chore(release): 0.27.0-fork.46 — cap --annotate legend

Dense pages produced hundreds of legend lines on stdout (Hermes: HN dumped 320).
Print the first 40 with a "… and N more" summary; every marker is still drawn in
the image, and --json still returns the full list.

README.md

@@ -227,6 +227,25 @@ When connected to your real Chrome, we inject **zero** JavaScript patches. Your
 
 When using `--launch` mode (standalone browser), a full suite of stealth patches is applied instead, and it still passes the suite above.
 
+### Human-like input (behavioural stealth)
+
+Fingerprint stealth isn't the whole story — the strongest anti-bot vendors (Akamai, PerimeterX, DataDome) also score *behaviour*. A click that teleports the cursor to an element's exact centre with no approach path and zero press delay is a tell, **even though our CDP events are `isTrusted`**.
+
+With humanize on, the cursor moves like a hand: clicks follow a curved, decelerating Bézier path and land on a jittered point *inside* the element (never the dead centre); typing uses variable inter-keystroke timing; scrolling eases in segments; drags follow a curve. It's **adaptive** — every navigation is probed for known anti-bot vendors (cookies / scripts / globals) and a guarded page auto-escalates to full human motion, while ordinary sites stay instant (zero overhead).
+
+What the page's own `mousemove` stream sees (this *is* what a behavioural detector analyses):
+
+| | trajectory |
+|---|---|
+| **off** (default) | straight lines · dead-centre · instant |
+| **human** | curved trails · slow-in/slow-out · off-centre landings |
+
+Control with `--humanize off\|fast\|human` or `AGENT_BROWSER_HUMANIZE`. Default `off`; the adaptive detector escalates per page.
+
+### Silent operation
+
+Driving your real Chrome should never interrupt your work. The agent operates **entirely in the background**: new tabs open un-focused (in their own colored per-session tab group), the agent **never force-fronts a tab**, and `Emulation.setFocusEmulationEnabled` keeps each agent tab rendering and reporting `document.hasFocus()` / `visibilityState: 'visible'`. So screenshots still work, pages aren't render-throttled, and "the tab was hidden the whole session" never becomes its own bot tell. You keep working in your active tab; the agent works alongside you, silently. (Surfacing a tab stays available as an explicit command.)
+
 ### Verify it yourself
 
 Don't take our word for it — point your connected Chrome at the toughest public detectors and compare:
@@ -244,6 +263,7 @@ We deliberately **don't ship our own bot detector** — the strongest, most hone
 | Variable | Default | Effect |
 |---|---|---|
 | `AGENT_BROWSER_CAPTURE_CONSOLE` | off | Enable `Runtime` domain so `console` / `errors` capture page output. Off keeps the stealthiest profile. |
+| `AGENT_BROWSER_HUMANIZE` | off | Human-like input motion: `off` (instant), `fast` (light eased trajectory), `human` (full curved trajectory + landing jitter + typing cadence + eased scroll/drag). Also `--humanize`. Default `off`; the adaptive detector auto-escalates pages guarded by Akamai/PerimeterX/DataDome to `human`. |
 | `AGENT_BROWSER_TIMEZONE` | unset | `--launch` only. An IANA id (e.g. `Asia/Tokyo`) sets the timezone natively (Intl + Date follow, no JS lie) to match a proxy; `auto` derives one from the locale. |
 | `AGENT_BROWSER_BLOCK_WEBRTC` | auto | `--launch` only. Auto-forces WebRTC through the proxy when one is set (no real-IP leak). `1` hides the local IP without a proxy; `0` opts out. |
 | `AGENT_BROWSER_HIDE_CANVAS` | off | `--launch` only. Adds session-stable canvas/audio fingerprint noise. Off by default (noise is itself a "lie"). |

README.zh.md

@@ -148,6 +148,25 @@ agent-browser --launch --profile auto open https://x.com/home
 
 `--launch` 独立模式下会改用一整套隐身补丁，同样过上述检测。
 
+### 类人输入（行为隐身）
+
+指纹隐身只是一半——最强的反爬厂商（Akamai、PerimeterX、DataDome）还会给**行为**打分。点击时光标瞬移到元素正中心、没有接近轨迹、按下即抬起,这本身就是破绽,**哪怕我们的 CDP 事件是 `isTrusted`**。
+
+开启 humanize 后,光标像手在动:点击走带减速的贝塞尔曲线、落在元素内**偏离正中心**的抖动点;打字用变速的击键间隔;滚动分段缓动;拖拽走曲线。而且**自适应**——每次导航探测页面是否有已知反爬厂商(cookie/脚本/全局变量),命中就自动升到全套类人动作,普通站点保持瞬时(零开销)。
+
+页面自己的 `mousemove` 流看到的(行为检测器分析的正是这个):
+
+| | 轨迹 |
+|---|---|
+| **off**（默认） | 直线 · 死磕正中心 · 瞬时 |
+| **human** | 曲线 · 先慢后快再慢 · 落点偏移 |
+
+用 `--humanize off\|fast\|human` 或 `AGENT_BROWSER_HUMANIZE` 控制。默认 `off`,自适应检测器按页面自动升档。
+
+### 静默操作
+
+操作你的真实 Chrome 不该打断你的工作。agent **全程在后台操作**:新标签后台打开(在自己的彩色会话标签组里),**从不强制把标签拽到前台**,并用 `Emulation.setFocusEmulationEnabled` 让每个 agent 标签照常渲染、`document.hasFocus()` / `visibilityState` 仍报 `visible`。于是截图正常、页面不被降频,"标签全程隐藏"也不会变成新的机器人信号。你在自己的标签里照常工作,agent 在旁边默默干活。(想置顶某个标签仍可显式调用命令。)
+
 ## 与上游的差异
 
 基于 [agent-browser v0.27.0](https://github.com/vercel-labs/agent-browser)：

cli/Cargo.lock

@@ -45,7 +45,7 @@ dependencies = [
 
 [[package]]
 name = "agent-browser-stealth"
-version = "0.27.0-fork.36"
+version = "0.27.0-fork.46"
 dependencies = [
  "aes-gcm",
  "async-trait",

cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "agent-browser-stealth"
-version = "0.27.0-fork.36"
+version = "0.27.0-fork.46"
 edition = "2021"
 description = "Fast browser automation CLI for AI agents"
 license = "Apache-2.0"

