chore(release): bump to 0.27.0-fork.13 — --profile auto + temp-profile warnings

Stops agents from silently launching a temporary empty profile (no login). Adds --profile auto, warns on bare --launch, and recommends --profile auto in connect-failure errors. Addresses issue #1 follow-up.
feat(profile): --profile auto + stop steering users into temp-profile launches
2026-06-01 18:30:28 +09:00 · 2026-06-01 18:30:11 +09:00 · 2026-06-01 18:12:18 +09:00 · 2026-06-01 17:24:56 +09:00 · 2026-06-01 17:24:34 +09:00 · 2026-06-01 17:09:54 +09:00
28 changed files with 1587 additions and 518 deletions
@@ -15,6 +15,11 @@ jobs:
      - name: Checkout repository
        uses: actions/checkout@v4

+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .node-version
+
      - name: Check version sync
        run: node scripts/check-version-sync.js

@@ -54,12 +59,10 @@ jobs:
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version-file: .node-version

      - name: Install pnpm
        uses: pnpm/action-setup@v4
-        with:
-          version: 10

      - name: Install dependencies
        run: pnpm install --filter dashboard
@@ -209,7 +212,7 @@ jobs:
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
-          node-version: 24
+          node-version-file: .node-version

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
@@ -0,0 +1,137 @@
+name: Release binaries
+
+# Build per-platform binaries and attach them to the GitHub Release for the
+# pushed tag. No npm, no tokens — only the built-in GITHUB_TOKEN. Consumers
+# install with: curl -fsSL .../install.sh | sh
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing tag to (re)build binaries for, e.g. v0.27.0-fork.12'
+        required: true
+
+permissions:
+  contents: write
+
+concurrency: release-binaries-${{ github.ref }}
+
+jobs:
+  build:
+    name: Build ${{ matrix.name }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { name: Linux x64,        os: ubuntu-latest, target: x86_64-unknown-linux-gnu,    asset: agent-browser-linux-x64,        use_zigbuild: true,  ext: '' }
+          - { name: Linux ARM64,      os: ubuntu-latest, target: aarch64-unknown-linux-gnu,   asset: agent-browser-linux-arm64,      use_zigbuild: true,  ext: '' }
+          - { name: Linux musl x64,   os: ubuntu-latest, target: x86_64-unknown-linux-musl,   asset: agent-browser-linux-musl-x64,   use_zigbuild: true,  ext: '' }
+          - { name: Linux musl ARM64, os: ubuntu-latest, target: aarch64-unknown-linux-musl,  asset: agent-browser-linux-musl-arm64, use_zigbuild: true,  ext: '' }
+          - { name: Windows x64,      os: ubuntu-latest, target: x86_64-pc-windows-gnu,       asset: agent-browser-win32-x64,        use_zigbuild: false, ext: '.exe' }
+          - { name: macOS x64,        os: macos-latest,  target: x86_64-apple-darwin,         asset: agent-browser-darwin-x64,       use_zigbuild: false, ext: '' }
+          - { name: macOS ARM64,      os: macos-latest,  target: aarch64-apple-darwin,        asset: agent-browser-darwin-arm64,     use_zigbuild: false, ext: '' }
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install cross-compilation tools (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu gcc-x86-64-linux-gnu mingw-w64
+
+      - name: Install cargo-zigbuild
+        if: matrix.use_zigbuild
+        run: |
+          pip3 install ziglang
+          cargo install cargo-zigbuild
+
+      - name: Configure Rust linkers
+        if: runner.os == 'Linux'
+        run: |
+          mkdir -p ~/.cargo
+          cat >> ~/.cargo/config.toml << 'EOF'
+          [target.aarch64-unknown-linux-gnu]
+          linker = "aarch64-linux-gnu-gcc"
+
+          [target.x86_64-pc-windows-gnu]
+          linker = "x86_64-w64-mingw32-gcc"
+          EOF
+
+      - name: Cache Rust build artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: cli
+
+      - name: Build (zigbuild)
+        if: matrix.use_zigbuild
+        run: cargo zigbuild --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
+
+      - name: Build (cargo)
+        if: '!matrix.use_zigbuild'
+        run: cargo build --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
+
+      - name: Package (.tar.gz + .sha256)
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p dist
+          src="cli/target/${{ matrix.target }}/release/agent-browser${{ matrix.ext }}"
+          # The binary inside every archive is named `agent-browser` (or .exe);
+          # install.sh extracts that fixed name regardless of platform.
+          cp "$src" "dist/agent-browser${{ matrix.ext }}"
+          chmod +x "dist/agent-browser${{ matrix.ext }}" || true
+          ( cd dist
+            tar czf "${{ matrix.asset }}.tar.gz" "agent-browser${{ matrix.ext }}"
+            if command -v sha256sum >/dev/null 2>&1; then
+              sha256sum "${{ matrix.asset }}.tar.gz" > "${{ matrix.asset }}.tar.gz.sha256"
+            else
+              shasum -a 256 "${{ matrix.asset }}.tar.gz" > "${{ matrix.asset }}.tar.gz.sha256"
+            fi
+          )
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.asset }}
+          path: dist/${{ matrix.asset }}.tar.gz*
+          retention-days: 3
+
+  release:
+    name: Attach binaries to GitHub Release
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: List assets
+        run: ls -la dist
+
+      - name: Attach to release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.event.inputs.tag || github.ref_name }}
+          files: |
+            dist/*.tar.gz
+            dist/*.tar.gz.sha256
+          fail_on_unmatched_files: true
+          # keep existing release notes if the release was created beforehand
+          append_body: false
@@ -1,331 +0,0 @@
-name: Release
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-concurrency: ${{ github.workflow }}-${{ github.ref }}
-
-permissions:
-  contents: read
-
-jobs:
-  check-release:
-    name: Check for new version
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    outputs:
-      should_release: ${{ steps.check.outputs.should_release }}
-      needs_github_release: ${{ steps.check.outputs.needs_github_release }}
-      version: ${{ steps.check.outputs.version }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Compare package.json version to npm and check GitHub release
-        id: check
-        run: |
-          LOCAL_VERSION=$(node -p "require('./package.json').version")
-          echo "Local version: $LOCAL_VERSION"
-
-          NPM_VERSION=$(npm view agent-browser version 2>/dev/null || echo "0.0.0")
-          echo "npm version: $NPM_VERSION"
-
-          if [ "$LOCAL_VERSION" != "$NPM_VERSION" ]; then
-            echo "Version changed: $NPM_VERSION -> $LOCAL_VERSION"
-            echo "should_release=true" >> "$GITHUB_OUTPUT"
-            echo "needs_github_release=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "Version unchanged on npm, skipping build and publish"
-            echo "should_release=false" >> "$GITHUB_OUTPUT"
-
-            # Check if GitHub release exists; it may be missing if a prior run
-            # published to npm but failed before creating the release.
-            TAG="v$LOCAL_VERSION"
-            if gh release view "$TAG" &>/dev/null; then
-              echo "GitHub release $TAG exists"
-              echo "needs_github_release=false" >> "$GITHUB_OUTPUT"
-            else
-              echo "GitHub release $TAG is missing, will rebuild and create it"
-              echo "needs_github_release=true" >> "$GITHUB_OUTPUT"
-            fi
-          fi
-          echo "version=$LOCAL_VERSION" >> "$GITHUB_OUTPUT"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  build-binaries:
-    name: Build ${{ matrix.name }}
-    needs: check-release
-    if: needs.check-release.outputs.should_release == 'true' || needs.check-release.outputs.needs_github_release == 'true'
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - name: Linux x64
-            os: ubuntu-latest
-            target: x86_64-unknown-linux-gnu
-            binary: agent-browser-linux-x64
-            use_zigbuild: true
-          - name: Linux ARM64
-            os: ubuntu-latest
-            target: aarch64-unknown-linux-gnu
-            binary: agent-browser-linux-arm64
-            use_zigbuild: true
-          - name: Linux musl x64
-            os: ubuntu-latest
-            target: x86_64-unknown-linux-musl
-            binary: agent-browser-linux-musl-x64
-            use_zigbuild: true
-          - name: Linux musl ARM64
-            os: ubuntu-latest
-            target: aarch64-unknown-linux-musl
-            binary: agent-browser-linux-musl-arm64
-            use_zigbuild: true
-          - name: Windows x64
-            os: ubuntu-latest
-            target: x86_64-pc-windows-gnu
-            binary: agent-browser-win32-x64.exe
-            use_zigbuild: false
-          - name: macOS x64
-            os: macos-latest
-            target: x86_64-apple-darwin
-            binary: agent-browser-darwin-x64
-            use_zigbuild: false
-          - name: macOS ARM64
-            os: macos-latest
-            target: aarch64-apple-darwin
-            binary: agent-browser-darwin-arm64
-            use_zigbuild: false
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-          cache: pnpm
-
-      - name: Install npm dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Sync version
-        run: pnpm run version:sync
-
-      - name: Build dashboard
-        run: pnpm --filter dashboard build
-
-      - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: ${{ matrix.target }}
-
-      - name: Install cross-compilation tools (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y gcc-aarch64-linux-gnu gcc-x86-64-linux-gnu mingw-w64
-
-      - name: Install cargo-zigbuild
-        if: matrix.use_zigbuild
-        run: |
-          pip3 install ziglang
-          cargo install cargo-zigbuild
-
-      - name: Configure Rust linkers
-        if: runner.os == 'Linux'
-        run: |
-          mkdir -p ~/.cargo
-          cat >> ~/.cargo/config.toml << 'EOF'
-          [target.aarch64-unknown-linux-gnu]
-          linker = "aarch64-linux-gnu-gcc"
-
-          [target.x86_64-pc-windows-gnu]
-          linker = "x86_64-w64-mingw32-gcc"
-          EOF
-
-      - name: Cache Rust build artifacts
-        uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: cli
-
-      - name: Build with zigbuild
-        if: matrix.use_zigbuild
-        run: cargo zigbuild --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
-
-      - name: Build with cargo
-        if: '!matrix.use_zigbuild'
-        run: cargo build --release --manifest-path cli/Cargo.toml --target ${{ matrix.target }}
-
-      - name: Copy binary
-        run: |
-          mkdir -p artifacts
-          if [[ "${{ matrix.target }}" == *"windows"* ]]; then
-            cp cli/target/${{ matrix.target }}/release/agent-browser.exe artifacts/${{ matrix.binary }}
-          else
-            cp cli/target/${{ matrix.target }}/release/agent-browser artifacts/${{ matrix.binary }}
-            chmod +x artifacts/${{ matrix.binary }}
-          fi
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.binary }}
-          path: artifacts/${{ matrix.binary }}
-          retention-days: 7
-
-  publish:
-    name: Publish to npm
-    needs: [check-release, build-binaries]
-    if: needs.check-release.outputs.should_release == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    environment: Release
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '24'
-          cache: pnpm
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Download all binary artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts/
-
-      - name: Move binaries to bin directory
-        run: |
-          mkdir -p bin
-          find artifacts -type f -name 'agent-browser-*' -exec mv {} bin/ \;
-          rm -rf artifacts
-          chmod +x bin/agent-browser-* 2>/dev/null || true
-          echo "Binaries in bin/:"
-          ls -la bin/
-
-      - name: Verify all binaries exist
-        run: |
-          EXPECTED_BINARIES=(
-            "agent-browser-linux-x64"
-            "agent-browser-linux-arm64"
-            "agent-browser-linux-musl-x64"
-            "agent-browser-linux-musl-arm64"
-            "agent-browser-win32-x64.exe"
-            "agent-browser-darwin-x64"
-            "agent-browser-darwin-arm64"
-          )
-          MIN_SIZE=100000
-          ERRORS=0
-          for binary in "${EXPECTED_BINARIES[@]}"; do
-            if [ ! -f "bin/$binary" ]; then
-              echo "ERROR: Missing bin/$binary"
-              ERRORS=$((ERRORS + 1))
-            else
-              SIZE=$(stat -c%s "bin/$binary" 2>/dev/null || stat -f%z "bin/$binary")
-              if [ "$SIZE" -lt "$MIN_SIZE" ]; then
-                echo "ERROR: bin/$binary is too small ($SIZE bytes, expected >= $MIN_SIZE)"
-                ERRORS=$((ERRORS + 1))
-              else
-                echo "OK: bin/$binary ($SIZE bytes)"
-              fi
-            fi
-          done
-          if [ "$ERRORS" -gt 0 ]; then
-            echo "Error: $ERRORS binary issues found"
-            exit 1
-          fi
-          echo "All 7 platform binaries present and valid"
-
-      - name: Publish to npm
-        run: npm publish --provenance
-
-  github-release:
-    name: Create GitHub Release
-    needs: [check-release, build-binaries, publish]
-    if: always() && needs.build-binaries.result == 'success' && needs.check-release.outputs.needs_github_release == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: artifacts/
-
-      - name: Move binaries to bin directory
-        run: |
-          mkdir -p bin
-          find artifacts -type f -name 'agent-browser-*' -exec mv {} bin/ \;
-          rm -rf artifacts
-          chmod +x bin/agent-browser-* 2>/dev/null || true
-          ls -la bin/
-
-      - name: Verify binaries exist
-        run: |
-          BINARY_COUNT=$(ls bin/agent-browser-* 2>/dev/null | wc -l)
-          if [ "$BINARY_COUNT" -lt 7 ]; then
-            echo "Error: Expected 7 binaries, found $BINARY_COUNT"
-            ls -la bin/
-            exit 1
-          fi
-          echo "Found $BINARY_COUNT binaries"
-
-      - name: Extract changelog entry
-        run: |
-          VERSION="${{ needs.check-release.outputs.version }}"
-          awk '/<!-- release:start -->/{found=1; next} /<!-- release:end -->/{found=0} found{print}' CHANGELOG.md > /tmp/release-notes.md
-
-          LINES=$(wc -l < /tmp/release-notes.md | tr -d ' ')
-          if [ "$LINES" -lt 2 ]; then
-            echo "Error: No release notes found between <!-- release:start --> and <!-- release:end --> markers in CHANGELOG.md"
-            exit 1
-          fi
-          echo "Extracted release notes for $VERSION ($LINES lines)"
-
-      - name: Create GitHub Release
-        run: |
-          VERSION="${{ needs.check-release.outputs.version }}"
-          TAG="v$VERSION"
-
-          if gh release view "$TAG" &>/dev/null; then
-            echo "Release $TAG already exists, uploading assets..."
-            gh release upload "$TAG" bin/agent-browser-* --clobber
-          else
-            echo "Creating release $TAG..."
-            gh release create "$TAG" \
-              --title "$TAG" \
-              --notes-file /tmp/release-notes.md \
-              bin/agent-browser-*
-          fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -0,0 +1 @@
+24
@@ -21,9 +21,20 @@ For basic usage, commands, and API reference, see the [upstream documentation](h
 ## Install

 ```bash
-npm install -g agent-browser-stealth
+curl -fsSL https://raw.githubusercontent.com/leeguooooo/agent-browser-stealth/main/install.sh | sh
 ```

+Downloads the prebuilt binary for your platform from the latest [GitHub Release](https://github.com/leeguooooo/agent-browser-stealth/releases) and installs `agent-browser` (+ the `abs` alias). No npm, no tokens.
+
+<details>
+<summary>Other ways to install</summary>
+
+- **Pin a version:** `AGENT_BROWSER_VERSION=v0.27.0-fork.12 curl -fsSL https://raw.githubusercontent.com/leeguooooo/agent-browser-stealth/main/install.sh | sh`
+- **Custom location:** `AGENT_BROWSER_BIN_DIR=$HOME/bin curl -fsSL … | sh`
+- **Windows:** download `agent-browser-win32-x64.tar.gz` from the [Releases page](https://github.com/leeguooooo/agent-browser-stealth/releases) and put `agent-browser.exe` on your PATH.
+- **npm (legacy):** `npm install -g agent-browser-stealth` — still published, but GitHub Releases is the primary channel now.
+</details>
+
 ### Install the AI agent skills

 The repo ships SKILL.md files for Claude Code, Cursor, etc. Pull them into the current project with [skills.sh](https://skills.sh):
@@ -34,14 +45,39 @@ npx skills add leeguooooo/agent-browser-stealth

 This drops `skills/agent-browser` (and the specialized `skill-data/{core,electron,slack,dogfood,agentcore,vercel-sandbox}`) into your project so your AI agent gets the right usage patterns and pre-approved bash permissions for `agent-browser`, `agent-browser-stealth`, and `abs`.

