                    .collect();
+                ClientRoute::Local(json!({ "id": id, "result": { "targetInfos": infos } }))
+            }
+            "Target.attachToTarget" => {
+                let target_id = params
+                    .get("targetId")
+                    .and_then(|t| t.as_str())
+                    .unwrap_or("");
+                match self.targets.get(target_id) {
+                    Some(entry) => {
+                        let session_id = entry.session_id.clone();
+                        // Explicitly adopting a target makes it this client's
+                        // (cross-session adopt, #21) — tag it into the adopter's
+                        // group so it stays in that client's scoped getTargets and
+                        // isn't churn-pruned.
+                        if let Some(g) = self.client_groups.get(&client_id).cloned() {
+                            self.target_group.insert(target_id.to_string(), g);
+                        }
+                        ClientRoute::Local(
+                            json!({ "id": id, "result": { "sessionId": session_id } }),
+                        )
+                    }
+                    None => ClientRoute::Local(json!({
+                        "id": id,
+                        "error": { "code": -32602, "message": format!("No such target {target_id}") }
+                    })),
+                }
+            }
+            // Everything else goes to the extension's chrome.debugger. Re-key the
+            // id so this client's reply can be routed back unambiguously.
+            _ => {
+                self.next_global_id += 1;
+                let gid = self.next_global_id;
+                self.pending.insert(gid, (client_id, id));
+                // Remember the group a createTarget carries so the reply's
+                // targetId can be tagged to the creating session (issue #40).
+                if method == "Target.createTarget" {
+                    if let Some(g) = params.get("agentGroup").and_then(|g| g.as_str()) {
+                        if !g.is_empty() {
+                            self.pending_create.insert(gid, g.to_string());
+                            self.client_groups
+                                .entry(client_id)
+                                .or_insert_with(|| g.to_string());
+                        }
+                    }
+                }
+                ClientRoute::Forward(json!({
+                    "id": gid,
+                    "method": "forwardCDPCommand",
+                    "params": { "method": method, "params": params, "sessionId": session_id },
+                }))
+            }
+        }
+    }
+
+    /// Handle one decoded message from the extension. Updates target state and
+    /// returns the messages to emit (routed to a client and/or back to the
+    /// extension). `expected_token` is matched against the connect handshake.
+    pub fn handle_ext_message(&mut self, msg: &Value, expected_token: &str) -> Vec<RelayOut> {
+        // Connect handshake request from the extension.
+        if msg.get("type").and_then(|t| t.as_str()) == Some("req")
+            && msg.get("method").and_then(|m| m.as_str()) == Some("connect")
+        {
+            let id = msg.get("id").cloned().unwrap_or(Value::Null);
+            let token = msg
+                .get("params")
+                .and_then(|p| p.get("auth"))
+                .and_then(|a| a.get("token"))
+                .and_then(|t| t.as_str())
+                .unwrap_or("");
+            let ok = !expected_token.is_empty() && token == expected_token;
+            let mut res = json!({ "type": "res", "id": id, "ok": ok });
+            if !ok {
+                res["error"] = json!({ "message": "invalid relay token" });
+            }
+            return vec![RelayOut::ToExt(res)];
+        }
+
+        // Keepalive.
+        if msg.get("method").and_then(|m| m.as_str()) == Some("pong") {
+            return vec![];
+        }
+
+        // Response to a forwardCDPCommand we sent → route the raw CDP response
+        // back to the client that issued it, with its original id restored.
+        if msg.get("id").is_some()
+            && (msg.get("result").is_some() || msg.get("error").is_some())
+            && msg.get("method").is_none()
+        {
+            let gid = msg.get("id").and_then(|i| i.as_i64());
+            // A createTarget reply: tag the new tab's targetId with the group the
+            // command carried, so it lands in the creating session's scope (#40).
+            if let Some(g) = gid.and_then(|g| self.pending_create.remove(&g)) {
+                if let Some(tid) = msg
+                    .get("result")
+                    .and_then(|r| r.get("targetId"))
+                    .and_then(|t| t.as_str())
+                {
+                    self.target_group.insert(tid.to_string(), g);
+                }
+            }
+            let (to, orig_id) = match gid.and_then(|g| self.pending.remove(&g)) {
+                Some((client_id, orig)) => (Some(client_id), orig),
+                // No mapping (stale/unknown id) — fall back to broadcasting with
+                // whatever id the extension echoed.
+                None => (None, msg.get("id").cloned().unwrap_or(Value::Null)),
+            };
+            let mut out = json!({ "id": orig_id });
+            if let Some(r) = msg.get("result") {
+                out["result"] = r.clone();
+            }
+            if let Some(e) = msg.get("error") {
+                // CdpClient expects an error object; wrap a bare string.
+                out["error"] = match e {
+                    Value::String(s) => json!({ "code": -32000, "message": s }),
+                    other => other.clone(),
+                };
+            }
+            return vec![RelayOut::ToClient { to, msg: out }];
+        }
+
+        // CDP event forwarded from a tab.
+        if msg.get("method").and_then(|m| m.as_str()) == Some("forwardCDPEvent") {
+            let p = msg.get("params").cloned().unwrap_or_else(|| json!({}));
+            let inner_method = p.get("method").and_then(|m| m.as_str()).unwrap_or("");
+            let inner_params = p.get("params").cloned().unwrap_or_else(|| json!({}));
+            let session_id = p.get("sessionId").and_then(|s| s.as_str());
+
+            // Learn/forget targets from the extension's synthesized Target events.
+            // We consume these to maintain state and do NOT forward them: abs
+            // discovers targets by pulling getTargets, and forwarding a second
+            // attachedToTarget would duplicate the one attachToTarget emits.
+            match inner_method {
+                "Target.attachedToTarget" => {
+                    if let Some(info) = inner_params.get("targetInfo") {
+                        if let Some(tid) = info.get("targetId").and_then(|t| t.as_str()) {
+                            let sid = inner_params
+                                .get("sessionId")
+                                .and_then(|s| s.as_str())
+                                .unwrap_or("")
+                                .to_string();
+                            // Attribute the tab to a group for scoping (issue #40),
+                            // unless we already know it (createTarget tag). An
+                            // explicit `abGroup` from the extension wins; otherwise a
+                            // pop-up inherits its opener's group via `openerTargetId`.
+                            if !self.target_group.contains_key(tid) {
+                                if let Some(g) = info
+                                    .get("abGroup")
+                                    .and_then(|g| g.as_str())
+                                    .filter(|g| !g.is_empty())
+                                {
+                                    self.target_group.insert(tid.to_string(), g.to_string());
+                                } else if let Some(opener) = info
+                                    .get("openerTargetId")
+                                    .and_then(|o| o.as_str())
+                                    .filter(|o| !o.is_empty())
+                                {
+                                    if let Some(g) = self.target_group.get(opener).cloned() {
+                                        self.target_group.insert(tid.to_string(), g);
+                                    }
+                                }
+                            }
+                            self.targets.insert(
+                                tid.to_string(),
+                                TargetEntry {
+                                    session_id: sid,
+                                    target_info: info.clone(),
+                                },
+                            );
+                        }
+                    }
+                    return vec![];
+                }
+                "Target.detachedFromTarget" => {
+                    let gone = inner_params.get("sessionId").and_then(|s| s.as_str());
+                    if let Some(gone) = gone {
+                        let gone_tids: Vec<String> = self
+                            .targets
+                            .iter()
+                            .filter(|(_, e)| e.session_id == gone)
+                            .map(|(tid, _)| tid.clone())
+                            .collect();
+                        for tid in gone_tids {
+                            self.target_group.remove(&tid);
+                        }
+                        self.targets.retain(|_, e| e.session_id != gone);
+                    }
+                    return vec![];
+                }
+                _ => {}
+            }
+
+            // Regular CDP event → fan out to all clients (each filters by the
+            // sessions it attached to).
+            let mut ev = json!({ "method": inner_method, "params": inner_params });
+            if let Some(sid) = session_id {
+                ev["sessionId"] = json!(sid);
+            }
+            return vec![RelayOut::ToClient { to: None, msg: ev }];
+        }
+
+        vec![]
+    }
+
+    #[cfg(test)]
+    fn seed_target(&mut self, target_id: &str, session_id: &str) {
+        self.targets.insert(
+            target_id.to_string(),
+            TargetEntry {
+                session_id: session_id.to_string(),
+                target_info: json!({
+                    "targetId": target_id,
+                    "type": "page",
+                    "title": "",
+                    "url": "about:blank",
+                    "attached": true,
+                }),
+            },
+        );
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn attached_event(target_id: &str, session_id: &str) -> Value {
+        json!({
+            "method": "forwardCDPEvent",
+            "params": {
+                "sessionId": session_id,
+                "method": "Target.attachedToTarget",
+                "params": {
+                    "sessionId": session_id,
+                    "targetInfo": { "targetId": target_id, "type": "page", "url": "https://x", "title": "X" }
+                }
+            }
+        })
+    }
+
+    #[test]
+    fn learns_target_from_attached_event_and_does_not_forward_it() {
+        let mut s = RelayState::new();
+        let out = s.handle_ext_message(&attached_event("T1", "cb-tab-1"), "tok");
+        assert!(
+            out.is_empty(),
+            "attachedToTarget should be consumed, not forwarded"
+        );
+        // Now getTargets must report it.
+        let route = s.route_client_command(1, &json!({ "id": 1, "method": "Target.getTargets" }));
+        match route {
+            ClientRoute::Local(v) => {
+                let infos = v["result"]["targetInfos"].as_array().unwrap();
+                assert_eq!(infos.len(), 1);
+                assert_eq!(infos[0]["targetId"], "T1");
+            }
+            _ => panic!("getTargets must be local"),
+        }
+    }
+
+    #[test]
+    fn reattach_with_same_session_restores_target() {
+        // Issue #17 recovery contract. A tab's chrome.debugger session is torn
+        // down (cross-process nav, SW restart, …) then re-attached. The fix has
+        // the extension reuse the SAME `cb-tab-<tabId>` id across that churn, so
+        // after detach+reattach the relay must expose the NEW target under the
+        // SAME session — which is exactly the session the daemon is still bound
+        // to, so its eval/snapshot auto-follow the new page instead of going stale.
+        let mut s = RelayState::new();
+        s.handle_ext_message(&attached_event("T_old", "cb-tab-42"), "tok");
+        s.handle_ext_message(
+            &json!({
+                "method": "forwardCDPEvent",
+                "params": { "method": "Target.detachedFromTarget", "params": { "sessionId": "cb-tab-42" } }
+            }),
+            "tok",
+        );
+        s.handle_ext_message(&attached_event("T_new", "cb-tab-42"), "tok");
+
+        let route = s.route_client_command(1, &json!({ "id": 1, "method": "Target.getTargets" }));
+        match route {
+            ClientRoute::Local(v) => {
+                let infos = v["result"]["targetInfos"].as_array().unwrap();
+                assert_eq!(infos.len(), 1, "only the new target should remain");
+                assert_eq!(infos[0]["targetId"], "T_new");
+            }
+            _ => panic!("getTargets must be local"),
+        }
+        // The daemon's existing session id still resolves — to the new target.
+        let route = s.route_client_command(
+            1,
+            &json!({ "id": 2, "method": "Target.attachToTarget", "params": { "targetId": "T_new" } }),
+        );
+        assert_eq!(
+            route,
+            ClientRoute::Local(json!({ "id": 2, "result": { "sessionId": "cb-tab-42" } }))
+        );
+    }
+
+    #[test]
+    fn browser_get_version_is_answered_locally() {
+        // Liveness probe must NOT be forwarded (the extension can't do
+        // browser-level commands) — else the daemon reconnects on every command.
+        let mut s = RelayState::new();
+        let route = s.route_client_command(1, &json!({ "id": 7, "method": "Browser.getVersion" }));
+        match route {
+            ClientRoute::Local(v) => {
+                assert_eq!(v["id"], 7);
+                assert!(v["result"]["protocolVersion"].is_string());
+            }
+            _ => panic!("Browser.getVersion must be answered locally"),
+        }
+    }
+
+    #[test]
+    fn attach_to_target_returns_known_session() {
+        let mut s = RelayState::new();
+        s.seed_target("T1", "cb-tab-1");
+        let route = s.route_client_command(
+            7,
+            &json!({ "id": 5, "method": "Target.attachToTarget", "params": { "targetId": "T1", "flatten": true } }),
+        );
+        assert_eq!(
+            route,
+            ClientRoute::Local(json!({ "id": 5, "result": { "sessionId": "cb-tab-1" } }))
+        );
+    }
+
+    #[test]
+    fn attach_to_unknown_target_errors_locally() {
+        let mut s = RelayState::new();
+        let route = s.route_client_command(
+            1,
+            &json!({ "id": 6, "method": "Target.attachToTarget", "params": { "targetId": "nope" } }),
+        );
+        match route {
+            ClientRoute::Local(v) => assert!(v.get("error").is_some()),
+            _ => panic!("should answer locally"),
+        }
+    }
+
+    #[test]
+    fn other_commands_forward_under_global_id() {
+        let mut s = RelayState::new();
+        let route = s.route_client_command(
+            42,
+            &json!({ "id": 9, "method": "Page.navigate", "params": { "url": "https://x" }, "sessionId": "cb-tab-1" }),
+        );
+        match route {
+            ClientRoute::Forward(v) => {
+                assert_eq!(v["method"], "forwardCDPCommand");
+                // id is re-keyed to a relay-global id (not the client's 9).
+                assert_eq!(v["id"], 1);
+                assert_eq!(v["params"]["method"], "Page.navigate");
+                assert_eq!(v["params"]["sessionId"], "cb-tab-1");
+                assert_eq!(v["params"]["params"]["url"], "https://x");
+            }
+            _ => panic!("Page.navigate must forward"),
+        }
+    }
+
+    #[test]
+    fn reply_routes_back_to_the_issuing_client_with_original_id() {
+        let mut s = RelayState::new();
+        // Two clients each send a command that happens to share original id 1.
+        let r1 = s.route_client_command(
+            100,
+            &json!({ "id": 1, "method": "Page.navigate", "params": {} }),
+        );
+        let r2 = s.route_client_command(
+            200,
+            &json!({ "id": 1, "method": "Page.reload", "params": {} }),
+        );
+        let g1 = match r1 {
+            ClientRoute::Forward(v) => v["id"].as_i64().unwrap(),
+            _ => panic!(),
+        };
+        let g2 = match r2 {
+            ClientRoute::Forward(v) => v["id"].as_i64().unwrap(),
+            _ => panic!(),
+        };
+        assert_ne!(g1, g2, "global ids must be distinct across clients");
+
+        // Extension replies for g2 → must go to client 200 with original id 1.
+        let out = s.handle_ext_message(&json!({ "id": g2, "result": { "ok": true } }), "tok");
+        assert_eq!(
+            out,
+            vec![RelayOut::ToClient {
+                to: Some(200),
+                msg: json!({ "id": 1, "result": { "ok": true } })
+            }]
+        );
+        // And g1 → client 100.
+        let out = s.handle_ext_message(&json!({ "id": g1, "result": { "ok": false } }), "tok");
+        assert_eq!(
+            out,
+            vec![RelayOut::ToClient {
+                to: Some(100),
+                msg: json!({ "id": 1, "result": { "ok": false } })
+            }]
+        );
+    }
+
+    #[test]
+    fn forward_command_error_is_wrapped_and_routed() {
+        let mut s = RelayState::new();
+        let r = s.route_client_command(
+            5,
+            &json!({ "id": 3, "method": "Page.navigate", "params": {} }),
+        );
+        let gid = match r {
+            ClientRoute::Forward(v) => v["id"].as_i64().unwrap(),
+            _ => panic!(),
+        };
+        let out = s.handle_ext_message(&json!({ "id": gid, "error": "boom" }), "tok");
+        match &out[0] {
+            RelayOut::ToClient { to, msg } => {
+                assert_eq!(*to, Some(5));
+                assert_eq!(msg["id"], 3);
+                assert_eq!(msg["error"]["message"], "boom");
+            }
+            _ => panic!("expected ToClient"),
+        }
+    }
+
+    #[test]
+    fn regular_event_broadcasts_with_session() {
+        let mut s = RelayState::new();
+        let ev = json!({
+            "method": "forwardCDPEvent",
+            "params": { "sessionId": "cb-tab-1", "method": "Page.loadEventFired", "params": { "timestamp": 1.0 } }
+        });
+        let out = s.handle_ext_message(&ev, "tok");
+        assert_eq!(
+            out,
+            vec![RelayOut::ToClient {
+                to: None,
+                msg: json!({
+                    "method": "Page.loadEventFired",
+                    "params": { "timestamp": 1.0 },
+                    "sessionId": "cb-tab-1"
+                })
+            }]
+        );
+    }
+
+    #[test]
+    fn drop_client_clears_its_pending() {
+        let mut s = RelayState::new();
+        let r = s.route_client_command(
+            9,
+            &json!({ "id": 1, "method": "Page.navigate", "params": {} }),
+        );
+        let gid = match r {
+            ClientRoute::Forward(v) => v["id"].as_i64().unwrap(),
+            _ => panic!(),
+        };
+        s.drop_client(9);
+        // Reply now has no mapping → broadcast fallback (to: None), echoed id.
+        let out = s.handle_ext_message(&json!({ "id": gid, "result": {} }), "tok");
+        match &out[0] {
+            RelayOut::ToClient { to, .. } => assert_eq!(*to, None),
+            _ => panic!(),
+        }
+    }
+
+    #[test]
+    fn connect_handshake_validates_token() {
+        let mut s = RelayState::new();
+        let req = json!({ "type": "req", "id": "c1", "method": "connect", "params": { "auth": { "token": "good" } } });
+        let ok = s.handle_ext_message(&req, "good");
+        assert_eq!(
+            ok,
+            vec![RelayOut::ToExt(
+                json!({ "type": "res", "id": "c1", "ok": true })
+            )]
+        );
+
+        let bad = s.handle_ext_message(&req, "different");
+        match &bad[0] {
+            RelayOut::ToExt(v) => {
+                assert_eq!(v["ok"], false);
+                assert!(v.get("error").is_some());
+            }
+            _ => panic!("expected ToExt"),
+        }
+    }
+
+    // === Group-scoped isolation (issue #40) ===
+
+    /// Drive the real create path: announce group, createTarget(agentGroup), feed
+    /// the ext reply (tags target→group) + the attachedToTarget event (creates the
+    /// entry). Returns nothing; mutates `s`.
+    fn create_in_group(s: &mut RelayState, client: ClientId, group: &str, tid: &str, sid: &str) {
+        s.route_client_command(
+            client,
+            &json!({ "id": 1, "method": "ABRelay.setGroup", "params": { "group": group } }),
+        );
+        let route = s.route_client_command(
+            client,
+            &json!({ "id": 2, "method": "Target.createTarget",
+                     "params": { "url": "about:blank", "agentGroup": group } }),
+        );
+        let gid = match route {
+            ClientRoute::Forward(env) => env["id"].as_i64().unwrap(),
+            _ => panic!("createTarget must forward"),
+        };
+        s.handle_ext_message(&json!({ "id": gid, "result": { "targetId": tid } }), "");
+        s.handle_ext_message(
+            &json!({ "method": "forwardCDPEvent", "params": {
+                "method": "Target.attachedToTarget",
+                "params": { "sessionId": sid, "targetInfo": {
+                    "targetId": tid, "type": "page", "url": "about:blank", "attached": true } } } }),
+            "",
+        );
+    }
+
+    fn get_target_ids(s: &mut RelayState, client: ClientId) -> Vec<String> {
+        match s.route_client_command(client, &json!({ "id": 9, "method": "Target.getTargets" })) {
+            ClientRoute::Local(v) => v["result"]["targetInfos"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .map(|t| t["targetId"].as_str().unwrap().to_string())
+                .collect(),
+            _ => panic!("getTargets must be local"),
+        }
+    }
+
+    #[test]
+    fn get_targets_is_scoped_to_each_clients_group() {
+        let mut s = RelayState::new();
+        create_in_group(&mut s, 1, "agent-a", "ta", "sa");
+        create_in_group(&mut s, 2, "agent-b", "tb", "sb");
+        // Each client sees ONLY its own group's tab — never the other agent's.
+        assert_eq!(get_target_ids(&mut s, 1), vec!["ta"]);
+        assert_eq!(get_target_ids(&mut s, 2), vec!["tb"]);
+    }
+
+    #[test]
+    fn legacy_client_without_group_sees_all_targets() {
+        let mut s = RelayState::new();
+        create_in_group(&mut s, 1, "agent-a", "ta", "sa");
+        create_in_group(&mut s, 2, "agent-b", "tb", "sb");
+        // Client 3 never announced a group → full, unscoped list (back-compat).
+        let mut all = get_target_ids(&mut s, 3);
+        all.sort();
+        assert_eq!(all, vec!["ta", "tb"]);
+    }
+
+    #[test]
+    fn popup_inherits_opener_group_and_is_visible_to_that_client_only() {
+        let mut s = RelayState::new();
+        create_in_group(&mut s, 1, "agent-a", "ta", "sa");
+        create_in_group(&mut s, 2, "agent-b", "tb", "sb");
+        // A pop-up that agent-a's tab opened: extension reports openerTargetId=ta.
+        s.handle_ext_message(
+            &json!({ "method": "forwardCDPEvent", "params": {
+                "method": "Target.attachedToTarget",
+                "params": { "sessionId": "sp", "targetInfo": {
+                    "targetId": "tp", "type": "page", "url": "https://oauth.example/",
+                    "attached": true, "openerTargetId": "ta" } } } }),
+            "",
+        );
+        // Only agent-a sees the pop-up; agent-b never does.
+        let mut a = get_target_ids(&mut s, 1);
+        a.sort();
+        assert_eq!(a, vec!["ta", "tp"]);
+        assert_eq!(get_target_ids(&mut s, 2), vec!["tb"]);
+    }
+
+    #[test]
+    fn explicit_attach_tags_target_into_adopter_group() {
+        let mut s = RelayState::new();
+        // A pre-existing, ungrouped tab the extension reported (e.g. user's tab).
+        s.handle_ext_message(
+            &json!({ "method": "forwardCDPEvent", "params": {
+                "method": "Target.attachedToTarget",
+                "params": { "sessionId": "su", "targetInfo": {
+                    "targetId": "tu", "type": "page", "url": "https://user.example/", "attached": true } } } }),
+            "",
+        );
+        // Client 1 (group agent-a) explicitly adopts it by targetId (#21).
+        s.route_client_command(
+            1,
+            &json!({ "id": 1, "method": "ABRelay.setGroup", "params": { "group": "agent-a" } }),
+        );
+        s.route_client_command(
+            1,
+            &json!({ "id": 2, "method": "Target.attachToTarget", "params": { "targetId": "tu" } }),
+        );
+        // Now it's in agent-a's scope and survives the scoped getTargets.
+        assert_eq!(get_target_ids(&mut s, 1), vec!["tu"]);
+        // A different agent still doesn't see it.
+        s.route_client_command(
+            2,
+            &json!({ "id": 1, "method": "ABRelay.setGroup", "params": { "group": "agent-b" } }),
+        );
+        assert!(get_target_ids(&mut s, 2).is_empty());
+    }
+
+    #[test]
+    fn get_all_targets_is_unscoped() {
+        let mut s = RelayState::new();
+        create_in_group(&mut s, 1, "agent-a", "ta", "sa");
+        create_in_group(&mut s, 2, "agent-b", "tb", "sb");
+        // Client 1's scoped getTargets sees only its own group...
+        assert_eq!(get_target_ids(&mut s, 1), vec!["ta"]);
+        // ...but ABRelay.getAllTargets returns EVERY target regardless of group
+        // (for explicit cross-group adoption).
+        let all = match s
+            .route_client_command(1, &json!({ "id": 1, "method": "ABRelay.getAllTargets" }))
+        {
+            ClientRoute::Local(v) => {
+                let mut ids: Vec<String> = v["result"]["targetInfos"]
+                    .as_array()
+                    .unwrap()
+                    .iter()
+                    .map(|t| t["targetId"].as_str().unwrap().to_string())
+                    .collect();
+                ids.sort();
+                ids
+            }
+            _ => panic!("getAllTargets must be local"),
+        };
+        assert_eq!(all, vec!["ta", "tb"]);
+    }
+
+    #[test]
+    fn detach_clears_target_group() {
+        let mut s = RelayState::new();
+        create_in_group(&mut s, 1, "agent-a", "ta", "sa");
+        assert_eq!(get_target_ids(&mut s, 1), vec!["ta"]);
+        s.handle_ext_message(
+            &json!({ "method": "forwardCDPEvent", "params": {
+                "method": "Target.detachedFromTarget", "params": { "sessionId": "sa" } } }),
+            "",
+        );
+        assert!(get_target_ids(&mut s, 1).is_empty());
+        assert!(!s.target_group.contains_key("ta"));
+    }
+}

cli/src/native/screenshot.rs

@@ -1,16 +1,68 @@
+use serde::Serialize;
 use serde_json::Value;
 use std::path::PathBuf;
 
+use std::collections::HashMap;
+
 use super::cdp::client::CdpClient;
 use super::cdp::types::*;
 use super::element::RefMap;
 
+const ANNOTATION_OVERLAY_ID: &str = "__agent_browser_annotations__";
+
+#[derive(Debug, Clone)]
+struct Rect {
+    x: f64,
+    y: f64,
+    width: f64,
+    height: f64,
+}
+
+#[derive(Debug, Clone)]
+struct RawAnnotation {
+    ref_id: String,
+    number: u64,
+    role: String,
+    name: Option<String>,
+    rect: Rect,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct AnnotationBox {
+    pub x: i64,
+    pub y: i64,
+    pub width: i64,
+    pub height: i64,
+}
+
+#[derive(Debug, Clone)]
+pub struct ScreenshotAnnotation {
+    pub ref_id: String,
+    pub number: u64,
+    pub role: String,
+    pub name: Option<String>,
+    pub box_: AnnotationBox,
+}
+
+#[derive(Debug, Clone)]
+pub struct ScreenshotResult {
+    pub path: String,
+    pub base64: String,
+    pub annotations: Vec<ScreenshotAnnotation>,
+}
+
+#[derive(Debug, Clone)]
 pub struct ScreenshotOptions {
     pub selector: Option<String>,
     pub path: Option<String>,
     pub full_page: bool,
     pub format: String,
     pub quality: Option<i32>,
+    pub annotate: bool,
+    pub output_dir: Option<String>,
+    /// Explicit pixel region (x, y, width, height) — `--clip` (issue #34). Takes
+    /// precedence over selector/full_page.
+    pub clip: Option<(f64, f64, f64, f64)>,
 }
 
 impl Default for ScreenshotOptions {
@@ -21,16 +73,112 @@ impl Default for ScreenshotOptions {
             full_page: false,
             format: "png".to_string(),
             quality: None,
+            annotate: false,
+            output_dir: None,
+            clip: None,
         }
     }
 }
 
+impl Serialize for ScreenshotAnnotation {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        use serde::ser::SerializeStruct;
+
+        let mut state = serializer.serialize_struct("ScreenshotAnnotation", 5)?;
+        state.serialize_field("ref", &self.ref_id)?;
+        state.serialize_field("number", &self.number)?;
+        state.serialize_field("role", &self.role)?;
+        if let Some(name) = &self.name {
+            state.serialize_field("name", name)?;
+        }
+        state.serialize_field("box", &self.box_)?;
+        state.end()
+    }
+}
+
+/// Captures a screenshot via CDP and optionally overlays numbered annotations
+/// that mirror the Node.js screenshot `annotate` mode.
 pub async fn take_screenshot(
     client: &CdpClient,
     session_id: &str,
     ref_map: &RefMap,
     options: &ScreenshotOptions,
-) -> Result<(String, String), String> {
+    iframe_sessions: &HashMap<String, String>,
+) -> Result<ScreenshotResult, String> {
+    let target_rect = if options.annotate {
+        match options.selector.as_deref() {
+            Some(selector) => {
+                get_rect_for_selector(client, session_id, ref_map, selector, iframe_sessions)
+                    .await?
+            }
+            None => None,
+        }
+    } else {
+        None
+    };
+
+    let raw_annotations = if options.annotate {
+        collect_annotations(client, session_id, ref_map).await?
+    } else {
+        Vec::new()
+    };
+
+    let overlay_items = filter_annotations(raw_annotations, target_rect.as_ref());
+    let overlay_injected = if options.annotate && !overlay_items.is_empty() {
+        inject_annotation_overlay(client, session_id, &overlay_items).await?;
+        true
+    } else {
+        false
+    };
+
+    let base64 =
+        capture_screenshot_base64(client, session_id, ref_map, options, iframe_sessions).await;
+
+    if overlay_injected {
+        let _ = remove_annotation_overlay(client, session_id).await;
+    }
+
+    let base64 = base64?;
+    let annotations = if options.annotate {
+        let scroll = if options.full_page {
+            Some(get_scroll_offsets(client, session_id).await?)
+        } else {
+            None
+        };
+        project_annotations(&overlay_items, target_rect.as_ref(), scroll)
+    } else {
+        Vec::new()
+    };
+
+    let ext = if options.format == "jpeg" {
+        "jpg"
+    } else {
+        "png"
+    };
+    let path = save_screenshot(
+        &base64,
+        options.path.as_deref(),
+        ext,
+        options.output_dir.as_deref(),
+    )?;
+
+    Ok(ScreenshotResult {
+        path,
+        base64,
+        annotations,
+    })
+}
+
+async fn capture_screenshot_base64(
+    client: &CdpClient,
+    session_id: &str,
+    ref_map: &RefMap,
+    options: &ScreenshotOptions,
+    iframe_sessions: &HashMap<String, String>,
+) -> Result<String, String> {
     let mut params = CaptureScreenshotParams {
         format: Some(options.format.clone()),
         quality: if options.format == "jpeg" {
@@ -43,7 +191,16 @@ pub async fn take_screenshot(
         capture_beyond_viewport: if options.full_page { Some(true) } else { None },
     };
 