cli/src/commands.rs

@@ -101,7 +101,62 @@ pub fn parse_curl_cookies(raw: &str) -> Result<Vec<Value>, String> {
                 .get("value")
                 .and_then(|v| v.as_str())
                 .ok_or_else(|| format!("cookies[{}] missing string value", i))?;
-            out.push(json!({ "name": name, "value": value }));
+            let mut cookie = json!({ "name": name, "value": value });
+            let obj = cookie.as_object_mut().unwrap();
+            // Preserve any CDP Network.setCookie attributes present on the
+            // source object so a full auth state round-trips: httpOnly session
+            // tokens, per-domain cookies (a single export spans .chatgpt.com,
+            // .openai.com, ...), and secure/sameSite/expiry. A bare
+            // {name,value} export is unchanged. Common aliases from DevTools /
+            // EditThisCookie / extension exports are accepted.
+            if let Some(v) = c.get("url").and_then(|v| v.as_str()) {
+                obj.insert("url".into(), json!(v));
+            }
+            if let Some(v) = c.get("domain").and_then(|v| v.as_str()) {
+                obj.insert("domain".into(), json!(v));
+            }
+            if let Some(v) = c.get("path").and_then(|v| v.as_str()) {
+                obj.insert("path".into(), json!(v));
+            }
+            if let Some(v) = c.get("secure").and_then(|v| v.as_bool()) {
+                obj.insert("secure".into(), json!(v));
+            }
+            if let Some(v) = c
+                .get("httpOnly")
+                .or_else(|| c.get("httponly"))
+                .or_else(|| c.get("http_only"))
+                .and_then(|v| v.as_bool())
+            {
+                obj.insert("httpOnly".into(), json!(v));
+            }
+            if let Some(v) = c
+                .get("sameSite")
+                .or_else(|| c.get("samesite"))
+                .or_else(|| c.get("same_site"))
+                .and_then(|v| v.as_str())
+            {
+                let norm = match v.to_lowercase().as_str() {
+                    "strict" => "Strict",
+                    "lax" => "Lax",
+                    "none" | "no_restriction" => "None",
+                    _ => "",
+                };
+                if !norm.is_empty() {
+                    obj.insert("sameSite".into(), json!(norm));
+                }
+            }
+            // CDP `expires` is seconds since the Unix epoch (f64). Accept
+            // `expires` or EditThisCookie's `expirationDate`.
+            if let Some(v) = c
+                .get("expires")
+                .or_else(|| c.get("expirationDate"))
+                .and_then(|v| v.as_f64())
+            {
+                if v > 0.0 {
+                    obj.insert("expires".into(), json!(v));
+                }
+            }
+            out.push(cookie);
         }
         return Ok(out);
     }
@@ -348,12 +403,48 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
             Ok(json!({ "id": id, "action": "fill", "selector": sel, "value": rest[1..].join(" ") }))
         }
         "type" => {
+            // `type --focused <text>` types into whatever element currently has
+            // focus (no selector) — for custom widgets that move focus to a hidden
+            // input after you open them.
+            if rest.first() == Some(&"--focused") {
+                return Ok(json!({
+                    "id": id, "action": "type", "focused": true,
+                    "text": rest[1..].join(" "),
+                }));
+            }
             let sel = rest.first().ok_or_else(|| ParseError::MissingArguments {
                 context: "type".to_string(),
-                usage: "type <selector> <text>",
+                usage: "type <selector> <text>   (or: type --focused <text>)",
             })?;
             Ok(json!({ "id": id, "action": "type", "selector": sel, "text": rest[1..].join(" ") }))
         }
+        "pick" => {
+            // pick <selector|@ref> --option "<text>"  — atomic combobox select:
+            // open the control, wait for options (incl. portal menus), match by
+            // text, fire the right event sequence, verify. Covers native <select>,
+            // ARIA combobox/listbox, and react-select.
+            let sel = rest.first().ok_or_else(|| ParseError::MissingArguments {
+                context: "pick".to_string(),
+                usage: "pick <selector> --option \"<text>\"",
+            })?;
+            let opt_pos = rest.iter().position(|a| *a == "--option" || *a == "-o");
+            let option = match opt_pos {
+                Some(p) => rest[p + 1..].join(" "),
+                None => {
+                    return Err(ParseError::MissingArguments {
+                        context: "pick".to_string(),
+                        usage: "pick <selector> --option \"<text>\"",
+                    })
+                }
+            };
+            if option.is_empty() {
+                return Err(ParseError::MissingArguments {
+                    context: "pick".to_string(),
+                    usage: "pick <selector> --option \"<text>\"",
+                });
+            }
+            Ok(json!({ "id": id, "action": "pick", "selector": sel, "option": option }))
+        }
         "hover" => {
             let sel = rest.first().ok_or_else(|| ParseError::MissingArguments {
                 context: "hover".to_string(),
@@ -786,17 +877,31 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
 
         // === Eval ===
         "eval" => {
-            // Check for flags: -b/--base64 or --stdin
-            let (is_base64, is_stdin, script_parts): (bool, bool, &[&str]) =
+            // Check for flags: -b/--base64, --stdin, or --file <path>
+            let (is_base64, is_stdin, is_file, script_parts): (bool, bool, bool, &[&str]) =
                 if rest.first() == Some(&"-b") || rest.first() == Some(&"--base64") {
-                    (true, false, &rest[1..])
+                    (true, false, false, &rest[1..])
                 } else if rest.first() == Some(&"--stdin") {
-                    (false, true, &rest[1..])
+                    (false, true, false, &rest[1..])
+                } else if rest.first() == Some(&"--file") {
+                    (false, false, true, &rest[1..])
                 } else {
-                    (false, false, rest.as_slice())
+                    (false, false, false, rest.as_slice())
                 };
 
-            let script = if is_stdin {
+            let script = if is_file {
+                // Read the script from a file. Avoids shell-mangling of inline JS
+                // (non-ASCII identifiers/strings, quotes, large scripts) — the file
+                // is read as UTF-8 and sent verbatim.
+                let path = script_parts.first().ok_or(ParseError::InvalidValue {
+                    message: "eval --file requires a path".to_string(),
+                    usage: "eval --file <path>",
+                })?;
+                std::fs::read_to_string(path).map_err(|e| ParseError::InvalidValue {
+                    message: format!("eval --file: cannot read {path}: {e}"),
+                    usage: "eval --file <path>",
+                })?
+            } else if is_stdin {
                 // Read script from stdin
                 let stdin = io::stdin();
                 let lines: Vec<String> = stdin
@@ -2859,6 +2964,27 @@ mod tests {
         assert_eq!(cmd["action"], "cookies_clear");
     }
 
+    #[test]
+    fn test_parse_curl_cookies_json_preserves_attributes() {
+        // A full cookie export (httpOnly session token, per-domain, secure,
+        // sameSite, expiry) must round-trip — not get flattened to name/value.
+        let input = r#"[
+            {"name":"__Secure-next-auth.session-token","value":"eyJ.tok","domain":".chatgpt.com","path":"/","secure":true,"httpOnly":true,"sameSite":"Lax","expires":1893456000},
+            {"name":"cf_clearance","value":"abc","domain":".openai.com","path":"/","secure":true,"http_only":true,"same_site":"no_restriction"}
+        ]"#;
+        let out = parse_curl_cookies(input).unwrap();
+        assert_eq!(out.len(), 2);
+        assert_eq!(out[0]["domain"], ".chatgpt.com");
+        assert_eq!(out[0]["secure"], true);
+        assert_eq!(out[0]["httpOnly"], true);
+        assert_eq!(out[0]["sameSite"], "Lax");
+        assert_eq!(out[0]["expires"], 1893456000.0);
+        // alias keys (http_only, same_site=no_restriction) normalize to CDP shape
+        assert_eq!(out[1]["domain"], ".openai.com");
+        assert_eq!(out[1]["httpOnly"], true);
+        assert_eq!(out[1]["sameSite"], "None");
+    }
+
     #[test]
     fn test_parse_curl_cookies_json_array() {
         let input = r#"[{"name":"a","value":"1"},{"name":"b","value":"2"}]"#;
@@ -2866,6 +2992,9 @@ mod tests {
         assert_eq!(out.len(), 2);
         assert_eq!(out[0]["name"], "a");
         assert_eq!(out[0]["value"], "1");
+        // bare {name,value} stays minimal — no spurious attribute keys
+        assert!(out[0].get("domain").is_none());
+        assert!(out[0].get("secure").is_none());
         assert_eq!(out[1]["name"], "b");
         assert_eq!(out[1]["value"], "2");
     }

cli/src/connect.rs

@@ -344,6 +344,19 @@ fn host_manifest_path_for_chrome() -> Option<PathBuf> {
         })
 }
 