-## Setup (one time)
+## Command names

-Enable Chrome DevTools Protocol in your Chrome:
+`agent-browser`, `agent-browser-stealth`, and `abs` are **the same binary** —
+`abs` is just a short alias. There is no separate "stealth executable"; stealth
+is a runtime behavior (see [Anti-detection](#anti-detection) below), applied
+automatically based on whether you attach to your real Chrome or `--launch` a
+fresh one.

-1. Open `chrome://inspect/#remote-debugging` in Chrome
-2. Toggle the switch on
+## Setup: connect to your Chrome

-That's it. This setting persists across Chrome restarts.
+Attaching uses the Chrome DevTools Protocol, which Chrome only exposes when it is
+**launched with a remote-debugging port**. This is a startup flag, not a setting
+— the `chrome://inspect` toggle alone is **not** enough (it only enables target
+discovery, not the CDP attach).
+
+**Recommended — fully quit Chrome, then relaunch with the port:**
+
+```bash
+# macOS
+open -a "Google Chrome" --args --remote-debugging-port=9222
+# Linux
+google-chrome --remote-debugging-port=9222
+# Windows: add --remote-debugging-port=9222 to your Chrome shortcut's target
+```
+
+Then run `agent-browser open <url>` — it auto-discovers the port and attaches.
+On first attach, **Chrome 136+ shows an "Allow remote debugging?" dialog — click
+Allow once** (it persists for that Chrome session).
+
+**No setup / don't want to touch your real Chrome?** Use
+`agent-browser --launch open <url>` to spawn a fresh isolated stealth browser
+(full anti-detection patches applied; see below). This always works without any
+port setup and is what CI uses automatically.

 ## Usage

@@ -57,14 +93,24 @@ agent-browser screenshot ./page.png

 The agent operates in your Chrome — you'll see tabs opening, pages loading, clicks happening in real time. You can take over at any point (e.g. solve a CAPTCHA), then let the agent continue.

-### Standalone mode
+### Standalone mode (`--launch`)

-If you need a separate browser (CI, testing, etc.):
+Spawn a separate browser instead of attaching to your running Chrome:

 ```bash
+# Throwaway: fresh, EMPTY profile — no cookies, no login (good for CI/testing)
 agent-browser --launch open https://example.com
+
+# Keep your login: launch with your real Chrome profile (cookies/sessions intact)
+agent-browser --launch --profile auto open https://x.com/home
+# or name it explicitly: --profile Default / --profile "Profile 1"
 ```

+> ⚠️ Plain `--launch` (no `--profile`) uses a **temporary empty profile** — you will
+> NOT be logged into anything. For logged-in sites use `--profile auto` (picks the
+> Chrome profile you used most recently) or `--profile <name>`. agent-browser prints
+> a warning when you `--launch` without a profile.
+
 In CI environments, standalone mode is used automatically.

 ## Anti-detection
@@ -45,7 +45,7 @@ dependencies = [

 [[package]]
 name = "agent-browser-stealth"
-version = "0.27.0-fork.8"
+version = "0.27.0-fork.13"
 dependencies = [
 "aes-gcm",
 "async-trait",
@@ -57,6 +57,7 @@ dependencies = [
 "hex",
 "hmac",
 "image",
+ "include_dir",
 "libc",
 "regex-lite",
 "reqwest",
@@ -1048,6 +1049,25 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c5cedc30da3a610cac6b4ba17597bdf7152cf974e8aab3afb3d54455e371c8"

+[[package]]
+name = "include_dir"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "923d117408f1e49d914f1a379a309cffe4f18c05cf4e3d12e613a15fc81bd0dd"
+dependencies = [
+ "include_dir_macros",
+]
+
+[[package]]
+name = "include_dir_macros"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cab85a7ed0bd5f0e76d93846e0147172bed2e2d3f859bcc33a8d9699cad1a75"
+dependencies = [
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.13.0"
@@ -1,6 +1,6 @@
 [package]
 name = "agent-browser-stealth"
-version = "0.27.0-fork.8"
+version = "0.27.0-fork.13"
 edition = "2021"
 description = "Fast browser automation CLI for AI agents"
 license = "Apache-2.0"
@@ -19,6 +19,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 regex-lite = "0.1"
 dirs = "5.0"
+include_dir = "0.7"
 base64 = "0.22"
 getrandom = "0.2"
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "io-util", "time", "sync", "signal", "process"] }
@@ -1066,6 +1066,18 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
        // === Get ===
        "get" => parse_get(&rest, &id),

+        // Top-level shortcuts for `get <x>` status reads — users naturally type
+        // `agent-browser url` / `cdp-url` / `title` without the `get` prefix
+        // (and expect `cdp-url`/`cdp_url` to work interchangeably).
+        "url" | "cdp-url" | "cdp_url" | "title" | "html" | "text" | "value"
+        | "count" | "box" | "styles" | "attr" => {
+            let sub = if cmd == "cdp_url" { "cdp-url" } else { cmd };
+            let mut get_args: Vec<&str> = Vec::with_capacity(rest.len() + 1);
+            get_args.push(sub);
+            get_args.extend_from_slice(&rest);
+            parse_get(&get_args, &id)
+        }
+
        // === Is (state checks) ===
        "is" => parse_is(&rest, &id),

@@ -2751,6 +2763,7 @@ mod tests {
            provider: None,
            ignore_https_errors: false,
            allow_file_access: false,
+            hide_scrollbars: true,
            device: None,
            auto_connect: false,
            force_launch: false,
@@ -2766,6 +2779,7 @@ mod tests {
            cli_proxy: false,
            cli_proxy_bypass: false,
            cli_allow_file_access: false,
+            cli_hide_scrollbars: false,
            cli_annotate: false,
            cli_download_path: false,
            cli_headed: false,
@@ -412,6 +412,7 @@ pub struct DaemonOptions<'a> {
    pub proxy_password: Option<&'a str>,
    pub ignore_https_errors: bool,
    pub allow_file_access: bool,
+    pub hide_scrollbars: bool,
    pub profile: Option<&'a str>,
    pub state: Option<&'a str>,
    pub provider: Option<&'a str>,
@@ -476,6 +477,10 @@ fn apply_daemon_env(cmd: &mut Command, session: &str, opts: &DaemonOptions) {
    if opts.allow_file_access {
        cmd.env("AGENT_BROWSER_ALLOW_FILE_ACCESS", "1");
    }
+    cmd.env(
+        "AGENT_BROWSER_HIDE_SCROLLBARS",
+        if opts.hide_scrollbars { "1" } else { "0" },
+    );
    if let Some(prof) = opts.profile {
        cmd.env("AGENT_BROWSER_PROFILE", prof);
    }
@@ -65,6 +65,7 @@ pub(super) fn check(checks: &mut Vec<Check>) {
        proxy_password: None,
        ignore_https_errors: false,
        allow_file_access: false,
+        hide_scrollbars: true,
        profile: None,
        state: None,
        provider: None,
@@ -70,6 +70,7 @@ pub struct Config {
    pub user_agent: Option<String>,
    pub provider: Option<String>,
    pub device: Option<String>,
+    pub hide_scrollbars: Option<bool>,
    pub ignore_https_errors: Option<bool>,
    pub allow_file_access: Option<bool>,
    pub cdp: Option<String>,
@@ -131,6 +132,7 @@ impl Config {
            user_agent: other.user_agent.or(self.user_agent),
            provider: other.provider.or(self.provider),
            device: other.device.or(self.device),
+            hide_scrollbars: other.hide_scrollbars.or(self.hide_scrollbars),
            ignore_https_errors: other.ignore_https_errors.or(self.ignore_https_errors),
            allow_file_access: other.allow_file_access.or(self.allow_file_access),
            cdp: other.cdp.or(self.cdp),
@@ -187,6 +189,12 @@ fn env_var_is_truthy(name: &str) -> bool {
    }
 }

+fn env_var_bool(name: &str) -> Option<bool> {
+    env::var(name)
+        .ok()
+        .map(|val| !matches!(val.to_lowercase().as_str(), "0" | "false" | "no" | ""))
+}
+
 /// Parse an optional boolean value after a flag. Returns (value, consumed_next_arg).
 /// Recognizes "true" as true, "false" as false. Bare flag defaults to true.
 fn parse_bool_arg(args: &[String], i: usize) -> (bool, bool) {
@@ -306,6 +314,7 @@ pub struct Flags {
    pub provider: Option<String>,
    pub ignore_https_errors: bool,
    pub allow_file_access: bool,
+    pub hide_scrollbars: bool,
    pub device: Option<String>,
    pub auto_connect: bool,
    pub force_launch: bool,
@@ -343,6 +352,7 @@ pub struct Flags {
    pub cli_proxy: bool,
    pub cli_proxy_bypass: bool,
    pub cli_allow_file_access: bool,
+    pub cli_hide_scrollbars: bool,
    pub cli_annotate: bool,
    pub cli_download_path: bool,
    pub cli_headed: bool,
@@ -443,6 +453,9 @@ pub fn parse_flags(args: &[String]) -> Flags {
            || config.ignore_https_errors.unwrap_or(false),
        allow_file_access: env_var_is_truthy("AGENT_BROWSER_ALLOW_FILE_ACCESS")
            || config.allow_file_access.unwrap_or(false),
+        hide_scrollbars: env_var_bool("AGENT_BROWSER_HIDE_SCROLLBARS")
+            .or(config.hide_scrollbars)
+            .unwrap_or(true),
        device: env::var("AGENT_BROWSER_IOS_DEVICE").ok().or(config.device),
        auto_connect: !env_var_is_truthy("AGENT_BROWSER_NO_AUTO_CONNECT")
            && (env_var_is_truthy("AGENT_BROWSER_AUTO_CONNECT")
@@ -518,6 +531,7 @@ pub fn parse_flags(args: &[String]) -> Flags {
        cli_proxy: false,
        cli_proxy_bypass: false,
        cli_allow_file_access: false,
+        cli_hide_scrollbars: false,
        cli_annotate: false,
        cli_download_path: false,
        cli_headed: false,
@@ -677,6 +691,14 @@ pub fn parse_flags(args: &[String]) -> Flags {
                    i += 1;
                }
            }
+            "--hide-scrollbars" => {
+                let (val, consumed) = parse_bool_arg(args, i);
+                flags.hide_scrollbars = val;
+                flags.cli_hide_scrollbars = true;
+                if consumed {
+                    i += 1;
+                }
+            }
            "--device" => {
                if let Some(d) = args.get(i + 1) {
                    flags.device = Some(d.clone());
@@ -852,6 +874,7 @@ pub fn clean_args(args: &[String]) -> Vec<String> {
        "--debug",
        "--ignore-https-errors",
        "--allow-file-access",
+        "--hide-scrollbars",
        "--auto-connect",
        "--launch",
        "--new",
@@ -933,6 +956,7 @@ pub fn clean_args(args: &[String]) -> Vec<String> {
 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::test_utils::EnvGuard;

    fn args(s: &str) -> Vec<String> {
        s.split_whitespace().map(String::from).collect()
@@ -1176,6 +1200,7 @@ mod tests {
            "userAgent": "test-agent",
            "provider": "ios",
            "device": "iPhone 15",
+            "hideScrollbars": false,
            "ignoreHttpsErrors": true,
            "allowFileAccess": true,
            "cdp": "9222",
@@ -1201,6 +1226,7 @@ mod tests {
        assert_eq!(config.user_agent.as_deref(), Some("test-agent"));
        assert_eq!(config.provider.as_deref(), Some("ios"));
        assert_eq!(config.device.as_deref(), Some("iPhone 15"));
+        assert_eq!(config.hide_scrollbars, Some(false));
        assert_eq!(config.ignore_https_errors, Some(true));
        assert_eq!(config.allow_file_access, Some(true));
        assert_eq!(config.cdp.as_deref(), Some("9222"));
@@ -1454,6 +1480,33 @@ mod tests {
        assert!(flags.cli_allow_file_access);
    }

+    #[test]
+    fn test_hide_scrollbars_default_true() {
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.remove("AGENT_BROWSER_HIDE_SCROLLBARS");
+        let flags = parse_flags(&args("open example.com"));
+        assert!(flags.hide_scrollbars);
+        assert!(!flags.cli_hide_scrollbars);
+    }
+
+    #[test]
+    fn test_hide_scrollbars_false() {
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.remove("AGENT_BROWSER_HIDE_SCROLLBARS");
+        let flags = parse_flags(&args("--hide-scrollbars false open"));
+        assert!(!flags.hide_scrollbars);
+        assert!(flags.cli_hide_scrollbars);
+    }
+
+    #[test]
+    fn test_hide_scrollbars_bare_defaults_true() {
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.remove("AGENT_BROWSER_HIDE_SCROLLBARS");
+        let flags = parse_flags(&args("--hide-scrollbars open"));
+        assert!(flags.hide_scrollbars);
+        assert!(flags.cli_hide_scrollbars);
+    }
+
    #[test]
    fn test_auto_connect_false() {
        let flags = parse_flags(&args("--auto-connect false open"));
@@ -1462,7 +1515,9 @@ mod tests {

    #[test]
    fn test_clean_args_removes_bool_flag_with_value() {
-        let cleaned = clean_args(&args("--headed false --debug true open example.com"));
+        let cleaned = clean_args(&args(
+            "--headed false --debug true --hide-scrollbars false open example.com",
+        ));
        assert_eq!(cleaned, vec!["open", "example.com"]);
    }

@@ -60,6 +60,23 @@ fn print_json_error_with_type(message: impl AsRef<str>, error_type: &str) {
    }));
 }

