chore(release): bump to 0.27.0-fork.16 — click reliability (scroll-into-view + DOM fallback) + skill docs (console opt-in, CLICK_MODE, form/hidden-input eval)

Real-world dogfooding surfaced clicks that resolve a valid @ref but still miss:

- Scroll the target into view before computing click coordinates
  (scrollIntoViewIfNeeded). Without it, an element below the fold — or revealed
  after a scroll/popup — yields off-viewport coordinates and the click lands on
  whatever occupies that screen point.
- Fall back to a DOM-dispatched `.click()` when the coordinate path fails (a
  persistent floating layer failing the occlusion guard, or coordinates that
  won't resolve). The DOM dispatch targets the intended element directly instead
  of a screen point, so an overlay or portal can't divert it.
- AGENT_BROWSER_CLICK_MODE: "" (default: scroll + coordinate + DOM fallback),
  "coord" (strict coordinate, hard-fail on occlusion), "dom" (always
  element.click() — best for autocomplete/menu <li> that close on input blur).

Fallback is limited to left single-clicks (DOM .click() can't express
right/middle/double). Non-left/multi and "coord" mode keep the original error.

Docs: README knob table + skill commands.md gain CLICK_MODE, a click-reliability
note, and a "debug forms/hidden inputs with eval" section (snapshot doesn't show
hidden inputs — the fast path to bugs like a hidden point_choice=none).

6 click/interaction e2e green; full suite 760 passed.

README.md

@@ -115,9 +115,10 @@ In CI environments, standalone mode is used automatically.
 
 ## Anti-detection
 
-When connected to your real Chrome, we inject **zero** JavaScript patches. Your browser's fingerprint is completely genuine.
+When connected to your real Chrome, we inject **zero** JavaScript patches. Your browser's fingerprint is completely genuine. The guiding rule is **native CDP/Chrome overrides over JS lies** — a re-defined getter is itself detectable; a native override isn't.
 
-The only thing we do is call `Emulation.setAutomationOverride` via CDP to set `navigator.webdriver = false` at the native Chrome level — undetectable by lie-detection systems like CreepJS.
+- `navigator.webdriver = false` via `Emulation.setAutomationOverride` (native, undetectable by CreepJS-style lie tests).
+- **`Runtime.enable` is left OFF by default.** A live `Runtime` domain is a detectable CDP signal (the patchright/rebrowser "runtime leak") — even when attached to your real Chrome. We only enable it when you opt into console/error capture (see below). `click`, `fill`, `eval`, etc. work without it.
 
 **Test results (connected to real Chrome):**
 
@@ -129,6 +130,17 @@ The only thing we do is call `Emulation.setAutomationOverride` via CDP to set `n
 
 When using `--launch` mode (standalone browser), a full suite of 32 stealth patches is applied for headless Chrome.
 
+### Tuning knobs (environment variables)
+
+| Variable | Default | Effect |
+|---|---|---|
+| `AGENT_BROWSER_CAPTURE_CONSOLE` | off | Enable `Runtime` domain so `console` / `errors` capture page output. Off keeps the stealthiest profile. |
+| `AGENT_BROWSER_TIMEZONE` | unset | `--launch` only. An IANA id (e.g. `Asia/Tokyo`) sets the timezone natively (Intl + Date follow, no JS lie) to match a proxy; `auto` derives one from the locale. |
+| `AGENT_BROWSER_BLOCK_WEBRTC` | auto | `--launch` only. Auto-forces WebRTC through the proxy when one is set (no real-IP leak). `1` hides the local IP without a proxy; `0` opts out. |
+| `AGENT_BROWSER_HIDE_CANVAS` | off | `--launch` only. Adds session-stable canvas/audio fingerprint noise. Off by default (noise is itself a "lie"). |
+| `AGENT_BROWSER_ADAPTIVE_REF` | on | When a saved `@ref` moves and the role/name re-query fails, relocate it by fingerprint similarity (high score + clear margin required, else it fails loudly). `0` disables. |
+| `AGENT_BROWSER_CLICK_MODE` | _(auto)_ | Click strategy. Default scrolls the target into view, dispatches a coordinate click, and falls back to a DOM `.click()` if a floating layer occludes the point. `dom` always uses `.click()` (best for autocomplete/menu items that close on blur); `coord` is strict coordinate-only (hard-fail on occlusion). |
+
 ## Differences from upstream
 
 Based on [agent-browser v0.27.0](https://github.com/vercel-labs/agent-browser). Changes:

cli/Cargo.lock

@@ -45,7 +45,7 @@ dependencies = [
 
 [[package]]
 name = "agent-browser-stealth"
-version = "0.27.0-fork.14"
+version = "0.27.0-fork.16"
 dependencies = [
  "aes-gcm",
  "async-trait",

cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "agent-browser-stealth"
-version = "0.27.0-fork.14"
+version = "0.27.0-fork.16"
 edition = "2021"
 description = "Fast browser automation CLI for AI agents"
 license = "Apache-2.0"

cli/src/native/actions.rs

@@ -3690,13 +3690,38 @@ async fn handle_console(cmd: &Value, state: &mut DaemonState) -> Result<Value, S
         state.event_tracker.clear_console();
         Ok(json!({ "cleared": true }))
     } else {
-        let result = state.event_tracker.get_console_json();
+        let mut result = state.event_tracker.get_console_json();
+        if !console_capture_active(state) {
+            if let Some(obj) = result.as_object_mut() {
+                obj.insert("hint".to_string(), json!(CONSOLE_DISABLED_HINT));
+            }
+        }
         Ok(result)
     }
 }
 
+/// Whether the active browser session has the CDP `Runtime` domain enabled
+/// (required to receive console/error events). OFF by default for stealth.
+fn console_capture_active(state: &DaemonState) -> bool {
+    state
+        .browser
+        .as_ref()
+        .map(|b| b.capture_console)
+        .unwrap_or(false)
+}
+
+const CONSOLE_DISABLED_HINT: &str =
+    "console/error capture is disabled for stealth (Runtime.enable is a detectable CDP \
+     signal). Restart the session with AGENT_BROWSER_CAPTURE_CONSOLE=1 to capture page output.";
+
 async fn handle_errors(state: &DaemonState) -> Result<Value, String> {
-    Ok(state.event_tracker.get_errors_json())
+    let mut result = state.event_tracker.get_errors_json();
+    if !console_capture_active(state) {
+        if let Some(obj) = result.as_object_mut() {
+            obj.insert("hint".to_string(), json!(CONSOLE_DISABLED_HINT));
+        }
+    }
+    Ok(result)
 }
 
 async fn handle_state_save(cmd: &Value, state: &DaemonState) -> Result<Value, String> {