+/// True if the ab-connect native-messaging host manifest is present — i.e. the
+/// user has set up the extension path. When installed, auto-connect treats the
+/// dialog-free extension relay as the *intended* transport and refuses to fall
+/// back to a raw debug port (which would pop Chrome 136+'s "Allow remote
+/// debugging?" consent modal). The relay-url file comes and goes with the
+/// service worker; this manifest is the durable signal that the extension is
+/// the chosen path.
+pub fn host_installed() -> bool {
+    native_messaging_dirs()
+        .into_iter()
+        .any(|d| d.join(format!("{HOST_NAME}.json")).exists())
+}
+
 fn report(json: bool, ok: bool, msg: &str) {
     if json {
         println!(

cli/src/connection.rs

@@ -821,7 +821,33 @@ fn connect(session: &str) -> Result<Connection, String> {
     }
 }
 
-pub fn send_command(cmd: Value, session: &str) -> Result<Response, String> {
+pub fn send_command(mut cmd: Value, session: &str) -> Result<Response, String> {
+    // Forward per-invocation env to the daemon. The daemon's environment is
+    // frozen at spawn, so settings like AGENT_BROWSER_CLICK_MODE /
+    // AGENT_BROWSER_HUMANIZE (incl. the --humanize flag, which sets the latter)
+    // are otherwise silently ignored on an already-running daemon. Carry them in
+    // the envelope so they apply to THIS command.
+    if let Some(obj) = cmd.as_object_mut() {
+        if let Ok(m) = std::env::var("AGENT_BROWSER_CLICK_MODE") {
+            obj.insert("_clickMode".to_string(), Value::String(m));
+        }
+        if let Ok(h) = std::env::var("AGENT_BROWSER_HUMANIZE") {
+            // Only forward a recognized level; warn once (like the --humanize flag
+            // does) when the env var is set to garbage, instead of silently
+            // ignoring it.
+            if crate::native::humanize::HumanizeLevel::parse(&h).is_some() {
+                obj.insert("_humanize".to_string(), Value::String(h));
+            } else {
+                static WARNED: std::sync::Once = std::sync::Once::new();
+                WARNED.call_once(|| {
+                    eprintln!(
+                        "warning: AGENT_BROWSER_HUMANIZE must be off|fast|human, got {h:?} (ignored)"
+                    );
+                });
+            }
+        }
+    }
+
     // Retry logic for transient errors (EAGAIN/EWOULDBLOCK/connection issues)
     const MAX_RETRIES: u32 = 5;
     const RETRY_DELAY_MS: u64 = 200;

cli/src/native/actions.rs

@@ -1160,6 +1160,23 @@ impl Drop for DaemonState {
 
 pub async fn execute_command(cmd: &Value, state: &mut DaemonState) -> Value {
     let action = cmd.get("action").and_then(|v| v.as_str()).unwrap_or("");
+
+    // Apply per-invocation overrides the client forwarded (the daemon's own env
+    // is frozen at spawn). CLICK_MODE is read fresh from the process env by
+    // interaction::click, so mirror it here — set when this command provided it,
+    // clear otherwise, so a value from an earlier command never leaks forward.
+    match cmd.get("_clickMode").and_then(|v| v.as_str()) {
+        Some(m) if !m.is_empty() => std::env::set_var("AGENT_BROWSER_CLICK_MODE", m),
+        _ => std::env::remove_var("AGENT_BROWSER_CLICK_MODE"),
+    }
+    // Humanize: set the session level from the client's --humanize / env. Only
+    // set when provided (don't clear — the adaptive per-navigation detector also
+    // owns this level between explicit overrides).
+    if let Some(h) = cmd.get("_humanize").and_then(|v| v.as_str()) {
+        if let Some(level) = super::humanize::HumanizeLevel::parse(h) {
+            super::humanize::set_detected_level(level);
+        }
+    }
     let id = cmd
         .get("id")
         .and_then(|v| v.as_str())
@@ -1306,6 +1323,7 @@ pub async fn execute_command(cmd: &Value, state: &mut DaemonState) -> Value {
         "fill" => handle_fill(cmd, state).await,
         "type" => handle_type(cmd, state).await,
         "press" => handle_press(cmd, state).await,
+        "pick" => handle_pick(cmd, state).await,
         "hover" => handle_hover(cmd, state).await,
         "scroll" => handle_scroll(cmd, state).await,
         "select" => handle_select(cmd, state).await,
@@ -1511,12 +1529,11 @@ pub async fn execute_command(cmd: &Value, state: &mut DaemonState) -> Value {
 /// subsequent navigations don't hijack the user's existing tabs.
 async fn connect_auto_with_fresh_tab() -> Result<BrowserManager, String> {
     let mut mgr = BrowserManager::connect_auto().await?;
+    // tab_new creates the tab in the background (CreateTargetParams.background),
+    // so attaching to the user's Chrome never steals their foreground tab. We
+    // deliberately do NOT bring it to front — silent operation.
     mgr.tab_new(None, None).await?;
     let session_id = mgr.active_session_id()?.to_string();
-    let _ = mgr
-        .client
-        .send_command("Page.bringToFront", None, Some(&session_id))
-        .await;
 
     // Liveness probe: confirm the CDP session can actually round-trip
     // before returning success. Without this, a zombie CDP socket (process
@@ -3015,6 +3032,22 @@ async fn handle_fill(cmd: &Value, state: &mut DaemonState) -> Result<Value, Stri
 async fn handle_type(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
     let mgr = state.browser.as_ref().ok_or("Browser not launched")?;
     let session_id = mgr.active_session_id()?.to_string();
+
+    // `type --focused <text>`: type into the currently-focused element without a
+    // selector (custom widgets that move focus to a hidden input on open).
+    if cmd
+        .get("focused")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false)
+    {
+        let text = cmd
+            .get("text")
+            .and_then(|v| v.as_str())
+            .ok_or("Missing 'text' parameter")?;
+        interaction::type_text_into_active_context(&mgr.client, &session_id, text, None).await?;
+        return Ok(json!({ "typed": text, "focused": true }));
+    }
+
     let selector = cmd
         .get("selector")
         .and_then(|v| v.as_str())
@@ -3040,6 +3073,103 @@ async fn handle_type(cmd: &Value, state: &mut DaemonState) -> Result<Value, Stri
     Ok(json!({ "typed": text }))
 }
 