+fn should_send_hide_scrollbars_launch_option(
+    cli_hide_scrollbars: bool,
+    hide_scrollbars: bool,
+) -> bool {
+    cli_hide_scrollbars || !hide_scrollbars
+}
+
+fn apply_hide_scrollbars_launch_option(
+    launch_cmd: &mut serde_json::Value,
+    cli_hide_scrollbars: bool,
+    hide_scrollbars: bool,
+) {
+    if should_send_hide_scrollbars_launch_option(cli_hide_scrollbars, hide_scrollbars) {
+        launch_cmd["hideScrollbars"] = json!(hide_scrollbars);
+    }
+}
+
 struct ParsedProxy {
    server: String,
    username: Option<String>,
@@ -514,6 +531,18 @@ fn main() {
    let mut flags = parse_flags(&args);
    let clean = clean_args(&args);

+    // Loudly warn when launching a fresh browser with no profile: it gets a
+    // temporary EMPTY profile (no cookies / no login). For logged-in sites the
+    // user almost always wants --profile auto (their real Chrome profile).
+    // Skipped under CI (force_launch is implicit there and login isn't expected).
+    if flags.force_launch && flags.profile.is_none() && env::var("CI").is_err() {
+        eprintln!(
+            "⚠ --launch uses a temporary EMPTY browser profile (no cookies, no login). \
+             For logged-in sites, add `--profile auto` (or `--profile Default`) to reuse \
+             your real Chrome session."
+        );
+    }
+
    let has_help = args.iter().any(|a| a == "--help" || a == "-h");
    let has_version = args.iter().any(|a| a == "--version" || a == "-V");

@@ -741,6 +770,7 @@ fn main() {
        proxy_password: proxy_password.as_deref(),
        ignore_https_errors: flags.ignore_https_errors,
        allow_file_access: flags.allow_file_access,
+        hide_scrollbars: flags.hide_scrollbars,
        profile: flags.profile.as_deref(),
        state: flags.state.as_deref(),
        provider: flags.provider.as_deref(),
@@ -814,6 +844,7 @@ fn main() {
            },
            flags.ignore_https_errors.then_some("--ignore-https-errors"),
            flags.cli_allow_file_access.then_some("--allow-file-access"),
+            flags.cli_hide_scrollbars.then_some("--hide-scrollbars"),
            flags.cli_download_path.then_some("--download-path"),
            flags.cli_headed.then_some("--headed"),
        ]
@@ -1062,6 +1093,10 @@ fn main() {
        || flags.args.is_some()
        || flags.user_agent.is_some()
        || flags.allow_file_access
+        || should_send_hide_scrollbars_launch_option(
+            flags.cli_hide_scrollbars,
+            flags.hide_scrollbars,
+        )
        || flags.color_scheme.is_some()
        || flags.download_path.is_some()
        || flags.engine.is_some()
@@ -1136,6 +1171,12 @@ fn main() {
            launch_cmd["allowFileAccess"] = json!(true);
        }

+        apply_hide_scrollbars_launch_option(
+            &mut launch_cmd,
+            flags.cli_hide_scrollbars,
+            flags.hide_scrollbars,
+        );
+
        if let Some(ref cs) = flags.color_scheme {
            launch_cmd["colorScheme"] = json!(cs);
        }
@@ -1488,4 +1529,23 @@ mod tests {
            "Daemon process exited during startup:\nline \"quoted\"\u{001b}[2mansi\u{001b}[22m"
        );
    }
+
+    #[test]
+    fn test_hide_scrollbars_launch_option_serialization() {
+        assert!(!should_send_hide_scrollbars_launch_option(false, true));
+        assert!(should_send_hide_scrollbars_launch_option(false, false));
+        assert!(should_send_hide_scrollbars_launch_option(true, true));
+
+        let mut default_cmd = json!({ "action": "launch" });
+        apply_hide_scrollbars_launch_option(&mut default_cmd, false, true);
+        assert!(default_cmd.get("hideScrollbars").is_none());
+
+        let mut config_false_cmd = json!({ "action": "launch" });
+        apply_hide_scrollbars_launch_option(&mut config_false_cmd, false, false);
+        assert_eq!(config_false_cmd["hideScrollbars"], false);
+
+        let mut cli_true_cmd = json!({ "action": "launch" });
+        apply_hide_scrollbars_launch_option(&mut cli_true_cmd, true, true);
+        assert_eq!(cli_true_cmd["hideScrollbars"], true);
+    }
 }
@@ -197,6 +197,7 @@ fn launch_hash(opts: &LaunchOptions) -> u64 {
    opts.proxy_password.hash(&mut h);
    opts.user_agent.hash(&mut h);
    opts.allow_file_access.hash(&mut h);
+    opts.hide_scrollbars.hash(&mut h);
    h.finish()
 }

@@ -632,6 +633,8 @@ impl DaemonState {
                        .send_command_no_params("Network.enable", Some(iframe_sid.as_str()))
                        .await;
                }
+                // Hide automation markers in this cross-origin iframe session too.
+                apply_stealth_via_mgr(mgr, iframe_sid.as_str()).await;
            }
        }
        for sid in &drained.detached_iframe_sessions {
@@ -1604,11 +1607,17 @@ async fn auto_launch(state: &mut DaemonState) -> Result<(), String> {
                // Return a helpful error guiding the user to enable it.
                return Err(format!(
                    "Could not connect to your Chrome browser.\n\n\
-                     To let agent-browser work with your existing Chrome (recommended):\n\
+                     If Chrome showed an \"Allow remote debugging?\" dialog, click \
+                     Allow and re-run — that consent is what lets agent-browser attach.\n\n\
+                     Otherwise, to let agent-browser reuse your logged-in Chrome (recommended):\n\
                     {}\n\n\
-                     Or start a standalone browser with: agent-browser --launch open <url>\n\n\
-                     Note: chrome://inspect/#remote-debugging only enables remote *target discovery* — \
-                     it does NOT expose the standard CDP HTTP API on /json/version. \
+                     Or launch a separate browser that KEEPS your login state:\n  \
+                     agent-browser --launch --profile auto open <url>\n\
+                     (plain `--launch` alone uses a temporary EMPTY profile — no cookies, \
+                     no logged-in sessions.)\n\n\
+                     Note: remote debugging is a startup flag, not a Chrome setting — \
+                     chrome://inspect/#remote-debugging only enables target discovery and \
+                     does NOT expose the CDP HTTP API on /json/version. \
                     A full restart with --remote-debugging-port=<port> is required.",
                    chrome_relaunch_hint(),
                ));
@@ -1757,45 +1766,62 @@ fn chrome_relaunch_hint() -> &'static str {
 /// Called after every successful launch / CDP connect / auto-connect.
 /// Uses `CdpAttach` mode for external connections (minimal patches) and
 /// `FullLaunch` mode for newly launched Chrome (all patches).
-async fn apply_stealth_to_browser(state: &DaemonState) {
-    if env::var("AGENT_BROWSER_STEALTH").map(|v| v == "0").unwrap_or(false) {
-        return; // Explicitly disabled
-    }
-    let Some(ref mgr) = state.browser else {
-        return;
-    };
-    let Ok(session_id) = mgr.active_session_id() else {
-        return;
-    };
+/// Whether stealth is enabled (default on; `AGENT_BROWSER_STEALTH=0` disables).
+fn stealth_enabled() -> bool {
+    !env::var("AGENT_BROWSER_STEALTH")
+        .map(|v| v == "0")
+        .unwrap_or(false)
+}

-    // Determine mode: if we attached to an external browser, use minimal patches.
-    // The user's real Chrome already has a genuine fingerprint — heavy patches
-    // would create detectable "lies" (e.g. creepjs hasIframeProxy).
+/// Apply stealth patches to ONE CDP session of the given browser.
+///
+/// Stealth scripts are registered per-session via
+/// `Page.addScriptToEvaluateOnNewDocument`, so they do NOT carry over to new
+/// tabs or cross-origin iframe sessions created after the initial page. We must
+/// re-apply to every session the user can touch, otherwise automation markers
+/// (and, in FullLaunch mode, the HeadlessChrome UA) leak on those surfaces.
+async fn apply_stealth_via_mgr(mgr: &BrowserManager, session_id: &str) {
+    if !stealth_enabled() {
+        return;
+    }
+    // Determine mode: an external attach uses minimal patches (the user's real
+    // Chrome already has a genuine fingerprint — heavy patches create detectable
+    // "lies" like creepjs hasIframeProxy); a fresh launch uses the full set.
    let mode = if mgr.is_cdp_connection() {
        stealth::StealthMode::CdpAttach
    } else {
        stealth::StealthMode::FullLaunch
    };
-
    let locale = env::var("AGENT_BROWSER_LOCALE").ok();
-    if let Err(e) = stealth::apply_stealth(
-        &mgr.client,
-        session_id,
-        mode,
-        locale.as_deref(),
-    )
-    .await
-    {
-        eprintln!("[stealth] Failed to apply stealth patches: {}", e);
+    if let Err(e) = stealth::apply_stealth(&mgr.client, session_id, mode, locale.as_deref()).await {
+        eprintln!("[stealth] failed to apply patches to session {session_id}: {e}");
    }
-    // Also inject into the current page (already loaded before our init script)
+    // Also inject into the current page (already loaded before our init script).
    if let Err(e) =
-        stealth::apply_stealth_to_current_page(&mgr.client, session_id, mode, locale.as_deref()).await
+        stealth::apply_stealth_to_current_page(&mgr.client, session_id, mode, locale.as_deref())
+            .await
    {
-        eprintln!("[stealth] Failed to patch current page: {}", e);
+        eprintln!("[stealth] failed to patch current page for session {session_id}: {e}");
    }
 }

+/// Apply stealth to a specific session of the active browser (no-op if no
+/// browser or stealth disabled).
+async fn apply_stealth_to_session(state: &DaemonState, session_id: &str) {
+    if let Some(ref mgr) = state.browser {
+        apply_stealth_via_mgr(mgr, session_id).await;
+    }
+}
+
+/// Apply stealth to the active page session (initial connect/launch).
+async fn apply_stealth_to_browser(state: &DaemonState) {
+    let session_id = match state.browser.as_ref().and_then(|m| m.active_session_id().ok()) {
+        Some(sid) => sid.to_string(),
+        None => return,
+    };
+    apply_stealth_to_session(state, &session_id).await;
+}
+
 /// If the previous daemon left a `.restore-url` sidecar (because it was killed
 /// by a version-mismatch restart), navigate the freshly-connected browser to
 /// that URL so `agent-browser get url` after `npm i -g` upgrade still reports
@@ -1876,11 +1902,24 @@ fn launch_options_from_env() -> LaunchOptions {
            .unwrap_or(false),
        color_scheme: env::var("AGENT_BROWSER_COLOR_SCHEME").ok(),
        download_path: env::var("AGENT_BROWSER_DOWNLOAD_PATH").ok(),
+        hide_scrollbars: hide_scrollbars_from_env(),
        viewport_size: None,
        use_real_keychain: false,
    }
 }

+fn hide_scrollbars_from_env() -> bool {
+    env::var("AGENT_BROWSER_HIDE_SCROLLBARS")
+        .map(|v| !matches!(v.to_ascii_lowercase().as_str(), "0" | "false" | "no" | ""))
+        .unwrap_or(true)
+}
+
+fn hide_scrollbars_from_launch_cmd(cmd: &Value) -> bool {
+    cmd.get("hideScrollbars")
+        .and_then(|v| v.as_bool())
+        .unwrap_or_else(hide_scrollbars_from_env)
+}
+
 async fn try_auto_restore_state(state: &mut DaemonState) {
    let session_name = match state.session_name.as_deref() {
        Some(n) if !n.is_empty() => n.to_string(),
@@ -2044,6 +2083,7 @@ async fn handle_launch(cmd: &Value, state: &mut DaemonState) -> Result<Value, St
            .get("downloadPath")
            .and_then(|v| v.as_str())
            .map(String::from),
+        hide_scrollbars: hide_scrollbars_from_launch_cmd(cmd),
        viewport_size: None,
        use_real_keychain: false,
    };
@@ -2133,11 +2173,17 @@ async fn handle_launch(cmd: &Value, state: &mut DaemonState) -> Result<Value, St
            Err(_e) => {
                return Err(format!(
                    "Could not connect to your Chrome browser.\n\n\
-                     To let agent-browser work with your existing Chrome (recommended):\n\
+                     If Chrome showed an \"Allow remote debugging?\" dialog, click \
+                     Allow and re-run — that consent is what lets agent-browser attach.\n\n\
+                     Otherwise, to let agent-browser reuse your logged-in Chrome (recommended):\n\
                     {}\n\n\
-                     Or start a standalone browser with: agent-browser --launch open <url>\n\n\
-                     Note: chrome://inspect/#remote-debugging only enables remote *target discovery* — \
-                     it does NOT expose the standard CDP HTTP API on /json/version. \
+                     Or launch a separate browser that KEEPS your login state:\n  \
+                     agent-browser --launch --profile auto open <url>\n\
+                     (plain `--launch` alone uses a temporary EMPTY profile — no cookies, \
+                     no logged-in sessions.)\n\n\
+                     Note: remote debugging is a startup flag, not a Chrome setting — \
+                     chrome://inspect/#remote-debugging only enables target discovery and \
+                     does NOT expose the CDP HTTP API on /json/version. \
                     A full restart with --remote-debugging-port=<port> is required.",
                    chrome_relaunch_hint(),
                ));
@@ -2278,6 +2324,11 @@ async fn handle_launch(cmd: &Value, state: &mut DaemonState) -> Result<Value, St
    load_storage_state_or_rollback(state, &storage_state_owned).await?;

    apply_launch_init_scripts(state).await;
+    // Apply stealth patches (the 32 JS patches + HeadlessChrome UA strip in
+    // FullLaunch mode). The fresh-launch path was missing this — only the launch
+    // FLAGS (e.g. --disable-blink-features) were applied, so the JS patches never
+    // ran and navigator.userAgent kept the HeadlessChrome marker.
+    apply_stealth_to_browser(state).await;

    Ok(json!({ "launched": true }))
 }
@@ -3933,13 +3984,26 @@ async fn handle_tab_list(state: &DaemonState) -> Result<Value, String> {
 }

 async fn handle_tab_new(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
-    let mgr = state.browser.as_mut().ok_or("Browser not launched")?;
    let url = cmd.get("url").and_then(|v| v.as_str());
    let label = cmd.get("label").and_then(|v| v.as_str());
    state.ref_map.clear();
    state.iframe_sessions.clear();
    state.active_frame_id = None;
-    mgr.tab_new(url, label).await
+    let result = {
+        let mgr = state.browser.as_mut().ok_or("Browser not launched")?;
+        mgr.tab_new(url, label).await?
+    };
+    // A new tab is a new CDP session; stealth scripts registered on the prior
+    // session don't carry over, so patch the new tab too.
+    if let Some(sid) = state
+        .browser
+        .as_ref()
+        .and_then(|m| m.active_session_id().ok())
+        .map(|s| s.to_string())
+    {
+        apply_stealth_to_session(state, &sid).await;
+    }
+    Ok(result)
 }

 async fn handle_tab_switch(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
@@ -8646,17 +8710,21 @@ mod tests {