cli/src/native/adaptive.rs

@@ -0,0 +1,364 @@
+//! Adaptive @ref relocation.
+//!
+//! When a saved `@ref`'s DOM node is gone (stale `backendNodeId`) and the
+//! role/name/nth re-query also fails, we score the current page's candidate
+//! elements against the ref's stored [`ElementFingerprint`] and relocate to the
+//! best match — but ONLY when confident: the best candidate must clear a high
+//! absolute threshold AND beat the runner-up by a clear margin. This matches the
+//! project's "fail loudly rather than mis-click" posture (see the identity and
+//! occlusion guards in `element.rs`).
+//!
+//! Everything in this module is pure and browser-free so the scoring can be
+//! unit-tested directly.
+
+use std::collections::BTreeMap;
+
+/// Minimum absolute similarity (0..1) for a relocation candidate to be accepted.
+pub const ADAPTIVE_THRESHOLD: f64 = 0.70;
+/// Minimum gap between the best and second-best candidate to avoid ambiguity.
+pub const ADAPTIVE_MARGIN: f64 = 0.15;
+
+/// A structural/semantic fingerprint of an element, captured at snapshot time so
+/// a moved element can be re-identified after the page mutates.
+///
+/// Populated purely from the accessibility tree we already walk (`TreeNode`), so
+/// capturing it costs no extra CDP round-trips — `TreeNode` has no DOM tag or
+/// attributes (those would need an N×`DOM.describeNode` storm per snapshot), so
+/// `tag` holds the AX **role** and `attrs` holds discriminating AX properties
+/// (value/url/level/checked), not DOM `id`/`class`.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct ElementFingerprint {
+    /// AX role, e.g. "button" (used where a DOM tag would otherwise go).
+    pub tag: String,
+    /// Accessible name / visible text — the dominant identity signal.
+    pub text: String,
+    /// Discriminating AX properties: value, url, level, checked. Keyed by name.
+    pub attrs: BTreeMap<String, String>,
+    /// Ancestor role signatures from nearest to farthest, e.g. "form" / "list".
+    pub ancestors: Vec<String>,
+    /// Parent role.
+    pub parent_tag: String,
+    /// Parent accessible name / text.
+    pub parent_text: String,
+    /// Index among same-role siblings.
+    pub sibling_index: u32,
+    /// Count of same-role siblings.
+    pub sibling_count: u32,
+}
+
+/// Component weights. They sum to 1.0 so the total score lands in 0..1.
+/// Tuned for AX-derived fingerprints: the accessible name dominates, with role
+/// and tree structure carrying disambiguation when the name has changed (which
+/// is exactly when the exact role+name+nth fallback failed and we got here).
+const W_TAG: f64 = 0.20;
+const W_TEXT: f64 = 0.40;
+const W_ATTRS: f64 = 0.10;
+const W_ANCESTORS: f64 = 0.20;
+const W_PARENT_SIBLING: f64 = 0.10;
+
+/// Per-attribute importance for the attribute-overlap score. Strong identity
+/// signals (a link's url) outweigh weak ones (heading level).
+fn attr_weight(name: &str) -> f64 {
+    match name {
+        "url" | "value" => 3.0,
+        "checked" => 2.0,
+        _ => 1.0,
+    }
+}
+
+/// Levenshtein-based string similarity in 0..1 (1.0 = identical). Two empty
+/// strings are treated as a perfect match (consistent absence of text).
+pub fn string_similarity(a: &str, b: &str) -> f64 {
+    if a == b {
+        return 1.0;
+    }
+    let a: Vec<char> = a.chars().collect();
+    let b: Vec<char> = b.chars().collect();
+    let max_len = a.len().max(b.len());
+    if max_len == 0 {
+        return 1.0;
+    }
+    let dist = levenshtein(&a, &b);
+    1.0 - (dist as f64 / max_len as f64)
+}
+
+fn levenshtein(a: &[char], b: &[char]) -> usize {
+    if a.is_empty() {
+        return b.len();
+    }
+    if b.is_empty() {
+        return a.len();
+    }
+    let mut prev: Vec<usize> = (0..=b.len()).collect();
+    let mut cur = vec![0usize; b.len() + 1];
+    for (i, &ca) in a.iter().enumerate() {
+        cur[0] = i + 1;
+        for (j, &cb) in b.iter().enumerate() {
+            let cost = if ca == cb { 0 } else { 1 };
+            cur[j + 1] = (prev[j + 1] + 1).min(cur[j] + 1).min(prev[j] + cost);
+        }
+        std::mem::swap(&mut prev, &mut cur);
+    }
+    prev[b.len()]
+}
+
+/// Jaccard similarity over whitespace-separated tokens (used for `class`).
+fn token_jaccard(a: &str, b: &str) -> f64 {
+    let sa: std::collections::BTreeSet<&str> = a.split_whitespace().collect();
+    let sb: std::collections::BTreeSet<&str> = b.split_whitespace().collect();
+    if sa.is_empty() && sb.is_empty() {
+        return 1.0;
+    }
+    let inter = sa.intersection(&sb).count() as f64;
+    let union = sa.union(&sb).count() as f64;
+    if union == 0.0 {
+        1.0
+    } else {
+        inter / union
+    }
+}
+
+/// Length-ratio of the longest common subsequence over two ancestor sequences.
+fn lcs_ratio(a: &[String], b: &[String]) -> f64 {
+    if a.is_empty() && b.is_empty() {
+        return 1.0;
+    }
+    if a.is_empty() || b.is_empty() {
+        return 0.0;
+    }
+    let mut dp = vec![vec![0usize; b.len() + 1]; a.len() + 1];
+    for i in 0..a.len() {
+        for j in 0..b.len() {
+            dp[i + 1][j + 1] = if a[i] == b[j] {
+                dp[i][j] + 1
+            } else {
+                dp[i][j + 1].max(dp[i + 1][j])
+            };
+        }
+    }
+    let lcs = dp[a.len()][b.len()] as f64;
+    (2.0 * lcs) / (a.len() + b.len()) as f64
+}
+
+fn attr_score(base: &BTreeMap<String, String>, cand: &BTreeMap<String, String>) -> f64 {
+    let mut names: std::collections::BTreeSet<&str> = std::collections::BTreeSet::new();
+    names.extend(base.keys().map(|s| s.as_str()));
+    names.extend(cand.keys().map(|s| s.as_str()));
+    if names.is_empty() {
+        return 1.0; // no attributes on either side — neutral
+    }
+    let mut total = 0.0;
+    let mut got = 0.0;
+    for name in names {
+        let w = attr_weight(name);
+        total += w;
+        // present on only one side → no credit
+        if let (Some(a), Some(b)) = (base.get(name), cand.get(name)) {
+            if name == "class" {
+                got += w * token_jaccard(a, b);
+            } else if a == b {
+                got += w;
+            }
+        }
+    }
+    if total == 0.0 {
+        1.0
+    } else {
+        got / total
+    }
+}
+
+fn parent_sibling_score(base: &ElementFingerprint, cand: &ElementFingerprint) -> f64 {
+    // Split the 0.10 budget: parent tag 0.4, parent text 0.3, sibling pos 0.3.
+    let parent_tag = if base.parent_tag == cand.parent_tag {
+        1.0
+    } else {
+        0.0
+    };
+    let parent_text = string_similarity(&base.parent_text, &cand.parent_text);
+    let span = base.sibling_count.max(1) as f64;
+    let delta = (base.sibling_index as i64 - cand.sibling_index as i64).unsigned_abs() as f64;
+    let sibling = 1.0 - (delta / span).min(1.0);
+    0.4 * parent_tag + 0.3 * parent_text + 0.3 * sibling
+}
+
+/// Similarity score in 0..1 between a stored baseline and a candidate element.
+pub fn score(base: &ElementFingerprint, cand: &ElementFingerprint) -> f64 {
+    let tag = if base.tag == cand.tag { 1.0 } else { 0.0 };
+    let text = string_similarity(&base.text, &cand.text);
+    let attrs = attr_score(&base.attrs, &cand.attrs);
+    let ancestors = lcs_ratio(&base.ancestors, &cand.ancestors);
+    let parent_sibling = parent_sibling_score(base, cand);
+
+    W_TAG * tag
+        + W_TEXT * text
+        + W_ATTRS * attrs
+        + W_ANCESTORS * ancestors
+        + W_PARENT_SIBLING * parent_sibling
+}
+
+/// Why a relocation was rejected.
+#[derive(Debug, Clone, PartialEq)]
+pub enum RejectReason {
+    /// No candidates to score.
+    NoCandidates,
+    /// Best score below [`ADAPTIVE_THRESHOLD`].
+    LowScore { best: f64 },
+    /// Best score too close to the runner-up (below [`ADAPTIVE_MARGIN`]).
+    Ambiguous { best: f64, second: f64 },
+}
+
+/// A successful relocation decision.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Relocation {
+    /// Chosen candidate's backend node id.
+    pub backend_node_id: i64,
+    /// Winning score.
+    pub score: f64,
+    /// Runner-up score (0.0 when there was only one candidate).
+    pub second_score: f64,
+}
+
+/// Pick the best candidate, accepting only when confident. `candidates` is a
+/// list of `(backend_node_id, fingerprint)` for the current page.
+pub fn pick_best(
+    base: &ElementFingerprint,
+    candidates: &[(i64, ElementFingerprint)],
+    threshold: f64,
+    margin: f64,
+) -> Result<Relocation, RejectReason> {
+    if candidates.is_empty() {
+        return Err(RejectReason::NoCandidates);
+    }
+    let mut scored: Vec<(i64, f64)> = candidates
+        .iter()
+        .map(|(id, fp)| (*id, score(base, fp)))
+        .collect();
+    // Highest score first; stable enough for deterministic ties.
+    scored.sort_by(|a, b| b.1.partial_cmp(&a.1).unwrap_or(std::cmp::Ordering::Equal));
+
+    let (best_id, best) = scored[0];
+    let second = scored.get(1).map(|(_, s)| *s).unwrap_or(0.0);
+
+    if best < threshold {
+        return Err(RejectReason::LowScore { best });
+    }
+    if best - second < margin {
+        return Err(RejectReason::Ambiguous { best, second });
+    }
+    Ok(Relocation {
+        backend_node_id: best_id,
+        score: best,
+        second_score: second,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn fp(tag: &str, text: &str, attrs: &[(&str, &str)]) -> ElementFingerprint {
+        ElementFingerprint {
+            tag: tag.to_string(),
+            text: text.to_string(),
+            attrs: attrs
+                .iter()
+                .map(|(k, v)| (k.to_string(), v.to_string()))
+                .collect(),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn identical_fingerprints_score_one() {
+        let a = fp("button", "Submit", &[("id", "go"), ("class", "btn primary")]);
+        assert!((score(&a, &a) - 1.0).abs() < 1e-9);
+    }
+
+    #[test]
+    fn different_tag_caps_score_below_threshold() {
+        let a = fp("button", "Submit", &[("id", "go")]);
+        let b = fp("a", "Submit", &[("id", "go")]);
+        // Same text + same attrs but different role: must lose the role weight
+        // (W_TAG = 0.20), landing around 0.80 and below a perfect match.
+        let s = score(&a, &b);
+        assert!(s < 0.85 && s > 0.75, "got {s}");
+    }
+
+    #[test]
+    fn string_similarity_basics() {
+        assert_eq!(string_similarity("abc", "abc"), 1.0);
+        assert_eq!(string_similarity("", ""), 1.0);
+        assert!(string_similarity("Submit", "Submit now") > 0.5);
+        assert!(string_similarity("Add post", "Post all") < 0.6);
+    }
+
+    #[test]
+    fn class_uses_token_overlap() {
+        let a = fp("div", "", &[("class", "card primary big")]);
+        let b = fp("div", "", &[("class", "card primary")]);
+        // partial class overlap should still score high (tag+text match, attrs partial)
+        let s = score(&a, &b);
+        assert!(s > 0.85, "got {s}");
+    }
+
+    #[test]
+    fn ancestors_lcs() {
+        let mut a = fp("button", "OK", &[]);
+        let mut b = fp("button", "OK", &[]);
+        a.ancestors = vec!["form#f".into(), "div.col".into(), "body".into()];
+        // b wrapped in an extra div — DOM path changed but mostly preserved
+        b.ancestors = vec!["form#f".into(), "div.wrap".into(), "div.col".into(), "body".into()];
+        let s = score(&a, &b);
+        assert!(s > 0.85, "got {s}");
+    }
+
+    #[test]
+    fn pick_best_accepts_clear_winner() {
+        let base = fp("button", "Submit", &[("id", "go")]);
+        let winner = fp("button", "Submit", &[("id", "go")]);
+        let other = fp("a", "Home", &[("href", "/")]);
+        let out = pick_best(
+            &base,
+            &[(10, other), (20, winner)],
+            ADAPTIVE_THRESHOLD,
+            ADAPTIVE_MARGIN,
+        )
+        .expect("should accept");
+        assert_eq!(out.backend_node_id, 20);
+        assert!(out.score > out.second_score);
+    }
+
+    #[test]
+    fn pick_best_rejects_ambiguous_twins() {
+        let base = fp("button", "Delete", &[("class", "btn danger")]);
+        // Two near-identical delete buttons — must refuse to guess.
+        let twin_a = fp("button", "Delete", &[("class", "btn danger")]);
+        let twin_b = fp("button", "Delete", &[("class", "btn danger")]);
+        let err = pick_best(
+            &base,
+            &[(1, twin_a), (2, twin_b)],
+            ADAPTIVE_THRESHOLD,
+            ADAPTIVE_MARGIN,
+        )
+        .unwrap_err();
+        assert!(matches!(err, RejectReason::Ambiguous { .. }), "got {err:?}");
+    }
+
+    #[test]
+    fn pick_best_rejects_low_score() {
+        let base = fp("button", "Submit order", &[("id", "checkout")]);
+        let junk = fp("span", "unrelated footer text", &[("class", "muted")]);
+        let err = pick_best(&base, &[(1, junk)], ADAPTIVE_THRESHOLD, ADAPTIVE_MARGIN).unwrap_err();
+        assert!(matches!(err, RejectReason::LowScore { .. }), "got {err:?}");
+    }
+
+    #[test]
+    fn pick_best_no_candidates() {
+        let base = fp("button", "x", &[]);
+        assert_eq!(
+            pick_best(&base, &[], ADAPTIVE_THRESHOLD, ADAPTIVE_MARGIN).unwrap_err(),
+            RejectReason::NoCandidates
+        );
+    }
+}