+/// Atomic combobox select: `pick <selector> --option "<text>"`. Opens the control
+/// (so a portal-rendered menu mounts), polls for the option by visible text, then
+/// fires the full pointer/mouse event sequence on it — covering native `<select>`,
+/// ARIA combobox/listbox, and react-select, which a bare `click`+`press Enter`
+/// can't do reliably. Runs as one in-page async routine so the open→render→pick
+/// dance happens without round-trips that let the menu collapse between commands.
+async fn handle_pick(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
+    let mgr = state.browser.as_ref().ok_or("Browser not launched")?;
+    let session_id = mgr.active_session_id()?.to_string();
+    let selector = cmd
+        .get("selector")
+        .and_then(|v| v.as_str())
+        .ok_or("Missing 'selector' parameter")?;
+    let option = cmd
+        .get("option")
+        .and_then(|v| v.as_str())
+        .ok_or("Missing 'option' parameter")?;
+
+    let (object_id, effective_session_id) = super::element::resolve_element_object_id(
+        &mgr.client,
+        &session_id,
+        &state.ref_map,
+        selector,
+        &state.iframe_sessions,
+    )
+    .await?;
+
+    let func = format!(
+        r#"async function() {{
+            const want = {opt};
+            const norm = s => (s || '').replace(/\s+/g, ' ').trim();
+            const matches = el => norm(el.textContent).toLowerCase().includes(want.toLowerCase());
+            const el = this;
+            const fire = (n, t) => n.dispatchEvent(new MouseEvent(t, {{ bubbles: true, cancelable: true, view: window }}));
+
+            // Native <select>: set the matching option and dispatch input/change.
+            if (el.tagName === 'SELECT') {{
+                const opt = [...el.options].find(matches);
+                if (!opt) return {{ ok: false, error: 'no <option> matched ' + JSON.stringify(want) }};
+                el.value = opt.value;
+                el.dispatchEvent(new Event('input', {{ bubbles: true }}));
+                el.dispatchEvent(new Event('change', {{ bubbles: true }}));
+                return {{ ok: true, picked: norm(opt.textContent), value: el.value, kind: 'select' }};
+            }}
+
+            // Custom widget: open it.
+            (el.focus && el.focus());
+            ['pointerdown', 'mousedown', 'mouseup', 'click'].forEach(t => fire(el, t));
+
+            // Poll for the option to render anywhere in the document (portals
+            // mount the menu outside the trigger), then click it.
+            const sel = '[role=option], [role=listbox] [role=option], li[role=option], [class*=option], [class*=item]';
+            const find = () => [...document.querySelectorAll(sel)].find(o => o.offsetParent !== null && matches(o));
+            const deadline = Date.now() + 2500;
+            let opt = find();
+            while (!opt && Date.now() < deadline) {{
+                await new Promise(r => setTimeout(r, 80));
+                opt = find();
+            }}
+            if (!opt) return {{ ok: false, error: 'option ' + JSON.stringify(want) + ' did not appear after opening the control' }};
+            (opt.scrollIntoView && opt.scrollIntoView({{ block: 'center' }}));
+            ['pointermove', 'pointerover', 'mouseover', 'pointerdown', 'mousedown', 'mouseup', 'click'].forEach(t => fire(opt, t));
+            return {{ ok: true, picked: norm(opt.textContent), kind: 'custom' }};
+        }}"#,
+        opt = serde_json::to_string(option).unwrap_or_default(),
+    );
+
+    let result: super::cdp::types::EvaluateResult = mgr
+        .client
+        .send_command_typed(
+            "Runtime.callFunctionOn",
+            &super::cdp::types::CallFunctionOnParams {
+                function_declaration: func,
+                object_id: Some(object_id),
+                arguments: None,
+                return_by_value: Some(true),
+                await_promise: Some(true),
+            },
+            Some(&effective_session_id),
+        )
+        .await?;
+
+    if let Some(ref ex) = result.exception_details {
+        return Err(format!("pick failed: {}", ex.text));
+    }
+    let val = result.result.value.unwrap_or(Value::Null);
+    if val.get("ok").and_then(|v| v.as_bool()).unwrap_or(false) {
+        Ok(json!({ "picked": val.get("picked"), "selector": selector }))
+    } else {
+        Err(val
+            .get("error")
+            .and_then(|v| v.as_str())
+            .unwrap_or("pick failed")
+            .to_string())
+    }
+}
+
 async fn handle_press(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
     let mgr = state.browser.as_ref().ok_or("Browser not launched")?;
     let session_id = mgr.active_session_id()?.to_string();
@@ -5513,19 +5643,29 @@ async fn handle_wheel(cmd: &Value, state: &DaemonState) -> Result<Value, String>
     let delta_x = cmd.get("deltaX").and_then(|v| v.as_f64()).unwrap_or(0.0);
     let delta_y = cmd.get("deltaY").and_then(|v| v.as_f64()).unwrap_or(0.0);
 
-    mgr.client
-        .send_command(
-            "Input.dispatchMouseEvent",
-            Some(json!({
-                "type": "mouseWheel",
-                "x": x,
-                "y": y,
-                "deltaX": delta_x,
-                "deltaY": delta_y,
-            })),
-            Some(&session_id),
-        )
-        .await?;
+    // Humanize: at Off this is one instant wheel event (unchanged); at
+    // Fast/Human the scroll is split into eased, slightly-jittered segments so
+    // it ramps and settles like a real wheel/trackpad flick.
+    let level = humanize::active_level();
+    let seed = humanize::next_seed();
+    for (dx, dy, delay) in humanize::scroll_segments(delta_x, delta_y, level, seed) {
+        mgr.client
+            .send_command(
+                "Input.dispatchMouseEvent",
+                Some(json!({
+                    "type": "mouseWheel",
+                    "x": x,
+                    "y": y,
+                    "deltaX": dx,
+                    "deltaY": dy,
+                })),
+                Some(&session_id),
+            )
+            .await?;
+        if !delay.is_zero() {
+            tokio::time::sleep(delay).await;
+        }
+    }
 
     Ok(json!({ "scrolled": true, "deltaX": delta_x, "deltaY": delta_y }))
 }
@@ -6522,7 +6662,7 @@ async fn handle_drag(cmd: &Value, state: &mut DaemonState) -> Result<Value, Stri
         .and_then(|v| v.as_str())
         .ok_or("Missing 'target' parameter")?;
 
-    let (sx, sy, source_session_id) = super::element::resolve_element_center(
+    let (sx, sy, _, _, source_session_id) = super::element::resolve_element_center(
         &mgr.client,
         &session_id,
         &state.ref_map,
@@ -6530,7 +6670,7 @@ async fn handle_drag(cmd: &Value, state: &mut DaemonState) -> Result<Value, Stri
         &state.iframe_sessions,
     )
     .await?;
-    let (tx, ty, target_session_id) = super::element::resolve_element_center(
+    let (tx, ty, _, _, target_session_id) = super::element::resolve_element_center(
         &mgr.client,
         &session_id,
         &state.ref_map,
@@ -6555,12 +6695,26 @@ async fn handle_drag(cmd: &Value, state: &mut DaemonState) -> Result<Value, Stri
         )
         .await?;
 