-    if options.full_page {
+    if let Some((x, y, width, height)) = options.clip {
+        // Explicit pixel region wins over selector/full_page (issue #34).
+        params.clip = Some(Viewport {
+            x,
+            y,
+            width,
+            height,
+            scale: 1.0,
+        });
+    } else if options.full_page {
         let metrics: Value = client
             .send_command_no_params("Page.getLayoutMetrics", Some(session_id))
             .await?;
@@ -64,40 +221,14 @@ pub async fn take_screenshot(
             });
         }
     } else if let Some(ref selector) = options.selector {
-        // Element screenshot via bounding box
-        let object_id =
-            super::element::resolve_element_object_id(client, session_id, ref_map, selector)
-                .await?;
-
-        let result: EvaluateResult = client
-            .send_command_typed(
-                "Runtime.callFunctionOn",
-                &CallFunctionOnParams {
-                    function_declaration: r#"function() {
-                        const rect = this.getBoundingClientRect();
-                        return { x: rect.x, y: rect.y, width: rect.width, height: rect.height };
-                    }"#
-                    .to_string(),
-                    object_id: Some(object_id),
-                    arguments: None,
-                    return_by_value: Some(true),
-                    await_promise: Some(false),
-                },
-                Some(session_id),
-            )
-            .await?;
-
-        if let Some(rect) = result.result.value {
-            let x = rect.get("x").and_then(|v| v.as_f64()).unwrap_or(0.0);
-            let y = rect.get("y").and_then(|v| v.as_f64()).unwrap_or(0.0);
-            let w = rect.get("width").and_then(|v| v.as_f64()).unwrap_or(100.0);
-            let h = rect.get("height").and_then(|v| v.as_f64()).unwrap_or(100.0);
-
+        if let Some(rect) =
+            get_rect_for_selector(client, session_id, ref_map, selector, iframe_sessions).await?
+        {
             params.clip = Some(Viewport {
-                x,
-                y,
-                width: w,
-                height: h,
+                x: rect.x,
+                y: rect.y,
+                width: rect.width,
+                height: rect.height,
                 scale: 1.0,
             });
         }
@@ -107,16 +238,345 @@ pub async fn take_screenshot(
         .send_command_typed("Page.captureScreenshot", &params, Some(session_id))
         .await?;
 
-    let ext = if options.format == "jpeg" {
-        "jpg"
-    } else {
-        "png"
-    };
+    Ok(result.data)
+}
 
-    let save_path = match &options.path {
-        Some(p) => p.clone(),
+async fn collect_annotations(
+    client: &CdpClient,
+    session_id: &str,
+    ref_map: &RefMap,
+) -> Result<Vec<RawAnnotation>, String> {
+    let entries = ref_map.entries_sorted();
+    if entries.is_empty() {
+        return Ok(Vec::new());
+    }
+
+    // Collect entries that have backend_node_ids for batch resolution.
+    let with_backend_ids: Vec<(String, super::element::RefEntry, i64)> = entries
+        .iter()
+        .filter_map(|(ref_id, entry)| {
+            entry
+                .backend_node_id
+                .map(|bid| (ref_id.clone(), entry.clone(), bid))
+        })
+        .collect();
+
+    if with_backend_ids.is_empty() {
+        return Ok(Vec::new());
+    }
+
+    // Batch-resolve all backend_node_ids to object IDs using concurrent CDP calls.
+    let resolve_futures: Vec<_> = with_backend_ids
+        .iter()
+        .map(|(_, _, backend_node_id)| {
+            client.send_command(
+                "DOM.resolveNode",
+                Some(serde_json::json!({
+                    "backendNodeId": backend_node_id,
+                    "objectGroup": "chrome-use-annotate"
+                })),
+                Some(session_id),
+            )
+        })
+        .collect();
+
+    let resolve_results = futures_util::future::join_all(resolve_futures).await;
+
+    // Collect resolved object IDs paired with their ref info.
+    let mut resolved: Vec<(String, super::element::RefEntry, String)> = Vec::new();
+    for (i, result) in resolve_results.into_iter().enumerate() {
+        if let Ok(val) = result {
+            if let Some(oid) = val
+                .get("object")
+                .and_then(|o| o.get("objectId"))
+                .and_then(|v| v.as_str())
+            {
+                let (ref_id, entry, _) = &with_backend_ids[i];
+                resolved.push((ref_id.clone(), entry.clone(), oid.to_string()));
+            }
+        }
+    }
+
+    if resolved.is_empty() {
+        return Ok(Vec::new());
+    }
+
+    // Batch-get bounding rects for all resolved elements using concurrent CDP calls.
+    let rect_futures: Vec<_> = resolved
+        .iter()
+        .map(|(_, _, object_id)| get_rect_for_object(client, session_id, object_id))
+        .collect();
+
+    let rect_results = futures_util::future::join_all(rect_futures).await;
+
+    let mut annotations = Vec::new();
+    for (i, rect_result) in rect_results.into_iter().enumerate() {
+        let rect = match rect_result {
+            Ok(Some(r)) if r.width > 0.0 && r.height > 0.0 => r,
+            _ => continue,
+        };
+
+        let (ref_id, entry, _) = &resolved[i];
+        let number = ref_id
+            .strip_prefix('e')
+            .and_then(|n| n.parse::<u64>().ok())
+            .unwrap_or(0);
+
+        annotations.push(RawAnnotation {
+            ref_id: ref_id.clone(),
+            number,
+            role: entry.role.clone(),
+            name: (!entry.name.is_empty()).then_some(entry.name.clone()),
+            rect,
+        });
+    }
+
+    Ok(annotations)
+}
+
+async fn get_rect_for_selector(
+    client: &CdpClient,
+    session_id: &str,
+    ref_map: &RefMap,
+    selector: &str,
+    iframe_sessions: &HashMap<String, String>,
+) -> Result<Option<Rect>, String> {
+    let (object_id, effective_session_id) = super::element::resolve_element_object_id(
+        client,
+        session_id,
+        ref_map,
+        selector,
+        iframe_sessions,
+    )
+    .await?;
+    get_rect_for_object(client, &effective_session_id, &object_id).await
+}
+
+async fn get_rect_for_object(
+    client: &CdpClient,
+    session_id: &str,
+    object_id: &str,
+) -> Result<Option<Rect>, String> {
+    let result: EvaluateResult = client
+        .send_command_typed(
+            "Runtime.callFunctionOn",
+            &CallFunctionOnParams {
+                function_declaration: r#"function() {
+                    const rect = this.getBoundingClientRect();
+                    return { x: rect.x, y: rect.y, width: rect.width, height: rect.height };
+                }"#
+                .to_string(),
+                object_id: Some(object_id.to_string()),
+                arguments: None,
+                return_by_value: Some(true),
+                await_promise: Some(false),
+            },
+            Some(session_id),
+        )
+        .await?;
+
+    Ok(result.result.value.as_ref().and_then(parse_rect))
+}
+
+fn parse_rect(value: &Value) -> Option<Rect> {
+    Some(Rect {
+        x: value.get("x")?.as_f64()?,
+        y: value.get("y")?.as_f64()?,
+        width: value.get("width")?.as_f64()?,
+        height: value.get("height")?.as_f64()?,
+    })
+}
+
+fn filter_annotations(
+    annotations: Vec<RawAnnotation>,
+    target_rect: Option<&Rect>,
+) -> Vec<RawAnnotation> {
+    let mut items = annotations
+        .into_iter()
+        .filter(|annotation| match target_rect {
+            Some(target) => overlaps(&annotation.rect, target),
+            None => true,
+        })
+        .collect::<Vec<_>>();
+
+    items.sort_by_key(|annotation| annotation.number);
+    items
+}
+
+fn overlaps(left: &Rect, right: &Rect) -> bool {
+    let left_x2 = left.x + left.width;
+    let left_y2 = left.y + left.height;
+    let right_x2 = right.x + right.width;
+    let right_y2 = right.y + right.height;
+
+    left.x < right_x2 && left_x2 > right.x && left.y < right_y2 && left_y2 > right.y
+}
+
+async fn inject_annotation_overlay(
+    client: &CdpClient,
+    session_id: &str,
+    annotations: &[RawAnnotation],
+) -> Result<(), String> {
+    let overlay_data = annotations
+        .iter()
+        .map(|annotation| {
+            serde_json::json!({
+                "number": annotation.number,
+                "x": round(annotation.rect.x),
+                "y": round(annotation.rect.y),
+                "width": round(annotation.rect.width),
+                "height": round(annotation.rect.height),
+            })
+        })
+        .collect::<Vec<_>>();
+
+    let expression = format!(
+        r#"(() => {{
+            var items = {items};
+            var id = {overlay_id};
+            var existing = document.getElementById(id);
+            if (existing) existing.remove();
+            var sx = window.scrollX || 0;
+            var sy = window.scrollY || 0;
+            var c = document.createElement('div');
+            c.id = id;
+            c.style.cssText = 'position:absolute;top:0;left:0;width:0;height:0;pointer-events:none;z-index:2147483647;';
+            for (var i = 0; i < items.length; i++) {{
+                var it = items[i];
+                var dx = it.x + sx;
+                var dy = it.y + sy;
+                var b = document.createElement('div');
+                b.style.cssText = 'position:absolute;left:' + dx + 'px;top:' + dy + 'px;width:' + it.width + 'px;height:' + it.height + 'px;border:2px solid rgba(255,0,0,0.8);box-sizing:border-box;pointer-events:none;';
+                var l = document.createElement('div');
+                l.textContent = String(it.number);
+                var labelTop = dy < 14 ? '2px' : '-14px';
+                l.style.cssText = 'position:absolute;top:' + labelTop + ';left:-2px;background:rgba(255,0,0,0.9);color:#fff;font:bold 11px/14px monospace;padding:0 4px;border-radius:2px;white-space:nowrap;';
+                b.appendChild(l);
+                c.appendChild(b);
+            }}
+            document.documentElement.appendChild(c);
+            return true;
+        }})()"#,
+        items = serde_json::to_string(&overlay_data).unwrap_or_else(|_| "[]".to_string()),
+        overlay_id =
+            serde_json::to_string(ANNOTATION_OVERLAY_ID).unwrap_or_else(|_| "\"\"".to_string()),
+    );
+
+    let _: EvaluateResult = client
+        .send_command_typed(
+            "Runtime.evaluate",
+            &EvaluateParams {
+                expression,
+                return_by_value: Some(true),
+                await_promise: Some(false),
+            },
+            Some(session_id),
+        )
+        .await?;
+
+    Ok(())
+}
+
+async fn remove_annotation_overlay(client: &CdpClient, session_id: &str) -> Result<(), String> {
+    let expression = format!(
+        r#"(() => {{
+            var el = document.getElementById({overlay_id});
+            if (el) el.remove();
+            return true;
+        }})()"#,
+        overlay_id =
+            serde_json::to_string(ANNOTATION_OVERLAY_ID).unwrap_or_else(|_| "\"\"".to_string()),
+    );
+
+    let _: EvaluateResult = client
+        .send_command_typed(
+            "Runtime.evaluate",
+            &EvaluateParams {
+                expression,
+                return_by_value: Some(true),
+                await_promise: Some(false),
+            },
+            Some(session_id),
+        )
+        .await?;
+
+    Ok(())
+}
+
+async fn get_scroll_offsets(client: &CdpClient, session_id: &str) -> Result<(f64, f64), String> {
+    let result: EvaluateResult = client
+        .send_command_typed(
+            "Runtime.evaluate",
+            &EvaluateParams {
+                expression: "({x: window.scrollX || 0, y: window.scrollY || 0})".to_string(),
+                return_by_value: Some(true),
+                await_promise: Some(false),
+            },
+            Some(session_id),
+        )
+        .await?;
+
+    let value = result.result.value.unwrap_or(Value::Null);
+    let x = value.get("x").and_then(|v| v.as_f64()).unwrap_or(0.0);
+    let y = value.get("y").and_then(|v| v.as_f64()).unwrap_or(0.0);
+    Ok((x, y))
+}
+
+fn project_annotations(
+    annotations: &[RawAnnotation],
+    target_rect: Option<&Rect>,
+    scroll: Option<(f64, f64)>,
+) -> Vec<ScreenshotAnnotation> {
+    annotations
+        .iter()
+        .map(|annotation| {
+            let rect = if let Some(target) = target_rect {
+                Rect {
+                    x: annotation.rect.x - target.x,
+                    y: annotation.rect.y - target.y,
+                    width: annotation.rect.width,
+                    height: annotation.rect.height,
+                }
+            } else if let Some((scroll_x, scroll_y)) = scroll {
+                Rect {
+                    x: annotation.rect.x + scroll_x,
+                    y: annotation.rect.y + scroll_y,
+                    width: annotation.rect.width,
+                    height: annotation.rect.height,
+                }
+            } else {
+                annotation.rect.clone()
+            };
+
+            ScreenshotAnnotation {
+                ref_id: annotation.ref_id.clone(),
+                number: annotation.number,
+                role: annotation.role.clone(),
+                name: annotation.name.clone(),
+                box_: AnnotationBox {
+                    x: round(rect.x),
+                    y: round(rect.y),
+                    width: round(rect.width),
+                    height: round(rect.height),
+                },
+            }
+        })
+        .collect()
+}
+
+fn save_screenshot(
+    base64_data: &str,
+    explicit_path: Option<&str>,
+    ext: &str,
+    output_dir: Option<&str>,
+) -> Result<String, String> {
+    let save_path = match explicit_path {
+        Some(path) => path.to_string(),
         None => {
-            let dir = get_screenshot_dir();
+            let dir = match output_dir {
+                Some(d) => PathBuf::from(d),
+                None => get_screenshot_dir(),
+            };
             let _ = std::fs::create_dir_all(&dir);
             let timestamp = std::time::SystemTime::now()
                 .duration_since(std::time::UNIX_EPOCH)
@@ -127,21 +587,116 @@ pub async fn take_screenshot(
         }
     };
 
-    let bytes = base64::Engine::decode(&base64::engine::general_purpose::STANDARD, &result.data)
+    let bytes = base64::Engine::decode(&base64::engine::general_purpose::STANDARD, base64_data)
         .map_err(|e| format!("Failed to decode screenshot: {}", e))?;
 
     std::fs::write(&save_path, &bytes)
         .map_err(|e| format!("Failed to save screenshot to {}: {}", save_path, e))?;
 
-    Ok((save_path, result.data))
+    Ok(save_path)
+}
+
+fn round(value: f64) -> i64 {
+    value.round() as i64
 }
 
 fn get_screenshot_dir() -> PathBuf {
     if let Some(home) = dirs::home_dir() {
-        home.join(".agent-browser").join("tmp").join("screenshots")
+        home.join(".chrome-use").join("tmp").join("screenshots")
     } else {
-        std::env::temp_dir()
-            .join("agent-browser")
-            .join("screenshots")
+        std::env::temp_dir().join("chrome-use").join("screenshots")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn filters_annotations_to_target_overlap() {
+        let annotations = vec![
+            RawAnnotation {
+                ref_id: "e1".to_string(),
+                number: 1,
+                role: "button".to_string(),
+                name: Some("Inside".to_string()),
+                rect: Rect {
+                    x: 10.0,
+                    y: 10.0,
+                    width: 50.0,
+                    height: 20.0,
+                },
+            },
+            RawAnnotation {
+                ref_id: "e2".to_string(),
+                number: 2,
+                role: "button".to_string(),
+                name: Some("Outside".to_string()),
+                rect: Rect {
+                    x: 200.0,
+                    y: 200.0,
+                    width: 40.0,
+                    height: 20.0,
+                },
+            },
+        ];
+
+        let target = Rect {
+            x: 0.0,
+            y: 0.0,
+            width: 100.0,
+            height: 100.0,
+        };
+
+        let filtered = filter_annotations(annotations, Some(&target));
+        assert_eq!(filtered.len(), 1);
+        assert_eq!(filtered[0].ref_id, "e1");
+    }
+
+    #[test]
+    fn projects_selector_annotations_relative_to_target() {
+        let annotations = vec![RawAnnotation {
+            ref_id: "e1".to_string(),
+            number: 1,
+            role: "button".to_string(),
+            name: Some("Inside".to_string()),
+            rect: Rect {
+                x: 25.0,
+                y: 35.0,
+                width: 40.0,
+                height: 20.0,
+            },
+        }];
+
+        let target = Rect {
+            x: 10.0,
+            y: 15.0,
+            width: 100.0,
+            height: 100.0,
+        };
+
+        let projected = project_annotations(&annotations, Some(&target), None);
+        assert_eq!(projected[0].box_.x, 15);
+        assert_eq!(projected[0].box_.y, 20);
+    }
+
+    #[test]
+    fn projects_full_page_annotations_to_document_space() {
+        let annotations = vec![RawAnnotation {
+            ref_id: "e1".to_string(),
+            number: 1,
+            role: "button".to_string(),
+            name: Some("Bottom".to_string()),
+            rect: Rect {
+                x: 5.0,
+                y: 12.0,
+                width: 40.0,
+                height: 20.0,
+            },
+        }];
+
+        let projected = project_annotations(&annotations, None, Some((10.0, 1000.0)));
+        assert_eq!(projected[0].box_.x, 15);
+        assert_eq!(projected[0].box_.y, 1012);
     }
 }

cli/src/native/state.rs

@@ -1,12 +1,17 @@
 use aes_gcm::{aead::Aead, aead::KeyInit, Aes256Gcm};
+use base64::Engine;
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
 use sha2::{Digest, Sha256};
+use std::collections::HashSet;
 use std::fs;
 use std::path::PathBuf;
 
 use super::cdp::client::CdpClient;
-use super::cdp::types::EvaluateParams;
+use super::cdp::types::{
+    AttachToTargetParams, AttachToTargetResult, CloseTargetParams, CreateTargetParams,
+    CreateTargetResult, EvaluateParams,
+};
 use super::cookies::{self, Cookie};
 
 #[derive(Debug, Serialize, Deserialize)]
@@ -32,16 +37,226 @@ pub struct StorageEntry {
     pub value: String,
 }
 
+fn collect_frame_origins(tree: &Value, origins: &mut HashSet<String>) {
+    if let Some(frame) = tree.get("frame") {
+        if let Some(url_str) = frame.get("url").and_then(|v| v.as_str()) {
+            if let Ok(parsed) = url::Url::parse(url_str) {
+                let origin = parsed.origin().ascii_serialization();
+                if origin != "null" && !origin.is_empty() {
+                    origins.insert(origin);
+                }
+            }
+        }
+    }
+    if let Some(children) = tree.get("childFrames").and_then(|v| v.as_array()) {
+        for child in children {
+            collect_frame_origins(child, origins);
+        }
+    }
+}
+
+/// Parse the JS-evaluated origin storage data into an OriginStorage struct.
+fn parse_origin_storage(data: &Value) -> Option<OriginStorage> {
+    if !data.is_object() {
+        return None;
+    }
+    let origin = data
+        .get("origin")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
+    if origin.is_empty() || origin == "null" {
+        return None;
+    }
+    let local_storage: Vec<StorageEntry> = data
+        .get("localStorage")
+        .and_then(|v| serde_json::from_value(v.clone()).ok())
+        .unwrap_or_default();
+    let session_storage: Vec<StorageEntry> = data
+        .get("sessionStorage")
+        .and_then(|v| serde_json::from_value(v.clone()).ok())
+        .unwrap_or_default();
+
+    Some(OriginStorage {
+        origin,
+        local_storage,
+        session_storage,
+    })
+}
+
+/// Evaluate the storage-collection JS snippet and parse the result.
+async fn eval_origin_storage(
+    client: &CdpClient,
+    session_id: &str,
+    origin_js: &str,
+) -> Option<OriginStorage> {
+    let result = client
+        .send_command_typed::<_, super::cdp::types::EvaluateResult>(
+            "Runtime.evaluate",
+            &EvaluateParams {
+                expression: origin_js.to_string(),
+                return_by_value: Some(true),
+                await_promise: Some(false),
+            },
+            Some(session_id),
+        )
+        .await
+        .ok()?;
+    let data = result.result.value.unwrap_or(Value::Null);
+    parse_origin_storage(&data)
+}
+
+/// Create a temporary CDP target, navigate it to each origin to collect localStorage,
+/// then close it. Uses Fetch interception to serve blank HTML instead of making real
+/// network requests.
+async fn collect_storage_via_temp_target(
+    client: &CdpClient,
+    origins: &[String],
+    origin_js: &str,
+) -> Result<Vec<OriginStorage>, String> {
+    let create_result: CreateTargetResult = client
+        .send_command_typed(
+            "Target.createTarget",
+            &CreateTargetParams {
+                url: "about:blank".to_string(),
+                // Transient internal target (storage collection) — never grouped.
+                agent_group: None,
+                background: None,
+            },
+            None,
+        )
+        .await?;
+
+    let target_id = create_result.target_id;
+
+    // Ensure the target is closed even if attach or later steps fail
+    let result = collect_storage_in_target(client, &target_id, origins, origin_js).await;
+
+    let _ = client
+        .send_command_typed::<_, Value>(
+            "Target.closeTarget",
+            &CloseTargetParams { target_id },
+            None,
+        )
+        .await;
+
+    result
+}
+
+async fn collect_storage_in_target(
+    client: &CdpClient,
+    target_id: &str,
+    origins: &[String],
+    origin_js: &str,
+) -> Result<Vec<OriginStorage>, String> {
+    let attach_result: AttachToTargetResult = client
+        .send_command_typed(
+            "Target.attachToTarget",
+            &AttachToTargetParams {
+                target_id: target_id.to_string(),
+                flatten: true,
+            },
+            None,
+        )
+        .await?;
+
+    let temp_session = &attach_result.session_id;
+
+    client
+        .send_command_no_params("Page.enable", Some(temp_session))
+        .await?;
+    client
+        .send_command_no_params("Runtime.enable", Some(temp_session))
+        .await?;
+
+    // Blank HTML response body, pre-encoded to avoid repeated base64 work per request
+    let blank_html_b64 = base64::engine::general_purpose::STANDARD.encode("<html></html>");
+
+    let _ = client
+        .send_command(
+            "Fetch.enable",
+            Some(json!({ "patterns": [{ "urlPattern": "*" }] })),
+            Some(temp_session),
+        )
+        .await;
+
+    let mut event_rx = client.subscribe();
+    let mut results = Vec::new();
+
+    for target_origin in origins {
+        let nav_url = format!("{}/", target_origin.trim_end_matches('/'));
+        if client
+            .send_command(
+                "Page.navigate",
+                Some(json!({ "url": nav_url })),
+                Some(temp_session),
+            )
+            .await
+            .is_err()
+        {
+            continue;
+        }
+
+        // Fulfill intercepted requests with blank HTML until the page loads
+        let deadline = tokio::time::Instant::now() + tokio::time::Duration::from_secs(5);
+        let mut page_loaded = false;
+        while tokio::time::Instant::now() < deadline {
+            match tokio::time::timeout(tokio::time::Duration::from_secs(2), event_rx.recv()).await {
+                Ok(Ok(evt)) if evt.session_id.as_deref() == Some(temp_session) => {
+                    if evt.method == "Fetch.requestPaused" {
+                        if let Some(request_id) =
+                            evt.params.get("requestId").and_then(|v| v.as_str())
+                        {
+                            let _ = client
+                                .send_command(
+                                    "Fetch.fulfillRequest",
+                                    Some(json!({
+                                        "requestId": request_id,
+                                        "responseCode": 200,
+                                        "responseHeaders": [
+                                            { "name": "Content-Type", "value": "text/html" }
+                                        ],
+                                        "body": &blank_html_b64
+                                    })),
+                                    Some(temp_session),
+                                )
+                                .await;
+                        }
+                    } else if evt.method == "Page.loadEventFired" {
+                        page_loaded = true;
+                        break;
+                    }
+                }
+                Ok(Ok(_)) => continue,  // event for a different session
+                Ok(Err(_)) => continue, // lagged or closed — retry within deadline
+                Err(_) => break,        // outer timeout elapsed
+            }
+        }
+
+        if !page_loaded {
+            continue;
+        }
+
+        if let Some(storage) = eval_origin_storage(client, temp_session, origin_js).await {
+            if !storage.local_storage.is_empty() || !storage.session_storage.is_empty() {
+                results.push(storage);
+            }
+        }
+    }
+
+    Ok(results)
+}
+
 pub async fn save_state(
     client: &CdpClient,
     session_id: &str,
     path: Option<&str>,
     session_name: Option<&str>,
     session_id_str: &str,
+    visited_origins: &HashSet<String>,
 ) -> Result<String, String> {
-    let cookies = cookies::get_cookies(client, session_id, None).await?;
+    let cookies = cookies::get_all_cookies(client, session_id).await?;
 
-    // Get current origin's storage
     let origin_js = r#"(() => {
         const result = { origin: location.origin, localStorage: [], sessionStorage: [] };
         try {
@@ -59,46 +274,38 @@ pub async fn save_state(
         return result;
     })()"#;
 
-    let origin_result: super::cdp::types::EvaluateResult = client
-        .send_command_typed(
-            "Runtime.evaluate",
-            &EvaluateParams {
-                expression: origin_js.to_string(),
-                return_by_value: Some(true),
-                await_promise: Some(false),
-            },
-            Some(session_id),
-        )
-        .await?;
-
-    let origin_data = origin_result.result.value.unwrap_or(Value::Null);
-    let origins = if origin_data.is_object() {
-        let origin = origin_data
-            .get("origin")
-            .and_then(|v| v.as_str())
-            .unwrap_or("")
-            .to_string();
-        let local_storage: Vec<StorageEntry> = origin_data
-            .get("localStorage")
-            .and_then(|v| serde_json::from_value(v.clone()).ok())
-            .unwrap_or_default();
-        let session_storage: Vec<StorageEntry> = origin_data
-            .get("sessionStorage")
-            .and_then(|v| serde_json::from_value(v.clone()).ok())
-            .unwrap_or_default();
-
-        if !origin.is_empty() && origin != "null" {
-            vec![OriginStorage {
-                origin,
-                local_storage,
-                session_storage,
-            }]
-        } else {
-            vec![]
+    // Merge visited origins with current frame tree origins
+    let mut all_origins = visited_origins.clone();
+    if let Ok(tree_result) = client
+        .send_command_no_params("Page.getFrameTree", Some(session_id))
+        .await
+    {
+        if let Some(tree) = tree_result.get("frameTree") {
+            collect_frame_origins(tree, &mut all_origins);
         }
-    } else {
-        vec![]
-    };
+    }
+
+    // 1. Collect localStorage from the current page
+    let mut origins = Vec::new();
+    let mut current_origin = String::new();
+
+    if let Some(storage) = eval_origin_storage(client, session_id, origin_js).await {
+        current_origin = storage.origin.clone();
+        if !storage.local_storage.is_empty() || !storage.session_storage.is_empty() {
+            origins.push(storage);
+        }
+    }
+
+    // 2. Collect localStorage from remaining origins via a disposable temp target
+    all_origins.remove(&current_origin);
+    if !all_origins.is_empty() {
+        let remaining: Vec<String> = all_origins.into_iter().collect();
+        if let Ok(temp_origins) =
+            collect_storage_via_temp_target(client, &remaining, origin_js).await
+        {
+            origins.extend(temp_origins);
+        }
+    }
 
     let state = StorageState { cookies, origins };
     let json_str = serde_json::to_string_pretty(&state)
@@ -467,7 +674,7 @@ pub fn find_auto_state_file(session_name: &str) -> Option<String> {
                 .ok()
                 .and_then(|m| m.modified().ok())
                 .unwrap_or(std::time::UNIX_EPOCH);
-            if best_path.as_ref().map_or(true, |(_, t)| modified > *t) {
+            if best_path.as_ref().is_none_or(|(_, t)| modified > *t) {
                 best_path = Some((path.to_string_lossy().to_string(), modified));
             }
         }
@@ -475,14 +682,56 @@ pub fn find_auto_state_file(session_name: &str) -> Option<String> {
     best_path.map(|(p, _)| p)
 }
 
-pub fn get_sessions_dir() -> PathBuf {
-    if let Some(home) = dirs::home_dir() {
-        home.join(".agent-browser").join("sessions")
-    } else {
-        std::env::temp_dir().join("agent-browser").join("sessions")
+/// Dispatch a state management command from its JSON payload.
+/// Returns `Some(result)` for recognised state_* actions, `None` otherwise.
+pub fn dispatch_state_command(cmd: &Value) -> Option<Result<Value, String>> {
+    let action = cmd.get("action").and_then(|v| v.as_str())?;
+    match action {
+        "state_list" => Some(state_list()),
+        "state_show" => Some(
+            cmd.get("path")
+                .and_then(|v| v.as_str())
+                .ok_or_else(|| "Missing 'path' parameter".to_string())
+                .and_then(state_show),
+        ),
+        "state_clear" => {
+            let path = cmd.get("path").and_then(|v| v.as_str());
+            Some(state_clear(path))
+        }
+        "state_clean" => {
+            let days = cmd.get("days").and_then(|v| v.as_u64()).unwrap_or(30);
+            Some(state_clean(days))
+        }
+        "state_rename" => Some(
+            cmd.get("path")
+                .and_then(|v| v.as_str())
+                .ok_or_else(|| "Missing 'path' parameter".to_string())
+                .and_then(|path| {
+                    cmd.get("name")
+                        .and_then(|v| v.as_str())
+                        .ok_or_else(|| "Missing 'name' parameter".to_string())
+                        .and_then(|name| state_rename(path, name))
+                }),
+        ),
+        _ => None,
     }
 }
 
+/// Return the chrome-use state root (`~/.chrome-use`, falling back to
+/// `<tempdir>/chrome-use` when the home directory can't be resolved).
+/// This is the parent of `sessions/`, auth storage, and the encryption key.
+pub fn get_state_dir() -> PathBuf {
+    if let Some(home) = dirs::home_dir() {
+        home.join(".chrome-use")
+    } else {
+        std::env::temp_dir().join("chrome-use")
+    }
+}
+
+pub fn get_sessions_dir() -> PathBuf {
+    get_state_dir().join("sessions")
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -534,19 +783,19 @@ mod tests {
 