cli/src/native/browser.rs

@@ -305,6 +305,22 @@ pub struct BrowserManager {
     /// Origins visited during this session, used by save_state to collect cross-origin localStorage.
     visited_origins: HashSet<String>,
     next_tab_id: u32,
+    /// Whether to enable the CDP `Runtime` domain (console / error / exception capture).
+    /// OFF by default for stealth: a live `Runtime.enable` is a detectable CDP signal
+    /// (the patchright / rebrowser "runtime leak") — even when attached to the user's
+    /// real Chrome. Opt in via `AGENT_BROWSER_CAPTURE_CONSOLE=1` when you need the
+    /// `console` / `errors` commands to return page output.
+    pub capture_console: bool,
+}
+
+/// Whether console/error capture (and thus `Runtime.enable`) is opted into for this
+/// daemon. Defaults to `false` so the common automation path leaves no Runtime-domain
+/// fingerprint. Set `AGENT_BROWSER_CAPTURE_CONSOLE=1` (or `true`) to turn it on.
+pub fn console_capture_enabled() -> bool {
+    std::env::var("AGENT_BROWSER_CAPTURE_CONSOLE")
+        .ok()
+        .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+        .unwrap_or(false)
 }
 
 const LIGHTPANDA_CDP_CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
@@ -413,6 +429,7 @@ impl BrowserManager {
                 ignore_https_errors,
                 visited_origins: HashSet::new(),
                 next_tab_id: 1,
+                capture_console: console_capture_enabled(),
             };
             manager.discover_and_attach_targets().await?;
             manager
@@ -502,6 +519,7 @@ impl BrowserManager {
             ignore_https_errors: false,
             visited_origins: HashSet::new(),
             next_tab_id: 1,
+            capture_console: console_capture_enabled(),
         };
 
         if direct_page {
@@ -629,9 +647,14 @@ impl BrowserManager {
         self.client
             .send_command_no_params("Page.enable", Some(session_id))
             .await?;
-        self.client
-            .send_command_no_params("Runtime.enable", Some(session_id))
-            .await?;
+        // `Runtime.enable` leaves a detectable CDP signal (the patchright/rebrowser
+        // "runtime leak"), so only enable it when console/error capture is opted in.
+        // `Runtime.evaluate` / `Runtime.callFunctionOn` work fine without it.
+        if self.capture_console {
+            self.client
+                .send_command_no_params("Runtime.enable", Some(session_id))
+                .await?;
+        }
         // Resume the target if it is paused waiting for the debugger.
         // This is needed for real browser sessions (Chrome 144+) where targets
         // are paused after attach until explicitly resumed. No-op otherwise.
@@ -665,9 +688,12 @@ impl BrowserManager {
         self.client
             .send_command_no_params("Page.enable", None)
             .await?;
-        self.client
-            .send_command_no_params("Runtime.enable", None)
-            .await?;
+        // See `enable_domains`: `Runtime.enable` is a CDP fingerprint, gated on opt-in.
+        if self.capture_console {
+            self.client
+                .send_command_no_params("Runtime.enable", None)
+                .await?;
+        }
         let _ = self
             .client
             .send_command_no_params("Runtime.runIfWaitingForDebugger", None)
@@ -1659,6 +1685,7 @@ async fn initialize_lightpanda_manager(
             ignore_https_errors: false,
             visited_origins: HashSet::new(),
             next_tab_id: 1,
+            capture_console: console_capture_enabled(),
         };
 
         match discover_and_attach_lightpanda_targets(&mut manager, deadline).await {

cli/src/native/cdp/chrome.rs

@@ -146,6 +146,30 @@ struct ChromeArgs {
     temp_user_data_dir: Option<PathBuf>,
 }
 
+/// Decide the `--force-webrtc-ip-handling-policy` value, if any, for a launched
+/// Chrome. Returns `None` to leave WebRTC at Chrome's default behavior.
+fn webrtc_ip_handling_policy(has_proxy: bool) -> Option<&'static str> {
+    let opt_in = std::env::var("AGENT_BROWSER_BLOCK_WEBRTC").ok();
+    let explicitly_off = opt_in
+        .as_deref()
+        .is_some_and(|v| v == "0" || v.eq_ignore_ascii_case("false"));
+    if explicitly_off {
+        return None;
+    }
+    let explicitly_on = opt_in
+        .as_deref()
+        .is_some_and(|v| v == "1" || v.eq_ignore_ascii_case("true"));
+    if has_proxy {
+        // Force all WebRTC UDP through the proxy so the real IP can't leak.
+        Some("disable_non_proxied_udp")
+    } else if explicitly_on {
+        // No proxy, but the user asked to hide the local network IP.
+        Some("default_public_interface_only")
+    } else {
+        None
+    }
+}
+
 fn build_chrome_args(options: &LaunchOptions) -> Result<ChromeArgs, String> {
     let mut args = vec![
         "--remote-debugging-port=0".to_string(),
@@ -204,6 +228,20 @@ fn build_chrome_args(options: &LaunchOptions) -> Result<ChromeArgs, String> {
         args.push(format!("--proxy-bypass-list={}", bypass));
     }
 