    #[test]
    fn test_launch_options_from_env_defaults() {
-        let _guard = EnvGuard::new(&["AGENT_BROWSER_HEADED"]);
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HEADED", "AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.remove("AGENT_BROWSER_HEADED");
+        guard.remove("AGENT_BROWSER_HIDE_SCROLLBARS");
        let opts = launch_options_from_env();
        assert!(opts.headless);
        assert!(opts.args.is_empty());
        assert!(!opts.allow_file_access);
+        assert!(opts.hide_scrollbars);
    }

    #[test]
    fn test_launch_options_from_env_headed_flag() {
-        let _guard = EnvGuard::new(&["AGENT_BROWSER_HEADED"]);
-        _guard.set("AGENT_BROWSER_HEADED", "1");
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HEADED", "AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.set("AGENT_BROWSER_HEADED", "1");
+        guard.remove("AGENT_BROWSER_HIDE_SCROLLBARS");
        let opts = launch_options_from_env();
        assert!(
            !opts.headless,
@@ -8664,6 +8732,35 @@ mod tests {
        );
    }

+    #[test]
+    fn test_launch_options_from_env_hide_scrollbars_false() {
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.set("AGENT_BROWSER_HIDE_SCROLLBARS", "false");
+        let opts = launch_options_from_env();
+        assert!(!opts.hide_scrollbars);
+    }
+
+    #[test]
+    fn test_launch_cmd_hide_scrollbars_missing_uses_env_default() {
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.set("AGENT_BROWSER_HIDE_SCROLLBARS", "false");
+
+        assert!(!hide_scrollbars_from_launch_cmd(&json!({
+            "action": "launch"
+        })));
+    }
+
+    #[test]
+    fn test_launch_cmd_hide_scrollbars_explicit_overrides_env_default() {
+        let guard = EnvGuard::new(&["AGENT_BROWSER_HIDE_SCROLLBARS"]);
+        guard.set("AGENT_BROWSER_HIDE_SCROLLBARS", "false");
+
+        assert!(hide_scrollbars_from_launch_cmd(&json!({
+            "action": "launch",
+            "hideScrollbars": true
+        })));
+    }
+
    #[test]
    fn test_har_entry_to_json_enriches_request_and_response() {
        // wall_time: 2026-03-15T12:00:00Z = 1_773_576_000
@@ -311,6 +311,42 @@ const LIGHTPANDA_CDP_CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
 const LIGHTPANDA_CDP_CONNECT_POLL_INTERVAL: Duration = Duration::from_millis(100);
 const LIGHTPANDA_TARGET_INIT_TIMEOUT: Duration = Duration::from_secs(10);

+/// Outcome of a single `Browser.getVersion` liveness probe.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum LivenessProbe {
+    /// Chrome answered — the connection is definitely alive.
+    Responded,
+    /// The CDP transport errored (WebSocket closed/reset) — the socket is gone.
+    TransportError,
+    /// The probe timed out with no response.
+    TimedOut,
+}
+
+/// Decide whether a CDP connection should be considered alive from one probe.
+///
+/// The subtle case is [`LivenessProbe::TimedOut`]. For a browser we launched
+/// ourselves (`is_external_attach == false`) a hung CDP socket is a real
+/// problem and the daemon should reconnect. But for an *externally attached*
+/// browser — the stealth fork's default, where we attach to the user's real
+/// Chrome — a slow/no response is almost always Chrome being briefly busy or,
+/// critically, showing the Chrome 136+ "Allow remote debugging?" consent modal,
+/// which blocks CDP responses until the user clicks Allow.
+///
+/// Treating that timeout as "dead" tears down the already-consented connection
+/// and forces a reconnect, which re-pops the consent prompt; repeated on every
+/// command it produces an endless prompt loop and a connection storm that can
+/// freeze Chrome. So for external attaches we keep the connection alive on
+/// timeout. A genuinely dead external socket instead surfaces as
+/// [`LivenessProbe::TransportError`] (and Chrome being closed by the user is a
+/// transport error, not a timeout), so zombie-socket detection is preserved.
+fn connection_alive_from_probe(probe: LivenessProbe, is_external_attach: bool) -> bool {
+    match probe {
+        LivenessProbe::Responded => true,
+        LivenessProbe::TransportError => false,
+        LivenessProbe::TimedOut => is_external_attach,
+    }
+}
+
 impl BrowserManager {
    pub async fn launch(options: LaunchOptions, engine: Option<&str>) -> Result<Self, String> {
        let engine = engine.unwrap_or("chrome");
@@ -829,21 +865,27 @@ impl BrowserManager {
        self.default_timeout_ms
    }

-    /// Checks if the CDP connection is alive by sending a simple command.
-    /// Returns false if the command times out or fails.
+    /// Checks if the CDP connection is alive by sending a `Browser.getVersion`
+    /// probe. See [`connection_alive_from_probe`] for how the outcome maps to a
+    /// liveness verdict — in particular why a timeout does NOT tear down an
+    /// externally-attached browser.
    pub async fn is_connection_alive(&self) -> bool {
        let timeout = tokio::time::Duration::from_secs(3);
-        let result = tokio::time::timeout(
+        let probe = match tokio::time::timeout(
            timeout,
            self.client
                .send_command_no_params("Browser.getVersion", None),
        )
-        .await;
-
-        match result {
-            Ok(Ok(_)) => true,
-            Ok(Err(_)) | Err(_) => false,
-        }
+        .await
+        {
+            Ok(Ok(_)) => LivenessProbe::Responded,
+            Ok(Err(_)) => LivenessProbe::TransportError,
+            Err(_) => LivenessProbe::TimedOut,
+        };
+        // No child process => we attached to an external browser (the user's
+        // real Chrome — the stealth fork's default).
+        let is_external_attach = self.browser_process.is_none();
+        connection_alive_from_probe(probe, is_external_attach)
    }

    /// Non-blocking check whether the locally-launched browser process has exited
@@ -1728,6 +1770,35 @@ mod tests {
        assert_eq!(format_tab_id(42), "t42");
    }

+    #[test]
+    fn liveness_responded_is_alive_for_both_kinds() {
+        assert!(connection_alive_from_probe(LivenessProbe::Responded, true));
+        assert!(connection_alive_from_probe(LivenessProbe::Responded, false));
+    }
+
+    #[test]
+    fn liveness_transport_error_is_dead_for_both_kinds() {
+        // A closed/reset WebSocket is a genuine death — reconnect in both cases.
+        assert!(!connection_alive_from_probe(LivenessProbe::TransportError, true));
+        assert!(!connection_alive_from_probe(LivenessProbe::TransportError, false));
+    }
+
+    #[test]
+    fn liveness_timeout_keeps_external_attach_alive() {
+        // Regression guard for the remote-debugging consent storm: a timed-out
+        // probe must NOT tear down an externally-attached browser, otherwise the
+        // daemon reconnects and re-pops Chrome's "Allow remote debugging?" modal
+        // on every command (endless prompts + browser freeze).
+        assert!(connection_alive_from_probe(LivenessProbe::TimedOut, true));
+    }
+
+    #[test]
+    fn liveness_timeout_marks_launched_browser_dead() {
+        // A browser we launched that stops responding is a real problem worth a
+        // reconnect (and has no consent modal to worry about).
+        assert!(!connection_alive_from_probe(LivenessProbe::TimedOut, false));
+    }
+
    #[test]
    fn test_parse_tab_ref_id() {
        assert_eq!(TabRef::parse("t1"), Ok(TabRef::Id(1)));
@@ -103,6 +103,9 @@ pub struct LaunchOptions {
    pub ignore_https_errors: bool,
    pub color_scheme: Option<String>,
    pub download_path: Option<String>,
+    /// Hide native scrollbars in headless Chromium screenshots by launching
+    /// Chrome with `--hide-scrollbars`.
+    pub hide_scrollbars: bool,
    /// Initial viewport dimensions used for `--window-size` so the content
    /// area matches the desired viewport from the start.
    pub viewport_size: Option<(u32, u32)>,
@@ -130,6 +133,7 @@ impl Default for LaunchOptions {
            ignore_https_errors: false,
            color_scheme: None,
            download_path: None,
+            hide_scrollbars: true,
            viewport_size: None,
            use_real_keychain: false,
        }
@@ -178,6 +182,13 @@ fn build_chrome_args(options: &LaunchOptions) -> Result<ChromeArgs, String> {
    // injected in headless mode).  Skip --headless when extensions are loaded.
    if options.headless && !has_extensions {
        args.push("--headless=new".to_string());
+        // Linux paints native scrollbars into viewport screenshots unless
+        // Chrome is launched with this flag. `--hide-scrollbars` is
+        // presence-based, so agent-browser exposes --hide-scrollbars false
+        // as the public opt-out instead of forwarding a fake inverse switch.
+        if options.hide_scrollbars {
+            args.push("--hide-scrollbars".to_string());
+        }
        // Enable SwiftShader software rendering in headless mode.  This
        // prevents silent crashes in environments where GPU drivers are
        // missing or restricted (VMs, containers, some cloud machines)
@@ -653,6 +664,62 @@ pub fn read_devtools_active_port(user_data_dir: &Path) -> Option<(u16, String)>
    Some((port, ws_path))
 }

+/// Remove leftover Chrome temp profile directories from daemons that were
+/// hard-killed. `ChromeProcess::drop` cleans these up on a normal exit, but a
+/// `kill -9` (version-mismatch restart, OOM, crash) skips Drop and leaks ~50MB
+/// per session under the system temp dir. On daemon startup we sweep them — but
+/// ONLY dirs that no running process still references as `--user-data-dir`, so
+/// a profile in active use is never deleted.
+pub fn cleanup_orphaned_chrome_profiles() {
+    let tmp = std::env::temp_dir();
+    let Ok(entries) = std::fs::read_dir(&tmp) else {
+        return;
+    };
+    // Snapshot live process command lines once. If we can't determine them,
+    // skip cleanup entirely rather than risk deleting an in-use profile.
+    let Some(live_cmdlines) = running_process_cmdlines() else {
+        return;
+    };
+    for entry in entries.flatten() {
+        let name = entry.file_name();
+        if !name.to_string_lossy().starts_with("agent-browser-chrome-") {
+            continue;
+        }
+        let path = entry.path();
+        let path_str = path.to_string_lossy();
+        let in_use = live_cmdlines
+            .iter()
+            .any(|cmd| cmd.contains(path_str.as_ref()));
+        if !in_use {
+            let _ = std::fs::remove_dir_all(&path);
+        }
+    }
+}
+
+#[cfg(unix)]
+fn running_process_cmdlines() -> Option<Vec<String>> {
+    let output = std::process::Command::new("ps")
+        .args(["-axww", "-o", "command="])
+        .output()
+        .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    Some(
+        String::from_utf8_lossy(&output.stdout)
+            .lines()
+            .map(|l| l.to_string())
+            .collect(),
+    )
+}
+
+#[cfg(not(unix))]
+fn running_process_cmdlines() -> Option<Vec<String>> {
+    // Best-effort: skip cleanup where we can't cheaply enumerate full process
+    // command lines, to avoid deleting a profile that is still in use.
+    None
+}
+
 pub async fn auto_connect_cdp() -> Result<String, String> {
    let user_data_dirs = get_chrome_user_data_dirs();

@@ -674,57 +741,61 @@ pub async fn auto_connect_cdp() -> Result<String, String> {
        }
    }

-    Err("No running Chrome instance found. Launch Chrome with --remote-debugging-port or use --cdp.".to_string())
+    Err("No running Chrome with remote debugging found. Remote debugging is a \
+         startup flag, not a setting: fully quit Chrome and relaunch it with \
+         --remote-debugging-port=9222 (then agent-browser auto-connects), or pass \
+         --cdp <port>/--launch."
+        .to_string())
 }

 /// Resolve a CDP WebSocket URL from a DevToolsActivePort entry.
 ///
-/// Tries the exact WebSocket path from DevToolsActivePort first (single
-/// prompt on M144+), then falls back to legacy HTTP discovery for older
-/// Chrome versions. This order avoids triggering duplicate remote-debugging
-/// permission prompts (#1210, #1206).
+/// Returns the exact browser WebSocket URL from DevToolsActivePort, gated only
+/// by a consent-free TCP liveness check. Falls back to HTTP discovery on the
+/// same port for older Chrome layouts.
+///
+/// Crucially, this does NOT open a throwaway verification WebSocket. On
+/// Chrome 136+ the "Allow remote debugging?" consent is granted *per
+/// connection*: a probe WebSocket we then close would consume the user's one
+/// Allow click, leaving the real connection (opened afterwards) unconsented —
+/// which manifests as an endless prompt loop or a hung command. By skipping the
+/// probe, the real connection is the single WebSocket the user consents to.
+/// (Background: #1210, #1206 duplicate-prompt reports.)
 async fn resolve_cdp_from_active_port(port: u16, ws_path: &str) -> Result<String, String> {
-    let ws_url = format!("ws://127.0.0.1:{}{}", port, ws_path);
-    if verify_ws_endpoint(&ws_url).await {
-        return Ok(ws_url);
+    // Consent-free liveness: a bare TCP connect does not trigger the
+    // remote-debugging consent flow (that fires on the CDP/WebSocket upgrade),
+    // so we can tell "Chrome is listening" from "stale DevToolsActivePort"
+    // without burning a prompt.
+    if tcp_port_alive(port).await {
+        return Ok(format!("ws://127.0.0.1:{}{}", port, ws_path));
    }

-    // Pre-M144 fallback: HTTP endpoints (/json/version, /json/list, etc.)
+    // Port isn't accepting connections (stale file / different layout). Fall
+    // back to HTTP discovery for older Chrome before giving up.
    if let Ok(ws_url) = discover_cdp_url("127.0.0.1", port, None).await {
        return Ok(ws_url);
    }

    Err(format!(
-        "Cannot connect to Chrome on port {}: both direct WebSocket and HTTP discovery failed",
+        "Cannot connect to Chrome on port {}: port not reachable and HTTP discovery failed",
        port
    ))
 }

-/// Verify that a WebSocket endpoint is a live CDP server by sending
-/// `Browser.getVersion` and checking for a valid response.
-async fn verify_ws_endpoint(ws_url: &str) -> bool {
-    use futures_util::{SinkExt, StreamExt};
-    use tokio_tungstenite::tungstenite::Message;
-
-    let timeout = Duration::from_secs(2);
-    let result = tokio::time::timeout(timeout, async {
-        let (mut ws, _) = tokio_tungstenite::connect_async(ws_url).await.ok()?;
-        let cmd = r#"{"id":1,"method":"Browser.getVersion"}"#;
-        ws.send(Message::Text(cmd.into())).await.ok()?;
-        while let Some(Ok(msg)) = ws.next().await {
-            if let Message::Text(text) = msg {
-                if let Ok(v) = serde_json::from_str::<serde_json::Value>(&text) {
-                    if v.get("id").and_then(|id| id.as_u64()) == Some(1) {
-                        let _ = ws.close(None).await;
-                        return Some(());
-                    }
-                }
-            }
-        }
-        None
-    })
-    .await;
-    matches!(result, Ok(Some(())))
+/// Consent-free check that something is accepting TCP connections on
+/// `127.0.0.1:port`. Unlike a CDP/WebSocket probe, a bare TCP connect does not
+/// trigger Chrome's "Allow remote debugging?" consent prompt, so it is safe to
+/// use for liveness before handing the URL to the single real connection.
+async fn tcp_port_alive(port: u16) -> bool {
+    let timeout = Duration::from_secs(1);
+    matches!(
+        tokio::time::timeout(
+            timeout,
+            tokio::net::TcpStream::connect(("127.0.0.1", port)),
+        )
+        .await,
+        Ok(Ok(_))
+    )
 }