     #[test]
     fn test_state_show_nonexistent_file() {
-        let result = state_show("/tmp/nonexistent-agent-browser-state-file.json");
+        let result = state_show("/tmp/nonexistent-chrome-use-state-file.json");
         assert!(result.is_err());
     }
 
     #[test]
     fn test_state_clear_nonexistent_file() {
-        let result = state_clear(Some("/tmp/nonexistent-agent-browser-state-file.json"));
+        let result = state_clear(Some("/tmp/nonexistent-chrome-use-state-file.json"));
         assert!(result.is_err());
     }
 
     #[test]
     fn test_state_rename_nonexistent() {
-        let result = state_rename("/tmp/nonexistent-agent-browser-state-file.json", "new-name");
+        let result = state_rename("/tmp/nonexistent-chrome-use-state-file.json", "new-name");
         assert!(result.is_err());
         assert!(result.unwrap_err().contains("not found"));
     }
@@ -604,4 +853,45 @@ mod tests {
         assert_eq!(json["secure"], true);
         assert_eq!(json["sameSite"], "Strict");
     }
+
+    #[test]
+    fn test_dispatch_state_command_routes_state_list() {
+        let cmd = serde_json::json!({ "action": "state_list" });
+        let result = dispatch_state_command(&cmd);
+        assert!(result.is_some());
+        assert!(result.unwrap().is_ok());
+    }
+
+    #[test]
+    fn test_dispatch_state_command_returns_none_for_unknown() {
+        let cmd = serde_json::json!({ "action": "navigate" });
+        assert!(dispatch_state_command(&cmd).is_none());
+    }
+
+    #[test]
+    fn test_dispatch_state_command_returns_none_for_missing_action() {
+        let cmd = serde_json::json!({});
+        assert!(dispatch_state_command(&cmd).is_none());
+    }
+
+    #[test]
+    fn test_dispatch_state_show_missing_path() {
+        let cmd = serde_json::json!({ "action": "state_show" });
+        let result = dispatch_state_command(&cmd).unwrap();
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err(), "Missing 'path' parameter");
+    }
+
+    #[test]
+    fn test_dispatch_state_rename_missing_params() {
+        let cmd = serde_json::json!({ "action": "state_rename" });
+        let result = dispatch_state_command(&cmd).unwrap();
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err(), "Missing 'path' parameter");
+
+        let cmd = serde_json::json!({ "action": "state_rename", "path": "/tmp/test.json" });
+        let result = dispatch_state_command(&cmd).unwrap();
+        assert!(result.is_err());
+        assert_eq!(result.unwrap_err(), "Missing 'name' parameter");
+    }
 }

cli/src/native/stealth.rs

@@ -0,0 +1,392 @@
+//! Stealth anti-detection module.
+//!
+//! Injects browser-level patches to evade bot detection (creepjs, sannysoft,
+//! Cloudflare Turnstile, etc.) by normalizing fingerprint signals that betray
+//! headless or automated Chrome instances.
+
+use serde_json::json;
+
+use super::cdp::client::CdpClient;
+
+/// Full stealth JS payload compiled at build time (for --launch mode).
+const STEALTH_SCRIPTS_RAW: &str = include_str!("stealth_scripts.js");
+
+/// Minimal stealth script for CDP-attach mode (connecting to user's real Chrome).
+/// Only removes navigator.webdriver — the browser's own fingerprint is already real.
+/// Minimal stealth script for CDP-attach mode.
+/// Emulation.setAutomationOverride handles navigator.webdriver at the native
+/// level, so no JS patching is needed in CdpAttach mode. An empty script
+/// avoids creating any detectable lie-props artifacts.
+const MINIMAL_STEALTH_SCRIPT: &str = "";
+
+/// Chrome launch arguments that reduce automation fingerprint surface.
+pub const STEALTH_CHROMIUM_ARGS: &[&str] = &[
+    "--disable-blink-features=AutomationControlled",
+    "--use-gl=angle",
+    "--use-angle=default",
+];
+
+/// Connection mode determines which stealth patches to apply.
+#[derive(Clone, Copy, PartialEq)]
+pub enum StealthMode {
+    /// Connected to user's real Chrome — minimal patches only (webdriver removal).
+    /// The browser already has a real fingerprint; heavy patches would create detectable lies.
+    CdpAttach,
+    /// Launched a new Chrome instance — apply full stealth patches.
+    FullLaunch,
+}
+
+/// Build the stealth JS payload for the given mode and locale.
+pub fn build_stealth_script(mode: StealthMode, locale: Option<&str>) -> String {
+    if mode == StealthMode::CdpAttach {
+        return MINIMAL_STEALTH_SCRIPT.to_string();
+    }
+
+    // Full launch mode: inject all patches
+    let locale = locale.unwrap_or("en-US");
+    let base_lang = locale.split('-').next().unwrap_or(locale);
+    let languages: Vec<&str> = if base_lang == locale {
+        vec![locale]
+    } else {
+        vec![locale, base_lang]
+    };
+    let config_line = format!(
+        r#"const __abStealth = {{ locale: "{}", languages: {}, allowWebGLContextFallback: false, hideCanvas: {}, canvasSeed: {}, disableIframeProxy: {} }};"#,
+        locale,
+        serde_json::to_string(&languages).unwrap_or_else(|_| r#"["en-US","en"]"#.to_string()),
+        hide_canvas_enabled(),
+        canvas_noise_seed(),
+        disable_iframe_proxy_enabled(),
+    );
+
+    // NB: this prefix MUST match the first line of stealth_scripts.js verbatim,
+    // otherwise the fallback below prepends a SECOND `const __abStealth`
+    // declaration and the whole script dies with a redeclaration SyntaxError.
+    if let Some(rest) = STEALTH_SCRIPTS_RAW.strip_prefix(
+        r#"const __abStealth = { locale: "en-US", languages: ["en-US", "en"], allowWebGLContextFallback: false, hideCanvas: false, canvasSeed: 0, disableIframeProxy: false };"#,
+    ) {
+        format!("{}{}", config_line, rest)
+    } else {
+        format!("{}\n{}", config_line, STEALTH_SCRIPTS_RAW)
+    }
+}
+
+/// Whether canvas/audio fingerprint noise is opted into (FullLaunch only).
+/// OFF by default: injecting noise is a deliberate "lie" that can itself be a
+/// tell, so it's reserved for users who explicitly want it via
+/// `AGENT_BROWSER_HIDE_CANVAS=1`.
+fn hide_canvas_enabled() -> bool {
+    std::env::var("AGENT_BROWSER_HIDE_CANVAS")
+        .ok()
+        .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+        .unwrap_or(false)
+}
+
+/// Whether to DROP the srcdoc-iframe `contentWindow` Proxy patch (FullLaunch).
+/// That patch masks automation in srcdoc iframes, but the JS `Proxy` is itself a
+/// fingerprintable tell (CreepJS `hasIframeProxy` → ~20% stealth). Off by default
+/// (keep the patch); `AGENT_BROWSER_DISABLE_IFRAME_PROXY=1` drops it for a clean
+/// 0% CreepJS at the cost of that niche srcdoc-iframe masking.
+fn disable_iframe_proxy_enabled() -> bool {
+    std::env::var("AGENT_BROWSER_DISABLE_IFRAME_PROXY")
+        .ok()
+        .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+        .unwrap_or(false)
+}
+
+/// A per-process seed so canvas/audio noise is STABLE within a session (a real
+/// device returns the same hash on repeated reads) but differs from the
+/// headless-stable default. 0 is avoided so the JS can treat it as "unset".
+fn canvas_noise_seed() -> u32 {
+    use std::sync::OnceLock;
+    static SEED: OnceLock<u32> = OnceLock::new();
+    *SEED.get_or_init(|| {
+        use std::time::{SystemTime, UNIX_EPOCH};
+        let nanos = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.subsec_nanos())
+            .unwrap_or(0x9e3779b9);
+        // mix the bits a little, then force non-zero
+        let mixed = nanos ^ nanos.rotate_left(13).wrapping_mul(2654435761);
+        mixed | 1
+    })
+}
+
+/// Apply stealth patches to a browser session.
+///
+/// In `CdpAttach` mode (user's real Chrome): only removes `navigator.webdriver`.
+/// In `FullLaunch` mode (new Chrome): injects all 32 patches + UA override.
+pub async fn apply_stealth(
+    client: &CdpClient,
+    session_id: &str,
+    mode: StealthMode,
+    locale: Option<&str>,
+) -> Result<(), String> {
+    // First: disable the automation flag at the CDP protocol level.
+    // This tells Chrome to natively set navigator.webdriver = false,
+    // which is undetectable by lie-detection systems like CreepJS.
+    // Falls back gracefully on older Chrome versions that don't support this.
+    let _ = client
+        .send_command(
+            "Emulation.setAutomationOverride",
+            Some(json!({ "enabled": false })),
+            Some(session_id),
+        )
+        .await;
+
+    let script = build_stealth_script(mode, locale);
+
+    // Inject stealth scripts to run before page JS
+    client
+        .send_command(
+            "Page.addScriptToEvaluateOnNewDocument",
+            Some(json!({ "source": script })),
+            Some(session_id),
+        )
+        .await?;
+
+    // In full launch mode, also override UA to remove HeadlessChrome marker
+    if mode == StealthMode::FullLaunch {
+        let ua = get_browser_user_agent(client, session_id).await;
+        if let Some(ua) = ua {
+            let cleaned = ua.replace("HeadlessChrome", "Chrome");
+            if cleaned != ua {
+                client
+                    .send_command(
+                        "Emulation.setUserAgentOverride",
+                        Some(json!({
+                            "userAgent": cleaned,
+                            "acceptLanguage": locale.unwrap_or("en-US"),
+                            "platform": platform_string(),
+                            "userAgentMetadata": build_ua_metadata(&cleaned, locale),
+                        })),
+                        Some(session_id),
+                    )
+                    .await?;
+            }
+        }
+
+        // Align the timezone for fresh launches when explicitly requested.
+        // Headless/launched Chrome often reports UTC (or the host's zone), which
+        // can contradict a proxy's geolocation or a spoofed locale.
+        // `Emulation.setTimezoneOverride` is a NATIVE override — Intl.DateTimeFormat
+        // and Date both follow it with no detectable JS lie. Opt-in only:
+        //   AGENT_BROWSER_TIMEZONE=<IANA id>  -> use that zone (e.g. align to proxy)
+        //   AGENT_BROWSER_TIMEZONE=auto       -> derive a default from the locale
+        //   (unset)                           -> leave the real timezone untouched
+        if let Some(tz) = resolve_timezone(locale) {
+            let _ = client
+                .send_command(
+                    "Emulation.setTimezoneOverride",
+                    Some(json!({ "timezoneId": tz })),
+                    Some(session_id),
+                )
+                .await;
+        }
+    }
+
+    Ok(())
+}
+
+/// Resolve the timezone to emulate for a fresh-launch session, if any.
+/// Controlled by `AGENT_BROWSER_TIMEZONE`: an explicit IANA id, or `auto` to
+/// derive a sensible default from the locale. Returns `None` (leave the real
+/// timezone) when unset, empty, or when `auto` can't map the locale.
+fn resolve_timezone(locale: Option<&str>) -> Option<String> {
+    let raw = std::env::var("AGENT_BROWSER_TIMEZONE").ok()?;
+    let raw = raw.trim();
+    if raw.is_empty() {
+        return None;
+    }
+    if raw.eq_ignore_ascii_case("auto") {
+        return locale.and_then(locale_default_timezone).map(str::to_string);
+    }
+    Some(raw.to_string())
+}
+
+/// Best-effort IANA timezone for a locale. Used only for
+/// `AGENT_BROWSER_TIMEZONE=auto`; unknown locales return `None` so the real
+/// timezone is left untouched rather than guessing a wrong one.
+fn locale_default_timezone(locale: &str) -> Option<&'static str> {
+    let tz = match locale.to_ascii_lowercase().as_str() {
+        "en-us" => "America/New_York",
+        "en-ca" => "America/Toronto",
+        "en-gb" => "Europe/London",
+        "en-au" => "Australia/Sydney",
+        "ja" | "ja-jp" => "Asia/Tokyo",
+        "ko" | "ko-kr" => "Asia/Seoul",
+        "zh-cn" | "zh-hans" | "zh-hans-cn" => "Asia/Shanghai",
+        "zh-tw" | "zh-hant" | "zh-hant-tw" => "Asia/Taipei",
+        "zh-hk" => "Asia/Hong_Kong",
+        "de" | "de-de" => "Europe/Berlin",
+        "fr" | "fr-fr" => "Europe/Paris",
+        "es" | "es-es" => "Europe/Madrid",
+        "it" | "it-it" => "Europe/Rome",
+        "nl" | "nl-nl" => "Europe/Amsterdam",
+        "pt-br" => "America/Sao_Paulo",
+        "pt" | "pt-pt" => "Europe/Lisbon",
+        "ru" | "ru-ru" => "Europe/Moscow",
+        _ => return None,
+    };
+    Some(tz)
+}
+
+/// Get the browser's User-Agent string via CDP.
+async fn get_browser_user_agent(client: &CdpClient, session_id: &str) -> Option<String> {
+    let result = client
+        .send_command(
+            "Runtime.evaluate",
+            Some(json!({ "expression": "navigator.userAgent", "returnByValue": true })),
+            Some(session_id),
+        )
+        .await
+        .ok()?;
+    result
+        .get("result")
+        .and_then(|r| r.get("value"))
+        .and_then(|v| v.as_str())
+        .map(String::from)
+}
+
+/// Also run stealth script on the current page (for already-loaded pages after CDP attach).
+pub async fn apply_stealth_to_current_page(
+    client: &CdpClient,
+    session_id: &str,
+    mode: StealthMode,
+    locale: Option<&str>,
+) -> Result<(), String> {
+    let script = build_stealth_script(mode, locale);
+    client
+        .send_command(
+            "Runtime.evaluate",
+            Some(json!({
+                "expression": script,
+                "returnByValue": true,
+            })),
+            Some(session_id),
+        )
+        .await?;
+    Ok(())
+}
+
+/// Strip sourceURL comments from CDP expressions to avoid leaking
+/// automation-framework identifiers in stack traces.
+pub fn strip_source_url_labels(input: &str) -> String {
+    // Remove //# sourceURL=... and //@ sourceURL=...
+    let re_line = regex_lite::Regex::new(r"(?i)\n?\s*//[@#]\s*sourceURL=[^\n\r]*").unwrap();
+    let output = re_line.replace_all(input, "");
+    // Remove /*# sourceURL=...*/ block comments
+    let re_block = regex_lite::Regex::new(r"(?is)\n?\s*/\*[@#]\s*sourceURL=[\s\S]*?\*/").unwrap();
+    re_block.replace_all(&output, "").to_string()
+}
+
+/// The legacy `navigator.platform` value (set via the CDP
+/// `Emulation.setUserAgentOverride` `platform` field). This is NOT the UA-CH
+/// platform (see `platform_hint`): real Chrome reports `MacIntel` on macOS and
+/// `Linux x86_64` on Linux, so emitting the UA-CH form ("macOS"/"Linux") here is
+/// a detectable mismatch against the UA's "Intel Mac OS X" / Linux strings.
+fn platform_string() -> &'static str {
+    if cfg!(target_os = "macos") {
+        "MacIntel"
+    } else if cfg!(target_os = "windows") {
+        "Win32"
+    } else {
+        "Linux x86_64"
+    }
+}
+
+fn platform_hint() -> &'static str {
+    if cfg!(target_os = "macos") {
+        "macOS"
+    } else if cfg!(target_os = "windows") {
+        "Windows"
+    } else {
+        "Linux"
+    }
+}
+
+fn platform_version_hint() -> &'static str {
+    if cfg!(target_os = "macos") {
+        "14.0.0"
+    } else if cfg!(target_os = "windows") {
+        "10.0.0"
+    } else {
+        "6.5.0"
+    }
+}
+
+fn build_ua_metadata(ua: &str, locale: Option<&str>) -> serde_json::Value {
+    // Extract Chrome version from UA string
+    let chrome_version = ua
+        .split("Chrome/")
+        .nth(1)
+        .and_then(|s| s.split_whitespace().next())
+        .unwrap_or("130.0.0.0");
+    let major = chrome_version.split('.').next().unwrap_or("130");
+
+    let _lang = locale.unwrap_or("en-US");
+
+    json!({
+        "brands": [
+            { "brand": "Chromium", "version": major },
+            { "brand": "Google Chrome", "version": major },
+            { "brand": "Not?A_Brand", "version": "99" },
+        ],
+        "fullVersionList": [
+            { "brand": "Chromium", "version": chrome_version },
+            { "brand": "Google Chrome", "version": chrome_version },
+            { "brand": "Not?A_Brand", "version": "99.0.0.0" },
+        ],
+        "fullVersion": chrome_version,
+        "platform": platform_hint(),
+        "platformVersion": platform_version_hint(),
+        "architecture": if cfg!(target_arch = "aarch64") { "arm" } else { "x86" },
+        "model": "",
+        "mobile": false,
+        "bitness": "64",
+        "wow64": false,
+    })
+}
+
+#[cfg(test)]
+mod timezone_tests {
+    use super::{locale_default_timezone, resolve_timezone};
+
+    #[test]
+    fn maps_common_locales_case_insensitively() {
+        assert_eq!(locale_default_timezone("en-US"), Some("America/New_York"));
+        assert_eq!(locale_default_timezone("ja-JP"), Some("Asia/Tokyo"));
+        assert_eq!(locale_default_timezone("zh-CN"), Some("Asia/Shanghai"));
+        assert_eq!(locale_default_timezone("ZH-TW"), Some("Asia/Taipei"));
+        assert_eq!(locale_default_timezone("ja"), Some("Asia/Tokyo"));
+    }
+
+    #[test]
+    fn unknown_locale_returns_none() {
+        assert_eq!(locale_default_timezone("xx-YY"), None);
+        assert_eq!(locale_default_timezone(""), None);
+    }
+
+    #[test]
+    fn resolve_timezone_honors_env() {
+        // Serialized via a single test to avoid cross-test env races on this key.
+        std::env::remove_var("AGENT_BROWSER_TIMEZONE");
+        assert_eq!(resolve_timezone(Some("en-US")), None);
+
+        std::env::set_var("AGENT_BROWSER_TIMEZONE", "Europe/Berlin");
+        assert_eq!(resolve_timezone(None), Some("Europe/Berlin".to_string()));
+
+        std::env::set_var("AGENT_BROWSER_TIMEZONE", "  ");
+        assert_eq!(resolve_timezone(Some("en-US")), None);
+
+        std::env::set_var("AGENT_BROWSER_TIMEZONE", "auto");
+        assert_eq!(
+            resolve_timezone(Some("ja-JP")),
+            Some("Asia/Tokyo".to_string())
+        );
+        assert_eq!(resolve_timezone(Some("xx-YY")), None);
+        assert_eq!(resolve_timezone(None), None);
+
+        std::env::remove_var("AGENT_BROWSER_TIMEZONE");
+    }
+}

cli/src/native/stream.rs

@@ -1,385 +0,0 @@
-use serde_json::{json, Value};
-use std::net::SocketAddr;
-use std::sync::Arc;
-
-use futures_util::{SinkExt, StreamExt};
-use tokio::net::TcpListener;
-use tokio::sync::{broadcast, Mutex};
-use tokio_tungstenite::tungstenite::Message;
-
-use super::cdp::client::CdpClient;
-
-/// Frame metadata from CDP Page.screencastFrame events.
-#[derive(Debug, Clone)]
-pub struct FrameMetadata {
-    pub offset_top: f64,
-    pub page_scale_factor: f64,
-    pub device_width: u32,
-    pub device_height: u32,
-    pub scroll_offset_x: f64,
-    pub scroll_offset_y: f64,
-    pub timestamp: u64,
-}
-
-impl Default for FrameMetadata {
-    fn default() -> Self {
-        Self {
-            offset_top: 0.0,
-            page_scale_factor: 1.0,
-            device_width: 1280,
-            device_height: 720,
-            scroll_offset_x: 0.0,
-            scroll_offset_y: 0.0,
-            timestamp: 0,
-        }
-    }
-}
-
-pub struct StreamServer {
-    port: u16,
-    frame_tx: broadcast::Sender<String>,
-    client_count: Arc<Mutex<usize>>,
-}
-
-impl StreamServer {
-    pub async fn start(
-        preferred_port: u16,
-        client: Arc<CdpClient>,
-        session_id: String,
-    ) -> Result<Self, String> {
-        let addr = format!("127.0.0.1:{}", preferred_port);
-        let listener = TcpListener::bind(&addr)
-            .await
-            .map_err(|e| format!("Failed to bind stream server: {}", e))?;
-
-        let actual_addr = listener
-            .local_addr()
-            .map_err(|e| format!("Failed to get stream address: {}", e))?;
-        let port = actual_addr.port();
-
-        let (frame_tx, _) = broadcast::channel::<String>(64);
-        let client_count = Arc::new(Mutex::new(0usize));
-
-        let frame_tx_clone = frame_tx.clone();
-        let client_count_clone = client_count.clone();
-
-        tokio::spawn(async move {
-            accept_loop(
-                listener,
-                frame_tx_clone,
-                client_count_clone,
-                client,
-                session_id,
-            )
-            .await;
-        });
-
-        Ok(Self {
-            port,
-            frame_tx,
-            client_count,
-        })
-    }
-
-    pub fn port(&self) -> u16 {
-        self.port
-    }
-
-    /// Broadcast a raw frame string (legacy).
-    pub fn broadcast_frame(&self, frame_json: &str) {
-        let _ = self.frame_tx.send(frame_json.to_string());
-    }
-
-    /// Broadcast a screencast frame with structured metadata.
-    pub fn broadcast_screencast_frame(&self, base64_data: &str, metadata: &FrameMetadata) {
-        let msg = json!({
-            "type": "frame",
-            "data": base64_data,
-            "metadata": {
-                "offsetTop": metadata.offset_top,
-                "pageScaleFactor": metadata.page_scale_factor,
-                "deviceWidth": metadata.device_width,
-                "deviceHeight": metadata.device_height,
-                "scrollOffsetX": metadata.scroll_offset_x,
-                "scrollOffsetY": metadata.scroll_offset_y,
-                "timestamp": metadata.timestamp,
-            }
-        });
-        let _ = self.frame_tx.send(msg.to_string());
-    }
-
-    /// Broadcast a status message to all connected clients.
-    pub fn broadcast_status(
-        &self,
-        connected: bool,
-        screencasting: bool,
-        viewport_width: u32,
-        viewport_height: u32,
-    ) {
-        let msg = json!({
-            "type": "status",
-            "connected": connected,
-            "screencasting": screencasting,
-            "viewportWidth": viewport_width,
-            "viewportHeight": viewport_height,
-        });
-        let _ = self.frame_tx.send(msg.to_string());
-    }
-
-    /// Broadcast an error message to all connected clients.
-    pub fn broadcast_error(&self, message: &str) {
-        let msg = json!({
-            "type": "error",
-            "message": message,
-        });
-        let _ = self.frame_tx.send(msg.to_string());
-    }
-}
-
-async fn accept_loop(
-    listener: TcpListener,
-    frame_tx: broadcast::Sender<String>,
-    client_count: Arc<Mutex<usize>>,
-    cdp_client: Arc<CdpClient>,
-    session_id: String,
-) {
-    while let Ok((stream, addr)) = listener.accept().await {
-        let frame_rx = frame_tx.subscribe();
-        let client_count = client_count.clone();
-        let cdp = cdp_client.clone();
-        let sid = session_id.clone();
-
-        tokio::spawn(async move {
-            handle_ws_client(stream, addr, frame_rx, client_count, cdp, sid).await;
-        });
-    }
-}
-
-async fn handle_ws_client(
-    stream: tokio::net::TcpStream,
-    _addr: SocketAddr,
-    mut frame_rx: broadcast::Receiver<String>,
-    client_count: Arc<Mutex<usize>>,
-    cdp_client: Arc<CdpClient>,
-    session_id: String,
-) {
-    // Origin checking on WebSocket handshake
-    let callback =
-        |req: &tokio_tungstenite::tungstenite::handshake::server::Request,
-         resp: tokio_tungstenite::tungstenite::handshake::server::Response| {
-            let origin = req
-                .headers()
-                .get("origin")
-                .and_then(|v| v.to_str().ok())
-                .map(|s| s.to_string());
-            if !is_allowed_origin(origin.as_deref()) {
-                let mut reject =
-                    tokio_tungstenite::tungstenite::handshake::server::ErrorResponse::new(Some(
-                        "Origin not allowed".to_string(),
-                    ));
-                *reject.status_mut() = tokio_tungstenite::tungstenite::http::StatusCode::FORBIDDEN;
-                return Err(reject);
-            }
-            Ok(resp)
-        };
-
-    let ws_stream = match tokio_tungstenite::accept_hdr_async(stream, callback).await {
-        Ok(ws) => ws,
-        Err(_) => return,
-    };
-
-    {
-        let mut count = client_count.lock().await;
-        *count += 1;
-    }
-
-    let (mut ws_tx, mut ws_rx) = ws_stream.split();
-
-    loop {
-        tokio::select! {
-            frame = frame_rx.recv() => {
-                match frame {
-                    Ok(data) => {
-                        if ws_tx.send(Message::Text(data)).await.is_err() {
-                            break;
-                        }
-                    }
-                    Err(_) => break,
-                }
-            }
-            msg = ws_rx.next() => {
-                match msg {
-                    Some(Ok(Message::Text(text))) => {
-                        handle_client_message(&text, &cdp_client, &session_id).await;
-                    }
-                    Some(Ok(Message::Close(_))) | None => break,
-                    _ => {}
-                }
-            }
-        }
-    }
-
-    {
-        let mut count = client_count.lock().await;
-        *count = count.saturating_sub(1);
-    }
-}
-
-async fn handle_client_message(msg: &str, client: &CdpClient, session_id: &str) {
-    let parsed: Value = match serde_json::from_str(msg) {
-        Ok(v) => v,
-        Err(_) => return,
-    };
-
-    let msg_type = parsed.get("type").and_then(|v| v.as_str()).unwrap_or("");
-
-    match msg_type {
-        "input_mouse" => {
-            let _ = client
-                .send_command(
-                    "Input.dispatchMouseEvent",
-                    Some(json!({
-                        "type": parsed.get("eventType").and_then(|v| v.as_str()).unwrap_or("mouseMoved"),
-                        "x": parsed.get("x").and_then(|v| v.as_f64()).unwrap_or(0.0),
-                        "y": parsed.get("y").and_then(|v| v.as_f64()).unwrap_or(0.0),
-                        "button": parsed.get("button").and_then(|v| v.as_str()).unwrap_or("none"),
-                        "clickCount": parsed.get("clickCount").and_then(|v| v.as_i64()).unwrap_or(0),
-                        "deltaX": parsed.get("deltaX").and_then(|v| v.as_f64()).unwrap_or(0.0),
-                        "deltaY": parsed.get("deltaY").and_then(|v| v.as_f64()).unwrap_or(0.0),
-                        "modifiers": parsed.get("modifiers").and_then(|v| v.as_i64()).unwrap_or(0),
-                    })),
-                    Some(session_id),
-                )
-                .await;
-        }
-        "input_keyboard" => {
-            let _ = client
-                .send_command(
-                    "Input.dispatchKeyEvent",
-                    Some(json!({
-                        "type": parsed.get("eventType").and_then(|v| v.as_str()).unwrap_or("keyDown"),
-                        "key": parsed.get("key"),
-                        "code": parsed.get("code"),
-                        "text": parsed.get("text"),
-                        "modifiers": parsed.get("modifiers").and_then(|v| v.as_i64()).unwrap_or(0),
-                    })),
-                    Some(session_id),
-                )
-                .await;
-        }
-        "input_touch" => {
-            let _ = client
-                .send_command(
-                    "Input.dispatchTouchEvent",
-                    Some(json!({
-                        "type": parsed.get("eventType").and_then(|v| v.as_str()).unwrap_or("touchStart"),
-                        "touchPoints": parsed.get("touchPoints").unwrap_or(&json!([])),
-                        "modifiers": parsed.get("modifiers").and_then(|v| v.as_i64()).unwrap_or(0),
-                    })),
-                    Some(session_id),
-                )
-                .await;
-        }
-        "status" => {
-            // Client requesting status -- handled via broadcast_status from the caller
-        }
-        _ => {}
-    }
-}
-
-pub fn is_allowed_origin(origin: Option<&str>) -> bool {
-    match origin {
-        None => true,
-        Some(o) => {
-            if o.starts_with("file://") {
-                return true;
-            }
-            if let Ok(url) = url::Url::parse(o) {
-                let host = url.host_str().unwrap_or("");
-                host == "localhost" || host == "127.0.0.1" || host == "::1" || host == "[::1]"
-            } else {
-                false
-            }
-        }
-    }
-}
-
-pub async fn start_screencast(
-    client: &CdpClient,
-    session_id: &str,
-    format: &str,
-    quality: i32,
-    max_width: i32,
-    max_height: i32,
-) -> Result<(), String> {
-    client
-        .send_command(
-            "Page.startScreencast",
-            Some(json!({
-                "format": format,
-                "quality": quality,
-                "maxWidth": max_width,
-                "maxHeight": max_height,
-                "everyNthFrame": 1,
-            })),
-            Some(session_id),
-        )
-        .await?;
-    Ok(())
-}
-
-pub async fn stop_screencast(client: &CdpClient, session_id: &str) -> Result<(), String> {
-    client
-        .send_command_no_params("Page.stopScreencast", Some(session_id))
-        .await?;
-    Ok(())
-}
-
-pub async fn ack_screencast_frame(
-    client: &CdpClient,
-    session_id: &str,
-    screencast_session_id: i64,
-) -> Result<(), String> {
-    client
-        .send_command(
-            "Page.screencastFrameAck",
-            Some(json!({ "sessionId": screencast_session_id })),
-            Some(session_id),
-        )
-        .await?;
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_allowed_origin_none() {
-        assert!(is_allowed_origin(None));
-    }
-
-    #[test]
-    fn test_allowed_origin_file() {
-        assert!(is_allowed_origin(Some("file:///path/to/file")));
-    }
-
-    #[test]
-    fn test_allowed_origin_localhost() {
-        assert!(is_allowed_origin(Some("http://localhost:3000")));
-        assert!(is_allowed_origin(Some("http://127.0.0.1:8080")));
-    }
-
-    #[test]
-    fn test_disallowed_origin() {
-        assert!(!is_allowed_origin(Some("http://evil.com")));
-    }
-
-    #[test]
-    fn test_frame_metadata_default() {
-        let meta = FrameMetadata::default();
-        assert_eq!(meta.device_width, 1280);
-        assert_eq!(meta.device_height, 720);
-        assert_eq!(meta.page_scale_factor, 1.0);
-    }
-}