+    // WebRTC IP-leak handling. WebRTC enumerates ICE candidates that can expose
+    // the machine's real local/public IP even when HTTP traffic goes through a
+    // proxy — defeating the proxy. `--force-webrtc-ip-handling-policy` is a real
+    // Chrome privacy switch (no detectable JS lie), applied here for launched
+    // Chrome only (an attached real Chrome keeps the user's own flags).
+    //   - proxy set            -> `disable_non_proxied_udp`: force WebRTC through
+    //                             the proxy so the real IP can't leak.
+    //   - AGENT_BROWSER_BLOCK_WEBRTC=1 (no proxy) -> `default_public_interface_only`:
+    //                             hide the local network IP (Brave/uBlock default).
+    // Opt out entirely with AGENT_BROWSER_BLOCK_WEBRTC=0.
+    if let Some(policy) = webrtc_ip_handling_policy(options.proxy.is_some()) {
+        args.push(format!("--force-webrtc-ip-handling-policy={}", policy));
+    }
+
     let (user_data_dir, temp_user_data_dir) = if let Some(ref profile) = options.profile {
         let expanded = expand_tilde(profile);
         let dir = PathBuf::from(&expanded);
@@ -1343,6 +1381,37 @@ mod tests {
     use super::*;
     use crate::test_utils::EnvGuard;
 
+    #[test]
+    fn webrtc_policy_forces_proxy_when_proxy_set() {
+        let g = EnvGuard::new(&["AGENT_BROWSER_BLOCK_WEBRTC"]);
+        g.remove("AGENT_BROWSER_BLOCK_WEBRTC");
+        // Proxy set, no env: always force WebRTC through the proxy.
+        assert_eq!(
+            webrtc_ip_handling_policy(true),
+            Some("disable_non_proxied_udp")
+        );
+        // No proxy, no env: leave WebRTC at Chrome's default.
+        assert_eq!(webrtc_ip_handling_policy(false), None);
+    }
+
+    #[test]
+    fn webrtc_policy_opt_in_and_opt_out() {
+        let g = EnvGuard::new(&["AGENT_BROWSER_BLOCK_WEBRTC"]);
+
+        g.set("AGENT_BROWSER_BLOCK_WEBRTC", "1");
+        assert_eq!(
+            webrtc_ip_handling_policy(false),
+            Some("default_public_interface_only")
+        );
+
+        // Explicit opt-out wins even when a proxy is set.
+        g.set("AGENT_BROWSER_BLOCK_WEBRTC", "0");
+        assert_eq!(webrtc_ip_handling_policy(true), None);
+        assert_eq!(webrtc_ip_handling_policy(false), None);
+
+        g.remove("AGENT_BROWSER_BLOCK_WEBRTC");
+    }
+
     #[cfg(unix)]
     fn spawn_noop_child() -> Child {
         Command::new("/bin/sh")

cli/src/native/element.rs

@@ -2,6 +2,7 @@ use std::collections::HashMap;
 
 use serde_json::Value;
 
+use super::adaptive::{self, ElementFingerprint};
 use super::cdp::client::CdpClient;
 use super::cdp::types::*;
 
@@ -13,6 +14,9 @@ pub struct RefEntry {
     pub nth: Option<usize>,
     pub selector: Option<String>,
     pub frame_id: Option<String>,
+    /// AX fingerprint captured at snapshot time, used by adaptive relocation when
+    /// the node is gone and the role/name/nth re-query also fails.
+    pub fingerprint: Option<ElementFingerprint>,
 }
 
 pub struct RefMap {
@@ -57,10 +61,19 @@ impl RefMap {
                 nth,
                 selector: None,
                 frame_id: frame_id.map(|s| s.to_string()),
+                fingerprint: None,
             },
         );
     }
 
+    /// Attach an AX fingerprint to an existing ref (set during snapshot, used by
+    /// adaptive relocation). No-op if the ref is unknown.
+    pub fn set_fingerprint(&mut self, ref_id: &str, fingerprint: ElementFingerprint) {
+        if let Some(entry) = self.map.get_mut(ref_id) {
+            entry.fingerprint = Some(fingerprint);
+        }
+    }
+
     pub fn add_selector(
         &mut self,
         ref_id: String,
@@ -78,6 +91,7 @@ impl RefMap {
                 nth,
                 selector: Some(selector),
                 frame_id: None,
+                fingerprint: None,
             },
         );
     }
@@ -146,6 +160,46 @@ pub fn parse_ref(input: &str) -> Option<String> {
     None
 }
 
+/// When a saved `@ref`'s node is gone and the role/name/nth re-query also failed,
+/// try to relocate the element by AX fingerprint similarity. Returns the chosen
+/// backend node id only when confident (high score + clear margin over the
+/// runner-up). Opt out with `AGENT_BROWSER_ADAPTIVE_REF=0`.
+async fn relocate_stale_ref(
+    client: &CdpClient,
+    ref_id: &str,
+    entry: &RefEntry,
+    session_id: &str,
+    iframe_sessions: &HashMap<String, String>,
+) -> Option<i64> {
+    if std::env::var("AGENT_BROWSER_ADAPTIVE_REF").as_deref() == Ok("0") {
+        return None;
+    }
+    let baseline = entry.fingerprint.as_ref()?;
+    let candidates = super::snapshot::collect_current_fingerprints(
+        client,
+        session_id,
+        entry.frame_id.as_deref(),
+        iframe_sessions,
+    )
+    .await
+    .ok()?;
+    match adaptive::pick_best(
+        baseline,
+        &candidates,
+        adaptive::ADAPTIVE_THRESHOLD,
+        adaptive::ADAPTIVE_MARGIN,
+    ) {
+        Ok(reloc) => {
+            eprintln!(
+                "[adaptive] relocated {ref_id} ({} \"{}\") score={:.2} second={:.2} -> backendNodeId {}",
+                entry.role, entry.name, reloc.score, reloc.second_score, reloc.backend_node_id
+            );
+            Some(reloc.backend_node_id)
+        }
+        Err(_) => None,
+    }
+}
+
 pub async fn resolve_element_center(
     client: &CdpClient,
     session_id: &str,
@@ -163,15 +217,19 @@ pub async fn resolve_element_center(
 
         // Try cached backend_node_id first (fast path)
         if let Some(backend_node_id) = entry.backend_node_id {
+            let mut active_id = backend_node_id;
             // Identity check: React often re-uses the same DOM node when
             // re-rendering — backendNodeId stays the same but accessibleName
             // / role changes. Without this verification, `click @e20` (saved
             // when the button said "Add post") happily clicks the *same*
             // node that now says "Post all", silently submitting the thread.
             //
-            // Set AGENT_BROWSER_VERIFY_REF=0 to skip (saves one CDP
-            // roundtrip per ref-based interaction; only safe if you know
-            // the page is static between snapshot and click).
+            // On mismatch, try adaptive fingerprint relocation before failing:
+            // a confident high-score/high-margin match is a stronger identity
+            // signal than role+name, and lets a moved+renamed element still
+            // resolve. If relocation isn't confident, surface the original
+            // identity error. Set AGENT_BROWSER_VERIFY_REF=0 to skip the check
+            // (and thus relocation) entirely.
             if std::env::var("AGENT_BROWSER_VERIFY_REF").as_deref() != Ok("0") {
                 if let Err(e) = verify_ref_identity(
                     client,
@@ -183,7 +241,12 @@ pub async fn resolve_element_center(
                 )
                 .await
                 {
-                    return Err(e);
+                    match relocate_stale_ref(client, &ref_id, entry, session_id, iframe_sessions)
+                        .await
+                    {
+                        Some(id) => active_id = id,
+                        None => return Err(e),
+                    }
                 }
             }
 
@@ -191,7 +254,7 @@ pub async fn resolve_element_center(
                 .send_command_typed(
                     "DOM.getBoxModel",
                     &DomGetBoxModelParams {
-                        backend_node_id: Some(backend_node_id),
+                        backend_node_id: Some(active_id),
                         node_id: None,
                         object_id: None,
                     },
@@ -213,15 +276,9 @@ pub async fn resolve_element_center(
                 //
                 // Set AGENT_BROWSER_VERIFY_CLICK_TARGET=0 to skip.
                 if std::env::var("AGENT_BROWSER_VERIFY_CLICK_TARGET").as_deref() != Ok("0") {
-                    if let Err(e) = verify_click_target(
-                        client,
-                        effective_session_id,
-                        backend_node_id,
-                        &ref_id,
-                        x,
-                        y,
-                    )
-                    .await
+                    if let Err(e) =
+                        verify_click_target(client, effective_session_id, active_id, &ref_id, x, y)
+                            .await
                     {
                         return Err(e);
                     }
@@ -231,8 +288,9 @@ pub async fn resolve_element_center(
             // backend_node_id is stale; re-query the accessibility tree below
         }
 
-        // Fallback: re-query the accessibility tree to find a fresh node by role/name
-        let fresh_id = find_node_id_by_role_name(
+        // Fallback: re-query the accessibility tree to find a fresh node by role/name.
+        // If that fails, try adaptive fingerprint relocation before giving up.
+        let fresh_id = match find_node_id_by_role_name(
             client,
             session_id,
             &entry.role,
@@ -241,7 +299,16 @@ pub async fn resolve_element_center(
             entry.frame_id.as_deref(),
             iframe_sessions,
         )
-        .await?;
+        .await
+        {
+            Ok(id) => id,
+            Err(e) => match relocate_stale_ref(client, &ref_id, entry, session_id, iframe_sessions)
+                .await
+            {
+                Some(id) => id,
+                None => return Err(e),
+            },
+        };
         let result: DomGetBoxModelResult = client
             .send_command_typed(
                 "DOM.getBoxModel",
@@ -279,9 +346,11 @@ pub async fn resolve_element_object_id(
 