 /// Returns the default Chrome user-data directory paths for the current platform.
@@ -846,6 +917,18 @@ pub fn list_chrome_profiles(user_data_dir: &Path) -> Vec<ChromeProfile> {
 /// 3. Case-insensitive directory name match
 ///
 /// Returns the resolved directory name, or an error with available profiles.
+/// Read `profile.last_used` (the directory name of the profile Chrome opened
+/// most recently) from a user-data dir's `Local State`. Used to resolve
+/// `--profile auto`.
+fn read_last_used_profile(user_data_dir: &Path) -> Option<String> {
+    let content = std::fs::read_to_string(user_data_dir.join("Local State")).ok()?;
+    let json: serde_json::Value = serde_json::from_str(&content).ok()?;
+    json.get("profile")?
+        .get("last_used")?
+        .as_str()
+        .map(String::from)
+}
+
 pub fn resolve_chrome_profile(user_data_dir: &Path, input: &str) -> Result<String, String> {
    let profiles = list_chrome_profiles(user_data_dir);

@@ -857,6 +940,21 @@ pub fn resolve_chrome_profile(user_data_dir: &Path, input: &str) -> Result<Strin
        ));
    }

+    // "auto": pick the profile Chrome last used (else "Default", else the first
+    // one), so `--profile auto` reuses the real logged-in profile without the
+    // user having to name it explicitly.
+    if input.eq_ignore_ascii_case("auto") {
+        if let Some(lu) = read_last_used_profile(user_data_dir) {
+            if let Some(p) = profiles.iter().find(|p| p.directory == lu) {
+                return Ok(p.directory.clone());
+            }
+        }
+        if let Some(p) = profiles.iter().find(|p| p.directory == "Default") {
+            return Ok(p.directory.clone());
+        }
+        return Ok(profiles[0].directory.clone());
+    }
+
    // Tier 1: exact directory name match
    if let Some(p) = profiles.iter().find(|p| p.directory == input) {
        return Ok(p.directory.clone());
@@ -1360,6 +1458,7 @@ mod tests {
        };
        let result = build_chrome_args(&opts).unwrap();
        assert!(result.args.iter().any(|a| a == "--headless=new"));
+        assert!(result.args.iter().any(|a| a == "--hide-scrollbars"));
        assert!(result
            .args
            .iter()
@@ -1380,6 +1479,7 @@ mod tests {
        };
        let result = build_chrome_args(&opts).unwrap();
        assert!(!result.args.iter().any(|a| a.contains("--headless")));
+        assert!(!result.args.iter().any(|a| a == "--hide-scrollbars"));
        assert!(!result
            .args
            .iter()
@@ -1434,6 +1534,23 @@ mod tests {
        }
    }

+    #[test]
+    fn test_build_args_hide_scrollbars_false_suppresses_default_hide_scrollbars() {
+        let opts = LaunchOptions {
+            headless: true,
+            hide_scrollbars: false,
+            ..Default::default()
+        };
+        let result = build_chrome_args(&opts).unwrap();
+        assert!(
+            !result.args.iter().any(|a| a == "--hide-scrollbars"),
+            "--hide-scrollbars false should suppress agent-browser's default hide switch"
+        );
+        if let Some(ref dir) = result.temp_user_data_dir {
+            let _ = std::fs::remove_dir_all(dir);
+        }
+    }
+
    #[test]
    fn test_build_args_start_maximized_suppresses_default_window_size() {
        let opts = LaunchOptions {
@@ -1474,6 +1591,10 @@ mod tests {
            !result.args.iter().any(|a| a.contains("--headless")),
            "headless flag should be omitted when extensions are present"
        );
+        assert!(
+            !result.args.iter().any(|a| a == "--hide-scrollbars"),
+            "scrollbars should remain visible when extensions force headed mode"
+        );
        assert!(
            !result.args.iter().any(|a| a.contains("--window-size")),
            "window-size should be omitted when extensions force headed mode"
@@ -1579,6 +1700,44 @@ mod tests {
        assert!(!is_chrome_profile_name("relative/path"));
    }

+    #[test]
+    fn test_resolve_chrome_profile_auto_prefers_last_used() {
+        let tmp = std::env::temp_dir().join("ab-auto-lastused-test");
+        let _ = std::fs::remove_dir_all(&tmp);
+        std::fs::create_dir_all(&tmp).unwrap();
+        let local_state = serde_json::json!({
+            "profile": {
+                "last_used": "Profile 2",
+                "info_cache": { "Default": {"name": "Person 1"}, "Profile 2": {"name": "Work"} }
+            }
+        });
+        std::fs::write(
+            tmp.join("Local State"),
+            serde_json::to_string(&local_state).unwrap(),
+        )
+        .unwrap();
+        assert_eq!(resolve_chrome_profile(&tmp, "auto").unwrap(), "Profile 2");
+        assert_eq!(resolve_chrome_profile(&tmp, "AUTO").unwrap(), "Profile 2");
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
+    #[test]
+    fn test_resolve_chrome_profile_auto_falls_back_to_default() {
+        let tmp = std::env::temp_dir().join("ab-auto-default-test");
+        let _ = std::fs::remove_dir_all(&tmp);
+        std::fs::create_dir_all(&tmp).unwrap();
+        let local_state = serde_json::json!({
+            "profile": { "info_cache": { "Default": {"name": "Person 1"}, "Profile 2": {"name": "Work"} } }
+        });
+        std::fs::write(
+            tmp.join("Local State"),
+            serde_json::to_string(&local_state).unwrap(),
+        )
+        .unwrap();
+        assert_eq!(resolve_chrome_profile(&tmp, "auto").unwrap(), "Default");
+        let _ = std::fs::remove_dir_all(&tmp);
+    }
+
    /// Helper to create a fake Chrome user-data dir with a `Local State` file.
    fn create_fake_local_state(base: &Path, profiles: &[(&str, &str)]) {
        let mut info_cache = serde_json::Map::new();
@@ -1870,83 +2029,60 @@ mod tests {
    // auto_connect_cdp discovery-order tests (#1210, #1206)
    // -------------------------------------------------------------------

-    /// When DevToolsActivePort provides a ws_path and the port is reachable,
-    /// `resolve_cdp_from_active_port` should return the exact ws_path URL
-    /// WITHOUT calling HTTP discovery first.
+    /// When the port is live, `resolve_cdp_from_active_port` returns the exact
+    /// DevToolsActivePort ws_path URL via a consent-free TCP check — it does NOT
+    /// probe with a verification WebSocket (which would burn Chrome 136+'s
+    /// per-connection remote-debugging consent on a throwaway socket).
    #[tokio::test]
-    async fn test_resolve_cdp_from_active_port_prefers_ws_path() {
-        use futures_util::{SinkExt, StreamExt};
-        use tokio_tungstenite::tungstenite::Message as WsMsg;
-
+    async fn test_resolve_cdp_from_active_port_returns_ws_path_without_probe() {
+        // A bound listener makes the port TCP-reachable. We do NOT accept/serve
+        // any WebSocket — resolve must succeed from the bare TCP check alone.
        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();
-        let ws_path = "/devtools/browser/test-uuid-1234".to_string();
+        let ws_path = "/devtools/browser/test-uuid-1234";

-        let server = tokio::spawn(async move {
-            // accept: verify_ws_endpoint() WebSocket handshake
-            let (stream, _) = listener.accept().await.unwrap();
-            let mut ws = tokio_tungstenite::accept_async(stream).await.unwrap();
-            if let Some(Ok(WsMsg::Text(text))) = ws.next().await {
-                let req: serde_json::Value = serde_json::from_str(&text).unwrap();
-                let id = req.get("id").unwrap();
-                let reply = format!(
-                    r#"{{"id":{},"result":{{"protocolVersion":"1.3","product":"Chrome/147"}}}}"#,
-                    id
-                );
-                ws.send(WsMsg::Text(reply)).await.unwrap();
-            }
-            let _ = ws.close(None).await;
-        });
-
-        let result = resolve_cdp_from_active_port(port, &ws_path).await;
-        assert!(result.is_ok(), "should succeed: {:?}", result);
-        let url = result.unwrap();
-        assert!(
-            url.contains("test-uuid-1234"),
-            "should use exact ws_path from DevToolsActivePort, got: {}",
-            url
+        let result = resolve_cdp_from_active_port(port, ws_path).await;
+        assert!(result.is_ok(), "should succeed when port is live: {:?}", result);
+        assert_eq!(
+            result.unwrap(),
+            format!("ws://127.0.0.1:{}{}", port, ws_path),
+            "should return the exact DevToolsActivePort URL untouched"
        );
-        assert_eq!(url, format!("ws://127.0.0.1:{}{}", port, ws_path));
-        server.await.unwrap();
+        drop(listener);
    }

-    /// When the exact ws_path connection fails, `resolve_cdp_from_active_port`
-    /// should fall back to HTTP discovery.
+    /// Regression guard for the consent storm: resolving the URL must only do a
+    /// bare TCP connect, never a WebSocket/CDP handshake. On Chrome 136+ a
+    /// handshake on a throwaway socket consumes the user's one "Allow remote
+    /// debugging?" click, leaving the real connection unconsented (endless
+    /// prompts / hang).
    #[tokio::test]
-    async fn test_resolve_cdp_from_active_port_falls_back_to_http_discovery() {
-        use tokio::io::{AsyncReadExt, AsyncWriteExt};
+    async fn test_resolve_cdp_from_active_port_does_not_open_websocket() {
+        use tokio::io::AsyncReadExt;

        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
        let port = listener.local_addr().unwrap().port();

        let server = tokio::spawn(async move {
-            // 1st accept: verify_ws_endpoint() ws_path probe — reject (just close)
-            let (s1, _) = listener.accept().await.unwrap();
-            drop(s1);
-
-            // 2nd accept: HTTP /json/version from discover_cdp_url()
-            let (mut s2, _) = listener.accept().await.unwrap();
-            let mut buf = [0u8; 2048];
-            let _ = s2.read(&mut buf).await;
-            let body = format!(
-                r#"{{"webSocketDebuggerUrl":"ws://127.0.0.1:{}/devtools/browser/fallback-uuid"}}"#,
-                port
-            );
-            let resp = format!(
-                "HTTP/1.1 200 OK\r\nContent-Length: {}\r\nContent-Type: application/json\r\n\r\n{}",
-                body.len(),
-                body
-            );
-            s2.write_all(resp.as_bytes()).await.unwrap();
+            let (mut stream, _) = listener.accept().await.unwrap();
+            // The liveness check connects then drops without writing anything.
+            // Assert we receive no WebSocket upgrade bytes (EOF / no data).
+            let mut buf = [0u8; 128];
+            let read = tokio::time::timeout(
+                Duration::from_millis(500),
+                stream.read(&mut buf),
+            )
+            .await;
+            match read {
+                Ok(Ok(n)) => assert_eq!(n, 0, "resolve must not send a WS/CDP handshake"),
+                Ok(Err(_)) | Err(_) => {} // closed or nothing sent — both fine
+            }
        });

-        let result = resolve_cdp_from_active_port(port, "/devtools/browser/nonexistent-uuid").await;
-        assert!(result.is_ok(), "should fall back to HTTP: {:?}", result);
-        let url = result.unwrap();
-        assert!(
-            url.contains("fallback-uuid"),
-            "should use HTTP discovery fallback, got: {}",
-            url
+        let result = resolve_cdp_from_active_port(port, "/devtools/browser/abc").await;
+        assert_eq!(
+            result.unwrap(),
+            format!("ws://127.0.0.1:{}/devtools/browser/abc", port)
        );
        server.await.unwrap();
    }
@@ -58,8 +58,12 @@ pub async fn discover_cdp_url_with_timeout(
    match discover_cdp_ws(host, port, timeout).await {
        Ok(ws_url) => Ok(append_query(&ws_url, query)),
        Err(ws_err) => Err(format!(
-            "All CDP discovery methods failed for {}:{}: /json/version: {}; /json/list: {}; WebSocket: {}",
-            host, port, version_err, list_err, ws_err
+            "All CDP discovery methods failed for {host}:{port}. \
+             Note: Chrome 136+ no longer serves the HTTP discovery endpoints \
+             (/json/version, /json/list), so `--cdp <port>` cannot find the target — \
+             use the default auto-connect (just `agent-browser open <url>`), which reads \
+             DevToolsActivePort and attaches over WebSocket. \
+             (details: /json/version: {version_err}; /json/list: {list_err}; WebSocket: {ws_err})"
        )),
    }
 }
@@ -59,6 +59,10 @@ pub async fn run_daemon(session: &str) {
        }
    }

+    // Sweep temp Chrome profiles leaked by hard-killed daemons (Drop doesn't
+    // run on kill -9). Only removes dirs no live process references.
+    super::cdp::chrome::cleanup_orphaned_chrome_profiles();
+
    let pid_path = socket_dir.join(format!("{}.pid", session));
    let _ = fs::write(&pid_path, process::id().to_string());

@@ -94,6 +94,61 @@ async fn create_storage_state_with_cookie(path: &str, cookie_name: &str, cookie_
    assert_success(&resp);
 }

+async fn send_raw_http_request(port: u64, request: &str) -> String {
+    let mut stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{port}"))
+        .await
+        .expect("HTTP client should connect to stream server");
+    stream
+        .write_all(request.as_bytes())
+        .await
+        .expect("HTTP request should be written");
+    stream
+        .shutdown()
+        .await
+        .expect("HTTP client write side should shut down");
+
+    let mut response = Vec::new();
+    stream
+        .read_to_end(&mut response)
+        .await
+        .expect("HTTP response should be read");
+    String::from_utf8(response).expect("HTTP response should be utf-8")
+}
+
+#[cfg(unix)]
+async fn spawn_fake_daemon_socket(
+    socket_dir: &std::path::Path,
+    session_name: &str,
+) -> tokio::sync::oneshot::Receiver<String> {
+    use tokio::io::AsyncBufReadExt;
+
+    let socket_path = socket_dir.join(format!("{session_name}.sock"));
+    let _ = std::fs::remove_file(&socket_path);
+    let listener =
+        tokio::net::UnixListener::bind(&socket_path).expect("fake daemon socket should bind");
+    let (tx, rx) = tokio::sync::oneshot::channel();
+
+    tokio::spawn(async move {
+        let Ok((stream, _)) = listener.accept().await else {
+            return;
+        };
+        let mut reader = tokio::io::BufReader::new(stream);
+        let mut command = String::new();
+        if reader.read_line(&mut command).await.is_err() {
+            return;
+        }
+
+        let mut stream = reader.into_inner();
+        let _ = stream
+            .write_all(br#"{"success":true,"data":{"ok":true}}"#)
+            .await;
+        let _ = stream.write_all(b"\n").await;
+        let _ = tx.send(command);
+    });
+
+    rx
+}
+
 // ---------------------------------------------------------------------------
 // Core: launch, navigate, evaluate, url, title, close
 // ---------------------------------------------------------------------------
@@ -363,6 +418,98 @@ async fn e2e_runtime_stream_enable_before_launch_attaches_and_disables() {
    let _ = std::fs::remove_dir_all(&socket_dir);
 }