cli/src/native/stream/cdp_loop.rs

@@ -0,0 +1,325 @@
+use serde_json::{json, Value};
+use std::sync::Arc;
+
+use tokio::sync::{broadcast, watch, Mutex, RwLock};
+
+use crate::native::cdp::client::CdpClient;
+use crate::native::network;
+
+use super::timestamp_ms;
+
+/// Background task that subscribes to CDP events and broadcasts screencast frames in real-time.
+/// Also handles auto-start/stop of screencast based on WebSocket client count.
+#[allow(clippy::too_many_arguments)]
+pub(super) async fn cdp_event_loop(
+    frame_tx: broadcast::Sender<String>,
+    client_slot: Arc<RwLock<Option<Arc<CdpClient>>>>,
+    client_notify: Arc<tokio::sync::Notify>,
+    screencasting: Arc<Mutex<bool>>,
+    client_count: Arc<Mutex<usize>>,
+    cdp_session_id: Arc<RwLock<Option<String>>>,
+    viewport_width: Arc<Mutex<u32>>,
+    viewport_height: Arc<Mutex<u32>>,
+    last_frame: Arc<RwLock<Option<String>>>,
+    last_tabs: Arc<RwLock<Vec<Value>>>,
+    last_engine: Arc<RwLock<String>>,
+    recording: Arc<Mutex<bool>>,
+    mut shutdown_rx: watch::Receiver<bool>,
+) {
+    loop {
+        tokio::select! {
+            changed = shutdown_rx.changed() => {
+                if changed.is_err() || *shutdown_rx.borrow() {
+                    let session_id = cdp_session_id.read().await.clone();
+                    if *screencasting.lock().await {
+                        if let Some(ref client) = *client_slot.read().await {
+                            let _ = client
+                                .send_command_no_params("Page.stopScreencast", session_id.as_deref())
+                                .await;
+                        }
+                        let mut sc = screencasting.lock().await;
+                        *sc = false;
+                    }
+                    return;
+                }
+            }
+            _ = client_notify.notified() => {}
+        }
+
+        let count = *client_count.lock().await;
+        let guard = client_slot.read().await;
+
+        if count > 0 {
+            if let Some(ref client) = *guard {
+                let mut event_rx = client.subscribe();
+                let client_arc = Arc::clone(client);
+                drop(guard);
+
+                let session_id = cdp_session_id.read().await.clone();
+
+                let vw = *viewport_width.lock().await;
+                let vh = *viewport_height.lock().await;
+
+                let eng = last_engine.read().await.clone();
+                let supports_screencast = eng == "chrome";
+
+                if supports_screencast {
+                    let _ = client_arc
+                        .send_command(
+                            "Page.startScreencast",
+                            Some(json!({
+                                "format": "jpeg",
+                                "quality": 80,
+                                "maxWidth": vw,
+                                "maxHeight": vh,
+                                "everyNthFrame": 1,
+                            })),
+                            session_id.as_deref(),
+                        )
+                        .await;
+                }
+
+                {
+                    let mut sc = screencasting.lock().await;
+                    *sc = supports_screencast;
+                }
+
+                let rec = *recording.lock().await;
+                let status = json!({
+                    "type": "status",
+                    "connected": true,
+                    "screencasting": supports_screencast,
+                    "viewportWidth": vw,
+                    "viewportHeight": vh,
+                    "engine": eng,
+                    "recording": rec,
+                });
+                let _ = frame_tx.send(status.to_string());
+
+                loop {
+                    tokio::select! {
+                        changed = shutdown_rx.changed() => {
+                            if changed.is_err() || *shutdown_rx.borrow() {
+                                if supports_screencast {
+                                    let session_id = cdp_session_id.read().await.clone();
+                                    let _ = client_arc
+                                        .send_command_no_params("Page.stopScreencast", session_id.as_deref())
+                                        .await;
+                                }
+                                let mut sc = screencasting.lock().await;
+                                *sc = false;
+                                return;
+                            }
+                        }
+                        event = event_rx.recv() => {
+                            match event {
+                                Ok(evt) => {
+                                    if evt.method == "Page.frameNavigated" {
+                                        if let Some(frame) = evt.params.get("frame") {
+                                            let is_main = frame
+                                                .get("parentId")
+                                                .and_then(|v| v.as_str())
+                                                .is_none_or(|s| s.is_empty());
+                                            if is_main {
+                                                if let Some(url) = frame.get("url").and_then(|v| v.as_str()) {
+                                                    {
+                                                        let mut tabs = last_tabs.write().await;
+                                                        for tab in tabs.iter_mut() {
+                                                            if tab.get("active").and_then(|v| v.as_bool()).unwrap_or(false) {
+                                                                tab.as_object_mut().map(|o| o.insert("url".to_string(), json!(url)));
+                                                            }
+                                                        }
+                                                    }
+                                                    let msg = json!({
+                                                        "type": "url",
+                                                        "url": url,
+                                                        "timestamp": timestamp_ms(),
+                                                    });
+                                                    let _ = frame_tx.send(msg.to_string());
+                                                }
+                                            }
+                                        }
+                                    } else if evt.method == "Page.screencastFrame" {
+                                        if let Some(sid) = evt.params.get("sessionId").and_then(|v| v.as_i64()) {
+                                            let _ = client_arc.send_command(
+                                                "Page.screencastFrameAck",
+                                                Some(json!({ "sessionId": sid })),
+                                                evt.session_id.as_deref(),
+                                            ).await;
+                                        }
+
+                                        if let Some(data) = evt.params.get("data").and_then(|v| v.as_str()) {
+                                            let meta = evt.params.get("metadata");
+                                            let msg = json!({
+                                                "type": "frame",
+                                                "data": data,
+                                                "metadata": {
+                                                    "offsetTop": meta.and_then(|m| m.get("offsetTop")).and_then(|v| v.as_f64()).unwrap_or(0.0),
+                                                    "pageScaleFactor": meta.and_then(|m| m.get("pageScaleFactor")).and_then(|v| v.as_f64()).unwrap_or(1.0),
+                                                    "deviceWidth": vw,
+                                                    "deviceHeight": vh,
+                                                    "scrollOffsetX": meta.and_then(|m| m.get("scrollOffsetX")).and_then(|v| v.as_f64()).unwrap_or(0.0),
+                                                    "scrollOffsetY": meta.and_then(|m| m.get("scrollOffsetY")).and_then(|v| v.as_f64()).unwrap_or(0.0),
+                                                    "timestamp": meta.and_then(|m| m.get("timestamp")).and_then(|v| v.as_u64()).unwrap_or(0),
+                                                }
+                                            });
+                                            let msg_str = msg.to_string();
+                                            {
+                                                let mut lf = last_frame.write().await;
+                                                *lf = Some(msg_str.clone());
+                                            }
+                                            let _ = frame_tx.send(msg_str);
+                                        }
+                                    } else if evt.method == "Runtime.consoleAPICalled" {
+                                        let level = evt.params.get("type")
+                                            .and_then(|v| v.as_str())
+                                            .unwrap_or("log");
+                                        let raw_args = evt.params.get("args")
+                                            .and_then(|v| v.as_array())
+                                            .cloned()
+                                            .unwrap_or_default();
+                                        let text = network::format_console_args(&raw_args);
+                                        if !text.is_empty() {
+                                            let mut msg = json!({
+                                                "type": "console",
+                                                "level": level,
+                                                "text": text,
+                                                "timestamp": timestamp_ms(),
+                                            });
+                                            if !raw_args.is_empty() {
+                                                msg.as_object_mut().unwrap().insert(
+                                                    "args".to_string(),
+                                                    Value::Array(raw_args),
+                                                );
+                                            }
+                                            let _ = frame_tx.send(msg.to_string());
+                                        }
+                                    } else if evt.method == "Runtime.exceptionThrown" {
+                                        let text = evt.params.get("exceptionDetails")
+                                            .and_then(|d| {
+                                                d.get("exception")
+                                                    .and_then(|e| e.get("description").and_then(|v| v.as_str()))
+                                                    .or_else(|| d.get("text").and_then(|v| v.as_str()))
+                                            })
+                                            .unwrap_or("Unknown error");
+                                        let line = evt.params.get("exceptionDetails")
+                                            .and_then(|d| d.get("lineNumber").and_then(|v| v.as_i64()));
+                                        let column = evt.params.get("exceptionDetails")
+                                            .and_then(|d| d.get("columnNumber").and_then(|v| v.as_i64()));
+                                        let msg = json!({
+                                            "type": "page_error",
+                                            "text": text,
+                                            "line": line,
+                                            "column": column,
+                                            "timestamp": timestamp_ms(),
+                                        });
+                                        let _ = frame_tx.send(msg.to_string());
+                                    }
+                                }
+                                Err(broadcast::error::RecvError::Lagged(_)) => continue,
+                                Err(broadcast::error::RecvError::Closed) => break,
+                            }
+                        }
+                        _ = client_notify.notified() => {
+                            let count = *client_count.lock().await;
+                            let new_session_id = cdp_session_id.read().await.clone();
+                            if count == 0 {
+                                if supports_screencast {
+                                    let _ = client_arc
+                                        .send_command_no_params("Page.stopScreencast", session_id.as_deref())
+                                        .await;
+                                }
+                                let mut sc = screencasting.lock().await;
+                                *sc = false;
+                                break;
+                            }
+                            let client_changed = {
+                                let guard = client_slot.read().await;
+                                let same = guard
+                                    .as_ref()
+                                    .is_some_and(|c| Arc::ptr_eq(c, &client_arc));
+                                !same
+                            };
+                            let session_changed = new_session_id != session_id;
+                            let new_vw = *viewport_width.lock().await;
+                            let new_vh = *viewport_height.lock().await;
+                            let viewport_changed = new_vw != vw || new_vh != vh;
+                            if client_changed || session_changed || viewport_changed {
+                                if supports_screencast {
+                                    let _ = client_arc
+                                        .send_command_no_params("Page.stopScreencast", session_id.as_deref())
+                                        .await;
+                                }
+                                let mut sc = screencasting.lock().await;
+                                *sc = false;
+                                client_notify.notify_one();
+                                break;
+                            }
+                        }
+                    }
+                }
+            } else {
+                drop(guard);
+            }
+        } else {
+            let was_screencasting = *screencasting.lock().await;
+            if was_screencasting {
+                if let Some(ref client) = *guard {
+                    let session_id = cdp_session_id.read().await.clone();
+                    let _ = client
+                        .send_command_no_params("Page.stopScreencast", session_id.as_deref())
+                        .await;
+                }
+                let mut sc = screencasting.lock().await;
+                *sc = false;
+            }
+            drop(guard);
+        }
+    }
+}
+
+pub async fn start_screencast(
+    client: &CdpClient,
+    session_id: &str,
+    format: &str,
+    quality: i32,
+    max_width: i32,
+    max_height: i32,
+) -> Result<(), String> {
+    client
+        .send_command(
+            "Page.startScreencast",
+            Some(json!({
+                "format": format,
+                "quality": quality,
+                "maxWidth": max_width,
+                "maxHeight": max_height,
+                "everyNthFrame": 1,
+            })),
+            Some(session_id),
+        )
+        .await?;
+    Ok(())
+}
+
+pub async fn stop_screencast(client: &CdpClient, session_id: &str) -> Result<(), String> {
+    client
+        .send_command_no_params("Page.stopScreencast", Some(session_id))
+        .await?;
+    Ok(())
+}
+
+pub async fn ack_screencast_frame(
+    client: &CdpClient,
+    session_id: &str,
+    screencast_session_id: i64,
+) -> Result<(), String> {
+    client
+        .send_command(
+            "Page.screencastFrameAck",
+            Some(json!({ "sessionId": screencast_session_id })),
+            Some(session_id),
+        )
+        .await?;
+    Ok(())
+}

cli/src/native/stream/chat.rs

@@ -0,0 +1,970 @@
+use std::sync::OnceLock;
+
+use serde_json::{json, Value};
+
+use tokio::io::AsyncWriteExt;
+
+use super::http::cors_headers_for_origin;
+
+pub(crate) const DEFAULT_AI_GATEWAY_URL: &str = "https://ai-gateway.vercel.sh";
+
+static HTTP_CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
+
+pub(crate) fn http_client() -> &'static reqwest::Client {
+    HTTP_CLIENT.get_or_init(reqwest::Client::new)
+}
+
+pub(crate) fn is_chat_enabled() -> bool {
+    std::env::var("AI_GATEWAY_API_KEY").is_ok()
+}
+
+pub(super) fn chat_status_json() -> String {
+    let enabled = is_chat_enabled();
+    let mut obj = json!({ "enabled": enabled });
+    if enabled {
+        if let Ok(model) = std::env::var("AI_GATEWAY_MODEL") {
+            obj["model"] = Value::String(model);
+        }
+    }
+    obj.to_string()
+}
+
+pub(super) async fn handle_models_request(
+    stream: &mut tokio::net::TcpStream,
+    origin: Option<&str>,
+) {
+    let cors = cors_headers_for_origin(origin);
+    let gateway_url = std::env::var("AI_GATEWAY_URL")
+        .unwrap_or_else(|_| DEFAULT_AI_GATEWAY_URL.to_string())
+        .trim_end_matches('/')
+        .to_string();
+    let api_key = match std::env::var("AI_GATEWAY_API_KEY") {
+        Ok(k) => k,
+        Err(_) => {
+            let body = r#"{"data":[]}"#;
+            let resp = format!(
+                "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n{cors}\r\n",
+                body.len()
+            );
+            let _ = stream.write_all(resp.as_bytes()).await;
+            let _ = stream.write_all(body.as_bytes()).await;
+            return;
+        }
+    };
+
+    let url = format!("{}/v1/models", gateway_url);
+    let client = http_client();
+    let result = client
+        .get(&url)
+        .header("Authorization", format!("Bearer {}", api_key))
+        .send()
+        .await;
+
+    let body = match result {
+        Ok(r) if r.status().is_success() => r
+            .text()
+            .await
+            .unwrap_or_else(|_| r#"{"data":[]}"#.to_string()),
+        _ => r#"{"data":[]}"#.to_string(),
+    };
+
+    let resp = format!(
+        "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n{cors}\r\n",
+        body.len()
+    );
+    let _ = stream.write_all(resp.as_bytes()).await;
+    let _ = stream.write_all(body.as_bytes()).await;
+}
+
+const SKILL_NAMES: &[&str] = &["chrome-use", "slack", "electron", "dogfood", "agentcore"];
+
+/// Locate the `skills/` directory by walking up from the executable.
+/// Works for npm installs (binary in `bin/`, skills at `../skills/`) and
+/// dev builds (binary deep in `cli/target/`, skills at repo root).
+fn find_skills_dir() -> Option<std::path::PathBuf> {
+    let exe = std::env::current_exe().ok()?;
+    let real = exe.canonicalize().unwrap_or(exe);
+    let mut dir = real.parent();
+    while let Some(d) = dir {
+        let candidate = d.join("skills");
+        if candidate.join("chrome-use").join("SKILL.md").exists() {
+            return Some(candidate);
+        }
+        dir = d.parent();
+    }
+    None
+}
+
+fn load_skills() -> Vec<(String, String)> {
+    let Some(skills_dir) = find_skills_dir() else {
+        return Vec::new();
+    };
+    SKILL_NAMES
+        .iter()
+        .filter_map(|name| {
+            let path = skills_dir.join(name).join("SKILL.md");
+            let content = std::fs::read_to_string(&path).ok()?;
+            Some((name.to_string(), content))
+        })
+        .collect()
+}
+
+fn strip_frontmatter(s: &str) -> &str {
+    if !s.starts_with("---") {
+        return s;
+    }
+    if let Some(end) = s[3..].find("---") {
+        let after = &s[3 + end + 3..];
+        after.trim_start_matches(['\n', '\r'])
+    } else {
+        s
+    }
+}
+
+pub(crate) fn get_system_prompt() -> &'static str {
+    static PROMPT: OnceLock<String> = OnceLock::new();
+    PROMPT.get_or_init(|| {
+        let skills = load_skills();
+
+        let mut sections = String::new();
+        for (name, content) in &skills {
+            let body = strip_frontmatter(content);
+            sections.push_str(&format!("\n\n<skill name=\"{}\">\n{}\n</skill>", name, body.trim()));
+        }
+
+        format!(
+            r#"You are an AI assistant that controls a browser through chrome-use. You have an active browser session, but you can also create new sessions.
+
+RULES:
+- You MUST use the agent_browser tool for every browser action. NEVER claim you performed an action without calling the tool.
+- If the user asks you to do something, call the tool first, then describe the result.
+- If a request is outside your capabilities (e.g. system operations), say so honestly. Do not improvise or pretend.
+- One tool call per command. Do not chain with `&&` or `;`.
+- Do not add `--json`.
+- Do not run non-chrome-use programs.
+- Keep responses concise.
+- For screenshots, omit the path argument so they save to the default location (which will be displayed inline). Screenshots from tool calls are ALREADY shown to the user. Do NOT re-display them with markdown image syntax in your text response. Never use `![...]()` to reference screenshots.
+- To create a new session: add `--session <name>` to any command (e.g. `chrome-use --session my-session open https://example.com`). If the session does not exist, it will be created automatically.
+- To use a different browser engine: add `--engine <engine>` (e.g. `chrome-use --session lp-session --engine lightpanda open https://example.com`). Supported engines: chrome (default), lightpanda.
+
+The following skill references describe chrome-use capabilities in detail. Use them when deciding which commands to run and how to approach tasks.
+{sections}"#,
+        )
+    })
+}
+
+pub(crate) const CHAT_TOOLS: &str = r#"[{"type":"function","function":{"name":"agent_browser","description":"Execute an chrome-use command. Runs against the active session by default. Add --session <name> to target or create a different session, and --engine <engine> to choose a browser engine.","parameters":{"type":"object","properties":{"command":{"type":"string","description":"The command to execute, e.g. 'chrome-use open https://google.com' or 'chrome-use --session new-session open https://example.com' or 'chrome-use snapshot -i' or 'chrome-use click @e3'"}},"required":["command"]}}}]"#;
+
+pub(crate) const COMPACT_THRESHOLD_CHARS: usize = 200_000;
+pub(crate) const KEEP_RECENT_MESSAGES: usize = 6;
+
+pub(crate) fn estimate_chars(messages: &[Value]) -> usize {
+    messages
+        .iter()
+        .map(|m| {
+            let content_len = m
+                .get("content")
+                .map(|c| {
+                    if let Some(s) = c.as_str() {
+                        s.len()
+                    } else {
+                        c.to_string().len()
+                    }
+                })
+                .unwrap_or(0);
+            let tc_len = m
+                .get("tool_calls")
+                .map(|t| t.to_string().len())
+                .unwrap_or(0);
+            content_len + tc_len
+        })
+        .sum()
+}
+
+pub(crate) fn find_safe_split(messages: &[Value], keep_recent: usize) -> usize {
+    if messages.len() <= keep_recent + 1 {
+        return 1;
+    }
+    let desired = messages.len() - keep_recent;
+    for i in (1..=desired).rev() {
+        if messages[i].get("role").and_then(|r| r.as_str()) == Some("user") {
+            return i;
+        }
+    }
+    desired.max(1)
+}
+
+fn build_summary_text(messages: &[Value]) -> String {
+    let mut text = String::new();
+    for msg in messages {
+        let role = msg
+            .get("role")
+            .and_then(|r| r.as_str())
+            .unwrap_or("unknown");
+        if let Some(content) = msg.get("content").and_then(|c| c.as_str()) {
+            if !content.is_empty() {
+                let truncated = if content.len() > 2000 {
+                    format!("{}...[truncated]", &content[..2000])
+                } else {
+                    content.to_string()
+                };
+                text.push_str(&format!("[{}] {}\n\n", role, truncated));
+            }
+        }
+        if let Some(tcs) = msg.get("tool_calls").and_then(|t| t.as_array()) {
+            for tc in tcs {
+                let name = tc
+                    .get("function")
+                    .and_then(|f| f.get("name"))
+                    .and_then(|n| n.as_str())
+                    .unwrap_or("");
+                let args = tc
+                    .get("function")
+                    .and_then(|f| f.get("arguments"))
+                    .and_then(|a| a.as_str())
+                    .unwrap_or("");
+                text.push_str(&format!("[assistant tool:{}] {}\n", name, args));
+            }
+        }
+    }
+    text
+}
+
+pub(crate) async fn summarize_for_compaction(