         // Try cached backend_node_id first (fast path)
         if let Some(backend_node_id) = entry.backend_node_id {
+            let mut active_id = backend_node_id;
             // Same identity guard as resolve_element_center — see that
             // function for why React DOM-node-reuse breaks ref-based
-            // interactions if we skip this.
+            // interactions if we skip this, and why a confident adaptive
+            // relocation is allowed to override an identity mismatch.
             if std::env::var("AGENT_BROWSER_VERIFY_REF").as_deref() != Ok("0") {
                 if let Err(e) = verify_ref_identity(
                     client,
@@ -293,7 +362,12 @@ pub async fn resolve_element_object_id(
                 )
                 .await
                 {
-                    return Err(e);
+                    match relocate_stale_ref(client, &ref_id, entry, session_id, iframe_sessions)
+                        .await
+                    {
+                        Some(id) => active_id = id,
+                        None => return Err(e),
+                    }
                 }
             }
 
@@ -301,7 +375,7 @@ pub async fn resolve_element_object_id(
                 .send_command_typed(
                     "DOM.resolveNode",
                     &DomResolveNodeParams {
-                        backend_node_id: Some(backend_node_id),
+                        backend_node_id: Some(active_id),
                         node_id: None,
                         object_group: Some("agent-browser".to_string()),
                     },
@@ -317,8 +391,9 @@ pub async fn resolve_element_object_id(
             // backend_node_id is stale; re-query the accessibility tree below
         }
 
-        // Fallback: re-query the accessibility tree to find a fresh node by role/name
-        let fresh_id = find_node_id_by_role_name(
+        // Fallback: re-query the accessibility tree to find a fresh node by role/name.
+        // If that fails, try adaptive fingerprint relocation before giving up.
+        let fresh_id = match find_node_id_by_role_name(
             client,
             session_id,
             &entry.role,
@@ -327,7 +402,16 @@ pub async fn resolve_element_object_id(
             entry.frame_id.as_deref(),
             iframe_sessions,
         )
-        .await?;
+        .await
+        {
+            Ok(id) => id,
+            Err(e) => match relocate_stale_ref(client, &ref_id, entry, session_id, iframe_sessions)
+                .await
+            {
+                Some(id) => id,
+                None => return Err(e),
+            },
+        };
         let result: DomResolveNodeResult = client
             .send_command_typed(
                 "DOM.resolveNode",

cli/src/native/interaction.rs

@@ -15,7 +15,111 @@ pub async fn click(
     click_count: i32,
     iframe_sessions: &HashMap<String, String>,
 ) -> Result<(), String> {
-    let (x, y, effective_session_id) = resolve_element_center(
+    // AGENT_BROWSER_CLICK_MODE: "" (default) = coordinate click with a DOM
+    // fallback; "coord" = strict coordinate only (no fallback); "dom" = always
+    // dispatch through the DOM.
+    let mode = std::env::var("AGENT_BROWSER_CLICK_MODE").unwrap_or_default();
+
+    // (A) Scroll the target into view first so the computed coordinates land
+    // inside the viewport. Without this, an element below the fold (or revealed
+    // after scroll/popup) yields off-viewport coordinates and the click lands on
+    // whatever currently occupies that point. Best-effort: ignore failures.
+    scroll_into_view_if_needed(client, session_id, ref_map, selector_or_ref, iframe_sessions).await;
+
+    if mode == "dom" {
+        return dom_click(client, session_id, ref_map, selector_or_ref, iframe_sessions).await;
+    }
+
+    let resolved = resolve_element_center(
+        client,
+        session_id,
+        ref_map,
+        selector_or_ref,
+        iframe_sessions,
+    )
+    .await;
+
+    match resolved {
+        Ok((x, y, effective_session_id)) => {
+            dispatch_click(client, &effective_session_id, x, y, button, click_count).await
+        }
+        Err(e) => {
+            // (B) The coordinate path failed — typically a persistent overlay
+            // failing the occlusion guard, or coordinates that won't resolve.
+            // Fall back to a DOM-dispatched `.click()` on the intended element,
+            // which targets the element directly instead of a screen point.
+            // Skipped for strict "coord" mode and for non-left / multi-clicks
+            // (a DOM `.click()` can't express right/middle/double semantics).
+            if mode == "coord" || button != "left" || click_count != 1 {
+                return Err(e);
+            }
+            eprintln!(
+                "[click] coordinate click failed ({e}); falling back to DOM dispatch \
+                 (set AGENT_BROWSER_CLICK_MODE=coord to disable)"
+            );
+            dom_click(client, session_id, ref_map, selector_or_ref, iframe_sessions)
+                .await
+                .map_err(|dom_err| format!("{e}\n(DOM-dispatch fallback also failed: {dom_err})"))
+        }
+    }
+}
+
+/// Best-effort scroll-into-view before a coordinate click. Uses Chrome's
+/// `scrollIntoViewIfNeeded` (only scrolls when not already fully visible),
+/// falling back to centered `scrollIntoView`. Resolution failures are ignored —
+/// the subsequent resolve will surface a real "not found" error.
+async fn scroll_into_view_if_needed(
+    client: &CdpClient,
+    session_id: &str,
+    ref_map: &RefMap,
+    selector_or_ref: &str,
+    iframe_sessions: &HashMap<String, String>,
+) {
+    let Ok((object_id, effective_session_id)) = resolve_element_object_id(
+        client,
+        session_id,
+        ref_map,
+        selector_or_ref,
+        iframe_sessions,
+    )
+    .await
+    else {
+        return;
+    };
+    let js = "function() { try { \
+        if (typeof this.scrollIntoViewIfNeeded === 'function') { this.scrollIntoViewIfNeeded(true); } \
+        else { this.scrollIntoView({ block: 'center', inline: 'center' }); } \
+    } catch (e) {} }";
+    let _ = client
+        .send_command_typed::<_, Value>(
+            "Runtime.callFunctionOn",
+            &CallFunctionOnParams {
+                function_declaration: js.to_string(),
+                object_id: Some(object_id),
+                arguments: None,
+                return_by_value: Some(true),
+                await_promise: Some(false),
+            },
+            Some(&effective_session_id),
+        )
+        .await;
+    // Let the scroll settle so the following getBoxModel sees final coordinates.
+    wait_for_paint_settled(client, &effective_session_id).await;
+}
+
+/// Dispatch a click through the DOM (`element.click()`) instead of via screen
+/// coordinates. Targets the intended element directly, so it works when a
+/// floating layer occludes the click point or the element sits in a portal that
+/// confuses `elementFromPoint`. Used as the fallback for `click` and when
+/// `AGENT_BROWSER_CLICK_MODE=dom`.
+async fn dom_click(
+    client: &CdpClient,
+    session_id: &str,
+    ref_map: &RefMap,
+    selector_or_ref: &str,
+    iframe_sessions: &HashMap<String, String>,
+) -> Result<(), String> {
+    let (object_id, effective_session_id) = resolve_element_object_id(
         client,
         session_id,
         ref_map,
@@ -23,7 +127,21 @@ pub async fn click(
         iframe_sessions,
     )
     .await?;
-    dispatch_click(client, &effective_session_id, x, y, button, click_count).await
+    client
+        .send_command_typed::<_, Value>(
+            "Runtime.callFunctionOn",
+            &CallFunctionOnParams {
+                function_declaration: "function() { this.click(); }".to_string(),
+                object_id: Some(object_id),
+                arguments: None,
+                return_by_value: Some(true),
+                await_promise: Some(false),
+            },
+            Some(&effective_session_id),
+        )
+        .await?;
+    wait_for_paint_settled(client, &effective_session_id).await;
+    Ok(())
 }
 
 pub async fn dblclick(

cli/src/native/mod.rs

@@ -1,6 +1,8 @@
 #[allow(dead_code)]
 pub mod actions;
 #[allow(dead_code)]
+pub mod adaptive;
+#[allow(dead_code)]
 pub mod auth;
 #[allow(dead_code)]
 pub mod browser;

cli/src/native/snapshot.rs

@@ -6,6 +6,7 @@ use super::cdp::client::CdpClient;
 use super::cdp::types::{
     AXNode, AXProperty, AXValue, EvaluateParams, EvaluateResult, GetFullAXTreeResult,
 };
+use super::adaptive::ElementFingerprint;
 use super::element::{resolve_ax_session, RefMap};
 
 const INTERACTIVE_ROLES: &[&str] = &[
@@ -148,6 +149,122 @@ impl TreeNode {
     }
 }
 