+#[cfg(unix)]
+#[tokio::test]
+#[ignore]
+async fn e2e_stream_command_requires_same_origin_before_daemon_relay() {
+    let guard = EnvGuard::new(&["AGENT_BROWSER_SOCKET_DIR", "AGENT_BROWSER_SESSION"]);
+    let temp_parent = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+        .join("target")
+        .join("t");
+    std::fs::create_dir_all(&temp_parent).expect("socket temp parent should be created");
+    let socket_dir = tempfile::Builder::new()
+        .prefix("ab-e2e-")
+        .tempdir_in(temp_parent)
+        .expect("socket dir should be created");
+    guard.set(
+        "AGENT_BROWSER_SOCKET_DIR",
+        socket_dir
+            .path()
+            .to_str()
+            .expect("socket dir should be utf-8"),
+    );
+    guard.set("AGENT_BROWSER_SESSION", "x");
+
+    let mut state = DaemonState::new();
+    let resp = execute_command(
+        &json!({ "id": "1", "action": "stream_enable", "port": 0 }),
+        &mut state,
+    )
+    .await;
+    assert_success(&resp);
+    let port = get_data(&resp)["port"]
+        .as_u64()
+        .expect("stream enable should report the bound port");
+
+    let mut daemon_command = spawn_fake_daemon_socket(socket_dir.path(), "x").await;
+    let body = r#"{"action":"tabs"}"#;
+    let cross_origin_request = format!(
+        "POST /api/command HTTP/1.1\r\nHost: localhost:{port}\r\nOrigin: https://evil.example\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+        body.len(),
+        body
+    );
+
+    let response = send_raw_http_request(port, &cross_origin_request).await;
+    assert!(
+        response.starts_with("HTTP/1.1 403 Forbidden"),
+        "unexpected cross-origin response: {response}"
+    );
+    assert!(
+        !response.contains("Access-Control-Allow-Origin: *"),
+        "forbidden command response exposed wildcard CORS: {response}"
+    );
+    assert!(
+        tokio::time::timeout(std::time::Duration::from_millis(100), &mut daemon_command)
+            .await
+            .is_err(),
+        "cross-origin command request reached daemon relay"
+    );
+
+    let same_origin_request = format!(
+        "POST /api/command HTTP/1.1\r\nHost: localhost:{port}\r\nOrigin: http://localhost:{port}\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+        body.len(),
+        body
+    );
+    let response = send_raw_http_request(port, &same_origin_request).await;
+    assert!(
+        response.starts_with("HTTP/1.1 200 OK"),
+        "unexpected same-origin response: {response}"
+    );
+    assert!(
+        response.contains(&format!(
+            "Access-Control-Allow-Origin: http://localhost:{port}"
+        )),
+        "same-origin command response did not reflect origin: {response}"
+    );
+    assert!(
+        !response.contains("Access-Control-Allow-Origin: *"),
+        "same-origin command response exposed wildcard CORS: {response}"
+    );
+
+    let relayed = tokio::time::timeout(std::time::Duration::from_secs(1), daemon_command)
+        .await
+        .expect("same-origin request should reach fake daemon")
+        .expect("fake daemon should return relayed command");
+    assert!(relayed.contains(r#""action":"tabs""#), "{relayed}");
+
+    let resp = execute_command(
+        &json!({ "id": "2", "action": "stream_disable" }),
+        &mut state,
+    )
+    .await;
+    assert_success(&resp);
+}
+
 // ---------------------------------------------------------------------------
 // Snapshot with refs and ref-based click
 // ---------------------------------------------------------------------------
@@ -1,14 +1,29 @@
 const __abStealth = { locale: "en-US", languages: ["en-US", "en"], allowWebGLContextFallback: false };
 (function(){
-  const removeWebdriver = (target) => {
+  // Prefer the CDP-level automation override (Emulation.setAutomationOverride),
+  // which makes navigator.webdriver report `false` NATIVELY — undetectable by
+  // lie-detection (creepjs). Only intervene when webdriver is still truthy
+  // (e.g. older Chrome without that override) and force it to FALSE.
+  //
+  // Never `delete` webdriver: real Chrome reports `false`, so `undefined` is
+  // itself a tell, and deleting it removes the native `false` the override set.
+  const forceWebdriverFalse = (target) => {
    if (!target) return;
-    try { delete target.webdriver; } catch {}
+    try {
+      if (target.webdriver === true) {
+        Object.defineProperty(target, 'webdriver', {
+          get: () => false,
+          configurable: true,
+          enumerable: false,
+        });
+      }
+    } catch {}
  };
-  removeWebdriver(navigator);
-  removeWebdriver(Object.getPrototypeOf(navigator));
-  removeWebdriver(Navigator.prototype);
+  forceWebdriverFalse(navigator);
+  forceWebdriverFalse(Object.getPrototypeOf(navigator));
+  forceWebdriverFalse(Navigator.prototype);
  if (typeof WorkerNavigator !== 'undefined') {
-    removeWebdriver(WorkerNavigator.prototype);
+    forceWebdriverFalse(WorkerNavigator.prototype);
  }
 })();
 (function(){
@@ -33,14 +33,141 @@ pub(super) fn cors_headers_for_origin(origin: Option<&str>) -> String {
    )
 }

+fn request_headers(request: &str) -> &str {
+    request
+        .find("\r\n\r\n")
+        .or_else(|| request.find("\n\n"))
+        .map(|header_end| &request[..header_end])
+        .unwrap_or(request)
+}
+
+fn request_header_value<'a>(request: &'a str, name: &str) -> Option<&'a str> {
+    request_headers(request).lines().find_map(|line| {
+        let (header_name, value) = line.split_once(':')?;
+        if header_name.trim().eq_ignore_ascii_case(name) {
+            Some(value.trim())
+        } else {
+            None
+        }
+    })
+}
+
 fn parse_origin(peeked: &[u8]) -> Option<String> {
    let header_str = std::str::from_utf8(peeked).ok()?;
-    for line in header_str.lines() {
-        if line.len() > 8 && line[..8].eq_ignore_ascii_case("origin: ") {
-            return Some(line[8..].trim().to_string());
+    request_header_value(header_str, "origin").map(ToString::to_string)
+}
+
+fn normalize_origin_authority(origin: &str) -> Option<String> {
+    let url = url::Url::parse(origin).ok()?;
+    let host = url.host_str()?.to_ascii_lowercase();
+    let host = if host.contains(':') {
+        format!("[{host}]")
+    } else {
+        host
+    };
+    let default_port = (url.scheme() == "http" && url.port() == Some(80))
+        || (url.scheme() == "https" && url.port() == Some(443));
+    Some(match url.port() {
+        Some(port) if !default_port => format!("{host}:{port}"),
+        _ => host,
+    })
+}
+
+fn normalize_host_authority(host: &str) -> String {
+    let host = host.trim().to_ascii_lowercase();
+
+    if let Some(bracket_end) = host.rfind(']') {
+        if bracket_end == host.len() - 1 {
+            return host;
+        }
+
+        if host.as_bytes().get(bracket_end + 1) == Some(&b':') {
+            let port = &host[bracket_end + 2..];
+            if port == "80" || port == "443" {
+                return host[..=bracket_end].to_string();
+            }
+        }
+
+        return host;
+    }
+
+    if let Some((name, port)) = host.rsplit_once(':') {
+        if !name.contains(':') && (port == "80" || port == "443") {
+            return name.to_string();
        }
    }
-    None
+
+    host
+}
+
+fn authority_host(authority: &str) -> &str {
+    if let Some(stripped) = authority.strip_prefix('[') {
+        if let Some(bracket_end) = stripped.find(']') {
+            return &authority[..=bracket_end + 1];
+        }
+    }
+
+    if let Some((host, _port)) = authority.rsplit_once(':') {
+        if !host.contains(':') {
+            return host;
+        }
+    }
+
+    authority
+}
+
+fn is_loopback_authority(authority: &str) -> bool {
+    matches!(
+        authority_host(authority),
+        "localhost" | "127.0.0.1" | "::1" | "[::1]"
+    )
+}
+
+fn header_authority_matches_host(request: &str, header_name: &str) -> bool {
+    let Some(authority) =
+        request_header_value(request, header_name).and_then(normalize_origin_authority)
+    else {
+        return false;
+    };
+    let Some(host) = request_header_value(request, "host").map(normalize_host_authority) else {
+        return false;
+    };
+    authority == host && is_loopback_authority(&authority) && is_loopback_authority(&host)
+}
+
+/// Protects the command relay by requiring same-origin browser metadata.
+fn is_same_origin_command_request(request: &str) -> bool {
+    if request_header_value(request, "origin").is_some() {
+        header_authority_matches_host(request, "origin")
+    } else {
+        header_authority_matches_host(request, "referer")
+    }
+}
+
+fn command_cors_headers(request: &str) -> String {
+    match request_header_value(request, "origin") {
+        Some(origin) if is_same_origin_command_request(request) => format!(
+            "Access-Control-Allow-Origin: {origin}\r\nAccess-Control-Allow-Methods: POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\nVary: Origin\r\n"
+        ),
+        _ => String::new(),
+    }
+}
+
+async fn write_json_error_response_no_cors(
+    stream: &mut tokio::net::TcpStream,
+    status: &str,
+    error: &str,
+) {
+    let body = format!(
+        r#"{{"success":false,"error":{}}}"#,
+        serde_json::to_string(error).unwrap_or_else(|_| format!("\"{}\"", error))
+    );
+    let response = format!(
+        "HTTP/1.1 {status}\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n\r\n",
+        body.len()
+    );
+    let _ = stream.write_all(response.as_bytes()).await;
+    let _ = stream.write_all(body.as_bytes()).await;
 }

 pub(super) async fn handle_http_request(
@@ -61,6 +188,25 @@ pub(super) async fn handle_http_request(
    let origin = parse_origin(peeked);

    if method == "OPTIONS" {
+        if path == "/api/command" {
+            if !is_same_origin_command_request(&request) {
+                write_json_error_response_no_cors(
+                    &mut stream,
+                    "403 Forbidden",
+                    "Origin or Referer does not match Host header.",
+                )
+                .await;
+                return;
+            }
+
+            let cors_headers = command_cors_headers(&request);
+            let response = format!(
+                "HTTP/1.1 204 No Content\r\n{cors_headers}Access-Control-Max-Age: 86400\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+            );
+            let _ = stream.write_all(response.as_bytes()).await;
+            return;
+        }
+
        let response = format!(
            "HTTP/1.1 204 No Content\r\n{CORS_HEADERS}Access-Control-Max-Age: 86400\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
        );
@@ -69,13 +215,28 @@ pub(super) async fn handle_http_request(
    }