+    client: &reqwest::Client,
+    url: &str,
+    api_key: &str,
+    model: &str,
+    messages: &[Value],
+) -> Option<String> {
+    let conversation = build_summary_text(messages);
+    if conversation.is_empty() {
+        return None;
+    }
+
+    let body = json!({
+        "model": model,
+        "messages": [
+            {
+                "role": "system",
+                "content": "Summarize this browser automation conversation concisely. Preserve: URLs visited, actions performed, current page state, errors encountered, and user goals. Output only the summary."
+            },
+            {
+                "role": "user",
+                "content": conversation
+            }
+        ],
+        "max_tokens": 1024,
+        "stream": false,
+    });
+
+    let resp = client
+        .post(url)
+        .header("Authorization", format!("Bearer {}", api_key))
+        .header("Content-Type", "application/json")
+        .body(body.to_string())
+        .send()
+        .await
+        .ok()?;
+
+    if !resp.status().is_success() {
+        return None;
+    }
+
+    let result: Value = resp.json().await.ok()?;
+    result
+        .get("choices")
+        .and_then(|c| c.get(0))
+        .and_then(|c| c.get("message"))
+        .and_then(|m| m.get("content"))
+        .and_then(|c| c.as_str())
+        .map(|s| s.to_string())
+}
+
+const SCREENSHOT_MAX_WIDTH: u32 = 1024;
+const SCREENSHOT_JPEG_QUALITY: u8 = 40;
+
+fn compress_image_to_jpeg(raw_bytes: &[u8]) -> Option<Vec<u8>> {
+    let img = image::load_from_memory(raw_bytes).ok()?;
+    let img = if img.width() > SCREENSHOT_MAX_WIDTH {
+        img.resize(
+            SCREENSHOT_MAX_WIDTH,
+            u32::MAX,
+            image::imageops::FilterType::Triangle,
+        )
+    } else {
+        img
+    };
+    let mut buf = std::io::Cursor::new(Vec::new());
+    let encoder =
+        image::codecs::jpeg::JpegEncoder::new_with_quality(&mut buf, SCREENSHOT_JPEG_QUALITY);
+    img.write_with_encoder(encoder).ok()?;
+    Some(buf.into_inner())
+}
+
+fn has_image_extension(s: &str) -> bool {
+    let lower = s.to_lowercase();
+    lower.ends_with(".png") || lower.ends_with(".jpg") || lower.ends_with(".jpeg")
+}
+
+fn extract_image_path(text: &str) -> Option<String> {
+    for line in text.lines() {
+        let trimmed = line.trim();
+        // Whole line is a path (handles paths with spaces)
+        if has_image_extension(trimmed) && std::path::Path::new(trimmed).exists() {
+            return Some(trimmed.to_string());
+        }
+        for suffix in [".png", ".jpg", ".jpeg"] {
+            if let Some(pos) = trimmed.to_lowercase().rfind(suffix) {
+                let end = pos + suffix.len();
+                let candidate = &trimmed[..end];
+                let start = candidate
+                    .rfind(|c: char| c.is_whitespace())
+                    .map(|i| i + 1)
+                    .unwrap_or(0);
+                let path = &candidate[start..];
+                if !path.is_empty() && std::path::Path::new(path).exists() {
+                    return Some(path.to_string());
+                }
+            }
+        }
+    }
+    None
+}
+
+fn enrich_tool_output(result: &str) -> String {
+    let Some(path) = extract_image_path(result) else {
+        return result.to_string();
+    };
+
+    let Ok(raw_bytes) = std::fs::read(&path) else {
+        return result.to_string();
+    };
+
+    let (jpeg_bytes, mime) = match compress_image_to_jpeg(&raw_bytes) {
+        Some(compressed) => (compressed, "image/jpeg"),
+        None => {
+            let lower = path.to_lowercase();
+            (
+                raw_bytes,
+                if lower.ends_with(".png") {
+                    "image/png"
+                } else {
+                    "image/jpeg"
+                },
+            )
+        }
+    };
+
+    let b64 = base64::Engine::encode(&base64::engine::general_purpose::STANDARD, &jpeg_bytes);
+    let data_url = format!("data:{};base64,{}", mime, b64);
+
+    json!({
+        "text": result,
+        "image": data_url
+    })
+    .to_string()
+}
+
+const ALLOWED_COMMANDS: &[&str] = &[
+    "open",
+    "goto",
+    "navigate",
+    "back",
+    "forward",
+    "reload",
+    "click",
+    "dblclick",
+    "fill",
+    "type",
+    "hover",
+    "focus",
+    "check",
+    "uncheck",
+    "select",
+    "drag",
+    "upload",
+    "download",
+    "press",
+    "key",
+    "keydown",
+    "keyup",
+    "keyboard",
+    "scroll",
+    "scrollintoview",
+    "scrollinto",
+    "wait",
+    "screenshot",
+    "pdf",
+    "snapshot",
+    "eval",
+    "close",
+    "quit",
+    "exit",
+    "inspect",
+    "auth",
+    "confirm",
+    "deny",
+    "connect",
+    "cookies",
+    "storage",
+    "window",
+    "frame",
+    "dialog",
+    "trace",
+    "profiler",
+    "record",
+    "har",
+    "network",
+    "title",
+    "url",
+    "console",
+    "errors",
+    "highlight",
+    "state",
+    "emulate",
+    "video",
+    "tap",
+    "swipe",
+    "device",
+    "batch",
+    "diff",
+    "find",
+    "role",
+    "text",
+    "label",
+    "placeholder",
+    "alt",
+    "testid",
+    "first",
+    "last",
+    "nth",
+    "mouse",
+    "touchscreen",
+    "attribute",
+    "property",
+    "set",
+    "get",
+    "is",
+    "stream",
+    "tab",
+    "clipboard",
+    "session",
+];
+
+const ALLOWED_GLOBAL_FLAGS: &[&str] = &["--session", "--engine"];
+
+pub(crate) async fn execute_chat_tool(session: &str, command: &str) -> String {
+    let exe = match std::env::current_exe() {
+        Ok(p) => p,
+        Err(e) => return format!("Failed to resolve executable: {}", e),
+    };
+
+    let single = command.split("&&").next().unwrap_or(command);
+    let single = single.split(';').next().unwrap_or(single).trim();
+    let stripped = single.strip_prefix("chrome-use ").unwrap_or(single);
+    let words = crate::commands::shell_words_split(stripped);
+
+    let mut global_flags: Vec<String> = Vec::new();
+    let mut cmd_words: Vec<String> = Vec::new();
+    let mut has_session_flag = false;
+    let mut i = 0;
+    while i < words.len() {
+        if ALLOWED_GLOBAL_FLAGS.contains(&words[i].as_str()) {
+            if words[i] == "--session" {
+                has_session_flag = true;
+            }
+            global_flags.push(words[i].clone());
+            if i + 1 < words.len() {
+                global_flags.push(words[i + 1].clone());
+                i += 2;
+            } else {
+                i += 1;
+            }
+        } else {
+            cmd_words.push(words[i].clone());
+            i += 1;
+        }
+    }
+
+    let first_cmd = cmd_words.first().map(|s| s.as_str()).unwrap_or("");
+    if !ALLOWED_COMMANDS.contains(&first_cmd) {
+        return format!(
+            "Blocked: '{}' is not a valid chrome-use command.",
+            first_cmd
+        );
+    }
+
+    let mut args: Vec<String> = Vec::new();
+    if !has_session_flag {
+        args.push("--session".into());
+        args.push(session.into());
+    }
+    args.extend(global_flags);
+    args.extend(cmd_words);
+
+    let mut cmd = tokio::process::Command::new(&exe);
+    cmd.args(&args)
+        .env_remove("AGENT_BROWSER_DASHBOARD")
+        .env_remove("AGENT_BROWSER_DASHBOARD_PORT")
+        .env_remove("AGENT_BROWSER_STREAM_PORT");
+
+    match cmd.output().await {
+        Ok(output) => {
+            let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
+            let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+            if stdout.is_empty() && !stderr.is_empty() {
+                stderr
+            } else if stdout.is_empty() {
+                "Command completed with no output.".to_string()
+            } else {
+                stdout
+            }
+        }
+        Err(e) => format!("Failed to execute command: {}", e),
+    }
+}
+
+async fn stream_gateway_response(
+    stream: &mut tokio::net::TcpStream,
+    gw_response: reqwest::Response,
+) -> Vec<(String, String, String)> {
+    use futures_util::StreamExt as _;
+
+    let mut text_part_id = uuid::Uuid::new_v4().to_string();
+    let mut text_started = false;
+    let mut tool_calls: Vec<(String, String, String)> = Vec::new();
+    let mut tool_call_args: std::collections::HashMap<usize, (String, String, String)> =
+        std::collections::HashMap::new();
+    let mut byte_stream = gw_response.bytes_stream();
+    let mut buffer = String::new();
+
+    while let Some(chunk_result) = byte_stream.next().await {
+        let chunk = match chunk_result {
+            Ok(c) => c,
+            Err(_) => break,
+        };
+
+        buffer.push_str(&String::from_utf8_lossy(&chunk));
+
+        while let Some(newline_pos) = buffer.find('\n') {
+            let line = buffer[..newline_pos].trim_end_matches('\r').to_string();
+            buffer = buffer[newline_pos + 1..].to_string();
+
+            if line.is_empty() {
+                continue;
+            }
+            let Some(data) = line.strip_prefix("data: ") else {
+                continue;
+            };
+            if data == "[DONE]" {
+                if text_started {
+                    let ev = format!("data: {}\n\n", json!({"type":"text-end","id":text_part_id}));
+                    let _ = stream.write_all(ev.as_bytes()).await;
+                }
+                let mut indices: Vec<usize> = tool_call_args.keys().copied().collect();
+                indices.sort();
+                for idx in indices {
+                    if let Some(tc) = tool_call_args.remove(&idx) {
+                        tool_calls.push(tc);
+                    }
+                }
+                return tool_calls;
+            }
+            let Ok(sse_json) = serde_json::from_str::<Value>(data) else {
+                continue;
+            };
+            let delta = sse_json
+                .get("choices")
+                .and_then(|c| c.get(0))
+                .and_then(|c| c.get("delta"));
+            let Some(delta) = delta else { continue };
+
+            if let Some(text) = delta.get("content").and_then(|c| c.as_str()) {
+                if !text.is_empty() {
+                    if !text_started {
+                        let ev = format!(
+                            "data: {}\n\n",
+                            json!({"type":"text-start","id":text_part_id})
+                        );
+                        if stream.write_all(ev.as_bytes()).await.is_err() {
+                            return tool_calls;
+                        }
+                        text_started = true;
+                    }
+                    let ev = format!(
+                        "data: {}\n\n",
+                        json!({"type":"text-delta","id":text_part_id,"delta":text})
+                    );
+                    if stream.write_all(ev.as_bytes()).await.is_err() {
+                        return tool_calls;
+                    }
+                }
+            }
+
+            if let Some(tcs) = delta.get("tool_calls").and_then(|t| t.as_array()) {
+                if text_started {
+                    let ev = format!("data: {}\n\n", json!({"type":"text-end","id":text_part_id}));
+                    let _ = stream.write_all(ev.as_bytes()).await;
+                    text_started = false;
+                    text_part_id = uuid::Uuid::new_v4().to_string();
+                }
+
+                for tc in tcs {
+                    let idx = tc.get("index").and_then(|i| i.as_u64()).unwrap_or(0) as usize;
+                    if let std::collections::hash_map::Entry::Vacant(e) = tool_call_args.entry(idx)
+                    {
+                        let id = tc
+                            .get("id")
+                            .and_then(|i| i.as_str())
+                            .unwrap_or("")
+                            .to_string();
+                        let name = tc
+                            .get("function")
+                            .and_then(|f| f.get("name"))
+                            .and_then(|n| n.as_str())
+                            .unwrap_or("")
+                            .to_string();
+                        let ev = format!(
+                            "data: {}\n\n",
+                            json!({"type":"tool-input-start","toolCallId":id,"toolName":name})
+                        );
+                        let _ = stream.write_all(ev.as_bytes()).await;
+                        e.insert((id, name, String::new()));
+                    }
+                    if let Some(arg_delta) = tc
+                        .get("function")
+                        .and_then(|f| f.get("arguments"))
+                        .and_then(|a| a.as_str())
+                    {
+                        let entry = tool_call_args.get_mut(&idx).unwrap();
+                        entry.2.push_str(arg_delta);
+                        let ev = format!(
+                            "data: {}\n\n",
+                            json!({"type":"tool-input-delta","toolCallId":entry.0,"inputTextDelta":arg_delta})
+                        );
+                        let _ = stream.write_all(ev.as_bytes()).await;
+                    }
+                }
+            }
+        }
+    }
+
+    if text_started {
+        let ev = format!("data: {}\n\n", json!({"type":"text-end","id":text_part_id}));
+        let _ = stream.write_all(ev.as_bytes()).await;
+    }
+    let mut indices: Vec<usize> = tool_call_args.keys().copied().collect();
+    indices.sort();
+    for idx in indices {
+        if let Some(tc) = tool_call_args.remove(&idx) {
+            tool_calls.push(tc);
+        }
+    }
+    tool_calls
+}
+
+pub(super) async fn handle_chat_request(
+    stream: &mut tokio::net::TcpStream,
+    body: &str,
+    origin: Option<&str>,
+) {
+    let cors = cors_headers_for_origin(origin);
+    let gateway_url = std::env::var("AI_GATEWAY_URL")
+        .unwrap_or_else(|_| DEFAULT_AI_GATEWAY_URL.to_string())
+        .trim_end_matches('/')
+        .to_string();
+    let api_key = match std::env::var("AI_GATEWAY_API_KEY") {
+        Ok(k) => k,
+        Err(_) => {
+            let err = r#"{"error":"AI_GATEWAY_API_KEY not set. Set the AI_GATEWAY_API_KEY environment variable to enable AI chat."}"#;
+            let resp = format!(
+                "HTTP/1.1 500 Internal Server Error\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n{cors}\r\n",
+                err.len()
+            );
+            let _ = stream.write_all(resp.as_bytes()).await;
+            let _ = stream.write_all(err.as_bytes()).await;
+            return;
+        }
+    };
+
+    let default_model = std::env::var("AI_GATEWAY_MODEL")
+        .unwrap_or_else(|_| "anthropic/claude-sonnet-4.6".to_string());
+
+    let parsed: Value = match serde_json::from_str(body) {
+        Ok(v) => v,
+        Err(e) => {
+            let err = format!(r#"{{"error":"Invalid JSON: {}"}}"#, e);
+            let resp = format!(
+                "HTTP/1.1 400 Bad Request\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n{cors}\r\n",
+                err.len()
+            );
+            let _ = stream.write_all(resp.as_bytes()).await;
+            let _ = stream.write_all(err.as_bytes()).await;
+            return;
+        }
+    };
+
+    let messages = parsed.get("messages").cloned().unwrap_or(json!([]));
+    let model = parsed
+        .get("model")
+        .and_then(|v| v.as_str())
+        .unwrap_or(&default_model)
+        .to_string();
+    let session = parsed
+        .get("session")
+        .and_then(|v| v.as_str())
+        .unwrap_or("default")
+        .to_string();
+
+    let mut openai_messages: Vec<Value> =
+        vec![json!({"role": "system", "content": get_system_prompt()})];
+    let mut frontend_boundaries: Vec<usize> = Vec::new();
+    let frontend_arr = messages.as_array();
+    let frontend_count = frontend_arr.map(|a| a.len()).unwrap_or(0);
+    if let Some(arr) = frontend_arr {
+        for msg in arr {
+            frontend_boundaries.push(openai_messages.len());
+            let Some(role) = msg.get("role").and_then(|r| r.as_str()) else {
+                continue;
+            };
+            if let Some(parts) = msg.get("parts").and_then(|p| p.as_array()) {
+                let mut content_parts: Vec<Value> = Vec::new();
+                for part in parts {
+                    match part.get("type").and_then(|t| t.as_str()) {
+                        Some("text") => {
+                            if let Some(text) = part.get("text").and_then(|t| t.as_str()) {
+                                if !text.is_empty() {
+                                    content_parts.push(json!({"type": "text", "text": text}));
+                                }
+                            }
+                        }
+                        Some("file") => {
+                            if let (Some(url), Some(media_type)) = (
+                                part.get("url").and_then(|u| u.as_str()),
+                                part.get("mediaType").and_then(|m| m.as_str()),
+                            ) {
+                                if media_type.starts_with("image/") {
+                                    content_parts.push(json!({
+                                        "type": "image_url",
+                                        "image_url": { "url": url }
+                                    }));
+                                }
+                            }
+                        }
+                        _ => {}
+                    }
+                }
+                if !content_parts.is_empty() {
+                    let content = if content_parts.len() == 1
+                        && content_parts[0].get("type").and_then(|t| t.as_str()) == Some("text")
+                    {
+                        content_parts[0]["text"].clone()
+                    } else {
+                        json!(content_parts)
+                    };
+                    openai_messages.push(json!({"role": role, "content": content}));
+                }
+            } else if let Some(content) = msg.get("content").and_then(|c| c.as_str()) {
+                openai_messages.push(json!({"role": role, "content": content}));
+            }
+        }
+    }
+
+    let tools: Value = serde_json::from_str(CHAT_TOOLS).unwrap();
+    let url = format!("{}/v1/chat/completions", gateway_url);
+    let client = http_client();
+
+    let total_chars = estimate_chars(&openai_messages);
+    let mut compaction_summary: Option<String> = None;
+    let mut compaction_failed = false;
+    let mut keep_last_n: usize = frontend_count;
+
+    if total_chars > COMPACT_THRESHOLD_CHARS && openai_messages.len() > KEEP_RECENT_MESSAGES + 2 {
+        let split = find_safe_split(&openai_messages, KEEP_RECENT_MESSAGES);
+        let to_summarize = &openai_messages[1..split];
+
+        if let Some(summary) =
+            summarize_for_compaction(client, &url, &api_key, &model, to_summarize).await
+        {
+            let summary_msg = json!({
+                "role": "system",
+                "content": format!("[Conversation summary]\n{}", summary)
+            });
+            let recent = openai_messages[split..].to_vec();
+            openai_messages = vec![openai_messages[0].clone(), summary_msg];
+            openai_messages.extend(recent);
+
+            let kept_frontend = frontend_boundaries
+                .iter()
+                .filter(|&&boundary| boundary >= split)
+                .count();
+            keep_last_n = kept_frontend;
+            compaction_summary = Some(summary);
+        } else {
+            compaction_failed = true;
+        }
+    }
+
+    let headers = format!(
+        "HTTP/1.1 200 OK\r\nContent-Type: text/event-stream\r\nCache-Control: no-cache\r\nConnection: keep-alive\r\nx-vercel-ai-ui-message-stream: v1\r\n{cors}\r\n"
+    );
+    if stream.write_all(headers.as_bytes()).await.is_err() {
+        return;
+    }
+
+    let message_id = uuid::Uuid::new_v4().to_string();
+    let start_ev = format!(
+        "data: {}\n\n",
+        json!({"type":"start","messageId":message_id})
+    );
+    if stream.write_all(start_ev.as_bytes()).await.is_err() {
+        return;
+    }
+
+    if let Some(ref summary) = compaction_summary {
+        let ev = format!(
+            "data: {}\n\n",
+            json!({
+                "type": "message-metadata",
+                "messageMetadata": {
+                    "compacted": true,
+                    "summary": summary,
+                    "keepLastN": keep_last_n
+                }
+            })
+        );
+        let _ = stream.write_all(ev.as_bytes()).await;
+    } else if compaction_failed {
+        let ev = format!(
+            "data: {}\n\n",
+            json!({
+                "type": "message-metadata",
+                "messageMetadata": {
+                    "compacted": false,
+                    "warning": "Conversation is large but compaction failed. Responses may be degraded."
+                }
+            })
+        );
+        let _ = stream.write_all(ev.as_bytes()).await;
+    }
+
+    let total_deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(300);
+    const TOOL_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(60);
+
+    for _step in 0..50 {
+        if tokio::time::Instant::now() >= total_deadline {
+            let ev = format!(
+                "data: {}\n\n",
+                json!({"type":"error","errorText":"Chat session timed out (5 minute limit)."})
+            );
+            let _ = stream.write_all(ev.as_bytes()).await;
+            break;
+        }
+
+        let step_ev = "data: {\"type\":\"start-step\"}\n\n";
+        if stream.write_all(step_ev.as_bytes()).await.is_err() {
+            return;
+        }
+
+        let gateway_body = json!({
+            "model": model,
+            "messages": openai_messages,
+            "tools": tools,
+            "stream": true,
+        });
+
+        let gw_response = match client
+            .post(&url)
+            .header("Authorization", format!("Bearer {}", api_key))
+            .header("Content-Type", "application/json")
+            .body(gateway_body.to_string())
+            .send()
+            .await
+        {
+            Ok(r) => r,
+            Err(e) => {
+                let ev = format!(
+                    "data: {}\n\n",
+                    json!({"type":"error","errorText":format!("Gateway request failed: {}", e)})
+                );
+                let _ = stream.write_all(ev.as_bytes()).await;
+                break;
+            }
+        };
+
+        if !gw_response.status().is_success() {
+            let body_text = gw_response.text().await.unwrap_or_default();
+            let ev = format!(
+                "data: {}\n\n",
+                json!({"type":"error","errorText":body_text})
+            );
+            let _ = stream.write_all(ev.as_bytes()).await;
+            break;
+        }
+
+        let tool_calls = stream_gateway_response(stream, gw_response).await;
+
+        if tool_calls.is_empty() {
+            let finish_step_ev = "data: {\"type\":\"finish-step\"}\n\n";
+            let _ = stream.write_all(finish_step_ev.as_bytes()).await;
+            break;
+        }
+
+        let tc_values: Vec<Value> = tool_calls.iter().map(|(id, name, args)| {
+            json!({"id": id, "type": "function", "function": {"name": name, "arguments": args}})
+        }).collect();
+        openai_messages.push(json!({"role": "assistant", "tool_calls": tc_values}));
+
+        for (tc_id, tc_name, tc_args) in &tool_calls {
+            let input: Value = serde_json::from_str(tc_args).unwrap_or(json!({}));
+            let command = input.get("command").and_then(|c| c.as_str()).unwrap_or("");
+
+            let ev = format!(
+                "data: {}\n\n",
+                json!({
+                    "type": "tool-input-available",
+                    "toolCallId": tc_id,
+                    "toolName": tc_name,
+                    "input": input
+                })
+            );
+            let _ = stream.write_all(ev.as_bytes()).await;
+
+            let result = match tokio::time::timeout(
+                TOOL_TIMEOUT,
+                execute_chat_tool(&session, command),
+            )
+            .await
+            {
+                Ok(r) => r,
+                Err(_) => "Tool execution timed out after 60 seconds.".to_string(),
+            };
+
+            let frontend_output = enrich_tool_output(&result);
+            let ev = format!(
+                "data: {}\n\n",
+                json!({
+                    "type": "tool-output-available",
+                    "toolCallId": tc_id,
+                    "output": frontend_output
+                })
+            );
+            let _ = stream.write_all(ev.as_bytes()).await;
+
+            openai_messages.push(json!({
+                "role": "tool",
+                "tool_call_id": tc_id,
+                "content": result
+            }));
+        }
+
+        let finish_step_ev = "data: {\"type\":\"finish-step\"}\n\n";
+        let _ = stream.write_all(finish_step_ev.as_bytes()).await;
+    }
+
+    let finish_ev = "data: {\"type\":\"finish\"}\n\n";
+    let _ = stream.write_all(finish_ev.as_bytes()).await;
+    let done_ev = "data: [DONE]\n\n";
+    let _ = stream.write_all(done_ev.as_bytes()).await;
+}