-    // Move in steps to target, keeping the left button held (buttons: 1) so
-    // that the browser sees a drag rather than a plain pointer move.
-    let steps = 10;
-    for i in 1..=steps {
-        let cx = sx + (tx - sx) * (i as f64) / (steps as f64);
-        let cy = sy + (ty - sy) * (i as f64) / (steps as f64);
+    // Move to the target with the left button held (buttons: 1) so the browser
+    // sees a drag. At Off this is the original linear 10-step path; at
+    // Fast/Human it follows humanize's curved, decelerating trajectory.
+    let level = humanize::active_level();
+    let drag_path: Vec<(f64, f64, std::time::Duration)> =
+        if matches!(level, humanize::HumanizeLevel::Off) {
+            (1..=10)
+                .map(|i| {
+                    let cx = sx + (tx - sx) * (i as f64) / 10.0;
+                    let cy = sy + (ty - sy) * (i as f64) / 10.0;
+                    (cx, cy, std::time::Duration::from_millis(10))
+                })
+                .collect()
+        } else {
+            humanize::move_path((sx, sy), (tx, ty), level, humanize::next_seed())
+                .into_iter()
+                .map(|s| (s.x, s.y, s.delay))
+                .collect()
+        };
+    for (cx, cy, delay) in drag_path {
         mgr.client
             .send_command(
                 "Input.dispatchMouseEvent",
@@ -6568,7 +6722,9 @@ async fn handle_drag(cmd: &Value, state: &mut DaemonState) -> Result<Value, Stri
                 Some(&target_session_id),
             )
             .await?;
-        tokio::time::sleep(tokio::time::Duration::from_millis(10)).await;
+        if !delay.is_zero() {
+            tokio::time::sleep(delay).await;
+        }
     }
 
     // Mouse up at target

cli/src/native/browser.rs

@@ -309,6 +309,12 @@ pub struct BrowserManager {
     pub ignore_https_errors: bool,
     /// Origins visited during this session, used by save_state to collect cross-origin localStorage.
     visited_origins: HashSet<String>,
+    /// Target IDs of tabs THIS session created via `Target.createTarget`. When
+    /// connected to the user's real Chrome (not a launched browser), these are
+    /// closed on `close()` so the session's tabs don't pile up in the user's
+    /// browser after it ends. Only ever holds tabs we created — never the user's
+    /// existing tabs or other sessions' tabs — so closing them is always safe.
+    created_targets: HashSet<String>,
     next_tab_id: u32,
     /// Whether to enable the CDP `Runtime` domain (console / error / exception capture).
     /// OFF by default for stealth: a live `Runtime.enable` is a detectable CDP signal
@@ -433,6 +439,7 @@ impl BrowserManager {
                 download_path: download_path.clone(),
                 ignore_https_errors,
                 visited_origins: HashSet::new(),
+                created_targets: HashSet::new(),
                 next_tab_id: 1,
                 capture_console: console_capture_enabled(),
             };
@@ -523,6 +530,7 @@ impl BrowserManager {
             download_path: None,
             ignore_https_errors: false,
             visited_origins: HashSet::new(),
+            created_targets: HashSet::new(),
             next_tab_id: 1,
             capture_console: console_capture_enabled(),
         };
@@ -581,10 +589,13 @@ impl BrowserManager {
                     &CreateTargetParams {
                         url: "about:blank".to_string(),
                         agent_group,
+                        background: None,
                     },
                     None,
                 )
                 .await?;
+            // We created this tab — own it so close() can clean it up.
+            self.created_targets.insert(result.target_id.clone());
 
             let attach_result: AttachToTargetResult = self
                 .client
@@ -687,6 +698,20 @@ impl BrowserManager {
                 Some(session_id),
             )
             .await;
+        // Silent operation: agent tabs are driven in the background (we never
+        // force them to the foreground), so emulate focus. Without this a
+        // backgrounded tab is render-throttled and reports `document.hidden` /
+        // `!document.hasFocus()` — which both breaks timing-sensitive pages and
+        // is itself a bot signal (a real user looks at the page). Best-effort;
+        // ignored on engines without Emulation support.
+        let _ = self
+            .client
+            .send_command(
+                "Emulation.setFocusEmulationEnabled",
+                Some(json!({ "enabled": true })),
+                Some(session_id),
+            )
+            .await;
         Ok(())
     }
 
@@ -877,6 +902,24 @@ impl BrowserManager {
                 .client
                 .send_command_no_params("Browser.close", None)
                 .await;
+        } else {
+            // Connected to the user's real Chrome: we must NOT close their
+            // browser, but we DO own the tabs this session created. Close them so
+            // they don't pile up in the user's window (in their per-session tab
+            // group) every time a session ends, idles out, or the daemon shuts
+            // down. `created_targets` only holds tabs we made via
+            // Target.createTarget — never the user's existing tabs or other
+            // sessions' — so this is always safe. Best-effort per tab.
+            for target_id in self.created_targets.drain() {
+                let _ = self
+                    .client
+                    .send_command_typed::<_, Value>(
+                        "Target.closeTarget",
+                        &CloseTargetParams { target_id },
+                        None,
+                    )
+                    .await;
+            }
         }
 
         if let Some(mut process) = self.browser_process.take() {
@@ -973,10 +1016,13 @@ impl BrowserManager {
                 &CreateTargetParams {
                     url: "about:blank".to_string(),
                     agent_group,
+                    background: None,
                 },
                 None,
             )
             .await?;
+        // We created this tab — own it so close() can clean it up.
+        self.created_targets.insert(result.target_id.clone());
 
         let attach_result: AttachToTargetResult = self
             .client
@@ -1137,10 +1183,13 @@ impl BrowserManager {
                 &CreateTargetParams {
                     url: target_url.to_string(),
                     agent_group,
+                    background: Some(true),
                 },
                 None,
             )
             .await?;
+        // We created this tab — own it so close() can clean it up.
+        self.created_targets.insert(result.target_id.clone());
 
         let attach: AttachToTargetResult = self
             .client
@@ -1192,11 +1241,10 @@ impl BrowserManager {
         let session_id = self.pages[index].session_id.clone();
         self.enable_domains(&session_id).await?;
 
-        // Bring tab to front
-        let _ = self
-            .client
-            .send_command("Page.bringToFront", None, Some(&session_id))
-            .await;
+        // Silent: switching the agent's *internal* active page must not yank the
+        // user's foreground tab. The page is driven in the background (focus is
+        // emulated in enable_domains); the explicit `bringToFront` command is the
+        // only way a tab is deliberately surfaced.
 
         let url = self.get_url().await.unwrap_or_default();
         let title = self.get_title().await.unwrap_or_default();
@@ -1734,6 +1782,7 @@ async fn initialize_lightpanda_manager(
             download_path: None,
             ignore_https_errors: false,
             visited_origins: HashSet::new(),
+            created_targets: HashSet::new(),
             next_tab_id: 1,
             capture_console: console_capture_enabled(),
         };