    if method == "POST" {
+        if path == "/api/command" && !is_same_origin_command_request(&request) {
+            write_json_error_response_no_cors(
+                &mut stream,
+                "403 Forbidden",
+                "Origin or Referer does not match Host header.",
+            )
+            .await;
+            return;
+        }
+
        let full_body = read_full_body(&mut stream, peeked).await;
        if full_body.is_none()
            && (path == "/api/chat" || path == "/api/sessions" || path == "/api/command")
        {
            let body = r#"{"error":"Request body too large"}"#;
+            let cors_headers = if path == "/api/command" {
+                command_cors_headers(&request)
+            } else {
+                CORS_HEADERS.to_string()
+            };
            let response = format!(
-                "HTTP/1.1 413 Payload Too Large\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n{CORS_HEADERS}\r\n",
+                "HTTP/1.1 413 Payload Too Large\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n{cors_headers}\r\n",
                body.len()
            );
            let _ = stream.write_all(response.as_bytes()).await;
@@ -117,8 +278,9 @@ pub(super) async fn handle_http_request(
                    ),
                ),
            };
+            let cors_headers = command_cors_headers(&request);
            let response = format!(
-                "HTTP/1.1 {status}\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n{CORS_HEADERS}\r\n",
+                "HTTP/1.1 {status}\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: {}\r\nConnection: close\r\n{cors_headers}\r\n",
                resp_body.len()
            );
            let _ = stream.write_all(response.as_bytes()).await;
@@ -313,3 +475,241 @@ pub(super) fn serve_embedded_file(url_path: &str) -> (&'static str, &'static str
        ),
    }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::test_utils::EnvGuard;
+    use std::sync::Arc;
+    use tokio::io::{AsyncBufReadExt, AsyncReadExt, AsyncWriteExt};
+    use tokio::net::TcpListener;
+    use tokio::sync::oneshot;
+
+    async fn send_request_to_handler(request: &str, session_name: &str) -> String {
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let addr = listener.local_addr().unwrap();
+        let peeked = request.as_bytes().to_vec();
+        let last_tabs = Arc::new(RwLock::new(Vec::new()));
+        let last_engine = Arc::new(RwLock::new("chrome".to_string()));
+        let session_name = session_name.to_string();
+
+        let server = tokio::spawn(async move {
+            let (stream, _) = listener.accept().await.unwrap();
+            handle_http_request(stream, &peeked, &last_tabs, &last_engine, &session_name).await;
+        });
+
+        let mut client = tokio::net::TcpStream::connect(addr).await.unwrap();
+        client.write_all(request.as_bytes()).await.unwrap();
+        client.shutdown().await.unwrap();
+
+        let mut response = Vec::new();
+        client.read_to_end(&mut response).await.unwrap();
+        server.await.unwrap();
+
+        String::from_utf8(response).unwrap()
+    }
+
+    #[cfg(unix)]
+    async fn spawn_fake_daemon(
+        socket_dir: &std::path::Path,
+        session_name: &str,
+    ) -> oneshot::Receiver<String> {
+        let socket_path = socket_dir.join(format!("{session_name}.sock"));
+        let _ = std::fs::remove_file(&socket_path);
+        let listener = tokio::net::UnixListener::bind(&socket_path).unwrap();
+        let (tx, rx) = oneshot::channel();
+
+        tokio::spawn(async move {
+            let (stream, _) = listener.accept().await.unwrap();
+            let mut reader = tokio::io::BufReader::new(stream);
+            let mut line = String::new();
+            reader.read_line(&mut line).await.unwrap();
+
+            let mut stream = reader.into_inner();
+            stream
+                .write_all(br#"{"success":true,"data":{"ok":true}}"#)
+                .await
+                .unwrap();
+            stream.write_all(b"\n").await.unwrap();
+            let _ = tx.send(line);
+        });
+
+        rx
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "current_thread")]
+    async fn cross_origin_command_post_is_rejected_without_relaying_to_daemon() {
+        let temp_parent = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("target")
+            .join("t");
+        std::fs::create_dir_all(&temp_parent).unwrap();
+        let socket_dir = tempfile::Builder::new()
+            .prefix("ab-")
+            .tempdir_in(temp_parent)
+            .unwrap();
+        let guard = EnvGuard::new(&["AGENT_BROWSER_SOCKET_DIR", "XDG_RUNTIME_DIR"]);
+        guard.set(
+            "AGENT_BROWSER_SOCKET_DIR",
+            socket_dir.path().to_str().unwrap(),
+        );
+        guard.remove("XDG_RUNTIME_DIR");
+
+        let session_name = "x";
+        let daemon_command = spawn_fake_daemon(socket_dir.path(), session_name).await;
+        let body = r#"{"action":"tabs"}"#;
+        let request = format!(
+            "POST /api/command HTTP/1.1\r\nHost: localhost:7777\r\nOrigin: https://evil.example\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+
+        let response = send_request_to_handler(&request, session_name).await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 403 Forbidden"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            tokio::time::timeout(std::time::Duration::from_millis(50), daemon_command)
+                .await
+                .is_err(),
+            "cross-origin request reached daemon command relay"
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn cross_origin_command_preflight_is_rejected_without_wildcard_cors() {
+        let request = concat!(
+            "OPTIONS /api/command HTTP/1.1\r\n",
+            "Host: localhost:7777\r\n",
+            "Origin: https://evil.example\r\n",
+            "Access-Control-Request-Method: POST\r\n",
+            "Access-Control-Request-Headers: content-type\r\n",
+            "\r\n"
+        );
+
+        let response = send_request_to_handler(request, "x").await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 403 Forbidden"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            !response.contains("Access-Control-Allow-Origin: *"),
+            "forbidden command preflight exposed wildcard CORS: {response}"
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn command_post_without_origin_or_referer_is_rejected() {
+        let body = r#"{"action":"tabs"}"#;
+        let request = format!(
+            "POST /api/command HTTP/1.1\r\nHost: localhost:7777\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+
+        let response = send_request_to_handler(&request, "x").await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 403 Forbidden"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            !response.contains("Access-Control-Allow-Origin: *"),
+            "forbidden command response exposed wildcard CORS: {response}"
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn command_post_with_dns_rebinding_host_is_rejected() {
+        let body = r#"{"action":"tabs"}"#;
+        let request = format!(
+            "POST /api/command HTTP/1.1\r\nHost: attacker.example:7777\r\nOrigin: http://attacker.example:7777\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+
+        let response = send_request_to_handler(&request, "x").await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 403 Forbidden"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            !response.contains("Access-Control-Allow-Origin: *"),
+            "forbidden command response exposed wildcard CORS: {response}"
+        );
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn command_post_ignores_header_like_body_lines() {
+        let body = "Referer: http://localhost:7777\r\n{\"action\":\"tabs\"}";
+        let request = format!(
+            "POST /api/command HTTP/1.1\r\nHost: localhost:7777\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+
+        let response = send_request_to_handler(&request, "x").await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 403 Forbidden"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            !response.contains("Access-Control-Allow-Origin: *"),
+            "forbidden command response exposed wildcard CORS: {response}"
+        );
+    }
+
+    #[cfg(unix)]
+    #[tokio::test(flavor = "current_thread")]
+    async fn same_origin_command_post_relays_without_wildcard_cors() {
+        let temp_parent = std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("target")
+            .join("t");
+        std::fs::create_dir_all(&temp_parent).unwrap();
+        let socket_dir = tempfile::Builder::new()
+            .prefix("ab-")
+            .tempdir_in(temp_parent)
+            .unwrap();
+        let guard = EnvGuard::new(&["AGENT_BROWSER_SOCKET_DIR", "XDG_RUNTIME_DIR"]);
+        guard.set(
+            "AGENT_BROWSER_SOCKET_DIR",
+            socket_dir.path().to_str().unwrap(),
+        );
+        guard.remove("XDG_RUNTIME_DIR");
+
+        let session_name = "x";
+        let daemon_command = spawn_fake_daemon(socket_dir.path(), session_name).await;
+        let body = r#"{"action":"tabs"}"#;
+        let request = format!(
+            "POST /api/command HTTP/1.1\r\nHost: localhost:7777\r\nOrigin: http://localhost:7777\r\nContent-Type: application/json\r\nContent-Length: {}\r\n\r\n{}",
+            body.len(),
+            body
+        );
+
+        let response = send_request_to_handler(&request, session_name).await;
+
+        assert!(
+            response.starts_with("HTTP/1.1 200 OK"),
+            "unexpected response: {response}"
+        );
+        assert!(
+            response.contains("Access-Control-Allow-Origin: http://localhost:7777"),
+            "same-origin command response did not reflect origin: {response}"
+        );
+        assert!(
+            !response.contains("Access-Control-Allow-Origin: *"),
+            "same-origin command response exposed wildcard CORS: {response}"
+        );
+
+        let relayed = tokio::time::timeout(std::time::Duration::from_secs(1), daemon_command)
+            .await
+            .unwrap()
+            .unwrap();
+        assert!(relayed.contains(r#""action":"tabs""#), "{relayed}");
+    }
+}
@@ -1042,6 +1042,11 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou

        // Default success
        println!("{} Done", color::success_indicator());
+    } else {
+        // Success response with no data payload — still confirm the command ran
+        // instead of printing nothing (a silent exit 0 looks like a no-op and
+        // hides whether anything happened).
+        println!("{} Done", color::success_indicator());
    }

    print_warning(resp);
@@ -1583,6 +1588,8 @@ Usage: agent-browser screenshot [selector] [path]

 Captures a screenshot of the current page. If no path is provided,
 saves to a temporary directory with a generated filename.
+Headless Chromium screenshots hide native scrollbars for consistent image output.
+Pass --hide-scrollbars false when launching to keep native scrollbars visible.

 Options:
  --full, -f           Capture full page (not just viewport)
@@ -3098,6 +3105,8 @@ Options:
                             e.g., --proxy-bypass "localhost,*.internal.com"
  --ignore-https-errors      Ignore HTTPS certificate errors
  --allow-file-access        Allow file:// URLs to access local files (Chromium only)
+  --hide-scrollbars <bool>   Hide native scrollbars in headless Chromium screenshots (default: true)
+                             Use --hide-scrollbars false to keep scrollbars visible
  -p, --provider <name>      Browser provider: ios, browserbase, kernel, browseruse, browserless, agentcore
  --device <name>            iOS device name (e.g., "iPhone 15 Pro")
  --json                     JSON output
@@ -3137,11 +3146,12 @@ Configuration:
  Boolean flags accept an optional true/false value to override config:
    --headed           (same as --headed true)
    --headed false     (disables "headed": true from config)
+    --hide-scrollbars false (keeps native scrollbars visible in headless Chromium screenshots)

  Extensions from user and project configs are merged (not replaced).

  Example agent-browser.json:
-    {{"headed": true, "proxy": "http://localhost:8080", "profile": "./browser-data"}}
+    {{"headed": true, "hideScrollbars": false, "proxy": "http://localhost:8080"}}

 Environment:
  AGENT_BROWSER_CONFIG           Path to config file (or use --config)
@@ -3161,6 +3171,7 @@ Environment:
  AGENT_BROWSER_PROVIDER         Browser provider (ios, browserbase, kernel, browseruse, browserless, agentcore)
  AGENT_BROWSER_AUTO_CONNECT     Auto-discover and connect to running Chrome
  AGENT_BROWSER_ALLOW_FILE_ACCESS Allow file:// URLs to access local files
+  AGENT_BROWSER_HIDE_SCROLLBARS  Hide scrollbars in headless Chromium screenshots (default: true)
  AGENT_BROWSER_COLOR_SCHEME     Color scheme preference (dark, light, no-preference)
  AGENT_BROWSER_DOWNLOAD_PATH    Default download directory for browser downloads
  AGENT_BROWSER_DEFAULT_TIMEOUT  Default action timeout in ms (default: 25000)
@@ -1,3 +1,4 @@
+use include_dir::{include_dir, Dir};
 use serde_json::json;
 use std::env;
 use std::fs;
@@ -6,6 +7,12 @@ use std::process::exit;

 use crate::color;

+/// Skill content compiled into the binary so `skills get` works on a
+/// single-binary install (GitHub Release / install.sh), where there is no
+/// adjacent `skills/` or `skill-data/` on disk the way an npm install has.
+static EMBEDDED_SKILLS: Dir = include_dir!("$CARGO_MANIFEST_DIR/../skills");
+static EMBEDDED_SKILL_DATA: Dir = include_dir!("$CARGO_MANIFEST_DIR/../skill-data");
+
 struct SkillInfo {
    name: String,
    description: String,
@@ -63,6 +70,29 @@ fn find_package_root() -> Option<PathBuf> {
    None
 }

+/// Extract the binary-embedded skill content to a per-version cache dir on
+/// first use, returning a package root that contains `skills/` and
+/// `skill-data/`. Fallback for single-binary installs (GitHub Release /
+/// install.sh) that have no on-disk skill directories. Version-stamped so an
+/// upgraded binary re-extracts fresh content.
+fn embedded_skills_root() -> Option<PathBuf> {
+    let base = dirs::cache_dir()?
+        .join("agent-browser")
+        .join(concat!("skills-", env!("CARGO_PKG_VERSION")));
+    let marker = base.join(".extracted");
+    if !marker.exists() {
+        let _ = fs::create_dir_all(base.join("skills"));
+        let _ = fs::create_dir_all(base.join("skill-data"));
+        if EMBEDDED_SKILLS.extract(base.join("skills")).is_err()
+            || EMBEDDED_SKILL_DATA.extract(base.join("skill-data")).is_err()
+        {
+            return None;
+        }
+        let _ = fs::write(&marker, env!("CARGO_PKG_VERSION"));
+    }
+    base.join("skills").is_dir().then_some(base)
+}
+
 /// Collect all skill directories to search, respecting the env var override.
 fn find_skills_dirs() -> Vec<PathBuf> {
    // Env var override: single directory, used as-is
@@ -73,15 +103,28 @@ fn find_skills_dirs() -> Vec<PathBuf> {
        }
    }

-    let Some(root) = find_package_root() else {
-        return vec![];
-    };
+    // On-disk package root (npm install layout, or dev build walking up to repo).
+    if let Some(root) = find_package_root() {
+        let dirs: Vec<PathBuf> = SKILL_DIRS
+            .iter()
+            .map(|d| root.join(d))
+            .filter(|p| p.is_dir())
+            .collect();
+        if !dirs.is_empty() {
+            return dirs;
+        }
+    }

-    SKILL_DIRS
-        .iter()
-        .map(|d| root.join(d))
-        .filter(|p| p.is_dir())
-        .collect()
+    // Fallback: skill content compiled into the binary (single-binary install).
+    if let Some(root) = embedded_skills_root() {
+        return SKILL_DIRS
+            .iter()
+            .map(|d| root.join(d))
+            .filter(|p| p.is_dir())
+            .collect();
+    }
+
+    vec![]
 }