cli/src/native/stream/dashboard.rs

@@ -0,0 +1,960 @@
+use futures_util::{SinkExt, StreamExt};
+use serde_json::{json, Value};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpListener;
+use tokio_tungstenite::tungstenite::Message;
+
+use crate::connection::get_socket_dir;
+
+use super::chat::{chat_status_json, handle_chat_request, handle_models_request};
+use super::discovery::discover_sessions;
+use super::http::{serve_embedded_file, CORS_HEADERS};
+
+/// Dashboard same-origin proxy endpoints for session metadata and streams.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum SessionProxyEndpoint {
+    Tabs,
+    Status,
+    Stream,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct DashboardProxyError {
+    status: &'static str,
+    message: String,
+}
+
+impl DashboardProxyError {
+    fn not_found(message: impl Into<String>) -> Self {
+        Self {
+            status: "404 Not Found",
+            message: message.into(),
+        }
+    }
+
+    fn bad_gateway(message: impl Into<String>) -> Self {
+        Self {
+            status: "502 Bad Gateway",
+            message: message.into(),
+        }
+    }
+}
+
+const PROXY_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
+const PROXY_MAX_RESPONSE_SIZE: u64 = 16 * 1024 * 1024;
+
+fn build_json_error_body(error: &str) -> String {
+    let escaped = serde_json::to_string(error).unwrap_or_else(|_| format!("\"{}\"", error));
+    format!(r#"{{"success":false,"error":{escaped}}}"#)
+}
+
+async fn write_http_response_inner(
+    stream: &mut tokio::net::TcpStream,
+    status: &str,
+    content_type: &str,
+    body: &[u8],
+    include_cors: bool,
+) {
+    let cors_headers = if include_cors { CORS_HEADERS } else { "" };
+    let response = format!(
+        "HTTP/1.1 {status}\r\nContent-Type: {content_type}\r\nContent-Length: {}\r\nConnection: close\r\n{cors_headers}\r\n",
+        body.len()
+    );
+    let _ = stream.write_all(response.as_bytes()).await;
+    let _ = stream.write_all(body).await;
+}
+
+async fn write_http_response(
+    stream: &mut tokio::net::TcpStream,
+    status: &str,
+    content_type: &str,
+    body: &[u8],
+) {
+    write_http_response_inner(stream, status, content_type, body, true).await;
+}
+
+async fn write_http_response_no_cors(
+    stream: &mut tokio::net::TcpStream,
+    status: &str,
+    content_type: &str,
+    body: &[u8],
+) {
+    write_http_response_inner(stream, status, content_type, body, false).await;
+}
+
+async fn write_json_error_response_no_cors(
+    stream: &mut tokio::net::TcpStream,
+    status: &'static str,
+    error: &str,
+) {
+    let body = build_json_error_body(error);
+    write_http_response_no_cors(
+        stream,
+        status,
+        "application/json; charset=utf-8",
+        body.as_bytes(),
+    )
+    .await;
+}
+
+fn parse_request_method_and_path(request: &str) -> (&str, &str) {
+    let first_line = request.lines().next().unwrap_or("");
+    let method = first_line.split_whitespace().next().unwrap_or("GET");
+    let path = first_line.split_whitespace().nth(1).unwrap_or("/");
+    (method, path)
+}
+
+fn is_websocket_upgrade(request: &str) -> bool {
+    request.lines().any(|line| {
+        if let Some((name, value)) = line.split_once(':') {
+            name.trim().eq_ignore_ascii_case("upgrade")
+                && value.trim().eq_ignore_ascii_case("websocket")
+        } else {
+            false
+        }
+    })
+}
+
+fn request_header_value<'a>(request: &'a str, name: &str) -> Option<&'a str> {
+    request.lines().find_map(|line| {
+        let (header_name, value) = line.split_once(':')?;
+        if header_name.trim().eq_ignore_ascii_case(name) {
+            Some(value.trim())
+        } else {
+            None
+        }
+    })
+}
+
+fn normalize_origin_authority(origin: &str) -> Option<String> {
+    let url = url::Url::parse(origin).ok()?;
+    let host = url.host_str()?.to_ascii_lowercase();
+    let host = if host.contains(':') {
+        format!("[{host}]")
+    } else {
+        host
+    };
+    Some(match url.port() {
+        Some(port) => format!("{host}:{port}"),
+        None => host,
+    })
+}
+
+fn normalize_host_authority(host: &str) -> String {
+    let host = host.trim().to_ascii_lowercase();
+
+    if let Some(bracket_end) = host.rfind(']') {
+        if bracket_end == host.len() - 1 {
+            return host;
+        }
+
+        if host.as_bytes().get(bracket_end + 1) == Some(&b':') {
+            let port = &host[bracket_end + 2..];
+            if port == "80" || port == "443" {
+                return host[..=bracket_end].to_string();
+            }
+        }
+
+        return host;
+    }
+
+    if let Some((name, port)) = host.rsplit_once(':') {
+        if !name.contains(':') && (port == "80" || port == "443") {
+            return name.to_string();
+        }
+    }
+
+    host
+}
+
+fn header_matches_host(request: &str, header_name: &str) -> Option<bool> {
+    let authority =
+        request_header_value(request, header_name).and_then(normalize_origin_authority)?;
+    let host = request_header_value(request, "host").map(normalize_host_authority)?;
+    Some(authority == host)
+}
+
+/// Validates that a proxied WebSocket request either has no Origin header or
+/// presents an Origin whose authority matches the request Host header.
+fn is_same_origin_ws_request(request: &str) -> bool {
+    match header_matches_host(request, "origin") {
+        Some(matches) => matches,
+        None => request_header_value(request, "origin").is_none(),
+    }
+}
+
+/// Validates that an HTTP session-proxy request came from a same-origin page.
+///
+/// For GET requests we require either a same-origin `Origin` or a same-origin
+/// `Referer` so browsers cannot hit the proxy routes via side-channel tags or
+/// arbitrary cross-origin fetches.
+fn is_same_origin_http_request(request: &str) -> bool {
+    matches!(header_matches_host(request, "origin"), Some(true))
+        || matches!(header_matches_host(request, "referer"), Some(true))
+}
+
+/// Parse a dashboard route of the form `/api/session/<port>/<endpoint>`.
+fn parse_session_proxy_route(path: &str) -> Result<(u16, SessionProxyEndpoint), &'static str> {
+    if !path.starts_with("/api/session/") {
+        return Err("Invalid session proxy route.");
+    }
+
+    let mut parts = path.split('/');
+    if parts.next() != Some("") || parts.next() != Some("api") || parts.next() != Some("session") {
+        return Err("Invalid session proxy route.");
+    }
+
+    let port_str = parts.next().ok_or("Missing session proxy port.")?;
+    if port_str.is_empty() {
+        return Err("Missing session proxy port.");
+    }
+
+    let endpoint = match parts.next().ok_or("Missing session proxy endpoint.")? {
+        "tabs" => SessionProxyEndpoint::Tabs,
+        "status" => SessionProxyEndpoint::Status,
+        "stream" => SessionProxyEndpoint::Stream,
+        _ => return Err("Unknown session proxy endpoint."),
+    };
+
+    if parts.next().is_some() {
+        return Err("Unexpected path segments in session proxy route.");
+    }
+
+    let port = port_str
+        .parse::<u16>()
+        .map_err(|_| "Session proxy port must be a valid TCP port.")?;
+    if port == 0 {
+        return Err("Session proxy port must be a valid TCP port.");
+    }
+
+    Ok((port, endpoint))
+}
+
+fn sessions_json_has_active_port(sessions_json: &str, port: u16) -> Result<bool, String> {
+    let sessions: Vec<Value> = serde_json::from_str(sessions_json)
+        .map_err(|e| format!("Failed to parse active sessions: {e}"))?;
+    Ok(sessions.iter().any(|session| {
+        session
+            .get("port")
+            .and_then(|value| value.as_u64())
+            .map(|value| value == u64::from(port))
+            .unwrap_or(false)
+    }))
+}
+
+fn require_active_session_port(port: u16) -> Result<(), DashboardProxyError> {
+    let sessions_json = discover_sessions();
+    let is_active = sessions_json_has_active_port(&sessions_json, port)
+        .map_err(DashboardProxyError::bad_gateway)?;
+    if is_active {
+        Ok(())
+    } else {
+        Err(DashboardProxyError::not_found(format!(
+            "No active session is listening on port {port}."
+        )))
+    }
+}
+
+fn split_http_response(response: &[u8]) -> Result<(&[u8], &[u8]), String> {
+    if let Some(header_end) = response.windows(4).position(|window| window == b"\r\n\r\n") {
+        let body_start = header_end + 4;
+        return Ok((&response[..header_end], &response[body_start..]));
+    }
+
+    if let Some(header_end) = response.windows(2).position(|window| window == b"\n\n") {
+        let body_start = header_end + 2;
+        return Ok((&response[..header_end], &response[body_start..]));
+    }
+
+    Err("Upstream response was missing an HTTP header terminator.".to_string())
+}
+
+fn parse_upstream_http_response(response: &[u8]) -> Result<(String, String, Vec<u8>), String> {
+    let (header_bytes, body) = split_http_response(response)?;
+    let header_str = std::str::from_utf8(header_bytes)
+        .map_err(|e| format!("Upstream response headers were not valid UTF-8: {e}"))?;
+
+    let mut lines = header_str.lines();
+    let status_line = lines
+        .next()
+        .ok_or_else(|| "Upstream response was missing a status line.".to_string())?;
+    let status = status_line
+        .split_once(' ')
+        .map(|(_, status)| status.trim().to_string())
+        .filter(|status| !status.is_empty())
+        .ok_or_else(|| "Upstream response status line was malformed.".to_string())?;
+    let content_type = lines
+        .find_map(|line| {
+            let (name, value) = line.split_once(':')?;
+            if name.trim().eq_ignore_ascii_case("content-type") {
+                Some(value.trim().to_string())
+            } else {
+                None
+            }
+        })
+        .unwrap_or_else(|| "application/json; charset=utf-8".to_string());
+
+    Ok((status, content_type, body.to_vec()))
+}
+
+/// Proxy dashboard-origin HTTP requests for session tabs or status to the loopback session server.
+async fn proxy_session_http_route(
+    port: u16,
+    endpoint: SessionProxyEndpoint,
+) -> Result<(String, String, Vec<u8>), DashboardProxyError> {
+    debug_assert!(matches!(
+        endpoint,
+        SessionProxyEndpoint::Tabs | SessionProxyEndpoint::Status
+    ));
+
+    require_active_session_port(port)?;
+
+    let upstream_path = match endpoint {
+        SessionProxyEndpoint::Tabs => "/api/tabs",
+        SessionProxyEndpoint::Status => "/api/status",
+        SessionProxyEndpoint::Stream => unreachable!("stream routes use the WebSocket proxy"),
+    };
+    let request = format!(
+        "GET {upstream_path} HTTP/1.1\r\nHost: 127.0.0.1:{port}\r\nConnection: close\r\n\r\n"
+    );
+
+    tokio::time::timeout(PROXY_TIMEOUT, async {
+        let mut upstream = tokio::net::TcpStream::connect(("127.0.0.1", port))
+            .await
+            .map_err(|e| {
+                DashboardProxyError::bad_gateway(format!(
+                    "Failed to connect to session {port}: {e}"
+                ))
+            })?;
+        upstream.write_all(request.as_bytes()).await.map_err(|e| {
+            DashboardProxyError::bad_gateway(format!(
+                "Failed to proxy request to session {port}: {e}"
+            ))
+        })?;
+
+        let mut response = Vec::new();
+        (&mut upstream)
+            .take(PROXY_MAX_RESPONSE_SIZE + 1)
+            .read_to_end(&mut response)
+            .await
+            .map_err(|e| {
+                DashboardProxyError::bad_gateway(format!(
+                    "Failed to read session {port} response: {e}"
+                ))
+            })?;
+        if response.len() as u64 > PROXY_MAX_RESPONSE_SIZE {
+            return Err(DashboardProxyError::bad_gateway(format!(
+                "Session {port} response exceeded {PROXY_MAX_RESPONSE_SIZE} bytes."
+            )));
+        }
+
+        parse_upstream_http_response(&response).map_err(DashboardProxyError::bad_gateway)
+    })
+    .await
+    .map_err(|_| {
+        DashboardProxyError::bad_gateway(format!(
+            "Session {port} proxy request timed out after {}s.",
+            PROXY_TIMEOUT.as_secs()
+        ))
+    })?
+}
+
+/// Bridge a dashboard-origin WebSocket upgrade to the loopback session stream.
+async fn proxy_session_stream(mut stream: tokio::net::TcpStream, port: u16) {
+    let upstream_url = format!("ws://127.0.0.1:{port}");
+    let (upstream_ws, _) = match tokio_tungstenite::connect_async(&upstream_url).await {
+        Ok(ws) => ws,
+        Err(error) => {
+            write_json_error_response_no_cors(
+                &mut stream,
+                "502 Bad Gateway",
+                &format!("Failed to connect to session {port}: {error}"),
+            )
+            .await;
+            return;
+        }
+    };
+    let client_ws = match tokio_tungstenite::accept_async(stream).await {
+        Ok(ws) => ws,
+        Err(_) => return,
+    };
+
+    let (mut client_tx, mut client_rx) = client_ws.split();
+    let (mut upstream_tx, mut upstream_rx) = upstream_ws.split();
+
+    loop {
+        tokio::select! {
+            message = client_rx.next() => {
+                match message {
+                    Some(Ok(message)) => {
+                        let is_close = matches!(message, Message::Close(_));
+                        if upstream_tx.send(message).await.is_err() {
+                            break;
+                        }
+                        if is_close {
+                            break;
+                        }
+                    }
+                    Some(Err(_)) | None => {
+                        let _ = upstream_tx.send(Message::Close(None)).await;
+                        break;
+                    }
+                }
+            }
+            message = upstream_rx.next() => {
+                match message {
+                    Some(Ok(message)) => {
+                        let is_close = matches!(message, Message::Close(_));
+                        if client_tx.send(message).await.is_err() {
+                            break;
+                        }
+                        if is_close {
+                            break;
+                        }
+                    }
+                    Some(Err(_)) | None => {
+                        let _ = client_tx.send(Message::Close(None)).await;
+                        break;
+                    }
+                }
+            }
+        }
+    }
+}
+
+pub async fn run_dashboard_server(port: u16) {
+    let addr = format!("127.0.0.1:{}", port);
+    let listener = match TcpListener::bind(&addr).await {
+        Ok(l) => l,
+        Err(e) => {
+            eprintln!("Failed to bind dashboard server on {}: {}", addr, e);
+            return;
+        }
+    };
+
+    loop {
+        let Ok((stream, _addr)) = listener.accept().await else {
+            break;
+        };
+        tokio::spawn(async move {
+            handle_dashboard_connection(stream).await;
+        });
+    }
+}
+
+async fn handle_dashboard_connection(mut stream: tokio::net::TcpStream) {
+    let mut buf = vec![0u8; 8192];
+    let peeked_len = match stream.peek(&mut buf).await {
+        Ok(n) if n > 0 => n,
+        _ => return,
+    };
+    let peeked_request = String::from_utf8_lossy(&buf[..peeked_len]);
+    let (peeked_method, peeked_path) = parse_request_method_and_path(&peeked_request);
+
+    if peeked_path.starts_with("/api/session/") {
+        let (port, endpoint) = match parse_session_proxy_route(peeked_path) {
+            Ok(route) => route,
+            Err(error) => {
+                write_json_error_response_no_cors(&mut stream, "400 Bad Request", error).await;
+                return;
+            }
+        };
+
+        match endpoint {
+            SessionProxyEndpoint::Stream => {
+                if peeked_method != "GET" {
+                    write_json_error_response_no_cors(
+                        &mut stream,
+                        "400 Bad Request",
+                        "Session stream proxy only supports GET WebSocket upgrades.",
+                    )
+                    .await;
+                    return;
+                }
+                if !is_websocket_upgrade(&peeked_request) {
+                    write_json_error_response_no_cors(
+                        &mut stream,
+                        "400 Bad Request",
+                        "Session stream proxy requires a WebSocket upgrade request.",
+                    )
+                    .await;
+                    return;
+                }
+                if !is_same_origin_ws_request(&peeked_request) {
+                    write_json_error_response_no_cors(
+                        &mut stream,
+                        "403 Forbidden",
+                        "Origin does not match Host header.",
+                    )
+                    .await;
+                    return;
+                }
+                if let Err(error) = require_active_session_port(port) {
+                    write_json_error_response_no_cors(&mut stream, error.status, &error.message)
+                        .await;
+                    return;
+                }
+                proxy_session_stream(stream, port).await;
+                return;
+            }
+            SessionProxyEndpoint::Tabs | SessionProxyEndpoint::Status => {
+                if peeked_method != "GET" {
+                    write_json_error_response_no_cors(
+                        &mut stream,
+                        "400 Bad Request",
+                        "Session proxy routes only support GET requests.",
+                    )
+                    .await;
+                    return;
+                }
+            }
+        }
+    }
+
+    let n = match stream.read(&mut buf).await {
+        Ok(n) if n > 0 => n,
+        _ => return,
+    };
+
+    let request = String::from_utf8_lossy(&buf[..n]).to_string();
+    let (method, path) = parse_request_method_and_path(&request);
+    let origin = request_header_value(&request, "origin").map(|value| value.to_string());
+
+    if method == "OPTIONS" {
+        let response = format!(
+            "HTTP/1.1 204 No Content\r\n{CORS_HEADERS}Access-Control-Max-Age: 86400\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+        );
+        let _ = stream.write_all(response.as_bytes()).await;
+        return;
+    }
+
+    if method == "POST" && path == "/api/chat" {
+        let body_str = read_post_body(&mut stream, &buf, n).await;
+        handle_chat_request(&mut stream, &body_str, origin.as_deref()).await;
+        return;
+    }
+
+    if method == "GET" && path == "/api/models" {
+        handle_models_request(&mut stream, origin.as_deref()).await;
+        return;
+    }
+
+    if method == "POST" && (path == "/api/sessions" || path == "/api/exec" || path == "/api/kill") {
+        let body_str = read_post_body(&mut stream, &buf, n).await;
+        let result = if path == "/api/exec" {
+            exec_cli(&body_str).await
+        } else if path == "/api/kill" {
+            kill_session(&body_str).await
+        } else {
+            spawn_session(&body_str).await
+        };
+        let (status, resp_body) = match result {
+            Ok(msg) => ("200 OK", msg),
+            Err(e) => ("400 Bad Request", build_json_error_body(&e)),
+        };
+        write_http_response(
+            &mut stream,
+            status,
+            "application/json; charset=utf-8",
+            resp_body.as_bytes(),
+        )
+        .await;
+        return;
+    }
+
+    if path.starts_with("/api/session/") {
+        let (port, endpoint) = match parse_session_proxy_route(path) {
+            Ok(route) => route,
+            Err(error) => {
+                write_json_error_response_no_cors(&mut stream, "400 Bad Request", error).await;
+                return;
+            }
+        };
+
+        match endpoint {
+            SessionProxyEndpoint::Tabs | SessionProxyEndpoint::Status => {
+                if !is_same_origin_http_request(&request) {
+                    write_json_error_response_no_cors(
+                        &mut stream,
+                        "403 Forbidden",
+                        "Origin or Referer does not match Host header.",
+                    )
+                    .await;
+                    return;
+                }
+
+                match proxy_session_http_route(port, endpoint).await {
+                    Ok((status, content_type, body)) => {
+                        write_http_response_no_cors(&mut stream, &status, &content_type, &body)
+                            .await;
+                    }
+                    Err(error) => {
+                        write_json_error_response_no_cors(
+                            &mut stream,
+                            error.status,
+                            &error.message,
+                        )
+                        .await;
+                    }
+                }
+                return;
+            }
+            SessionProxyEndpoint::Stream => {
+                write_json_error_response_no_cors(
+                    &mut stream,
+                    "400 Bad Request",
+                    "Session stream proxy requires a WebSocket upgrade request.",
+                )
+                .await;
+                return;
+            }
+        }
+    }
+
+    let (status, content_type, body): (&str, &str, Vec<u8>) = if path == "/api/sessions" {
+        (
+            "200 OK",
+            "application/json; charset=utf-8",
+            discover_sessions().into_bytes(),
+        )
+    } else if path == "/api/chat/status" {
+        (
+            "200 OK",
+            "application/json; charset=utf-8",
+            chat_status_json().into_bytes(),
+        )
+    } else {
+        serve_embedded_file(path)
+    };
+
+    write_http_response(&mut stream, status, content_type, &body).await;
+}
+
+async fn read_post_body(stream: &mut tokio::net::TcpStream, initial: &[u8], n: usize) -> String {
+    let header_end = initial[..n]
+        .windows(4)
+        .position(|w| w == b"\r\n\r\n")
+        .map(|p| p + 4)
+        .or_else(|| {
+            initial[..n]
+                .windows(2)
+                .position(|w| w == b"\n\n")
+                .map(|p| p + 2)
+        });
+    let Some(header_end) = header_end else {
+        return String::new();
+    };
+
+    let header_str = String::from_utf8_lossy(&initial[..header_end]);
+    let content_length: usize = header_str
+        .lines()
+        .find_map(|l| {
+            if l.len() > 16 && l[..16].eq_ignore_ascii_case("content-length: ") {
+                l[16..].trim().parse::<usize>().ok()
+            } else {
+                let lower = l.to_lowercase();
+                lower
+                    .strip_prefix("content-length:")
+                    .and_then(|v| v.trim().parse::<usize>().ok())
+            }
+        })
+        .unwrap_or(0);
+
+    if content_length == 0 {
+        return String::new();
+    }
+
+    let read_body = &initial[header_end..n];
+    let already_read = read_body.len().min(content_length);
+
+    let mut body = Vec::with_capacity(content_length);
+    body.extend_from_slice(&read_body[..already_read]);
+
+    let remaining = content_length - already_read;
+    if remaining > 0 {
+        let mut rest = vec![0u8; remaining];
+        if stream.read_exact(&mut rest).await.is_ok() {
+            body.extend_from_slice(&rest);
+        }
+    }
+
+    String::from_utf8(body).unwrap_or_default()
+}
+
+async fn exec_cli(body: &str) -> Result<String, String> {
+    let parsed: Value = serde_json::from_str(body).map_err(|e| format!("Invalid JSON: {}", e))?;
+    let args: Vec<String> = parsed
+        .get("args")
+        .and_then(|v| v.as_array())
+        .ok_or("Missing \"args\" array")?
+        .iter()
+        .filter_map(|v| v.as_str().map(|s| s.to_string()))
+        .collect();
+
+    if args.is_empty() {
+        return Err("Empty args array".to_string());
+    }
+
+    let exe = std::env::current_exe().map_err(|e| format!("Cannot resolve executable: {}", e))?;
+
+    let mut cmd = tokio::process::Command::new(&exe);
+    cmd.args(&args)
+        .arg("--json")
+        .env_remove("AGENT_BROWSER_DASHBOARD")
+        .env_remove("AGENT_BROWSER_DASHBOARD_PORT")
+        .env_remove("AGENT_BROWSER_STREAM_PORT");
+
+    let output = cmd
+        .output()
+        .await
+        .map_err(|e| format!("Failed to execute: {}", e))?;
+
+    let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
+    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+
+    Ok(json!({
+        "success": output.status.success(),
+        "exit_code": output.status.code(),
+        "stdout": stdout,
+        "stderr": stderr,
+    })
+    .to_string())
+}
+
+async fn kill_session(body: &str) -> Result<String, String> {
+    let parsed: Value = serde_json::from_str(body).map_err(|e| format!("Invalid JSON: {}", e))?;
+    let session = parsed
+        .get("session")
+        .and_then(|v| v.as_str())
+        .ok_or("Missing \"session\" field")?;
+
+    if session.is_empty() || session.len() > 64 {
+        return Err("Session name must be 1-64 characters".to_string());
+    }
+
+    let dir = get_socket_dir();
+    let pid_path = dir.join(format!("{}.pid", session));
+
+    let pid_str = std::fs::read_to_string(&pid_path)
+        .map_err(|_| format!("No PID file for session '{}'", session))?;
+    let pid: u32 = pid_str
+        .trim()
+        .parse()
+        .map_err(|_| format!("Invalid PID in file: {}", pid_str.trim()))?;
+
+    #[cfg(unix)]
+    {
+        // SAFETY: The PID came from the daemon-managed pidfile and is only used
+        // to send standard termination signals to that process.
+        unsafe {
+            libc::kill(pid as i32, libc::SIGTERM);
+        }
+        tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+        // SAFETY: A signal value of 0 performs an existence check on the same pid.
+        if unsafe { libc::kill(pid as i32, 0) } == 0 {
+            // SAFETY: The process still exists after SIGTERM, so escalate to SIGKILL.
+            unsafe {
+                libc::kill(pid as i32, libc::SIGKILL);
+            }
+        }
+    }
+
+    for ext in &["pid", "sock", "stream", "engine", "extensions"] {
+        let _ = std::fs::remove_file(dir.join(format!("{}.{}", session, ext)));
+    }
+
+    Ok(json!({ "success": true, "killed_pid": pid }).to_string())
+}
+
+pub(super) async fn spawn_session(body: &str) -> Result<String, String> {
+    let parsed: Value = serde_json::from_str(body).map_err(|e| format!("Invalid JSON: {}", e))?;
+    let session = parsed
+        .get("session")
+        .and_then(|v| v.as_str())
+        .ok_or("Missing \"session\" field")?;
+
+    if session.is_empty() || session.len() > 64 {
+        return Err("Session name must be 1-64 characters".to_string());
+    }
+
+    let exe = std::env::current_exe().map_err(|e| format!("Cannot resolve executable: {}", e))?;
+
+    let mut cmd = tokio::process::Command::new(&exe);
+    cmd.arg("open")
+        .arg("about:blank")
+        .arg("--session")
+        .arg(session);
+
+    cmd.stdout(std::process::Stdio::null());
+    cmd.stderr(std::process::Stdio::null());
+
+    let status = cmd
+        .status()
+        .await
+        .map_err(|e| format!("Failed to spawn session: {}", e))?;
+
+    if status.success() {
+        Ok(format!(
+            r#"{{"success":true,"session":{}}}"#,
+            serde_json::to_string(session).unwrap_or_default()
+        ))
+    } else {
+        Err(format!("Session process exited with {}", status))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_same_origin_ws_request_matching() {
+        let req = "GET /api/session/9222/stream HTTP/1.1\r\nHost: localhost:4848\r\nOrigin: http://localhost:4848\r\nUpgrade: websocket\r\n\r\n";
+        assert!(is_same_origin_ws_request(req));
+    }
+
+    #[test]
+    fn test_same_origin_ws_request_proxied() {
+        let req = "GET /api/session/9222/stream HTTP/1.1\r\nHost: dashboard.chrome-use.localhost\r\nOrigin: https://dashboard.chrome-use.localhost\r\nUpgrade: websocket\r\n\r\n";
+        assert!(is_same_origin_ws_request(req));
+    }
+
+    #[test]
+    fn test_normalize_origin_authority_https_without_port() {
+        assert_eq!(
+            normalize_origin_authority("https://dashboard.chrome-use.localhost"),
+            Some("dashboard.chrome-use.localhost".to_string())
+        );
+    }
+
+    #[test]
+    fn test_same_origin_ws_request_default_https_port() {
+        let req = "GET /api/session/9222/stream HTTP/1.1\r\nHost: dashboard.chrome-use.localhost:443\r\nOrigin: https://dashboard.chrome-use.localhost\r\nUpgrade: websocket\r\n\r\n";
+        assert!(is_same_origin_ws_request(req));
+    }
+
+    #[test]
+    fn test_same_origin_http_request_matching_origin() {
+        let req = "GET /api/session/9222/tabs HTTP/1.1\r\nHost: localhost:4848\r\nOrigin: http://localhost:4848\r\n\r\n";
+        assert!(is_same_origin_http_request(req));
+    }
+
+    #[test]
+    fn test_same_origin_http_request_matching_referer() {
+        let req = "GET /api/session/9222/tabs HTTP/1.1\r\nHost: dashboard.chrome-use.localhost:443\r\nReferer: https://dashboard.chrome-use.localhost/sessions\r\n\r\n";
+        assert!(is_same_origin_http_request(req));
+    }
+
+    #[test]
+    fn test_same_origin_http_request_rejects_missing_origin_and_referer() {
+        let req = "GET /api/session/9222/tabs HTTP/1.1\r\nHost: localhost:4848\r\n\r\n";
+        assert!(!is_same_origin_http_request(req));
+    }
+
+    #[test]
+    fn test_same_origin_http_request_rejects_cross_origin_referer() {
+        let req = "GET /api/session/9222/tabs HTTP/1.1\r\nHost: localhost:4848\r\nReferer: https://evil.com/path\r\n\r\n";
+        assert!(!is_same_origin_http_request(req));
+    }
+
+    #[test]
+    fn test_same_origin_ws_request_coder() {
+        let req = "GET /api/session/9222/stream HTTP/1.1\r\nHost: workspace.coder.com\r\nOrigin: https://workspace.coder.com\r\nUpgrade: websocket\r\n\r\n";
+        assert!(is_same_origin_ws_request(req));
+    }
+
+    #[test]
+    fn test_cross_origin_ws_request_rejected() {
+        let req = "GET /api/session/9222/stream HTTP/1.1\r\nHost: localhost:4848\r\nOrigin: https://evil.com\r\nUpgrade: websocket\r\n\r\n";
+        assert!(!is_same_origin_ws_request(req));
+    }
+
+    #[test]
+    fn test_no_origin_header_allowed() {
+        let req = "GET /api/session/9222/stream HTTP/1.1\r\nHost: localhost:4848\r\nUpgrade: websocket\r\n\r\n";
+        assert!(is_same_origin_ws_request(req));
+    }
+
+    #[test]
+    fn test_parse_session_proxy_route_valid() {
+        assert_eq!(
+            parse_session_proxy_route("/api/session/9222/tabs"),
+            Ok((9222, SessionProxyEndpoint::Tabs))
+        );
+        assert_eq!(
+            parse_session_proxy_route("/api/session/1337/status"),
+            Ok((1337, SessionProxyEndpoint::Status))
+        );
+        assert_eq!(
+            parse_session_proxy_route("/api/session/65535/stream"),
+            Ok((65535, SessionProxyEndpoint::Stream))
+        );
+    }
+
+    #[test]
+    fn test_parse_session_proxy_route_invalid() {
+        assert!(parse_session_proxy_route("/api/session/0/tabs").is_err());
+        assert!(parse_session_proxy_route("/api/session/not-a-port/tabs").is_err());
+        assert!(parse_session_proxy_route("/api/session/70000/tabs").is_err());
+        assert!(parse_session_proxy_route("/api/session/9222").is_err());
+        assert!(parse_session_proxy_route("/api/session/9222/unknown").is_err());
+        assert!(parse_session_proxy_route("/api/session/9222/tabs/extra").is_err());
+    }
+
+    #[test]
+    fn test_parse_session_proxy_route_path_traversal() {
+        assert!(parse_session_proxy_route("/api/session/9222/tabs/..").is_err());
+        assert!(parse_session_proxy_route("/api/session/9222/tabs/../status").is_err());
+        assert!(parse_session_proxy_route("/api/session/9222/../../etc/passwd").is_err());
+        assert!(parse_session_proxy_route("/api/session/../session/9222/tabs").is_err());
+    }
+
+    #[test]
+    fn test_parse_session_proxy_route_double_slashes() {
+        assert!(parse_session_proxy_route("/api/session//9222/tabs").is_err());
+        assert!(parse_session_proxy_route("/api//session/9222/tabs").is_err());
+        assert!(parse_session_proxy_route("//api/session/9222/tabs").is_err());
+    }
+
+    #[test]
+    fn test_parse_session_proxy_route_trailing_slash() {
+        assert!(parse_session_proxy_route("/api/session/9222/tabs/").is_err());
+        assert!(parse_session_proxy_route("/api/session/9222/status/").is_err());
+        assert!(parse_session_proxy_route("/api/session/9222/stream/").is_err());
+    }
+
+    #[test]
+    fn test_parse_session_proxy_route_encoded_paths() {
+        assert!(parse_session_proxy_route("/api/session/9222/tabs%20extra").is_err());
+        assert!(parse_session_proxy_route("/api/session/%39%32%32%32/tabs").is_err());
+    }
+
+    #[test]
+    fn test_sessions_json_has_active_port() {
+        let sessions_json = r#"[
+            {"session":"alpha","port":9222,"engine":"chrome"},
+            {"session":"beta","port":9333,"engine":"chrome"}
+        ]"#;
+
+        assert_eq!(sessions_json_has_active_port(sessions_json, 9222), Ok(true));
+        assert_eq!(
+            sessions_json_has_active_port(sessions_json, 9444),
+            Ok(false)
+        );
+    }
+
+    #[test]
+    fn test_sessions_json_has_active_port_invalid_json() {
+        assert!(sessions_json_has_active_port("{", 9222).is_err());
+    }
+
+    #[test]
+    fn test_parse_upstream_http_response() {
+        let response = b"HTTP/1.1 200 OK\r\nContent-Type: application/json; charset=utf-8\r\nConnection: close\r\n\r\n{\"ok\":true}";
+        let parsed = parse_upstream_http_response(response).expect("response should parse");
+
+        assert_eq!(parsed.0, "200 OK");
+        assert_eq!(parsed.1, "application/json; charset=utf-8");
+        assert_eq!(parsed.2, b"{\"ok\":true}".to_vec());
+    }
+}

cli/src/native/stream/discovery.rs

@@ -0,0 +1,118 @@
+use serde_json::{json, Value};
+use std::path::Path;
+
+use crate::connection::get_socket_dir;
+
+pub(super) fn discover_sessions() -> String {
+    let dir = get_socket_dir();
+    let mut sessions = Vec::new();
+
+    if let Ok(entries) = std::fs::read_dir(&dir) {
+        for entry in entries.flatten() {
+            let name = entry.file_name();
+            let name_str = name.to_string_lossy();
+            if let Some(session) = name_str.strip_suffix(".stream") {
+                if let Ok(port_str) = std::fs::read_to_string(entry.path()) {
+                    if let Ok(port) = port_str.trim().parse::<u16>() {
+                        let pid_path = dir.join(format!("{}.pid", session));
+                        if is_process_alive(&pid_path) {
+                            let engine_path = dir.join(format!("{}.engine", session));
+                            let engine = std::fs::read_to_string(&engine_path)
+                                .ok()
+                                .filter(|s| !s.trim().is_empty())
+                                .unwrap_or_else(|| "chrome".to_string());
+
+                            let provider_path = dir.join(format!("{}.provider", session));
+                            let provider = std::fs::read_to_string(&provider_path)
+                                .ok()
+                                .filter(|s| !s.trim().is_empty());
+
+                            let extensions = read_extensions_metadata(&dir, session);
+
+                            let mut entry = json!({
+                                "session": session,
+                                "port": port,
+                                "engine": engine.trim(),
+                            });
+                            if let Some(ref p) = provider {
+                                entry["provider"] = json!(p.trim());
+                            }
+                            if !extensions.is_empty() {
+                                entry["extensions"] = json!(extensions);
+                            }
+                            sessions.push(entry);
+                        } else {
+                            let _ = std::fs::remove_file(entry.path());
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    serde_json::to_string(&sessions).unwrap_or_else(|_| "[]".to_string())
+}
+
+fn read_extensions_metadata(dir: &std::path::Path, session: &str) -> Vec<Value> {
+    let ext_path = dir.join(format!("{}.extensions", session));
+    let ext_str = match std::fs::read_to_string(&ext_path) {
+        Ok(s) => s,
+        Err(_) => return Vec::new(),
+    };
+
+    ext_str
+        .split(',')
+        .map(|p| p.trim())
+        .filter(|p| !p.is_empty())
+        .filter_map(|path| {
+            let manifest_path = std::path::Path::new(path).join("manifest.json");
+            let manifest_str = std::fs::read_to_string(&manifest_path).ok()?;
+            let manifest: Value = serde_json::from_str(&manifest_str).ok()?;
+
+            let name = manifest
+                .get("name")
+                .and_then(|v| v.as_str())
+                .unwrap_or("Unknown")
+                .to_string();
+            let version = manifest
+                .get("version")
+                .and_then(|v| v.as_str())
+                .unwrap_or("")
+                .to_string();
+            let description = manifest
+                .get("description")
+                .and_then(|v| v.as_str())
+                .map(|s| s.to_string());
+
+            let mut ext = json!({
+                "name": name,
+                "version": version,
+                "path": path,
+            });
+            if let Some(desc) = description {
+                ext["description"] = json!(desc);
+            }
+            Some(ext)
+        })
+        .collect()
+}
+
+fn is_process_alive(pid_path: &Path) -> bool {
+    let pid_str = match std::fs::read_to_string(pid_path) {
+        Ok(s) => s,
+        Err(_) => return false,
+    };
+    let pid: u32 = match pid_str.trim().parse() {
+        Ok(p) => p,
+        Err(_) => return false,
+    };
+    #[cfg(unix)]
+    {
+        unsafe { libc::kill(pid as i32, 0) == 0 }
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = pid;
+        true
+    }
+}