cli/src/native/cdp/chrome.rs

@@ -783,14 +783,46 @@ pub async fn auto_connect_cdp() -> Result<String, String> {
     // / :9222 probes below: if the user's Chrome happens to also be listening on a
     // debug port, attaching there would pop the consent dialog and defeat the
     // whole zero-interaction extension path.
-    if let Some(relay) = crate::connect::relay_url() {
-        // The relay is a local CDP-over-WS endpoint we connect to like Chrome.
-        // A bare TCP liveness check (no WS upgrade) confirms it is actually
-        // accepting before we commit, mirroring the consent-free probe used for
-        // DevToolsActivePort.
-        if relay_is_live(&relay).await {
-            return Ok(relay);
+    // If the extension is installed, it is the *intended* transport. The relay
+    // URL file comes and goes with the MV3 service worker (a Chrome restart or an
+    // idle SW briefly drops it), so a single failed probe doesn't mean "no
+    // extension" — retry for a few seconds while it reconnects. Crucially, when
+    // the extension is set up we must NEVER fall through to the raw :9222 path
+    // below: that pops Chrome 136+'s "Allow remote debugging?" dialog, the exact
+    // thing the extension exists to avoid.
+    // ~15s of retries (500ms apart) when the extension is installed: long enough
+    // for the MV3 service worker to wake and reconnect on its own (onStartup
+    // after a Chrome restart, or the keepalive alarm) so the relay self-heals
+    // with NO user action. The loop re-checks the relay file every iteration, so
+    // a recovery mid-wait is picked up immediately — the full window is only ever
+    // spent when the extension is genuinely down.
+    let host_installed = crate::connect::host_installed();
+    let relay_attempts = if host_installed { 30 } else { 1 };
+    for attempt in 0..relay_attempts {
+        if let Some(relay) = crate::connect::relay_url() {
+            // The relay is a local CDP-over-WS endpoint we connect to like Chrome.
+            // A bare TCP liveness check (no WS upgrade) confirms it is actually
+            // accepting before we commit, mirroring the consent-free probe used
+            // for DevToolsActivePort.
+            if relay_is_live(&relay).await {
+                return Ok(relay);
+            }
         }
+        if host_installed && attempt + 1 < relay_attempts {
+            tokio::time::sleep(std::time::Duration::from_millis(500)).await;
+        }
+    }
+
+    if host_installed {
+        return Err(
+            "The agent-browser-stealth extension is installed, but its relay \
+             isn't connected right now. Wake it up — click the extension's \
+             toolbar icon, or reload it at chrome://extensions — then retry. \
+             (agent-browser will not attach to a raw --remote-debugging-port \
+             while the extension is set up, because that pops Chrome's \"Allow \
+             remote debugging?\" dialog. Use --cdp <port> to force the raw path.)"
+                .to_string(),
+        );
     }
 
     let user_data_dirs = get_chrome_user_data_dirs();

cli/src/native/cdp/types.rs

@@ -153,6 +153,12 @@ pub struct CreateTargetParams {
     /// endpoint never receives an unknown parameter.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub agent_group: Option<String>,
+    /// Create the tab in the background so opening it never steals the user's
+    /// foreground tab (silent operation). Standard CDP param; the ab-connect
+    /// extension creates its tabs `active: false` regardless, so this only
+    /// affects the raw-CDP (no extension) path.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub background: Option<bool>,
 }
 
 #[derive(Debug, Deserialize)]

cli/src/native/element.rs

@@ -200,13 +200,17 @@ async fn relocate_stale_ref(
     }
 }
 
+/// Resolve a `@ref` or CSS selector to a click point. Returns
+/// `(centre_x, centre_y, width, height, session_id)`. Width/height come from the
+/// element's box model and feed humanize's in-bounds landing jitter; the CSS
+/// selector path returns zero size (→ land on centre, no jitter).
 pub async fn resolve_element_center(
     client: &CdpClient,
     session_id: &str,
     ref_map: &RefMap,
     selector_or_ref: &str,
     iframe_sessions: &HashMap<String, String>,
-) -> Result<(f64, f64, String), String> {
+) -> Result<(f64, f64, f64, f64, String), String> {
     if let Some(ref_id) = parse_ref(selector_or_ref) {
         let entry = ref_map
             .get(&ref_id)
@@ -263,7 +267,7 @@ pub async fn resolve_element_center(
                 .await;
 
             if let Ok(r) = result {
-                let (x, y) = box_model_center(&r.model);
+                let (x, y, w, h) = box_model_dims(&r.model);
                 // Occlusion check: a transient overlay (X.com's "click
                 // outside to close" mask, modal backdrop, sticky banner,
                 // etc.) can land on top of our target between snapshot
@@ -279,7 +283,7 @@ pub async fn resolve_element_center(
                     verify_click_target(client, effective_session_id, active_id, &ref_id, x, y)
                         .await?;
                 }
-                return Ok((x, y, effective_session_id.to_string()));
+                return Ok((x, y, w, h, effective_session_id.to_string()));
             }
             // backend_node_id is stale; re-query the accessibility tree below
         }
@@ -316,13 +320,14 @@ pub async fn resolve_element_center(
                 Some(effective_session_id),
             )
             .await?;
-        let (x, y) = box_model_center(&result.model);
-        return Ok((x, y, effective_session_id.to_string()));
+        let (x, y, w, h) = box_model_dims(&result.model);
+        return Ok((x, y, w, h, effective_session_id.to_string()));
     }
 
     // CSS selector
     let (x, y) = resolve_by_selector(client, session_id, selector_or_ref).await?;
-    Ok((x, y, session_id.to_string()))
+    // No box model on the CSS-selector fast path → zero size → land on centre.
+    Ok((x, y, 0.0, 0.0, session_id.to_string()))
 }
 
 pub async fn resolve_element_object_id(
@@ -872,6 +877,35 @@ fn box_model_center(model: &BoxModel) -> (f64, f64) {
     }
 }
 
+/// Centre plus width/height of the content box, derived from the quad's
+/// bounding extent. Width/height feed humanize's in-bounds landing jitter; a
+/// degenerate quad yields zero size, which the jitter treats as "land on
+/// centre" (no jitter).
+fn box_model_dims(model: &BoxModel) -> (f64, f64, f64, f64) {
+    let (cx, cy) = box_model_center(model);
+    if model.content.len() >= 8 {
+        let xs = [
+            model.content[0],
+            model.content[2],
+            model.content[4],
+            model.content[6],
+        ];
+        let ys = [
+            model.content[1],
+            model.content[3],
+            model.content[5],
+            model.content[7],
+        ];
+        let w = xs.iter().cloned().fold(f64::MIN, f64::max)
+            - xs.iter().cloned().fold(f64::MAX, f64::min);
+        let h = ys.iter().cloned().fold(f64::MIN, f64::max)
+            - ys.iter().cloned().fold(f64::MAX, f64::min);
+        (cx, cy, w.max(0.0), h.max(0.0))
+    } else {
+        (cx, cy, 0.0, 0.0)
+    }
+}
+
 pub async fn get_element_text(
     client: &CdpClient,
     session_id: &str,

cli/src/native/humanize.rs

@@ -277,6 +277,41 @@ pub fn move_path(
     out
 }
 
+/// Split a wheel scroll of (`total_dx`, `total_dy`) into eased segments. `Off`
+/// returns a single instant segment (today's one-shot scroll); `Fast`/`Human`
+/// break it into several accelerate-then-decelerate chunks with small,
+/// jittered inter-segment delays, the way a trackpad/wheel flick actually
+/// lands. The segment deltas always sum to the requested total.
+pub fn scroll_segments(
+    total_dx: f64,
+    total_dy: f64,
+    level: HumanizeLevel,
+    seed: u64,
+) -> Vec<(f64, f64, Duration)> {
+    if level.is_off() {
+        return vec![(total_dx, total_dy, Duration::ZERO)];
+    }
+    let (segs, base_ms) = match level {
+        HumanizeLevel::Fast => (4usize, 18.0),
+        _ => (9usize, 28.0),
+    };
+    let mut rng = Rng::new(seed);
+    let mut out = Vec::with_capacity(segs);
+    let mut prev = 0.0;
+    for i in 1..=segs {
+        let f = ease(i as f64 / segs as f64);
+        let frac = f - prev;
+        prev = f;
+        let jitter = 1.0 + 0.3 * rng.signed();
+        out.push((
+            total_dx * frac,
+            total_dy * frac,
+            Duration::from_millis((base_ms * jitter).max(4.0) as u64),
+        ));
+    }
+    out
+}
+
 /// Dwell between `mousePressed` and `mouseReleased` (a real click isn't
 /// instantaneous). Zero for `Off`.
 pub fn press_dwell(level: HumanizeLevel, seed: u64) -> Duration {
@@ -435,6 +470,23 @@ mod tests {
         assert!(human.iter().all(|d| *d >= Duration::from_millis(8)));
     }
 