+/// Build an AX fingerprint for a tree node, used by adaptive @ref relocation.
+/// Pulls only data already in the AX tree (no extra CDP calls): role as `tag`,
+/// accessible name as `text`, a few discriminating AX properties as `attrs`, and
+/// the ancestor/parent/sibling structure from the tree links.
+fn build_ax_fingerprint(tree_nodes: &[TreeNode], idx: usize) -> ElementFingerprint {
+    let node = &tree_nodes[idx];
+
+    let mut attrs = std::collections::BTreeMap::new();
+    if let Some(v) = &node.value_text {
+        if !v.is_empty() {
+            attrs.insert("value".to_string(), v.clone());
+        }
+    }
+    if let Some(u) = &node.url {
+        if !u.is_empty() {
+            attrs.insert("url".to_string(), u.clone());
+        }
+    }
+    if let Some(l) = node.level {
+        attrs.insert("level".to_string(), l.to_string());
+    }
+    if let Some(c) = &node.checked {
+        attrs.insert("checked".to_string(), c.clone());
+    }
+
+    // Ancestor roles, nearest first, capped to keep the signature stable.
+    let mut ancestors = Vec::new();
+    let mut cur = node.parent_idx;
+    while let Some(pidx) = cur {
+        if ancestors.len() >= 6 {
+            break;
+        }
+        let role = tree_nodes[pidx].role.clone();
+        if !role.is_empty() {
+            ancestors.push(role);
+        }
+        cur = tree_nodes[pidx].parent_idx;
+    }
+
+    let (parent_tag, parent_text) = node
+        .parent_idx
+        .map(|pidx| (tree_nodes[pidx].role.clone(), tree_nodes[pidx].name.clone()))
+        .unwrap_or_default();
+
+    // Position among same-role siblings under the same parent.
+    let (sibling_index, sibling_count) = match node.parent_idx {
+        Some(pidx) => {
+            let mut count = 0u32;
+            let mut index = 0u32;
+            for &child in &tree_nodes[pidx].children {
+                if tree_nodes[child].role == node.role {
+                    if child == idx {
+                        index = count;
+                    }
+                    count += 1;
+                }
+            }
+            (index, count)
+        }
+        None => (0, 0),
+    };
+
+    ElementFingerprint {
+        tag: node.role.clone(),
+        text: node.name.clone(),
+        attrs,
+        ancestors,
+        parent_tag,
+        parent_text,
+        sibling_index,
+        sibling_count,
+    }
+}
+
+/// Collect AX fingerprints for every node that has a backend node id, used as the
+/// candidate set when relocating a stale @ref. Reuses the same extraction as the
+/// baseline so the two are scored in the same space.
+fn collect_fingerprints(tree_nodes: &[TreeNode]) -> Vec<(i64, ElementFingerprint)> {
+    tree_nodes
+        .iter()
+        .enumerate()
+        .filter_map(|(idx, n)| {
+            n.backend_node_id
+                .map(|bid| (bid, build_ax_fingerprint(tree_nodes, idx)))
+        })
+        .collect()
+}
+
+/// Fetch a fresh AX tree for the given frame and return `(backend_node_id,
+/// fingerprint)` for every node — the candidate set for adaptive @ref
+/// relocation. One `getFullAXTree` call, no per-element work.
+pub(super) async fn collect_current_fingerprints(
+    client: &CdpClient,
+    session_id: &str,
+    frame_id: Option<&str>,
+    iframe_sessions: &HashMap<String, String>,
+) -> Result<Vec<(i64, ElementFingerprint)>, String> {
+    let (ax_params, effective_session_id) =
+        resolve_ax_session(frame_id, session_id, iframe_sessions);
+    let _ = client
+        .send_command_no_params("DOM.enable", Some(effective_session_id))
+        .await;
+    let _ = client
+        .send_command_no_params("Accessibility.enable", Some(effective_session_id))
+        .await;
+    let ax_tree: GetFullAXTreeResult = client
+        .send_command_typed(
+            "Accessibility.getFullAXTree",
+            &ax_params,
+            Some(effective_session_id),
+        )
+        .await?;
+    let (tree_nodes, _roots) = build_tree(&ax_tree.nodes);
+    Ok(collect_fingerprints(&tree_nodes))
+}
+
 /// The type of a hidden form input found inside a cursor-interactive element.
 #[derive(Clone, Copy)]
 enum HiddenInputKind {
@@ -397,6 +514,7 @@ pub async fn take_snapshot(
             actual_nth,
             frame_id,
         );
+        ref_map.set_fingerprint(&ref_id, build_ax_fingerprint(&tree_nodes, *idx));
 
         tree_nodes[*idx].has_ref = true;
         tree_nodes[*idx].ref_id = Some(ref_id);

cli/src/native/stealth.rs

@@ -51,13 +51,18 @@ pub fn build_stealth_script(mode: StealthMode, locale: Option<&str>) -> String {
         vec![locale, base_lang]
     };
     let config_line = format!(
-        r#"const __abStealth = {{ locale: "{}", languages: {}, allowWebGLContextFallback: false }};"#,
+        r#"const __abStealth = {{ locale: "{}", languages: {}, allowWebGLContextFallback: false, hideCanvas: {}, canvasSeed: {} }};"#,
         locale,
         serde_json::to_string(&languages).unwrap_or_else(|_| r#"["en-US","en"]"#.to_string()),
+        hide_canvas_enabled(),
+        canvas_noise_seed(),
     );
 
+    // NB: this prefix MUST match the first line of stealth_scripts.js verbatim,
+    // otherwise the fallback below prepends a SECOND `const __abStealth`
+    // declaration and the whole script dies with a redeclaration SyntaxError.
     if let Some(rest) = STEALTH_SCRIPTS_RAW.strip_prefix(
-        r#"const __abStealth = { locale: "en-US", languages: ["en-US", "en"], allowWebGLContextFallback: false };"#,
+        r#"const __abStealth = { locale: "en-US", languages: ["en-US", "en"], allowWebGLContextFallback: false, hideCanvas: false, canvasSeed: 0 };"#,
     ) {
         format!("{}{}", config_line, rest)
     } else {
@@ -65,6 +70,35 @@ pub fn build_stealth_script(mode: StealthMode, locale: Option<&str>) -> String {
     }
 }
 
+/// Whether canvas/audio fingerprint noise is opted into (FullLaunch only).
+/// OFF by default: injecting noise is a deliberate "lie" that can itself be a
+/// tell, so it's reserved for users who explicitly want it via
+/// `AGENT_BROWSER_HIDE_CANVAS=1`.
+fn hide_canvas_enabled() -> bool {
+    std::env::var("AGENT_BROWSER_HIDE_CANVAS")
+        .ok()
+        .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+        .unwrap_or(false)
+}
+
+/// A per-process seed so canvas/audio noise is STABLE within a session (a real
+/// device returns the same hash on repeated reads) but differs from the
+/// headless-stable default. 0 is avoided so the JS can treat it as "unset".
+fn canvas_noise_seed() -> u32 {
+    use std::sync::OnceLock;
+    static SEED: OnceLock<u32> = OnceLock::new();
+    *SEED.get_or_init(|| {
+        use std::time::{SystemTime, UNIX_EPOCH};
+        let nanos = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .map(|d| d.subsec_nanos())
+            .unwrap_or(0x9e3779b9);
+        // mix the bits a little, then force non-zero
+        let mixed = nanos ^ nanos.rotate_left(13).wrapping_mul(2654435761);
+        mixed | 1
+    })
+}
+
 /// Apply stealth patches to a browser session.
 ///
 /// In `CdpAttach` mode (user's real Chrome): only removes `navigator.webdriver`.
@@ -118,11 +152,74 @@ pub async fn apply_stealth(
                     .await?;
             }
         }
+
+        // Align the timezone for fresh launches when explicitly requested.
+        // Headless/launched Chrome often reports UTC (or the host's zone), which
+        // can contradict a proxy's geolocation or a spoofed locale.
+        // `Emulation.setTimezoneOverride` is a NATIVE override — Intl.DateTimeFormat
+        // and Date both follow it with no detectable JS lie. Opt-in only:
+        //   AGENT_BROWSER_TIMEZONE=<IANA id>  -> use that zone (e.g. align to proxy)
+        //   AGENT_BROWSER_TIMEZONE=auto       -> derive a default from the locale
+        //   (unset)                           -> leave the real timezone untouched
+        if let Some(tz) = resolve_timezone(locale) {
+            let _ = client
+                .send_command(
+                    "Emulation.setTimezoneOverride",
+                    Some(json!({ "timezoneId": tz })),
+                    Some(session_id),
+                )
+                .await;
+        }
     }
 