cli/src/native/stream/http.rs

@@ -0,0 +1,715 @@
+use rust_embed::Embed;
+use serde_json::{json, Value};
+use std::sync::Arc;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::sync::RwLock;
+
+use crate::connection::get_socket_dir;
+#[cfg(windows)]
+use crate::connection::resolve_port;
+
+use super::chat::{chat_status_json, handle_chat_request, handle_models_request};
+use super::dashboard::spawn_session;
+use super::discovery::discover_sessions;
+
+#[derive(Embed)]
+#[folder = "../packages/dashboard/out/"]
+struct DashboardAssets;
+
+pub(super) const CORS_HEADERS: &str = "Access-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\n";
+
+/// Build CORS headers that reflect the request origin only when it passes
+/// `is_allowed_origin`. Used for sensitive endpoints (chat, models) so the
+/// API key is not accessible from arbitrary web pages.
+pub(super) fn cors_headers_for_origin(origin: Option<&str>) -> String {
+    let allowed_origin = match origin {
+        Some(o) if super::is_allowed_origin(Some(o)) => o,
+        _ => "http://localhost",
+    };
+    format!(
+        "Access-Control-Allow-Origin: {}\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\n",
+        allowed_origin
+    )
+}
+
+fn request_headers(request: &str) -> &str {
+    request
+        .find("\r\n\r\n")
+        .or_else(|| request.find("\n\n"))
+        .map(|header_end| &request[..header_end])
+        .unwrap_or(request)
+}
+
+fn request_header_value<'a>(request: &'a str, name: &str) -> Option<&'a str> {
+    request_headers(request).lines().find_map(|line| {
+        let (header_name, value) = line.split_once(':')?;
+        if header_name.trim().eq_ignore_ascii_case(name) {
+            Some(value.trim())
+        } else {
+            None
+        }
+    })
+}
+
+fn parse_origin(peeked: &[u8]) -> Option<String> {
+    let header_str = std::str::from_utf8(peeked).ok()?;
+    request_header_value(header_str, "origin").map(ToString::to_string)
+}
+
+fn normalize_origin_authority(origin: &str) -> Option<String> {
+    let url = url::Url::parse(origin).ok()?;
+    let host = url.host_str()?.to_ascii_lowercase();
+    let host = if host.contains(':') {
+        format!("[{host}]")
+    } else {
+        host
+    };
+    let default_port = (url.scheme() == "http" && url.port() == Some(80))
+        || (url.scheme() == "https" && url.port() == Some(443));
+    Some(match url.port() {
+        Some(port) if !default_port => format!("{host}:{port}"),
+        _ => host,
+    })
+}
+
+fn normalize_host_authority(host: &str) -> String {
+    let host = host.trim().to_ascii_lowercase();
+
+    if let Some(bracket_end) = host.rfind(']') {
+        if bracket_end == host.len() - 1 {
+            return host;
+        }
+
+        if host.as_bytes().get(bracket_end + 1) == Some(&b':') {
+            let port = &host[bracket_end + 2..];
+            if port == "80" || port == "443" {
+                return host[..=bracket_end].to_string();
+            }
+        }
+
+        return host;
+    }
+
+    if let Some((name, port)) = host.rsplit_once(':') {
+        if !name.contains(':') && (port == "80" || port == "443") {
+            return name.to_string();
+        }
+    }
+
+    host
+}
+
+fn authority_host(authority: &str) -> &str {
+    if let Some(stripped) = authority.strip_prefix('[') {
+        if let Some(bracket_end) = stripped.find(']') {
+            return &authority[..=bracket_end + 1];
+        }
+    }
+
+    if let Some((host, _port)) = authority.rsplit_once(':') {
+        if !host.contains(':') {
+            return host;
+        }
+    }
+
+    authority
+}
+
+fn is_loopback_authority(authority: &str) -> bool {
+    matches!(
+        authority_host(authority),
+        "localhost" | "127.0.0.1" | "::1" | "[::1]"
+    )
+}
+
+fn header_authority_matches_host(request: &str, header_name: &str) -> bool {
+    let Some(authority) =
+        request_header_value(request, header_name).and_then(normalize_origin_authority)
+    else {
+        return false;
+    };
+    let Some(host) = request_header_value(request, "host").map(normalize_host_authority) else {
+        return false;
+    };
+    authority == host && is_loopback_authority(&authority) && is_loopback_authority(&host)
+}
+
+/// Protects the command relay by requiring same-origin browser metadata.
+fn is_same_origin_command_request(request: &str) -> bool {
+    if request_header_value(request, "origin").is_some() {
+        header_authority_matches_host(request, "origin")
+    } else {
+        header_authority_matches_host(request, "referer")
+    }
+}
+
+fn command_cors_headers(request: &str) -> String {
+    match request_header_value(request, "origin") {
+        Some(origin) if is_same_origin_command_request(request) => format!(
+            "Access-Control-Allow-Origin: {origin}\r\nAccess-Control-Allow-Methods: POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\nVary: Origin\r\n"
+        ),
+        _ => String::new(),
+    }
+}
+
+async fn write_json_error_response_no_cors(
+    stream: &mut tokio::net::TcpStream,
+    status: &str,
+    error: &str,
+) {
+    let body = format!(
+        r#"{{"success":false,"error":{}}}"#,
+        serde_json::to_string(error).unwrap_or_else(|_| format!("\"{}\"", error))
+    );
+    let response = format!(
+        "HTTP/1.1 {status}\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+        body.len()
+    );
+    let _ = stream.write_all(response.as_bytes()).await;
+    let _ = stream.write_all(body.as_bytes()).await;
+}
+
+pub(super) async fn handle_http_request(
+    mut stream: tokio::net::TcpStream,
+    peeked: &[u8],
+    last_tabs: &Arc<RwLock<Vec<Value>>>,
+    last_engine: &Arc<RwLock<String>>,
+    session_name: &str,
+) {
+    let peeked_len = peeked.len();
+    let mut discard = vec![0u8; peeked_len];
+    let _ = stream.read_exact(&mut discard).await;
+
+    let request = String::from_utf8_lossy(peeked);
+    let first_line = request.lines().next().unwrap_or("");
+    let method = first_line.split_whitespace().next().unwrap_or("GET");
+    let path = first_line.split_whitespace().nth(1).unwrap_or("/");
+    let origin = parse_origin(peeked);
+
+    if method == "OPTIONS" {
+        if path == "/api/command" {
+            if !is_same_origin_command_request(&request) {
+                write_json_error_response_no_cors(
+                    &mut stream,
+                    "403 Forbidden",
+                    "Origin or Referer does not match Host header.",
+                )
+                .await;
+                return;
+            }
+
+            let cors_headers = command_cors_headers(&request);
+            let response = format!(
+                "HTTP/1.1 204 No Content\r\n{cors_headers}Access-Control-Max-Age: 86400\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+            );
+            let _ = stream.write_all(response.as_bytes()).await;
+            return;
+        }
+
+        let response = format!(
+            "HTTP/1.1 204 No Content\r\n{CORS_HEADERS}Access-Control-Max-Age: 86400\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+        );
+        let _ = stream.write_all(response.as_bytes()).await;
+        return;
+    }
+
+    if method == "POST" {
+        if path == "/api/command" && !is_same_origin_command_request(&request) {
+            write_json_error_response_no_cors(
+                &mut stream,
+                "403 Forbidden",
+                "Origin or Referer does not match Host header.",
+            )
+            .await;
+            return;
+        }
+
+        let full_body = read_full_body(&mut stream, peeked).await;
+        if full_body.is_none()
+            && (path == "/api/chat" || path == "/api/sessions" || path == "/api/command")
+        {
+            let body = r#"{"error":"Request body too large"}"#;
+            let cors_headers = if path == "/api/command" {
+                command_cors_headers(&request)
+            } else {
+                CORS_HEADERS.to_string()
+            };
+            let response = format!(
+                "HTTP/1.1 413 Payload Too Large\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n{cors_headers}\r\n",
+                body.len()
+            );
+            let _ = stream.write_all(response.as_bytes()).await;
+            let _ = stream.write_all(body.as_bytes()).await;
+            return;
+        }
+        let body_str = full_body.as_deref().unwrap_or("");
+
+        if path == "/api/sessions" {
+            let result = spawn_session(body_str).await;
+            let (status, resp_body) = match result {
+                Ok(msg) => ("200 OK", msg),
+                Err(e) => (
+                    "400 Bad Request",
+                    format!(
+                        r#"{{"success":false,"error":{}}}"#,
+                        serde_json::to_string(&e).unwrap_or_else(|_| format!("\"{}\"", e))
+                    ),
+                ),
+            };
+            let response = format!(
+                "HTTP/1.1 {status}\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n{CORS_HEADERS}\r\n",
+                resp_body.len()
+            );
+            let _ = stream.write_all(response.as_bytes()).await;
+            let _ = stream.write_all(resp_body.as_bytes()).await;
+            return;
+        }
+
+        if path == "/api/command" {
+            let result = relay_command_to_daemon(session_name, body_str).await;
+            let (status, resp_body) = match result {
+                Ok(resp) => ("200 OK", resp),
+                Err(e) => (
+                    "502 Bad Gateway",
+                    format!(
+                        r#"{{"success":false,"error":{}}}"#,
+                        serde_json::to_string(&e).unwrap_or_else(|_| format!("\"{}\"", e))
+                    ),
+                ),
+            };
+            let cors_headers = command_cors_headers(&request);
+            let response = format!(
+                "HTTP/1.1 {status}\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n{cors_headers}\r\n",
+                resp_body.len()
+            );
+            let _ = stream.write_all(response.as_bytes()).await;
+            let _ = stream.write_all(resp_body.as_bytes()).await;
+            return;
+        }
+
+        if path == "/api/chat" {
+            handle_chat_request(&mut stream, body_str, origin.as_deref()).await;
+            return;
+        }
+    }
+
+    if method == "GET" && path == "/api/models" {
+        handle_models_request(&mut stream, origin.as_deref()).await;
+        return;
+    }
+
+    let (status, content_type, body): (&str, &str, Vec<u8>) = if path == "/api/sessions" {
+        (
+            "200 OK",
+            "application/json; charset=utf-8",
+            discover_sessions().into_bytes(),
+        )
+    } else if path == "/api/tabs" {
+        let tabs = last_tabs.read().await;
+        (
+            "200 OK",
+            "application/json; charset=utf-8",
+            serde_json::to_string(&*tabs)
+                .unwrap_or_else(|_| "[]".to_string())
+                .into_bytes(),
+        )
+    } else if path == "/api/status" {
+        let engine = last_engine.read().await;
+        (
+            "200 OK",
+            "application/json; charset=utf-8",
+            format!(r#"{{"engine":"{}"}}"#, *engine).into_bytes(),
+        )
+    } else if path == "/api/chat/status" {
+        (
+            "200 OK",
+            "application/json; charset=utf-8",
+            chat_status_json().into_bytes(),
+        )
+    } else {
+        serve_embedded_file(path)
+    };
+
+    let response = format!(
+        "HTTP/1.1 {}\r\nContent-Type: {}\r\nContent-Length: {}\r\nConnection: close\r\n{CORS_HEADERS}\r\n",
+        status,
+        content_type,
+        body.len()
+    );
+    let _ = stream.write_all(response.as_bytes()).await;
+    let _ = stream.write_all(&body).await;
+}
+
+fn find_header_end(buf: &[u8]) -> Option<usize> {
+    buf.windows(4)
+        .position(|w| w == b"\r\n\r\n")
+        .map(|p| p + 4)
+        .or_else(|| buf.windows(2).position(|w| w == b"\n\n").map(|p| p + 2))
+}
+
+fn parse_content_length_bytes(headers: &[u8]) -> Option<usize> {
+    let header_str = std::str::from_utf8(headers).ok()?;
+    for line in header_str.lines() {
+        if line.len() > 16 && line[..16].eq_ignore_ascii_case("content-length: ") {
+            return line[16..].trim().parse().ok();
+        }
+    }
+    None
+}
+
+const MAX_BODY_SIZE: usize = 10 * 1024 * 1024;
+
+async fn read_full_body(stream: &mut tokio::net::TcpStream, peeked: &[u8]) -> Option<String> {
+    let body_offset = find_header_end(peeked)?;
+    let content_length = parse_content_length_bytes(&peeked[..body_offset])?;
+    if content_length == 0 {
+        return Some(String::new());
+    }
+    if content_length > MAX_BODY_SIZE {
+        return None;
+    }
+
+    let peeked_body = &peeked[body_offset..];
+    let peeked_body_len = peeked_body.len().min(content_length);
+
+    let mut body = Vec::with_capacity(content_length);
+    body.extend_from_slice(&peeked_body[..peeked_body_len]);
+
+    let remaining = content_length - peeked_body_len;
+    if remaining > 0 {
+        let mut rest = vec![0u8; remaining];
+        if stream.read_exact(&mut rest).await.is_err() {
+            return String::from_utf8(body).ok();
+        }
+        body.extend_from_slice(&rest);
+    }
+
+    String::from_utf8(body).ok()
+}
+
+pub(super) async fn relay_command_to_daemon(
+    session_name: &str,
+    body: &str,
+) -> Result<String, String> {
+    let mut cmd: Value = serde_json::from_str(body).map_err(|e| format!("Invalid JSON: {}", e))?;
+
+    if cmd.get("id").is_none() {
+        let id = format!(
+            "dash-{}",
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap_or_default()
+                .as_millis()
+        );
+        cmd["id"] = json!(id);
+    }
+
+    let mut json_str = serde_json::to_string(&cmd).map_err(|e| e.to_string())?;
+    json_str.push('\n');
+
+    #[cfg(unix)]
+    let stream = {
+        let socket_path = get_socket_dir().join(format!("{}.sock", session_name));
+        tokio::net::UnixStream::connect(&socket_path)
+            .await
+            .map_err(|e| format!("Failed to connect to daemon: {}", e))?
+    };
+
+    #[cfg(windows)]
+    let stream = {
+        let port = resolve_port(session_name);
+        tokio::net::TcpStream::connect(format!("127.0.0.1:{}", port))
+            .await
+            .map_err(|e| format!("Failed to connect to daemon: {}", e))?
+    };
+
+    let (reader, mut writer) = tokio::io::split(stream);
+
+    writer
+        .write_all(json_str.as_bytes())
+        .await
+        .map_err(|e| format!("Failed to send command: {}", e))?;
+
+    let mut buf_reader = tokio::io::BufReader::new(reader);
+    let mut response_line = String::new();
+    tokio::io::AsyncBufReadExt::read_line(&mut buf_reader, &mut response_line)
+        .await
+        .map_err(|e| format!("Failed to read response: {}", e))?;
+
+    Ok(response_line.trim().to_string())
+}
+
+pub(super) fn serve_embedded_file(url_path: &str) -> (&'static str, &'static str, Vec<u8>) {
+    let clean = url_path.trim_start_matches('/');
+    let key = if clean.is_empty() {
+        "index.html"
+    } else {
+        clean
+    };
+
+    let file = DashboardAssets::get(key).or_else(|| DashboardAssets::get("index.html"));
+
+    match file {
+        Some(content) => {
+            let ext = key.rsplit('.').next().unwrap_or("");
+            let ct = match ext {
+                "html" => "text/html; charset=utf-8",
+                "js" => "application/javascript; charset=utf-8",
+                "css" => "text/css; charset=utf-8",
+                "json" => "application/json; charset=utf-8",
+                "svg" => "image/svg+xml",
+                "png" => "image/png",
+                "ico" => "image/x-icon",
+                "woff2" => "font/woff2",
+                "woff" => "font/woff",
+                "txt" => "text/plain; charset=utf-8",
+                _ => "application/octet-stream",
+            };
+            ("200 OK", ct, content.data.to_vec())
+        }
+        None => (
+            "404 Not Found",
+            "text/html; charset=utf-8",
+            b"<html><body><p>404 Not Found</p></body></html>".to_vec(),
+        ),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::test_utils::EnvGuard;
+    use std::sync::Arc;
+    use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt};
+    use tokio::net::TcpListener;
+    use tokio::sync::oneshot;
+
+    async fn send_request_to_handler(request: &str, session_name: &str) -> String {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        let peeked = request.as_bytes().to_vec();
+        let last_tabs = Arc::new(RwLock::new(Vec::new()));
+        let last_engine = Arc::new(RwLock::new("chrome".to_string()));
+        let session_name = session_name.to_string();
+
+        let server = tokio::spawn(async move {
+            let (stream, _) = listener.accept().await.unwrap();
+            handle_http_request(stream, &peeked, &last_tabs, &last_engine, &session_name).await;
+        });
+
+        let mut client = tokio::net::TcpStream::connect(addr).await.unwrap();
+        client.write_all(request.as_bytes()).await.unwrap();
+        client.shutdown().await.unwrap();
+
+        let mut response = Vec::new();
+        client.read_to_end(&mut response).await.unwrap();
+        server.await.unwrap();
+
+        String::from_utf8(response).unwrap()
+    }
+
+    #[cfg(unix)]
+    async fn spawn_fake_daemon(
+        socket_dir: &std::path::Path,
+        session_name: &str,
+    ) -> oneshot::Receiver<String> {
+        let socket_path = socket_dir.join(format!("{session_name}.sock"));
+        let _ = std::fs::remove_file(&socket_path);
+        let listener = tokio::net::UnixListener::bind(&socket_path).unwrap();
+        let (tx, rx) = oneshot::channel();
+
+        tokio::spawn(async move {
+            let (stream, _) = listener.accept().await.unwrap();
+            let mut reader = tokio::io::BufReader::new(stream);
+            let mut line = String::new();
+            reader.read_line(&mut line).await.unwrap();
+
+            let mut stream = reader.into_inner();
+            stream
+                .write_all(br#"{"success":true,"data":{"ok":true}}"#)
+                .await
+                .unwrap();
+            stream.write_all(b"\n").await.unwrap();
+            let _ = tx.send(line);
+        });
+
+        rx
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "current_thread")]
+    async fn cross_origin_command_post_is_rejected_without_relaying_to_daemon() {
+        let temp_parent = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("target")
+            .join("t");
+        std::fs::create_dir_all(&temp_parent).unwrap();
+        let socket_dir = tempfile::Builder::new()
+            .prefix("ab-")
+            .tempdir_in(temp_parent)
+            .unwrap();
+        let guard = EnvGuard::new(&["AGENT_BROWSER_SOCKET_DIR", "XDG_RUNTIME_DIR"]);
+        guard.set(
+            "AGENT_BROWSER_SOCKET_DIR",
+            socket_dir.path().to_str().unwrap(),
+        );
+        guard.remove("XDG_RUNTIME_DIR");
+
+        let session_name = "x";
+        let daemon_command = spawn_fake_daemon(socket_dir.path(), session_name).await;
+        let body = r#"{"action":"tabs"}"#;
+        let request = format!(
+            "POST /api/command HTTP/1.1\r\nHost: localhost:7777\r\nOrigin: https://evil.example\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+
+        let response = send_request_to_handler(&request, session_name).await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 403 Forbidden"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            tokio::time::timeout(std::time::Duration::from_millis(50), daemon_command)
+                .await
+                .is_err(),
+            "cross-origin request reached daemon command relay"
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn cross_origin_command_preflight_is_rejected_without_wildcard_cors() {
+        let request = concat!(
+            "OPTIONS /api/command HTTP/1.1\r\n",
+            "Host: localhost:7777\r\n",
+            "Origin: https://evil.example\r\n",
+            "Access-Control-Request-Method: POST\r\n",
+            "Access-Control-Request-Headers: content-type\r\n",
+            "\r\n"
+        );
+
+        let response = send_request_to_handler(request, "x").await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 403 Forbidden"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            !response.contains("Access-Control-Allow-Origin: *"),
+            "forbidden command preflight exposed wildcard CORS: {response}"
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn command_post_without_origin_or_referer_is_rejected() {
+        let body = r#"{"action":"tabs"}"#;
+        let request = format!(
+            "POST /api/command HTTP/1.1\r\nHost: localhost:7777\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+
+        let response = send_request_to_handler(&request, "x").await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 403 Forbidden"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            !response.contains("Access-Control-Allow-Origin: *"),
+            "forbidden command response exposed wildcard CORS: {response}"
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn command_post_with_dns_rebinding_host_is_rejected() {
+        let body = r#"{"action":"tabs"}"#;
+        let request = format!(
+            "POST /api/command HTTP/1.1\r\nHost: attacker.example:7777\r\nOrigin: http://attacker.example:7777\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+
+        let response = send_request_to_handler(&request, "x").await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 403 Forbidden"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            !response.contains("Access-Control-Allow-Origin: *"),
+            "forbidden command response exposed wildcard CORS: {response}"
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn command_post_ignores_header_like_body_lines() {
+        let body = "Referer: http://localhost:7777\r\n{\"action\":\"tabs\"}";
+        let request = format!(
+            "POST /api/command HTTP/1.1\r\nHost: localhost:7777\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+
+        let response = send_request_to_handler(&request, "x").await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 403 Forbidden"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            !response.contains("Access-Control-Allow-Origin: *"),
+            "forbidden command response exposed wildcard CORS: {response}"
+        );
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "current_thread")]
+    async fn same_origin_command_post_relays_without_wildcard_cors() {
+        let temp_parent = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("target")
+            .join("t");
+        std::fs::create_dir_all(&temp_parent).unwrap();
+        let socket_dir = tempfile::Builder::new()
+            .prefix("ab-")
+            .tempdir_in(temp_parent)
+            .unwrap();
+        let guard = EnvGuard::new(&["AGENT_BROWSER_SOCKET_DIR", "XDG_RUNTIME_DIR"]);
+        guard.set(
+            "AGENT_BROWSER_SOCKET_DIR",
+            socket_dir.path().to_str().unwrap(),
+        );
+        guard.remove("XDG_RUNTIME_DIR");
+
+        let session_name = "x";
+        let daemon_command = spawn_fake_daemon(socket_dir.path(), session_name).await;
+        let body = r#"{"action":"tabs"}"#;
+        let request = format!(
+            "POST /api/command HTTP/1.1\r\nHost: localhost:7777\r\nOrigin: http://localhost:7777\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+
+        let response = send_request_to_handler(&request, session_name).await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 200 OK"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            response.contains("Access-Control-Allow-Origin: http://localhost:7777"),
+            "same-origin command response did not reflect origin: {response}"
+        );
+        assert!(
+            !response.contains("Access-Control-Allow-Origin: *"),
+            "same-origin command response exposed wildcard CORS: {response}"
+        );
+
+        let relayed = tokio::time::timeout(std::time::Duration::from_secs(1), daemon_command)
+            .await
+            .unwrap()
+            .unwrap();
+        assert!(relayed.contains(r#""action":"tabs""#), "{relayed}");
+    }
+}

cli/src/native/stream/mod.rs

@@ -0,0 +1,486 @@
+mod cdp_loop;
+pub(crate) mod chat;
+mod dashboard;
+mod discovery;
+mod http;
+mod websocket;
+
+pub use cdp_loop::{ack_screencast_frame, start_screencast, stop_screencast};
+pub use dashboard::run_dashboard_server;
+
+use serde_json::{json, Value};
+use std::sync::Arc;
+
+use tokio::net::TcpListener;
+use tokio::sync::{broadcast, watch, Mutex, Notify, RwLock};
+
+use super::cdp::client::CdpClient;
+
+/// Frame metadata from CDP Page.screencastFrame events.
+#[derive(Debug, Clone)]
+pub struct FrameMetadata {
+    pub offset_top: f64,
+    pub page_scale_factor: f64,
+    pub device_width: u32,
+    pub device_height: u32,
+    pub scroll_offset_x: f64,
+    pub scroll_offset_y: f64,
+    pub timestamp: u64,
+}
+
+impl Default for FrameMetadata {
+    fn default() -> Self {
+        Self {
+            offset_top: 0.0,
+            page_scale_factor: 1.0,
+            device_width: 1280,
+            device_height: 720,
+            scroll_offset_x: 0.0,
+            scroll_offset_y: 0.0,
+            timestamp: 0,
+        }
+    }
+}
+
+pub struct StreamServer {
+    port: u16,
+    session_name: String,
+    frame_tx: broadcast::Sender<String>,
+    client_count: Arc<Mutex<usize>>,
+    client_slot: Arc<RwLock<Option<Arc<CdpClient>>>>,
+    /// The active CDP page session ID (from Target.attachToTarget).
+    cdp_session_id: Arc<RwLock<Option<String>>>,
+    client_notify: Arc<Notify>,
+    screencasting: Arc<Mutex<bool>>,
+    viewport_width: Arc<Mutex<u32>>,
+    viewport_height: Arc<Mutex<u32>>,
+    last_tabs: Arc<RwLock<Vec<Value>>>,
+    last_engine: Arc<RwLock<String>>,
+    last_frame: Arc<RwLock<Option<String>>>,
+    recording: Arc<Mutex<bool>>,
+    shutdown_tx: watch::Sender<bool>,
+    accept_task: Mutex<Option<tokio::task::JoinHandle<()>>>,
+    cdp_task: Mutex<Option<tokio::task::JoinHandle<()>>>,
+}
+
+impl StreamServer {
+    pub async fn start(
+        preferred_port: u16,
+        client: Arc<CdpClient>,
+        session_id: String,
+    ) -> Result<Self, String> {
+        let client_slot = Arc::new(RwLock::new(Some(client)));
+        let (server, _) = Self::start_inner(preferred_port, client_slot, session_id, true).await?;
+        Ok(server)
+    }
+
+    /// Start the stream server without a CDP client.
+    /// Returns the server and a shared slot to set the client when the browser launches.
+    /// Input messages are ignored until the client is set.
+    /// When `allow_port_fallback` is true, binding to an occupied port falls back to an
+    /// OS-assigned port (used by daemon startup). When false, the error propagates
+    /// (used by the runtime `stream_enable` command).
+    pub async fn start_without_client(
+        preferred_port: u16,
+        session_id: String,
+        allow_port_fallback: bool,
+    ) -> Result<(Self, Arc<RwLock<Option<Arc<CdpClient>>>>), String> {
+        let client_slot = Arc::new(RwLock::new(None::<Arc<CdpClient>>));
+        Self::start_inner(preferred_port, client_slot, session_id, allow_port_fallback).await
+    }
+
+    /// Notify the background CDP listener that the client has changed (browser launched/closed).
+    pub fn notify_client_changed(&self) {
+        self.client_notify.notify_one();
+    }
+
+    /// Update the active CDP page session ID used for screencast commands.
+    pub async fn set_cdp_session_id(&self, session_id: Option<String>) {
+        let mut guard = self.cdp_session_id.write().await;
+        *guard = session_id;
+    }
+
+    /// Check whether the server currently has active screencast running.
+    pub async fn is_screencasting(&self) -> bool {
+        *self.screencasting.lock().await
+    }
+
+    /// Update the stored viewport dimensions and restart the active screencast (if any)
+    /// so frames are captured at the new size.
+    pub async fn set_viewport(&self, width: u32, height: u32) {
+        let mut vw = self.viewport_width.lock().await;
+        let mut vh = self.viewport_height.lock().await;
+        if *vw == width && *vh == height {
+            return;
+        }
+        *vw = width;
+        *vh = height;
+        drop(vw);
+        drop(vh);
+        self.client_notify.notify_one();
+    }
+
+    /// Get the current viewport dimensions.
+    pub async fn viewport(&self) -> (u32, u32) {
+        let w = *self.viewport_width.lock().await;
+        let h = *self.viewport_height.lock().await;
+        (w, h)
+    }
+
+    /// Override the cached screencast state for explicit CLI start/stop commands.
+    pub async fn set_screencasting(&self, active: bool) {
+        let mut guard = self.screencasting.lock().await;
+        *guard = active;
+    }
+
+    /// Update and broadcast the recording state.
+    pub async fn set_recording(&self, active: bool, engine: &str) {
+        *self.recording.lock().await = active;
+        let connected = self.client_slot.read().await.is_some();
+        let sc = *self.screencasting.lock().await;
+        let (vw, vh) = self.viewport().await;
+        self.broadcast_status(connected, sc, vw, vh, engine).await;
+    }
+
+    /// Shut down the accept loop and background CDP listener, releasing the bound port.
+    pub async fn shutdown(&self) {
+        let _ = self.shutdown_tx.send(true);
+
+        if let Some(task) = self.accept_task.lock().await.take() {
+            let _ = task.await;
+        }
+        if let Some(task) = self.cdp_task.lock().await.take() {
+            let _ = task.await;
+        }
+    }
+
+    async fn start_inner(
+        preferred_port: u16,
+        client_slot: Arc<RwLock<Option<Arc<CdpClient>>>>,
+        session_id: String,
+        allow_port_fallback: bool,
+    ) -> Result<(Self, Arc<RwLock<Option<Arc<CdpClient>>>>), String> {
+        let addr = format!("127.0.0.1:{}", preferred_port);
+        let listener = match TcpListener::bind(&addr).await {
+            Ok(l) => l,
+            Err(_) if allow_port_fallback && preferred_port != 0 => {
+                TcpListener::bind("127.0.0.1:0")
+                    .await
+                    .map_err(|e| format!("Failed to bind stream server: {}", e))?
+            }
+            Err(e) => return Err(format!("Failed to bind stream server: {}", e)),
+        };
+
+        let actual_addr = listener
+            .local_addr()
+            .map_err(|e| format!("Failed to get stream address: {}", e))?;
+        let port = actual_addr.port();
+
+        let (frame_tx, _) = broadcast::channel::<String>(64);
+        let client_count = Arc::new(Mutex::new(0usize));
+        let client_notify = Arc::new(Notify::new());
+        let screencasting = Arc::new(Mutex::new(false));
+        let cdp_session_id = Arc::new(RwLock::new(None::<String>));
+        let viewport_width = Arc::new(Mutex::new(1280u32));
+        let viewport_height = Arc::new(Mutex::new(720u32));
+        let last_tabs = Arc::new(RwLock::new(Vec::<Value>::new()));
+        let last_engine = Arc::new(RwLock::new("chrome".to_string()));
+        let last_frame = Arc::new(RwLock::new(None::<String>));
+        let recording = Arc::new(Mutex::new(false));
+        let (shutdown_tx, shutdown_rx) = watch::channel(false);
+
+        let frame_tx_clone = frame_tx.clone();
+        let client_count_clone = client_count.clone();
+        let client_slot_clone = client_slot.clone();
+        let notify_clone = client_notify.clone();
+        let screencasting_clone = screencasting.clone();
+        let cdp_session_clone = cdp_session_id.clone();
+
+        let vw_clone = viewport_width.clone();
+        let vh_clone = viewport_height.clone();
+        let last_tabs_clone = last_tabs.clone();
+        let last_engine_clone = last_engine.clone();
+        let last_frame_clone = last_frame.clone();
+        let recording_clone = recording.clone();
+        let accept_shutdown_rx = shutdown_rx.clone();
+        let session_name_clone = session_id.clone();
+        let accept_task = tokio::spawn(async move {
+            websocket::accept_loop(
+                listener,
+                frame_tx_clone,
+                client_count_clone,
+                client_slot_clone,
+                notify_clone,
+                screencasting_clone,
+                cdp_session_clone,
+                vw_clone,
+                vh_clone,
+                last_tabs_clone,
+                last_engine_clone,
+                last_frame_clone,
+                recording_clone,
+                accept_shutdown_rx,
+                session_name_clone,
+            )
+            .await;
+        });
+
+        let frame_tx_bg = frame_tx.clone();
+        let client_slot_bg = client_slot.clone();
+        let client_notify_bg = client_notify.clone();
+        let screencasting_bg = screencasting.clone();
+        let client_count_bg = client_count.clone();
+        let cdp_session_bg = cdp_session_id.clone();
+        let vw_bg = viewport_width.clone();
+        let vh_bg = viewport_height.clone();
+        let last_frame_bg = last_frame.clone();
+        let last_tabs_bg = last_tabs.clone();
+        let last_engine_bg = last_engine.clone();
+        let recording_bg = recording.clone();
+        let cdp_task = tokio::spawn(async move {
+            cdp_loop::cdp_event_loop(
+                frame_tx_bg,
+                client_slot_bg,
+                client_notify_bg,
+                screencasting_bg,
+                client_count_bg,
+                cdp_session_bg,
+                vw_bg,
+                vh_bg,
+                last_frame_bg,
+                last_tabs_bg,
+                last_engine_bg,
+                recording_bg,
+                shutdown_rx,
+            )
+            .await;
+        });
+
+        Ok((
+            Self {
+                port,
+                session_name: session_id,
+                frame_tx,
+                client_count,
+                client_slot: client_slot.clone(),
+                cdp_session_id,
+                client_notify,
+                screencasting,
+                viewport_width,
+                viewport_height,
+                last_tabs,
+                last_engine,
+                last_frame,
+                recording,
+                shutdown_tx,
+                accept_task: Mutex::new(Some(accept_task)),
+                cdp_task: Mutex::new(Some(cdp_task)),
+            },
+            client_slot,
+        ))
+    }
+
+    pub fn port(&self) -> u16 {
+        self.port
+    }
+
+    /// Broadcast a raw frame string (legacy).
+    pub fn broadcast_frame(&self, frame_json: &str) {
+        let s = frame_json.to_string();
+        if let Ok(mut lf) = self.last_frame.try_write() {
+            *lf = Some(s.clone());
+        }
+        let _ = self.frame_tx.send(s);
+    }
+
+    /// Broadcast a screencast frame with structured metadata.
+    pub fn broadcast_screencast_frame(&self, base64_data: &str, metadata: &FrameMetadata) {
+        let msg = json!({
+            "type": "frame",
+            "data": base64_data,
+            "metadata": {
+                "offsetTop": metadata.offset_top,
+                "pageScaleFactor": metadata.page_scale_factor,
+                "deviceWidth": metadata.device_width,
+                "deviceHeight": metadata.device_height,
+                "scrollOffsetX": metadata.scroll_offset_x,
+                "scrollOffsetY": metadata.scroll_offset_y,
+                "timestamp": metadata.timestamp,
+            }
+        });
+        let s = msg.to_string();
+        if let Ok(mut lf) = self.last_frame.try_write() {
+            *lf = Some(s.clone());
+        }
+        let _ = self.frame_tx.send(s);
+    }
+
+    /// Broadcast a status message to all connected clients.
+    pub async fn broadcast_status(
+        &self,
+        connected: bool,
+        screencasting: bool,
+        viewport_width: u32,
+        viewport_height: u32,
+        engine: &str,
+    ) {
+        {
+            let mut guard = self.last_engine.write().await;
+            *guard = engine.to_string();
+        }
+        let rec = *self.recording.lock().await;
+        let msg = json!({
+            "type": "status",
+            "connected": connected,
+            "screencasting": screencasting,
+            "viewportWidth": viewport_width,
+            "viewportHeight": viewport_height,
+            "engine": engine,
+            "recording": rec,
+        });
+        let _ = self.frame_tx.send(msg.to_string());
+    }
+
+    /// Broadcast an error message to all connected clients.
+    pub fn broadcast_error(&self, message: &str) {
+        let msg = json!({
+            "type": "error",
+            "message": message,
+        });
+        let _ = self.frame_tx.send(msg.to_string());
+    }
+
+    /// Broadcast a command event when a command begins executing.
+    pub fn broadcast_command(&self, action: &str, id: &str, params: &Value) {
+        let msg = json!({
+            "type": "command",
+            "action": action,
+            "id": id,
+            "params": params,
+            "timestamp": timestamp_ms(),
+        });
+        let _ = self.frame_tx.send(msg.to_string());
+    }
+
+    /// Broadcast a result event after a command finishes executing.
+    pub fn broadcast_result(
+        &self,
+        id: &str,
+        action: &str,
+        success: bool,
+        data: &Value,
+        duration_ms: u64,
+    ) {
+        let msg = json!({
+            "type": "result",
+            "id": id,
+            "action": action,
+            "success": success,
+            "data": data,
+            "duration_ms": duration_ms,
+            "timestamp": timestamp_ms(),
+        });
+        let _ = self.frame_tx.send(msg.to_string());
+    }
+
+    /// Broadcast a console event from the browser.
+    pub fn broadcast_console(&self, level: &str, text: &str, args: &[Value]) {
+        let mut msg = json!({
+            "type": "console",
+            "level": level,
+            "text": text,
+            "timestamp": timestamp_ms(),
+        });
+        if !args.is_empty() {
+            msg.as_object_mut()
+                .unwrap()
+                .insert("args".to_string(), Value::Array(args.to_vec()));
+        }
+        let _ = self.frame_tx.send(msg.to_string());
+    }
+
+    /// Broadcast a page error (uncaught exception) from the browser.
+    pub fn broadcast_page_error(&self, text: &str, line: Option<i64>, column: Option<i64>) {
+        let msg = json!({
+            "type": "page_error",
+            "text": text,
+            "line": line,
+            "column": column,
+            "timestamp": timestamp_ms(),
+        });
+        let _ = self.frame_tx.send(msg.to_string());
+    }
+
+    /// Broadcast the current tab list so the dashboard can render a tab bar.
+    /// Also caches the list so newly connected WebSocket clients receive it immediately.
+    pub async fn broadcast_tabs(&self, tabs: &[Value]) {
+        {
+            let mut guard = self.last_tabs.write().await;
+            *guard = tabs.to_vec();
+        }
+        let msg = json!({
+            "type": "tabs",
+            "tabs": tabs,
+            "timestamp": timestamp_ms(),
+        });
+        let _ = self.frame_tx.send(msg.to_string());
+    }
+}
+
+pub(crate) fn timestamp_ms() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_millis() as u64)
+        .unwrap_or(0)
+}
+
+pub fn is_allowed_origin(origin: Option<&str>) -> bool {
+    match origin {
+        None => true,
+        Some(o) => {
+            if o.starts_with("file://") {
+                return true;
+            }
+            if let Ok(url) = url::Url::parse(o) {
+                let host = url.host_str().unwrap_or("");
+                host == "localhost" || host == "127.0.0.1" || host == "::1" || host == "[::1]"
+            } else {
+                false
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_allowed_origin_none() {
+        assert!(is_allowed_origin(None));
+    }
+
+    #[test]
+    fn test_allowed_origin_file() {
+        assert!(is_allowed_origin(Some("file:///path/to/file")));
+    }
+
+    #[test]
+    fn test_allowed_origin_localhost() {
+        assert!(is_allowed_origin(Some("http://localhost:3000")));
+        assert!(is_allowed_origin(Some("http://127.0.0.1:8080")));
+    }
+
+    #[test]
+    fn test_disallowed_origin() {
+        assert!(!is_allowed_origin(Some("http://evil.com")));
+    }
+
+    #[test]
+    fn test_frame_metadata_default() {
+        let meta = FrameMetadata::default();
+        assert_eq!(meta.device_width, 1280);
+        assert_eq!(meta.device_height, 720);
+        assert_eq!(meta.page_scale_factor, 1.0);
+    }
+}