+    #[test]
+    fn scroll_segments_sum_to_total_and_single_when_off() {
+        let off = scroll_segments(0.0, 600.0, HumanizeLevel::Off, 1);
+        assert_eq!(off.len(), 1);
+        assert_eq!((off[0].0, off[0].1), (0.0, 600.0));
+        assert_eq!(off[0].2, Duration::ZERO);
+
+        let human = scroll_segments(0.0, 600.0, HumanizeLevel::Human, 5);
+        assert!(human.len() >= 5);
+        let total_dy: f64 = human.iter().map(|s| s.1).sum();
+        assert!(
+            (total_dy - 600.0).abs() < 1e-6,
+            "segments must sum to total"
+        );
+        assert!(human.iter().all(|s| s.2 >= Duration::from_millis(4)));
+    }
+
     #[test]
     fn detect_escalates_on_known_vendor_else_baseline() {
         let mut s = DetectSignals::default();

cli/src/native/interaction.rs

@@ -4,7 +4,7 @@ use serde_json::Value;
 
 use super::cdp::client::CdpClient;
 use super::cdp::types::*;
-use super::element::{resolve_element_center, resolve_element_object_id, RefMap};
+use super::element::{parse_ref, resolve_element_center, resolve_element_object_id, RefMap};
 use super::humanize;
 
 pub async fn click(
@@ -55,8 +55,42 @@ pub async fn click(
     .await;
 
     match resolved {
-        Ok((x, y, effective_session_id)) => {
-            dispatch_click(client, &effective_session_id, x, y, button, click_count).await
+        Ok((cx, cy, w, h, effective_session_id)) => {
+            // Occlusion guard for the CSS-selector path. `@ref` clicks are already
+            // occlusion-checked in resolve_element_center, but a plain selector
+            // resolves to coordinates without that check — so an overlay (modal
+            // backdrop, sticky banner, the getByText located node sitting under a
+            // full-screen layer) would make the coordinate click land on the
+            // overlay and still report success. If the click point doesn't hit the
+            // target, dispatch through the DOM instead (targets the element
+            // directly). Skipped for strict `coord` mode and non-left/multi-clicks.
+            if mode != "coord"
+                && button == "left"
+                && click_count == 1
+                && parse_ref(selector_or_ref).is_none()
+                && point_misses_element(client, &effective_session_id, selector_or_ref).await
+            {
+                eprintln!(
+                    "[click] target occluded at its click point; dispatching through \
+                     the DOM (set AGENT_BROWSER_CLICK_MODE=coord to disable)"
+                );
+                return dom_click(
+                    client,
+                    session_id,
+                    ref_map,
+                    selector_or_ref,
+                    iframe_sessions,
+                )
+                .await;
+            }
+            // Land on a jittered point inside the element rather than its exact
+            // centre (Fast/Human). Zero size or Off → exact centre.
+            let (tx, ty) = humanize::landing_point(
+                (cx - w / 2.0, cy - h / 2.0, w, h),
+                humanize::active_level(),
+                humanize::next_seed(),
+            );
+            dispatch_click(client, &effective_session_id, tx, ty, button, click_count).await
         }
         Err(e) => {
             // (B) The coordinate path failed — typically a persistent overlay
@@ -85,6 +119,42 @@ pub async fn click(
     }
 }
 
+/// True if a coordinate click at the selector's centre would land on something
+/// OTHER than the element (an overlay on top), i.e. the element is occluded.
+/// `false` when not occluded, the element is missing, or the probe fails (so we
+/// never block a click on a flaky probe — the normal coordinate path runs).
+async fn point_misses_element(client: &CdpClient, session_id: &str, selector: &str) -> bool {
+    let js = format!(
+        r#"(() => {{
+            const el = document.querySelector({sel});
+            if (!el) return false;
+            const r = el.getBoundingClientRect();
+            if (r.width === 0 || r.height === 0) return false;
+            const hit = document.elementFromPoint(r.left + r.width / 2, r.top + r.height / 2);
+            if (!hit) return false;
+            // Not occluded if the hit is the element, a descendant, or an ancestor
+            // wrapper (clicking those still reaches the element's handlers).
+            return !(hit === el || el.contains(hit) || hit.contains(el));
+        }})()"#,
+        sel = serde_json::to_string(selector).unwrap_or_default()
+    );
+    match client
+        .send_command_typed::<_, EvaluateResult>(
+            "Runtime.evaluate",
+            &EvaluateParams {
+                expression: js,
+                return_by_value: Some(true),
+                await_promise: Some(false),
+            },
+            Some(session_id),
+        )
+        .await
+    {
+        Ok(r) => r.result.value.and_then(|v| v.as_bool()).unwrap_or(false),
+        Err(_) => false,
+    }
+}
+
 /// Best-effort scroll-into-view before a coordinate click. Uses Chrome's
 /// `scrollIntoViewIfNeeded` (only scrolls when not already fully visible),
 /// falling back to centered `scrollIntoView`. Resolution failures are ignored —
@@ -191,7 +261,7 @@ pub async fn hover(
     selector_or_ref: &str,
     iframe_sessions: &HashMap<String, String>,
 ) -> Result<(), String> {
-    let (x, y, effective_session_id) = resolve_element_center(
+    let (x, y, _w, _h, effective_session_id) = resolve_element_center(
         client,
         session_id,
         ref_map,
@@ -999,7 +1069,7 @@ pub async fn tap_touch(
     selector_or_ref: &str,
     iframe_sessions: &HashMap<String, String>,
 ) -> Result<(), String> {
-    let (x, y, effective_session_id) = resolve_element_center(
+    let (x, y, _w, _h, effective_session_id) = resolve_element_center(
         client,
         session_id,
         ref_map,

cli/src/native/state.rs

@@ -121,6 +121,7 @@ async fn collect_storage_via_temp_target(
                 url: "about:blank".to_string(),
                 // Transient internal target (storage collection) — never grouped.
                 agent_group: None,
+                background: None,
             },
             None,
         )

cli/src/output.rs

@@ -130,6 +130,20 @@ fn format_stream_status_text(action: Option<&str>, data: &serde_json::Value) ->
     }
 }
 