     Ok(())
 }
 
+/// Resolve the timezone to emulate for a fresh-launch session, if any.
+/// Controlled by `AGENT_BROWSER_TIMEZONE`: an explicit IANA id, or `auto` to
+/// derive a sensible default from the locale. Returns `None` (leave the real
+/// timezone) when unset, empty, or when `auto` can't map the locale.
+fn resolve_timezone(locale: Option<&str>) -> Option<String> {
+    let raw = std::env::var("AGENT_BROWSER_TIMEZONE").ok()?;
+    let raw = raw.trim();
+    if raw.is_empty() {
+        return None;
+    }
+    if raw.eq_ignore_ascii_case("auto") {
+        return locale
+            .and_then(locale_default_timezone)
+            .map(str::to_string);
+    }
+    Some(raw.to_string())
+}
+
+/// Best-effort IANA timezone for a locale. Used only for
+/// `AGENT_BROWSER_TIMEZONE=auto`; unknown locales return `None` so the real
+/// timezone is left untouched rather than guessing a wrong one.
+fn locale_default_timezone(locale: &str) -> Option<&'static str> {
+    let tz = match locale.to_ascii_lowercase().as_str() {
+        "en-us" => "America/New_York",
+        "en-ca" => "America/Toronto",
+        "en-gb" => "Europe/London",
+        "en-au" => "Australia/Sydney",
+        "ja" | "ja-jp" => "Asia/Tokyo",
+        "ko" | "ko-kr" => "Asia/Seoul",
+        "zh-cn" | "zh-hans" | "zh-hans-cn" => "Asia/Shanghai",
+        "zh-tw" | "zh-hant" | "zh-hant-tw" => "Asia/Taipei",
+        "zh-hk" => "Asia/Hong_Kong",
+        "de" | "de-de" => "Europe/Berlin",
+        "fr" | "fr-fr" => "Europe/Paris",
+        "es" | "es-es" => "Europe/Madrid",
+        "it" | "it-it" => "Europe/Rome",
+        "nl" | "nl-nl" => "Europe/Amsterdam",
+        "pt-br" => "America/Sao_Paulo",
+        "pt" | "pt-pt" => "Europe/Lisbon",
+        "ru" | "ru-ru" => "Europe/Moscow",
+        _ => return None,
+    };
+    Some(tz)
+}
+
 /// Get the browser's User-Agent string via CDP.
 async fn get_browser_user_agent(client: &CdpClient, session_id: &str) -> Option<String> {
     let result = client
@@ -235,3 +332,43 @@ fn build_ua_metadata(ua: &str, locale: Option<&str>) -> serde_json::Value {
         "wow64": false,
     })
 }
+
+#[cfg(test)]
+mod timezone_tests {
+    use super::{locale_default_timezone, resolve_timezone};
+
+    #[test]
+    fn maps_common_locales_case_insensitively() {
+        assert_eq!(locale_default_timezone("en-US"), Some("America/New_York"));
+        assert_eq!(locale_default_timezone("ja-JP"), Some("Asia/Tokyo"));
+        assert_eq!(locale_default_timezone("zh-CN"), Some("Asia/Shanghai"));
+        assert_eq!(locale_default_timezone("ZH-TW"), Some("Asia/Taipei"));
+        assert_eq!(locale_default_timezone("ja"), Some("Asia/Tokyo"));
+    }
+
+    #[test]
+    fn unknown_locale_returns_none() {
+        assert_eq!(locale_default_timezone("xx-YY"), None);
+        assert_eq!(locale_default_timezone(""), None);
+    }
+
+    #[test]
+    fn resolve_timezone_honors_env() {
+        // Serialized via a single test to avoid cross-test env races on this key.
+        std::env::remove_var("AGENT_BROWSER_TIMEZONE");
+        assert_eq!(resolve_timezone(Some("en-US")), None);
+
+        std::env::set_var("AGENT_BROWSER_TIMEZONE", "Europe/Berlin");
+        assert_eq!(resolve_timezone(None), Some("Europe/Berlin".to_string()));
+
+        std::env::set_var("AGENT_BROWSER_TIMEZONE", "  ");
+        assert_eq!(resolve_timezone(Some("en-US")), None);
+
+        std::env::set_var("AGENT_BROWSER_TIMEZONE", "auto");
+        assert_eq!(resolve_timezone(Some("ja-JP")), Some("Asia/Tokyo".to_string()));
+        assert_eq!(resolve_timezone(Some("xx-YY")), None);
+        assert_eq!(resolve_timezone(None), None);
+
+        std::env::remove_var("AGENT_BROWSER_TIMEZONE");
+    }
+}

cli/src/native/stealth_scripts.js

@@ -1,4 +1,4 @@
-const __abStealth = { locale: "en-US", languages: ["en-US", "en"], allowWebGLContextFallback: false };
+const __abStealth = { locale: "en-US", languages: ["en-US", "en"], allowWebGLContextFallback: false, hideCanvas: false, canvasSeed: 0 };
 (function(){
   // Prefer the CDP-level automation override (Emulation.setAutomationOverride),
   // which makes navigator.webdriver report `false` NATIVELY — undetectable by
@@ -1275,3 +1275,126 @@ const __abStealth = { locale: "en-US", languages: ["en-US", "en"], allowWebGLCon
     }
   }
 })();
+// Canvas + audio fingerprint noise (OPT-IN, full-launch only).
+// Headless Chrome produces a stable canvas/audio hash that trackers use as a
+// device id. When __abStealth.hideCanvas is on we perturb readback APIs with a
+// SESSION-STABLE, sub-perceptual amount of noise: repeated reads on this page
+// return the same noised result (a real device is consistent too), but the
+// hash differs from the headless default. Off by default — noise is itself a
+// "lie", so it's reserved for users who explicitly enable it.
+(function(){
+  if (!__abStealth || __abStealth.hideCanvas !== true) return;
+
+  // Deterministic PRNG keyed by the per-session seed plus a position, so the
+  // same pixel/sample is perturbed identically every read within the session.
+  const baseSeed = (__abStealth.canvasSeed >>> 0) || 0x9e3779b9;
+  const noiseAt = (n) => {
+    let t = (baseSeed ^ Math.imul(n | 0, 0x6d2b79f5)) >>> 0;
+    t = Math.imul(t ^ (t >>> 15), t | 1) >>> 0;
+    t ^= t + Math.imul(t ^ (t >>> 7), t | 61);
+    return ((t ^ (t >>> 14)) >>> 0) / 4294967296;
+  };
+
+  // Make a wrapped function masquerade as the native one (toString + name).
+  const mask = (wrapped, native) => {
+    try {
+      Object.defineProperty(wrapped, 'name', {
+        value: native.name,
+        configurable: true,
+      });
+      Object.defineProperty(wrapped, 'toString', {
+        value: () => native.toString(),
+        configurable: true,
+        writable: true,
+      });
+    } catch {}
+    return wrapped;
+  };
+
+  // ---- Canvas 2D readback ---------------------------------------------------
+  const perturbImageData = (imageData) => {
+    const data = imageData && imageData.data;
+    if (!data || !data.length) return imageData;
+    for (let i = 0; i < data.length; i += 4) {
+      // Touch ~5% of pixels by +/-1 on each RGB channel; leave alpha alone.
+      if (noiseAt(i) < 0.05) {
+        const delta = noiseAt(i + 1) < 0.5 ? -1 : 1;
+        data[i] = Math.max(0, Math.min(255, data[i] + delta));
+        data[i + 1] = Math.max(0, Math.min(255, data[i + 1] + delta));
+        data[i + 2] = Math.max(0, Math.min(255, data[i + 2] + delta));
+      }
+    }
+    return imageData;
+  };
+
+  try {
+    const ctxProto = (typeof CanvasRenderingContext2D !== 'undefined')
+      ? CanvasRenderingContext2D.prototype : null;
+    if (ctxProto && typeof ctxProto.getImageData === 'function') {
+      const nativeGetImageData = ctxProto.getImageData;
+      ctxProto.getImageData = mask(function(...args) {
+        return perturbImageData(nativeGetImageData.apply(this, args));
+      }, nativeGetImageData);
+    }
+  } catch {}
+
+  // For toDataURL/toBlob, draw the (already-rendered) canvas onto a scratch
+  // canvas, perturb its pixels, then encode that — so the export hash shifts
+  // without disturbing what the page sees on screen.
+  const exportNoised = (canvas) => {
+    try {
+      const w = canvas.width, h = canvas.height;
+      if (!w || !h) return null;
+      const scratch = document.createElement('canvas');
+      scratch.width = w; scratch.height = h;
+      const sctx = scratch.getContext('2d');
+      if (!sctx) return null;
+      sctx.drawImage(canvas, 0, 0);
+      const img = sctx.getImageData(0, 0, w, h);
+      perturbImageData(img);
+      sctx.putImageData(img, 0, 0);
+      return scratch;
+    } catch { return null; }
+  };
+
+  try {
+    const canvasProto = (typeof HTMLCanvasElement !== 'undefined')
+      ? HTMLCanvasElement.prototype : null;
+    if (canvasProto && typeof canvasProto.toDataURL === 'function') {
+      const nativeToDataURL = canvasProto.toDataURL;
+      canvasProto.toDataURL = mask(function(...args) {
+        const scratch = exportNoised(this);
+        return nativeToDataURL.apply(scratch || this, args);
+      }, nativeToDataURL);
+    }
+    if (canvasProto && typeof canvasProto.toBlob === 'function') {
+      const nativeToBlob = canvasProto.toBlob;
+      canvasProto.toBlob = mask(function(cb, ...rest) {
+        const scratch = exportNoised(this);
+        return nativeToBlob.call(scratch || this, cb, ...rest);
+      }, nativeToBlob);
+    }
+  } catch {}
+
+  // ---- AudioBuffer readback -------------------------------------------------
+  // Perturb time-domain samples by a tiny, seed-stable amount so the audio
+  // fingerprint (sum/hash of channel data) shifts without audible effect.
+  try {
+    const audioProto = (typeof AudioBuffer !== 'undefined') ? AudioBuffer.prototype : null;
+    if (audioProto && typeof audioProto.getChannelData === 'function') {
+      const nativeGetChannelData = audioProto.getChannelData;
+      const seen = new WeakSet();
+      audioProto.getChannelData = mask(function(...args) {
+        const channel = nativeGetChannelData.apply(this, args);
+        // Only perturb once per buffer to keep reads consistent.
+        if (channel && !seen.has(channel)) {
+          seen.add(channel);
+          for (let i = 0; i < channel.length; i += 100) {
+            channel[i] = channel[i] + (noiseAt(i) - 0.5) * 1e-7;
+          }
+        }
+        return channel;
+      }, nativeGetChannelData);
+    }
+  } catch {}
+})();