cli/src/native/stream/websocket.rs

@@ -0,0 +1,338 @@
+use serde_json::{json, Value};
+use std::net::SocketAddr;
+use std::sync::Arc;
+
+use futures_util::{SinkExt, StreamExt};
+use tokio::net::TcpListener;
+use tokio::sync::{broadcast, watch, Mutex, Notify, RwLock};
+use tokio_tungstenite::tungstenite::Message;
+
+use crate::native::cdp::client::CdpClient;
+
+use super::http::handle_http_request;
+use super::{is_allowed_origin, timestamp_ms};
+
+#[allow(clippy::too_many_arguments)]
+pub(super) async fn accept_loop(
+    listener: TcpListener,
+    frame_tx: broadcast::Sender<String>,
+    client_count: Arc<Mutex<usize>>,
+    client_slot: Arc<RwLock<Option<Arc<CdpClient>>>>,
+    client_notify: Arc<Notify>,
+    screencasting: Arc<Mutex<bool>>,
+    cdp_session_id: Arc<RwLock<Option<String>>>,
+    viewport_width: Arc<Mutex<u32>>,
+    viewport_height: Arc<Mutex<u32>>,
+    last_tabs: Arc<RwLock<Vec<Value>>>,
+    last_engine: Arc<RwLock<String>>,
+    last_frame: Arc<RwLock<Option<String>>>,
+    recording: Arc<Mutex<bool>>,
+    mut shutdown_rx: watch::Receiver<bool>,
+    session_name: String,
+) {
+    let session_name: Arc<str> = Arc::from(session_name);
+    loop {
+        tokio::select! {
+            changed = shutdown_rx.changed() => {
+                if changed.is_err() || *shutdown_rx.borrow() {
+                    break;
+                }
+            }
+            accept_result = listener.accept() => {
+                let Ok((stream, addr)) = accept_result else {
+                    break;
+                };
+                let frame_tx = frame_tx.clone();
+                let client_count = client_count.clone();
+                let client_slot = client_slot.clone();
+                let client_notify = client_notify.clone();
+                let screencasting = screencasting.clone();
+                let cdp_session_id = cdp_session_id.clone();
+                let vw = viewport_width.clone();
+                let vh = viewport_height.clone();
+                let lt = last_tabs.clone();
+                let le = last_engine.clone();
+                let lf = last_frame.clone();
+                let rec = recording.clone();
+                let shutdown_rx = shutdown_rx.clone();
+                let sn = session_name.clone();
+
+                tokio::spawn(async move {
+                    handle_connection(
+                        stream,
+                        addr,
+                        frame_tx,
+                        client_count,
+                        client_slot,
+                        client_notify,
+                        screencasting,
+                        cdp_session_id,
+                        vw,
+                        vh,
+                        lt,
+                        le,
+                        lf,
+                        rec,
+                        shutdown_rx,
+                        sn,
+                    )
+                    .await;
+                });
+            }
+        }
+    }
+}
+
+fn is_websocket_upgrade(request: &str) -> bool {
+    request.lines().any(|line| {
+        if let Some((name, value)) = line.split_once(':') {
+            name.trim().eq_ignore_ascii_case("upgrade")
+                && value.trim().eq_ignore_ascii_case("websocket")
+        } else {
+            false
+        }
+    })
+}
+
+/// Peek at the TCP stream to dispatch between WebSocket upgrade and plain HTTP.
+#[allow(clippy::too_many_arguments)]
+async fn handle_connection(
+    stream: tokio::net::TcpStream,
+    addr: SocketAddr,
+    frame_tx: broadcast::Sender<String>,
+    client_count: Arc<Mutex<usize>>,
+    client_slot: Arc<RwLock<Option<Arc<CdpClient>>>>,
+    client_notify: Arc<Notify>,
+    screencasting: Arc<Mutex<bool>>,
+    cdp_session_id: Arc<RwLock<Option<String>>>,
+    viewport_width: Arc<Mutex<u32>>,
+    viewport_height: Arc<Mutex<u32>>,
+    last_tabs: Arc<RwLock<Vec<Value>>>,
+    last_engine: Arc<RwLock<String>>,
+    last_frame: Arc<RwLock<Option<String>>>,
+    recording: Arc<Mutex<bool>>,
+    shutdown_rx: watch::Receiver<bool>,
+    session_name: Arc<str>,
+) {
+    let mut buf = [0u8; 4096];
+    let n = match stream.peek(&mut buf).await {
+        Ok(n) => n,
+        Err(_) => return,
+    };
+    let request = String::from_utf8_lossy(&buf[..n]);
+
+    if is_websocket_upgrade(&request) {
+        let frame_rx = frame_tx.subscribe();
+        handle_ws_client(
+            stream,
+            addr,
+            frame_rx,
+            client_count,
+            client_slot,
+            client_notify,
+            screencasting,
+            cdp_session_id,
+            viewport_width,
+            viewport_height,
+            last_tabs,
+            last_engine,
+            last_frame,
+            recording,
+            shutdown_rx,
+        )
+        .await;
+    } else {
+        handle_http_request(stream, &buf[..n], &last_tabs, &last_engine, &session_name).await;
+    }
+}
+
+#[allow(clippy::result_large_err, clippy::too_many_arguments)]
+async fn handle_ws_client(
+    stream: tokio::net::TcpStream,
+    _addr: SocketAddr,
+    mut frame_rx: broadcast::Receiver<String>,
+    client_count: Arc<Mutex<usize>>,
+    client_slot: Arc<RwLock<Option<Arc<CdpClient>>>>,
+    client_notify: Arc<Notify>,
+    screencasting: Arc<Mutex<bool>>,
+    cdp_session_id: Arc<RwLock<Option<String>>>,
+    viewport_width: Arc<Mutex<u32>>,
+    viewport_height: Arc<Mutex<u32>>,
+    last_tabs: Arc<RwLock<Vec<Value>>>,
+    last_engine: Arc<RwLock<String>>,
+    last_frame: Arc<RwLock<Option<String>>>,
+    recording: Arc<Mutex<bool>>,
+    mut shutdown_rx: watch::Receiver<bool>,
+) {
+    let callback =
+        |req: &tokio_tungstenite::tungstenite::handshake::server::Request,
+         resp: tokio_tungstenite::tungstenite::handshake::server::Response| {
+            let origin = req
+                .headers()
+                .get("origin")
+                .and_then(|v| v.to_str().ok())
+                .map(|s| s.to_string());
+            if !is_allowed_origin(origin.as_deref()) {
+                let mut reject =
+                    tokio_tungstenite::tungstenite::handshake::server::ErrorResponse::new(Some(
+                        "Origin not allowed".to_string(),
+                    ));
+                *reject.status_mut() = tokio_tungstenite::tungstenite::http::StatusCode::FORBIDDEN;
+                return Err(reject);
+            }
+            Ok(resp)
+        };
+
+    let ws_stream = match tokio_tungstenite::accept_hdr_async(stream, callback).await {
+        Ok(ws) => ws,
+        Err(_) => return,
+    };
+
+    {
+        let mut count = client_count.lock().await;
+        *count += 1;
+    }
+
+    let (mut ws_tx, mut ws_rx) = ws_stream.split();
+
+    {
+        let guard = client_slot.read().await;
+        let connected = guard.is_some();
+        let sc = *screencasting.lock().await;
+        let vw = *viewport_width.lock().await;
+        let vh = *viewport_height.lock().await;
+        let eng = last_engine.read().await.clone();
+        let rec = *recording.lock().await;
+        let status = json!({
+            "type": "status",
+            "connected": connected,
+            "screencasting": sc,
+            "viewportWidth": vw,
+            "viewportHeight": vh,
+            "engine": eng,
+            "recording": rec,
+        });
+        let _ = ws_tx.send(Message::Text(status.to_string())).await;
+
+        let tabs = last_tabs.read().await;
+        if !tabs.is_empty() {
+            let tabs_msg = json!({
+                "type": "tabs",
+                "tabs": *tabs,
+                "timestamp": timestamp_ms(),
+            });
+            let _ = ws_tx.send(Message::Text(tabs_msg.to_string())).await;
+        }
+
+        if let Some(ref cached) = *last_frame.read().await {
+            let _ = ws_tx.send(Message::Text(cached.clone())).await;
+        }
+    }
+
+    client_notify.notify_one();
+
+    loop {
+        tokio::select! {
+            changed = shutdown_rx.changed() => {
+                if changed.is_err() || *shutdown_rx.borrow() {
+                    let _ = ws_tx.send(Message::Close(None)).await;
+                    break;
+                }
+            }
+            frame = frame_rx.recv() => {
+                match frame {
+                    Ok(data) => {
+                        if ws_tx.send(Message::Text(data)).await.is_err() {
+                            break;
+                        }
+                    }
+                    Err(broadcast::error::RecvError::Lagged(_)) => {
+                        continue;
+                    }
+                    Err(broadcast::error::RecvError::Closed) => break,
+                }
+            }
+            msg = ws_rx.next() => {
+                match msg {
+                    Some(Ok(Message::Text(text))) => {
+                        let guard = client_slot.read().await;
+                        if let Some(ref client) = *guard {
+                            let sid = cdp_session_id.read().await;
+                            handle_client_message(&text, client.as_ref(), sid.as_deref()).await;
+                        }
+                    }
+                    Some(Ok(Message::Close(_))) | None => break,
+                    _ => {}
+                }
+            }
+        }
+    }
+
+    {
+        let mut count = client_count.lock().await;
+        *count = count.saturating_sub(1);
+    }
+
+    client_notify.notify_one();
+}
+
+async fn handle_client_message(msg: &str, client: &CdpClient, session_id: Option<&str>) {
+    let parsed: Value = match serde_json::from_str(msg) {
+        Ok(v) => v,
+        Err(_) => return,
+    };
+
+    let msg_type = parsed.get("type").and_then(|v| v.as_str()).unwrap_or("");
+
+    match msg_type {
+        "input_mouse" => {
+            let _ = client
+                .send_command(
+                    "Input.dispatchMouseEvent",
+                    Some(json!({
+                        "type": parsed.get("eventType").and_then(|v| v.as_str()).unwrap_or("mouseMoved"),
+                        "x": parsed.get("x").and_then(|v| v.as_f64()).unwrap_or(0.0),
+                        "y": parsed.get("y").and_then(|v| v.as_f64()).unwrap_or(0.0),
+                        "button": parsed.get("button").and_then(|v| v.as_str()).unwrap_or("none"),
+                        "clickCount": parsed.get("clickCount").and_then(|v| v.as_i64()).unwrap_or(0),
+                        "deltaX": parsed.get("deltaX").and_then(|v| v.as_f64()).unwrap_or(0.0),
+                        "deltaY": parsed.get("deltaY").and_then(|v| v.as_f64()).unwrap_or(0.0),
+                        "modifiers": parsed.get("modifiers").and_then(|v| v.as_i64()).unwrap_or(0),
+                    })),
+                    session_id,
+                )
+                .await;
+        }
+        "input_keyboard" => {
+            let _ = client
+                .send_command(
+                    "Input.dispatchKeyEvent",
+                    Some(json!({
+                        "type": parsed.get("eventType").and_then(|v| v.as_str()).unwrap_or("keyDown"),
+                        "key": parsed.get("key"),
+                        "code": parsed.get("code"),
+                        "text": parsed.get("text"),
+                        "windowsVirtualKeyCode": parsed.get("windowsVirtualKeyCode").and_then(|v| v.as_i64()).unwrap_or(0),
+                        "modifiers": parsed.get("modifiers").and_then(|v| v.as_i64()).unwrap_or(0),
+                    })),
+                    session_id,
+                )
+                .await;
+        }
+        "input_touch" => {
+            let _ = client
+                .send_command(
+                    "Input.dispatchTouchEvent",
+                    Some(json!({
+                        "type": parsed.get("eventType").and_then(|v| v.as_str()).unwrap_or("touchStart"),
+                        "touchPoints": parsed.get("touchPoints").unwrap_or(&json!([])),
+                        "modifiers": parsed.get("modifiers").and_then(|v| v.as_i64()).unwrap_or(0),
+                    })),
+                    session_id,
+                )
+                .await;
+        }
+        "status" => {}
+        _ => {}
+    }
+}

cli/src/native/test_fixtures/drag_probe.html

@@ -0,0 +1,135 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Drag Probe</title>
+  <style>
+    body {
+      margin: 0;
+      font: 14px/1.4 sans-serif;
+      background: #f4f4f4;
+    }
+
+    #pad {
+      position: relative;
+      width: 800px;
+      height: 500px;
+      margin: 24px;
+      border: 1px solid #999;
+      background: white;
+      overflow: hidden;
+    }
+
+    #target {
+      position: absolute;
+      left: 320px;
+      top: 40px;
+      width: 100px;
+      height: 40px;
+      background: #e34c26;
+      color: white;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      user-select: none;
+      cursor: grab;
+    }
+
+    #target.dragging {
+      cursor: grabbing;
+      background: #0d9488;
+    }
+
+    #log {
+      margin: 24px;
+      white-space: pre-wrap;
+      font-family: ui-monospace, monospace;
+    }
+  </style>
+</head>
+<body>
+  <div id="pad">
+    <div id="target">drag me</div>
+  </div>
+  <pre id="log"></pre>
+  <script>
+    const target = document.getElementById("target");
+    const logEl = document.getElementById("log");
+
+    window.__dragProbe = {
+      dragging: false,
+      events: [],
+      finalLeft: 320,
+      finalTop: 40,
+    };
+
+    let offsetX = 0;
+    let offsetY = 0;
+
+    function pushEvent(event, extra = {}) {
+      window.__dragProbe.events.push({
+        type: event.type,
+        button: event.button,
+        buttons: event.buttons,
+        x: event.clientX,
+        y: event.clientY,
+        target: event.target.id || event.target.tagName,
+        ...extra,
+      });
+      logEl.textContent = JSON.stringify(window.__dragProbe, null, 2);
+    }
+
+    function onPointerLikeStart(event) {
+      if (event.type === "mousedown") {
+        const rect = target.getBoundingClientRect();
+        offsetX = event.clientX - rect.left;
+        offsetY = event.clientY - rect.top;
+        window.__dragProbe.dragging = true;
+        target.classList.add("dragging");
+        event.preventDefault();
+      }
+      pushEvent(event, { phase: "start" });
+    }
+
+    target.addEventListener("mousedown", (event) => {
+      const rect = target.getBoundingClientRect();
+      offsetX = event.clientX - rect.left;
+      offsetY = event.clientY - rect.top;
+      window.__dragProbe.dragging = true;
+      target.classList.add("dragging");
+      event.preventDefault();
+      pushEvent(event, { phase: "start" });
+    });
+    target.addEventListener("pointerdown", onPointerLikeStart);
+
+    document.addEventListener("mousemove", (event) => {
+      if (window.__dragProbe.dragging) {
+        const left = event.clientX - offsetX;
+        const top = event.clientY - offsetY;
+        target.style.left = `${left}px`;
+        target.style.top = `${top}px`;
+        window.__dragProbe.finalLeft = left;
+        window.__dragProbe.finalTop = top;
+      }
+      pushEvent(event);
+    });
+    document.addEventListener("pointermove", (event) => {
+      pushEvent(event);
+    });
+
+    document.addEventListener("mouseup", (event) => {
+      if (window.__dragProbe.dragging) {
+        window.__dragProbe.dragging = false;
+        target.classList.remove("dragging");
+      }
+      pushEvent(event, { phase: "end" });
+    });
+    document.addEventListener("pointerup", (event) => {
+      pushEvent(event, { phase: "end" });
+    });
+    target.addEventListener("dragstart", (event) => {
+      pushEvent(event, { phase: "dragstart" });
+    });
+  </script>
+</body>
+</html>

cli/src/native/test_fixtures/html5_drag_probe.html

@@ -0,0 +1,91 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>HTML5 Drag Probe</title>
+  <style>
+    body {
+      margin: 24px;
+      font: 14px/1.4 sans-serif;
+    }
+
+    #source, #dest {
+      width: 120px;
+      height: 80px;
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      border: 1px solid #666;
+      user-select: none;
+      margin-right: 40px;
+    }
+
+    #source {
+      background: #f97316;
+      color: white;
+    }
+
+    #dest {
+      background: #e5e7eb;
+    }
+
+    pre {
+      margin-top: 24px;
+      white-space: pre-wrap;
+      font-family: ui-monospace, monospace;
+    }
+  </style>
+</head>
+<body>
+  <div id="source" draggable="true">drag source</div>
+  <div id="dest">drop zone</div>
+  <pre id="log"></pre>
+  <script>
+    const source = document.getElementById("source");
+    const dest = document.getElementById("dest");
+    const logEl = document.getElementById("log");
+
+    window.__html5DragProbe = { events: [] };
+
+    function pushEvent(event, extra = {}) {
+      window.__html5DragProbe.events.push({
+        type: event.type,
+        target: event.target.id || event.target.tagName,
+        x: event.clientX,
+        y: event.clientY,
+        button: event.button,
+        buttons: event.buttons,
+        ...extra,
+      });
+      logEl.textContent = JSON.stringify(window.__html5DragProbe, null, 2);
+    }
+
+    for (const type of ["pointerdown", "mousedown", "dragstart", "drag", "dragend"]) {
+      source.addEventListener(type, (event) => {
+        if (type === "dragstart") {
+          event.dataTransfer.setData("text/plain", "probe");
+        }
+        pushEvent(event);
+      });
+    }
+
+    for (const type of ["pointermove", "mousemove", "dragenter", "dragover", "drop", "pointerup", "mouseup"]) {
+      document.addEventListener(type, (event) => {
+        if (type === "dragover") {
+          event.preventDefault();
+        }
+        if (type === "drop") {
+          pushEvent(event, { dropped: event.dataTransfer.getData("text/plain") });
+          return;
+        }
+        pushEvent(event);
+      });
+    }
+
+    dest.addEventListener("dragover", (event) => event.preventDefault());
+    dest.addEventListener("drop", (event) => {
+      pushEvent(event, { dropped: event.dataTransfer.getData("text/plain") });
+    });
+  </script>
+</body>
+</html>

cli/src/native/test_fixtures/iframe_button_probe.html

@@ -0,0 +1,28 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>iframe button probe</title>
+  </head>
+  <body>
+    <h1>iframe button probe</h1>
+    <iframe
+      id="frame"
+      width="320"
+      height="140"
+      srcdoc="
+        <!doctype html>
+        <html>
+          <body style='margin:24px'>
+            <button id='b' style='padding:24px;font-size:22px'>save</button>
+            <script>
+              document.getElementById('b').addEventListener('click', function (e) {
+                this.textContent = 'clicked:' + e.isTrusted;
+              });
+            </script>
+          </body>
+        </html>
+      "
+    ></iframe>
+  </body>
+</html>

cli/src/native/test_fixtures/pointer_capture_probe.html

@@ -0,0 +1,113 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Pointer Capture Probe</title>
+  <style>
+    body {
+      margin: 24px;
+      font: 14px/1.4 sans-serif;
+    }
+    #crop {
+      position: relative;
+      width: 240px;
+      height: 180px;
+      border: 2px solid #fff;
+      outline: 1px solid #555;
+      background: rgba(0, 0, 0, 0.2);
+    }
+    #handle {
+      position: absolute;
+      width: 20px;
+      height: 20px;
+      top: -16px;
+      left: -16px;
+      padding-top: 13px;
+      padding-left: 13px;
+      box-sizing: content-box;
+      background: rgba(255, 0, 0, 0.25);
+    }
+    #handle::after {
+      content: "";
+      display: block;
+      width: 20px;
+      height: 20px;
+      border-top: 2px solid white;
+      border-left: 2px solid white;
+    }
+    pre {
+      margin-top: 24px;
+      white-space: pre-wrap;
+      font-family: ui-monospace, monospace;
+    }
+  </style>
+</head>
+<body>
+  <div id="crop" aria-label="crop area">
+    <div id="handle" aria-label="crop handle topLeft" data-anchor="topLeft"></div>
+  </div>
+  <pre id="log"></pre>
+  <script>
+    const crop = document.getElementById("crop");
+    const handle = document.getElementById("handle");
+    const logEl = document.getElementById("log");
+
+    const state = {
+      targetAnchor: null,
+      dragging: false,
+      moved: false,
+      events: [],
+    };
+    window.__pointerCaptureProbe = state;
+
+    function sync() {
+      logEl.textContent = JSON.stringify(state, null, 2);
+    }
+
+    function push(event, extra = {}) {
+      state.events.push({
+        type: event.type,
+        target: event.target.id || event.target.tagName,
+        currentTarget: event.currentTarget.id || event.currentTarget.tagName,
+        pointerId: event.pointerId,
+        button: event.button,
+        buttons: event.buttons,
+        hasCapture: event.currentTarget.hasPointerCapture?.(event.pointerId) ?? false,
+        x: event.clientX,
+        y: event.clientY,
+        ...extra,
+      });
+      sync();
+    }
+
+    crop.addEventListener("pointerdown", (event) => {
+      state.targetAnchor = event.target.getAttribute("data-anchor");
+      crop.setPointerCapture(event.pointerId);
+      event.preventDefault();
+      push(event, { phase: "down", targetAnchor: state.targetAnchor });
+    });
+
+    crop.addEventListener("pointermove", (event) => {
+      const hasCapture = crop.hasPointerCapture(event.pointerId);
+      if (hasCapture && state.targetAnchor) {
+        state.dragging = true;
+        state.moved = true;
+      }
+      push(event, { phase: hasCapture ? "drag" : "hover", targetAnchor: state.targetAnchor });
+    });
+
+    crop.addEventListener("pointerup", (event) => {
+      const hadCapture = crop.hasPointerCapture(event.pointerId);
+      state.dragging = false;
+      push(event, { phase: "up", targetAnchor: state.targetAnchor, hadCapture });
+      state.targetAnchor = null;
+    });
+
+    handle.addEventListener("pointerdown", (event) => push(event, { listener: "handle" }));
+    handle.addEventListener("pointermove", (event) => push(event, { listener: "handle" }));
+    handle.addEventListener("pointerup", (event) => push(event, { listener: "handle" }));
+
+    sync();
+  </script>
+</body>
+</html>

cli/src/native/test_fixtures/upload_probe.html

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head><title>Upload Test</title></head>
+<body>
+  <h1>Upload Test</h1>
+  <label for="fileInput">Choose file:</label>
+  <input type="file" id="fileInput" name="fileInput">
+  <div id="result"></div>
+  <script>
+    document.getElementById('fileInput').addEventListener('change', function(e) {
+      var file = e.target.files[0];
+      if (file) {
+        document.getElementById('result').textContent = 'uploaded:' + file.name;
+      }
+    });
+  </script>
+</body>
+</html>

cli/src/native/tracing.rs

@@ -358,16 +358,16 @@ fn get_clock_domain() -> Option<&'static str> {
 
 fn get_traces_dir() -> PathBuf {
     if let Some(home) = dirs::home_dir() {
-        home.join(".agent-browser").join("tmp").join("traces")
+        home.join(".chrome-use").join("tmp").join("traces")
     } else {
-        std::env::temp_dir().join("agent-browser").join("traces")
+        std::env::temp_dir().join("chrome-use").join("traces")
     }
 }
 
 fn get_profiles_dir() -> PathBuf {
     if let Some(home) = dirs::home_dir() {
-        home.join(".agent-browser").join("tmp").join("profiles")
+        home.join(".chrome-use").join("tmp").join("profiles")
     } else {
-        std::env::temp_dir().join("agent-browser").join("profiles")
+        std::env::temp_dir().join("chrome-use").join("profiles")
     }
 }

cli/src/native/webdriver/appium.rs

@@ -40,32 +40,45 @@ impl AppiumManager {
         })
     }
 
+    pub fn build_ios_capabilities(
+        device_udid: Option<&str>,
+        device_name: Option<&str>,
+        platform_version: Option<&str>,
+    ) -> Value {
+        let mut caps = json!({
+            "platformName": "iOS",
+            "appium:automationName": "XCUITest",
+            "browserName": "Safari",
+            "appium:noReset": true,
+        });
+
+        if let Some(name) = device_name {
+            caps["appium:deviceName"] = json!(name);
+        } else {
+            caps["appium:deviceName"] = json!("iPhone");
+        }
+
+        if let Some(ver) = platform_version {
+            caps["appium:platformVersion"] = json!(ver);
+        }
+
+        if let Some(udid) = device_udid {
+            caps["appium:udid"] = json!(udid);
+        }
+
+        caps
+    }
+
     pub async fn create_ios_session(
         &mut self,
         device_name: Option<&str>,
         platform_version: Option<&str>,
     ) -> Result<Value, String> {
-        let mut caps = json!({
-            "platformName": "iOS",
-            "automationName": "XCUITest",
-            "browserName": "Safari",
-            "noReset": true,
-        });
-
-        if let Some(name) = device_name {
-            caps["deviceName"] = json!(name);
-        } else {
-            caps["deviceName"] = json!("iPhone");
-        }
-
-        if let Some(ver) = platform_version {
-            caps["platformVersion"] = json!(ver);
-        }
-
-        if let Some(ref udid) = self.device_udid {
-            caps["udid"] = json!(udid);
-        }
-
+        let caps = Self::build_ios_capabilities(
+            self.device_udid.as_deref(),
+            device_name,
+            platform_version,
+        );
         self.client.create_session(caps).await
     }
 
@@ -198,4 +211,30 @@ mod tests {
         assert_eq!(APPIUM_DEFAULT_PORT, 4723);
         assert_eq!(APPIUM_STARTUP_TIMEOUT_SECS, 30);
     }
+
+    #[test]
+    fn test_ios_capabilities_use_vendor_prefix() {
+        let caps = AppiumManager::build_ios_capabilities(
+            Some("TEST-UDID-123"),
+            Some("iPhone 16 Pro"),
+            Some("18.5"),
+        );
+
+        // W3C standard capabilities must NOT have vendor prefix
+        assert!(caps.get("platformName").is_some());
+        assert!(caps.get("browserName").is_some());
+
+        // Non-standard capabilities MUST have appium: vendor prefix
+        assert!(caps.get("appium:automationName").is_some());
+        assert!(caps.get("appium:noReset").is_some());
+        assert!(caps.get("appium:deviceName").is_some());
+        assert!(caps.get("appium:platformVersion").is_some());
+        assert!(caps.get("appium:udid").is_some());
+
+        // Must NOT have unprefixed non-standard capabilities
+        assert!(caps.get("automationName").is_none());
+        assert!(caps.get("noReset").is_none());
+        assert!(caps.get("deviceName").is_none());
+        assert!(caps.get("udid").is_none());
+    }
 }

cli/src/native/webdriver/client.rs

@@ -212,32 +212,6 @@ impl WebDriverClient {
     }
 }
 
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_client_new() {
-        let client = WebDriverClient::new(4444);
-        assert_eq!(client.base_url, "http://127.0.0.1:4444");
-        assert!(client.session_id.is_none());
-    }
-
-    #[test]
-    fn test_session_id_none() {
-        let client = WebDriverClient::new(4444);
-        let result = client.session_id();
-        assert!(result.is_err());
-        assert!(result.unwrap_err().contains("No active WebDriver session"));
-    }
-
-    #[test]
-    fn test_client_custom_port() {
-        let client = WebDriverClient::new(9515);
-        assert_eq!(client.base_url, "http://127.0.0.1:9515");
-    }
-}
-
 async fn http_request(method: &str, url: &str, body: Option<&Value>) -> Result<Value, String> {
     let parsed = url::Url::parse(url).map_err(|e| format!("Invalid URL: {}", e))?;
     let host = parsed.host_str().unwrap_or("127.0.0.1");
@@ -316,3 +290,29 @@ async fn http_request(method: &str, url: &str, body: Option<&Value>) -> Result<V
         )
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_client_new() {
+        let client = WebDriverClient::new(4444);
+        assert_eq!(client.base_url, "http://127.0.0.1:4444");
+        assert!(client.session_id.is_none());
+    }
+
+    #[test]
+    fn test_session_id_none() {
+        let client = WebDriverClient::new(4444);
+        let result = client.session_id();
+        assert!(result.is_err());
+        assert!(result.unwrap_err().contains("No active WebDriver session"));
+    }
+
+    #[test]
+    fn test_client_custom_port() {
+        let client = WebDriverClient::new(9515);
+        assert_eq!(client.base_url, "http://127.0.0.1:9515");
+    }
+}