+/// Shorten an over-long string by keeping its head and tail and eliding the
+/// middle, with a char count. Used so multi-KB URLs (JWT/OTP login links) don't
+/// flood `tab list`.
+fn truncate_middle(s: &str, max: usize) -> String {
+    let n = s.chars().count();
+    if n <= max {
+        return s.to_string();
+    }
+    let keep = max.saturating_sub(1) / 2;
+    let head: String = s.chars().take(keep).collect();
+    let tail: String = s.chars().skip(n - keep).collect();
+    format!("{head}…{tail} [{n} chars]")
+}
+
 pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &OutputOptions) {
     if opts.json {
         if opts.content_boundaries {
@@ -344,6 +358,16 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou
         }
         // Eval result
         if let Some(result) = data.get("result") {
+            // Surface which page the eval actually ran on — to stderr, so it
+            // never corrupts the parsed value on stdout. Lets an agent catch tab
+            // drift (commands landing on the wrong tab) before trusting a result,
+            // e.g. a logged-in `fetch` that hit the wrong origin. (In
+            // content-boundaries mode the origin is already in the banner.)
+            if !opts.content_boundaries {
+                if let Some(o) = origin.filter(|o| !o.is_empty()) {
+                    eprintln!("eval @ {o}");
+                }
+            }
             let formatted = serde_json::to_string_pretty(result).unwrap_or_default();
             print_with_boundaries(&formatted, origin, opts);
             return;
@@ -422,6 +446,9 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou
                     .and_then(|v| v.as_str())
                     .unwrap_or("Untitled");
                 let url = tab.get("url").and_then(|v| v.as_str()).unwrap_or("");
+                // Truncate very long URLs (e.g. multi-KB JWT/OTP login links) so
+                // the list stays readable instead of flooding the terminal.
+                let url = truncate_middle(url, 120);
                 let active = tab.get("active").and_then(|v| v.as_bool()).unwrap_or(false);
                 let marker = if active {
                     color::cyan("→")
@@ -734,7 +761,12 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou
                         color::green(path)
                     );
                     if let Some(annotations) = data.get("annotations").and_then(|v| v.as_array()) {
-                        for ann in annotations {
+                        // Cap the printed legend on dense pages (it can be
+                        // hundreds of lines and flood the terminal). The image
+                        // still shows every marker; --json returns the full list.
+                        const LEGEND_CAP: usize = 40;
+                        let total = annotations.len();
+                        for ann in annotations.iter().take(LEGEND_CAP) {
                             let num = ann.get("number").and_then(|n| n.as_u64()).unwrap_or(0);
                             let ref_id = ann.get("ref").and_then(|r| r.as_str()).unwrap_or("");
                             let role = ann.get("role").and_then(|r| r.as_str()).unwrap_or("");
@@ -756,6 +788,15 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou
                                 );
                             }
                         }
+                        if total > LEGEND_CAP {
+                            println!(
+                                "   {}",
+                                color::dim(&format!(
+                                    "… and {} more markers (shown in the image; --json for the full list)",
+                                    total - LEGEND_CAP
+                                ))
+                            );
+                        }
                     }
                 }
                 "pdf" => println!(

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-browser-stealth",
-  "version": "0.27.0-fork.36",
+  "version": "0.27.0-fork.46",
   "description": "Browser automation CLI for AI agents — stealth fork with anti-detection",
   "type": "module",
   "packageManager": "pnpm@11.1.3",

skill-data/core/SKILL.md

@@ -102,6 +102,20 @@ connect) > a headed launched browser > headless (forbidden).** A genuine human
 browser has no headless/automation tells at all, so prefer it for anything
 anti-bot-sensitive.
 
+**Silent by default.** When driving the user's real Chrome the agent works
+entirely in the background — new tabs open un-focused, the agent never force-
+fronts a tab, and focus is emulated so the page still renders and reports
+`visibilityState: 'visible'`. You don't need to do anything; just don't expect
+the user's view to follow you (use the explicit `bringToFront` only if you
+deliberately want to surface a tab).
+
+**Human-like input for behavioural anti-bot.** Beyond fingerprint stealth,
+`--humanize off|fast|human` (or `AGENT_BROWSER_HUMANIZE`) makes clicks follow a
+curved, decelerating path with in-element landing jitter, typing use variable
+cadence, and scroll/drag ease. Default `off`; a per-navigation detector
+auto-escalates pages guarded by Akamai/PerimeterX/DataDome to `human`. Leave it
+on auto; force `human` only when you already know the target scores behaviour.
+
 ## Two ways to drive a page — and when to drop to `eval`
 
 You have a **real Chrome with the user's DOM**. Two layers, mix them freely:
@@ -168,14 +182,17 @@ Snapshot output looks like:
 Page: Example - Log in
 URL: https://example.com/login
 
-@e1 [heading] "Log in"
-@e2 [form]
-  @e3 [input type="email"] placeholder="Email"
-  @e4 [input type="password"] placeholder="Password"
-  @e5 [button type="submit"] "Continue"
-  @e6 [link] "Forgot password?"
+- heading "Log in" [level=1, ref=e1]
+- textbox "Email" [ref=e2]
+- textbox "Password" [ref=e3]
+- button "Continue" [ref=e4]
+- link "Forgot password?" [ref=e5]
 ```
 
+Each line is `- <role> "<accessible name>" [<attrs>, ref=eN]`, indented by nesting
+depth. You pass the ref to commands as `@eN` (e.g. `click @e4`). Refs are
+assigned fresh on every snapshot.
+
 For unstructured reading (no refs needed):
 
 ```bash
@@ -202,8 +219,16 @@ agent-browser press Enter                 # press a key at current focus
 agent-browser press Control+a             # key combination
 agent-browser check @e3                   # check checkbox
 agent-browser uncheck @e3                 # uncheck
-agent-browser select @e4 "option-value"   # select dropdown option
+agent-browser select @e4 "option-value"   # native <select> only
 agent-browser select @e4 "a" "b"          # select multiple
+agent-browser pick @e4 --option "Europe"  # ANY combobox (react-select / ARIA /
+                                          # native): opens it, waits for the menu
+                                          # (incl. portal-rendered), matches by
+                                          # visible text, fires the right events,
+                                          # and ERRORS if the option never shows
+                                          # (no silent no-op). Use this for custom
+                                          # dropdowns where `select` returns ✓ but
+                                          # changes nothing.
 agent-browser upload @e5 file1.pdf        # upload file(s)
 agent-browser scroll down 500             # scroll page (up/down/left/right)
 agent-browser scrollintoview @e1          # scroll element into view
@@ -372,9 +397,16 @@ Array.from(rows).map(r => ({
 EOF
 ```
 
-Prefer `eval --stdin` (heredoc) or `eval -b <base64>` for any JS with
-quotes or special characters. Inline `agent-browser eval "..."` works
-only for simple expressions.
+Prefer `eval --stdin` (heredoc), `eval --file <path>`, or `eval -b <base64>`
+for any JS with quotes, **non-ASCII identifiers/strings (e.g. Chinese)**, or
+large scripts — inline `agent-browser eval "..."` is shell-mangled and works
+only for simple ASCII expressions.
+
+**`eval` runs in the page's MAIN world and state persists across calls**, so a
+top-level `const x`/`let x`/`var x` in one call collides with the next
+(`SyntaxError: Identifier 'x' has already been declared`). Either use unique
+names, assign to `window.x`, or wrap the body in an IIFE
+(`(() => { const x = …; return x; })()`).
 
 ### Screenshot