install.sh

@@ -95,10 +95,14 @@ fi
 mkdir -p "$bindir"
 
 mv "$tmp/${BIN_NAME}" "$bindir/${BIN_NAME}"
-# convenience aliases: `abs` (short) -> agent-browser
-ln -sf "$bindir/${BIN_NAME}" "$bindir/abs" 2>/dev/null || true
+# Aliases pointing at the same binary: `abs` (short) and `agent-browser-stealth`
+# (the fork's package name). All three names work, and an upgrade refreshes
+# whichever name you actually run.
+for alias_name in abs agent-browser-stealth; do
+  ln -sf "$bindir/${BIN_NAME}" "$bindir/${alias_name}" 2>/dev/null || true
+done
 
-info "installed ${BIN_NAME} -> ${bindir}/${BIN_NAME}"
+info "installed -> ${bindir}/ (agent-browser, agent-browser-stealth, abs)"
 "$bindir/${BIN_NAME}" --version 2>/dev/null || true
 
 case ":$PATH:" in

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-browser-stealth",
-  "version": "0.27.0-fork.14",
+  "version": "0.27.0-fork.16",
   "description": "Browser automation CLI for AI agents — stealth fork with anti-detection",
   "type": "module",
   "packageManager": "pnpm@11.1.3",

skill-data/core/references/commands.md

@@ -324,9 +324,9 @@ agent-browser <command> --help        # Show detailed help for a command
 agent-browser --headed open example.com   # Show browser window
 agent-browser --cdp 9222 snapshot         # Connect via CDP port
 agent-browser connect 9222                # Alternative: connect command
-agent-browser console                     # View console messages
+agent-browser console                     # View console messages (needs AGENT_BROWSER_CAPTURE_CONSOLE=1)
 agent-browser console --clear             # Clear console
-agent-browser errors                      # View page errors
+agent-browser errors                      # View page errors (needs AGENT_BROWSER_CAPTURE_CONSOLE=1)
 agent-browser errors --clear              # Clear errors
 agent-browser highlight @e1               # Highlight element
 agent-browser inspect                     # Open Chrome DevTools for this session
@@ -336,6 +336,25 @@ agent-browser profiler start              # Start Chrome DevTools profiling
 agent-browser profiler stop trace.json    # Stop and save profile
 ```
 
+### Debugging forms / hidden state with `eval`
+
+The a11y `snapshot` shows visible, interactive elements — it does **not** show
+hidden inputs or a control's actual submitted value. When a form "looks filled"
+but submit-validation rejects it, go straight to the DOM with `eval` instead of
+guessing from the snapshot. This is usually the fastest way to find the real
+problem (e.g. a hidden `point_choice=none` that the visible UI never exposes):
+
+```bash
+# Dump every field's name → value, including hidden inputs and unchecked radios
+agent-browser eval "JSON.stringify([...document.forms[0].elements].map(e=>({name:e.name,type:e.type,value:e.value,checked:e.checked})).filter(e=>e.name))"
+
+# Inspect one hidden field directly
+agent-browser eval "document.querySelector('[name=point_choice]')?.value"
+
+# Why won't it submit? Ask the browser's own validity API
+agent-browser eval "[...document.forms[0].elements].filter(e=>!e.validity?.valid).map(e=>e.name+': '+e.validationMessage)"
+```
+
 ## React / Web Vitals
 
 Requires `--enable react-devtools` at launch for the `react ...` commands.
@@ -391,4 +410,38 @@ AGENT_BROWSER_HIDE_SCROLLBARS="false"        # Keep native scrollbars visible in
 AGENT_BROWSER_PROVIDER="browserbase"         # Cloud browser provider
 AGENT_BROWSER_STREAM_PORT="9223"             # Override WebSocket streaming port (default: OS-assigned)
 AGENT_BROWSER_HOME="/path/to/agent-browser"  # Custom install location
+AGENT_BROWSER_CLICK_MODE="dom"               # Click strategy: "" (default: scroll-in + coordinate
+                                             #   click, DOM-dispatch fallback), "coord" (strict
+                                             #   coordinate only), "dom" (always element.click())
 ```
+
+### Click reliability
+
+`click` auto-scrolls the target into view first, then dispatches a coordinate
+click. If that fails (a floating layer fails the occlusion guard, or the point
+won't resolve) it falls back to a DOM-dispatched `.click()` on the intended
+element. If a click *reports success but the page didn't react* — common for
+autocomplete/menu `<li>` items that close on the input's blur — retry that one
+with `AGENT_BROWSER_CLICK_MODE=dom` (a DOM dispatch doesn't move focus the way a
+real pointer press does, so the item still selects). `=coord` disables the
+fallback when you specifically want a hard failure on occlusion.
+
+### Stealth / anti-detection knobs (fork)
+
+```bash
+AGENT_BROWSER_CAPTURE_CONSOLE="1"     # Enable `console`/`errors` capture. OFF by default:
+                                      #   a live CDP Runtime domain is a detectable bot signal,
+                                      #   so console/errors return empty (with a hint) until set.
+AGENT_BROWSER_TIMEZONE="Asia/Tokyo"   # --launch only. Native timezone override (IANA id, or
+                                      #   "auto" to derive from locale). Aligns Intl+Date to a proxy.
+AGENT_BROWSER_BLOCK_WEBRTC="1"        # --launch only. Hide local IP via WebRTC. Auto-forces WebRTC
+                                      #   through the proxy when one is set; "0" opts out.
+AGENT_BROWSER_HIDE_CANVAS="1"         # --launch only. Session-stable canvas/audio fingerprint noise.
+AGENT_BROWSER_ADAPTIVE_REF="0"        # Disable adaptive @ref relocation (on by default; relocates a
+                                      #   moved element by fingerprint when role/name re-query fails).
+```
+
+> **Heads-up for `console` / `errors`:** capture is **off by default** in this stealth
+> fork. Both commands return `{"messages":[]}` / `{"errors":[]}` plus a `hint` until you
+> launch the session with `AGENT_BROWSER_CAPTURE_CONSOLE=1`. This keeps the CDP `Runtime`
+> domain disabled (a known bot signal) for the common automation path.

skill-data/dogfood/SKILL.md

@@ -96,7 +96,7 @@ Read [references/issue-taxonomy.md](references/issue-taxonomy.md) for the full l
 - Within each section, test interactive elements: click buttons, fill forms, open dropdowns/modals.
 - Check edge cases: empty states, error handling, boundary inputs.
 - Try realistic end-to-end workflows (create, edit, delete flows).
-- Check the browser console for errors periodically.
+- Check the browser console for errors periodically. **Console/error capture is off by default in this stealth fork** — start the dogfood session with `AGENT_BROWSER_CAPTURE_CONSOLE=1` (e.g. `AGENT_BROWSER_CAPTURE_CONSOLE=1 agent-browser --session {SESSION} open <url>`) or `console`/`errors` will return empty.
 
 **At each page:**
 

skill-data/slack/SKILL.md

@@ -230,6 +230,9 @@ agent-browser snapshot -i | grep -c "treeitem"
 
 ### Check console for errors
 
+Console/error capture is off by default in this stealth fork — launch the session with
+`AGENT_BROWSER_CAPTURE_CONSOLE=1` first, or these return empty.
+
 ```bash
 agent-browser console
 agent-browser errors