 /// Parse YAML frontmatter from a SKILL.md file. Returns (name, description, hidden).
@@ -0,0 +1,107 @@
+#!/bin/sh
+# agent-browser-stealth installer — downloads the prebuilt binary from the
+# GitHub Release (no npm, no auth for you or your users).
+#
+#   curl -fsSL https://raw.githubusercontent.com/leeguooooo/agent-browser-stealth/main/install.sh | sh
+#
+# Env overrides:
+#   AGENT_BROWSER_VERSION=v0.27.0-fork.11   pin a specific release tag
+#   AGENT_BROWSER_BIN_DIR=/usr/local/bin    install location (auto-detected otherwise)
+set -eu
+
+REPO="leeguooooo/agent-browser-stealth"
+BIN_NAME="agent-browser"
+
+err() { printf '\033[31merror:\033[0m %s\n' "$1" >&2; exit 1; }
+info() { printf '\033[36m==>\033[0m %s\n' "$1" >&2; }
+
+command -v curl >/dev/null 2>&1 || err "curl is required"
+command -v tar >/dev/null 2>&1 || err "tar is required"
+
+# --- detect platform -> release asset name -------------------------------
+os=$(uname -s)
+arch=$(uname -m)
+case "$os" in
+  Darwin) plat="darwin" ;;
+  Linux)  plat="linux" ;;
+  *) err "unsupported OS: $os (use the Windows .exe asset from the Releases page)" ;;
+esac
+case "$arch" in
+  x86_64|amd64)   cpu="x64" ;;
+  arm64|aarch64)  cpu="arm64" ;;
+  *) err "unsupported architecture: $arch" ;;
+esac
+
+# musl (Alpine etc.) gets the statically-linked Linux build
+libc=""
+if [ "$plat" = "linux" ] && ! ldd /bin/sh 2>/dev/null | grep -qi 'gnu\|glibc'; then
+  if [ -e /lib/ld-musl-x86_64.so.1 ] || [ -e /lib/ld-musl-aarch64.so.1 ]; then
+    libc="-musl"
+  fi
+fi
+asset="agent-browser-${plat}${libc}-${cpu}"
+
+# --- resolve release tag --------------------------------------------------
+tag="${AGENT_BROWSER_VERSION:-}"
+if [ -z "$tag" ]; then
+  info "resolving latest release..."
+  # Resolve via the releases/latest redirect on the github.com web host, NOT the
+  # api.github.com JSON API (which rate-limits unauthenticated callers to 60/hr).
+  # github.com/<repo>/releases/latest -> 302 -> github.com/<repo>/releases/tag/<TAG>
+  loc=$(curl -fsSLI -o /dev/null -w '%{url_effective}' \
+    "https://github.com/${REPO}/releases/latest" 2>/dev/null || true)
+  case "$loc" in
+    */releases/tag/*) tag="${loc##*/releases/tag/}" ;;
+    *) tag="" ;;
+  esac
+  [ -n "$tag" ] || err "could not resolve latest release (set AGENT_BROWSER_VERSION=vX.Y.Z)"
+fi
+
+base="https://github.com/${REPO}/releases/download/${tag}"
+tgz_url="${base}/${asset}.tar.gz"
+sha_url="${tgz_url}.sha256"
+
+# --- download + verify ----------------------------------------------------
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+info "downloading ${asset} (${tag})..."
+curl -fsSL "$tgz_url" -o "$tmp/pkg.tar.gz" \
+  || err "download failed: $tgz_url (is asset '${asset}.tar.gz' attached to release ${tag}?)"
+
+if curl -fsSL "$sha_url" -o "$tmp/pkg.sha256" 2>/dev/null; then
+  info "verifying checksum..."
+  expected=$(awk '{print $1}' "$tmp/pkg.sha256")
+  if command -v shasum >/dev/null 2>&1; then
+    actual=$(shasum -a 256 "$tmp/pkg.tar.gz" | awk '{print $1}')
+  elif command -v sha256sum >/dev/null 2>&1; then
+    actual=$(sha256sum "$tmp/pkg.tar.gz" | awk '{print $1}')
+  else
+    actual=""; info "no sha256 tool found, skipping verification"
+  fi
+  [ -z "$actual" ] || [ "$expected" = "$actual" ] || err "checksum mismatch (expected $expected, got $actual)"
+else
+  info "no .sha256 published, skipping verification"
+fi
+
+tar -xzf "$tmp/pkg.tar.gz" -C "$tmp"
+[ -f "$tmp/${BIN_NAME}" ] || err "archive did not contain ${BIN_NAME}"
+chmod +x "$tmp/${BIN_NAME}"
+
+# --- choose install dir ---------------------------------------------------
+bindir="${AGENT_BROWSER_BIN_DIR:-}"
+if [ -z "$bindir" ]; then
+  if [ -w /usr/local/bin ] 2>/dev/null; then bindir="/usr/local/bin"; else bindir="$HOME/.local/bin"; fi
+fi
+mkdir -p "$bindir"
+
+mv "$tmp/${BIN_NAME}" "$bindir/${BIN_NAME}"
+# convenience aliases: `abs` (short) -> agent-browser
+ln -sf "$bindir/${BIN_NAME}" "$bindir/abs" 2>/dev/null || true
+
+info "installed ${BIN_NAME} -> ${bindir}/${BIN_NAME}"
+"$bindir/${BIN_NAME}" --version 2>/dev/null || true
+
+case ":$PATH:" in
+  *":$bindir:"*) : ;;
+  *) printf '\033[33mnote:\033[0m %s is not on your PATH. Add:\n  export PATH="%s:$PATH"\n' "$bindir" "$bindir" >&2 ;;
+esac
@@ -1,8 +1,9 @@
 {
  "name": "agent-browser-stealth",
-  "version": "0.27.0-fork.8",
+  "version": "0.27.0-fork.13",
  "description": "Browser automation CLI for AI agents — stealth fork with anti-detection",
  "type": "module",
+  "packageManager": "pnpm@11.1.3",
  "files": [
    "bin",
    "scripts",
@@ -21,9 +22,9 @@
    "version": "npm run version:sync && git add cli/Cargo.toml",
    "build:native": "npm run version:sync && cargo build --release --manifest-path cli/Cargo.toml && node scripts/copy-native.js",
    "build:linux": "npm run version:sync && docker compose -f docker/docker-compose.yml run --rm build-linux",
-    "build:macos": "npm run version:sync && (cargo build --release --manifest-path cli/Cargo.toml --target aarch64-apple-darwin & cargo build --release --manifest-path cli/Cargo.toml --target x86_64-apple-darwin & wait) && cp cli/target/aarch64-apple-darwin/release/agent-browser bin/agent-browser-darwin-arm64 && cp cli/target/x86_64-apple-darwin/release/agent-browser bin/agent-browser-darwin-x64",
+    "build:macos": "npm run version:sync && bash -c 'cargo build --release --manifest-path cli/Cargo.toml --target aarch64-apple-darwin & PID1=$!; cargo build --release --manifest-path cli/Cargo.toml --target x86_64-apple-darwin & PID2=$!; wait $PID1 || exit 1; wait $PID2 || exit 1' && cp cli/target/aarch64-apple-darwin/release/agent-browser bin/agent-browser-darwin-arm64 && cp cli/target/x86_64-apple-darwin/release/agent-browser bin/agent-browser-darwin-x64",
    "build:windows": "npm run version:sync && docker compose -f docker/docker-compose.yml run --rm build-windows",
-    "build:all-platforms": "npm run version:sync && (npm run build:linux & npm run build:windows & wait) && npm run build:macos",
+    "build:all-platforms": "npm run version:sync && npm run build:linux && npm run build:windows && npm run build:macos",
    "build:docker": "docker build -t agent-browser-builder -f docker/Dockerfile.build .",
    "release": "npm run version:sync && npm run build:all-platforms && npm publish --tag fork",
    "postinstall": "node scripts/postinstall.js"
@@ -1,2 +1,9 @@
 packages:
  - '.'
+minimumReleaseAge: 2880
+allowBuilds:
+  '@mongodb-js/zstd': false
+  msw: false
+  node-liblzma: false
+  sharp: false
+  unrs-resolver: false
@@ -243,6 +243,9 @@ agent-browser screenshot --full full.png        # full scroll height
 agent-browser screenshot --annotate map.png     # numbered labels + legend keyed to snapshot refs
 ```

+Headless Chromium screenshots hide native scrollbars for consistent image output.
+Pass `--hide-scrollbars false` when launching to keep native scrollbars visible.
+
 `--annotate` is designed for multimodal models: each label `[N]` maps to ref `@eN`.

 ### Handle multiple pages via tabs
@@ -103,6 +103,9 @@ agent-browser screenshot --full   # Full page
 agent-browser pdf output.pdf      # Save as PDF
 ```

+Headless Chromium screenshots hide native scrollbars for consistent image output.
+Pass `--hide-scrollbars false` when launching to keep native scrollbars visible.
+
 ## Video Recording

 ```bash
@@ -309,6 +312,7 @@ agent-browser --headers <json> ...    # HTTP headers scoped to URL's origin
 agent-browser --executable-path <p>   # Custom browser executable
 agent-browser --extension <path> ...  # Load browser extension (repeatable)
 agent-browser --ignore-https-errors   # Ignore SSL certificate errors
+agent-browser --hide-scrollbars false # Keep native scrollbars visible in headless Chromium screenshots
 agent-browser --help                  # Show help (-h)
 agent-browser --version               # Show version (-V)
 agent-browser <command> --help        # Show detailed help for a command
@@ -383,6 +387,7 @@ AGENT_BROWSER_EXECUTABLE_PATH="/path/chrome" # Custom browser path
 AGENT_BROWSER_EXTENSIONS="/ext1,/ext2"       # Comma-separated extension paths
 AGENT_BROWSER_INIT_SCRIPTS="/a.js,/b.js"     # Comma-separated init script paths
 AGENT_BROWSER_ENABLE="react-devtools"        # Comma-separated built-in init script features
+AGENT_BROWSER_HIDE_SCROLLBARS="false"        # Keep native scrollbars visible in headless Chromium screenshots
 AGENT_BROWSER_PROVIDER="browserbase"         # Cloud browser provider
 AGENT_BROWSER_STREAM_PORT="9223"             # Override WebSocket streaming port (default: OS-assigned)
 AGENT_BROWSER_HOME="/path/to/agent-browser"  # Custom install location
@@ -10,7 +10,13 @@ hidden: true
 Fast browser automation CLI for AI agents. Chrome/Chromium via CDP with
 accessibility-tree snapshots and compact `@eN` element refs.

-Install: `npm i -g agent-browser && agent-browser install`
+**Install / self-heal:** if the `agent-browser` (or `abs`) command is missing —
+e.g. a command errors with "command not found" — install it from the GitHub
+Release (no npm, no token), then retry. Do NOT fall back to other browser tools:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/leeguooooo/agent-browser-stealth/main/install.sh | sh
+```

 ## Start here
Author	SHA1	Message	Date
leeguooooo	dc54855784	chore(release): bump to 0.27.0-fork.13 — --profile auto + temp-profile warnings Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled Stops agents from silently launching a temporary empty profile (no login). Adds --profile auto, warns on bare --launch, and recommends --profile auto in connect-failure errors. Addresses issue #1 follow-up.	2026-06-01 18:30:28 +09:00
leeguooooo	ed61be3359	feat(profile): --profile auto + stop steering users into temp-profile launches Addresses the footgun raised in issue #1 follow-up: plain `--launch` silently uses a temporary EMPTY profile (no cookies/login), and the connect-failure error even recommended it — trapping agents into thinking they reused the logged-in browser when they didn't. - `--profile auto`: resolves to the Chrome profile last used (from Local State `profile.last_used`), falling back to "Default", then the first profile. So `--launch --profile auto open <url>` reuses real login state without naming the profile. (--profile <name>/Default already worked.) - connect-failure error now recommends `--launch --profile auto` and states plainly that bare `--launch` is a temporary EMPTY profile — no cookies/login. - bare `--launch` (no --profile, not CI) now prints a warning to that effect. - README: fix Setup (relaunch with --remote-debugging-port, not chrome://inspect) and split Standalone mode into throwaway vs. keep-your-login (`--profile auto`). Tests: resolve_chrome_profile("auto") prefers last_used, falls back to Default.	2026-06-01 18:30:11 +09:00
leeguooooo	54b61f4375	docs(readme): fix Setup (remote-debugging-port, not chrome://inspect) + clarify aliases Addresses issue #1. The "Setup (one time)" section told users to toggle chrome://inspect, which only enables target discovery and is NOT enough to attach — the most-reported first-run failure. Replace with the correct model: relaunch Chrome with --remote-debugging-port (a startup flag), expect the Chrome 136+ "Allow remote debugging?" consent dialog, and use --launch as a zero-setup fallback. Add a "Command names" note that agent-browser / agent-browser-stealth / abs are the same binary (stealth is runtime behavior, not a separate executable).	2026-06-01 18:12:18 +09:00
leeguooooo	9ae82d620e	chore(release): bump to 0.27.0-fork.12 — embedded skills for single-binary install Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled `abs skills get core` now works on GitHub-Release/install.sh installs (skill content is embedded in the binary and extracted to a cache dir on first use). First release via the automated tag-push -> release-binaries CI flow.	2026-06-01 17:24:56 +09:00
leeguooooo	8f67cff3e1	fix(skills): embed skill content in the binary for single-binary installs `skills get core` (the first step the agent-browser skill stub tells agents to run) failed with "Skills directory not found" on a GitHub-Release / install.sh install: only the binary is shipped, with no adjacent skills/ or skill-data/ the way an npm install bundles them, so find_package_root() returned nothing. Embed skills/ and skill-data/ into the binary via include_dir (168K) and, when no on-disk skill dirs are found, extract them once to a per-version cache dir ($CACHE/agent-browser/skills-<version>/) and serve from there. npm/dev installs still use the on-disk dirs unchanged. Verified: from an isolated dir (no skills/ nearby), `skills list` shows all 6 skills and `skills get core` serves content.	2026-06-01 17:24:34 +09:00
leeguooooo	e70d841a94	fix(install): resolve latest release via redirect, not the rate-limited API install.sh resolved the latest tag through api.github.com/.../releases/latest, which rate-limits unauthenticated callers to 60/hr and returned 403 in testing. Use the github.com/<repo>/releases/latest 302 redirect instead (web host, not rate-limited) and parse the tag from the resolved /releases/tag/<TAG> URL. Verified: `curl … install.sh \| sh` resolves v0.27.0-fork.11, downloads the darwin-arm64 asset, verifies the .sha256, installs agent-browser + abs.	2026-06-01 17:09:54 +09:00
leeguooooo	6032deabd5	feat(dist): ship via GitHub Release binaries + install.sh (drop npm as primary) Distribute the prebuilt binary through GitHub Releases instead of the npm registry — zero auth for the publisher (CI's GITHUB_TOKEN) and zero auth for consumers (no npm token / 2FA / OTP, no GitHub Packages .npmrc). - install.sh: detects OS/arch (incl. linux musl), downloads the matching agent-browser-<platform>.tar.gz from the GitHub Release, verifies .sha256, installs `agent-browser` + `abs` to /usr/local/bin or ~/.local/bin. Override via AGENT_BROWSER_VERSION / AGENT_BROWSER_BIN_DIR. - .github/workflows/release-binaries.yml: on tag push (v*), build all 7 platform variants (reusing the zigbuild cross-compile matrix), package each as .tar.gz + .sha256, attach to the tag's GitHub Release. No npm, no token. - remove .github/workflows/release.yml: it published to npm (--provenance) and built the (removed) dashboard, so it broke on every main push. - README install now leads with `curl … install.sh \| sh`; npm demoted to a legacy alternative. - skill stub self-heals: if `agent-browser` is missing, run install.sh (don't fall back to other browser tools).	2026-06-01 16:46:11 +09:00
leeguooooo	27dff19105	chore(release): bump to 0.27.0-fork.11 — FullLaunch stealth now fully applied Fixes the longstanding FullLaunch (--launch) stealth gap: handle_launch's fresh-launch path now calls apply_stealth_to_browser, so the 32 JS fingerprint patches and the HeadlessChrome→Chrome UA strip run on launched browsers (they never did before — only the launch flags applied). Verified FullLaunch headless: navigator.webdriver=false, navigator.userAgent=Chrome/<v> (no HeadlessChrome), new tabs + initial page clean, bot.sannysoft.com 0 failed / 31 passed.	2026-06-01 14:45:12 +09:00
leeguooooo	21d591ee65	fix(stealth): apply stealth on the --launch path (FullLaunch JS patches + UA strip) handle_launch's fresh-launch path (the path `--launch open <url>` takes) never called apply_stealth_to_browser — only the launch FLAGS were applied (e.g. --disable-blink-features=AutomationControlled, which is why navigator.webdriver was already false). As a result the 32 JS fingerprint patches and the Emulation.setUserAgentOverride HeadlessChrome→Chrome UA strip NEVER ran on a launched browser: navigator.userAgent kept the HeadlessChrome marker (a longstanding bug — identical on the prior prebuilt binary). Add the apply_stealth_to_browser call after launch (the auto_launch path already had it; only the explicit-launch path was missing it). Verified, FullLaunch headless: - navigator.webdriver === false, navigator.userAgent => Chrome/<v> (no Headless) - new tabs and the initial page both clean - bot.sannysoft.com: 0 failed / 31 passed	2026-06-01 14:39:03 +09:00
leeguooooo	a6b2f5a192	chore(release): bump to 0.27.0-fork.10 — UX batch + stealth coverage/webdriver Fixes since fork.9 (UX audit batch): - stealth: per-session coverage so new tabs (tab new) and cross-origin iframe sessions get patched (were unpatched/detectable) - stealth: navigator.webdriver = false (boolean), not undefined — never delete the property (undefined is itself a detection tell) - hygiene: sweep orphaned temp Chrome profiles on daemon startup (only dirs no live process references) — fixes the kill -9 temp-dir disk leak - ux: success-with-no-data prints "Done" instead of a silent exit 0 - ux: top-level aliases for `get` reads (url, cdp-url, title, html, text, ...) - ux: clearer connect errors (consent dialog, "startup flag" guidance, and --cdp on Chrome 136+ points to auto-connect) Known follow-up (not in this release): FullLaunch (--launch) browsers don't get the JS patches / UA-strip applied (navigator.userAgent still shows HeadlessChrome); secondary to the primary CdpAttach mode. Tracked for a dedicated fix.	2026-06-01 14:25:08 +09:00
leeguooooo	7a1ca90416	fix(stealth): webdriver = false (not undefined) — never delete the property The webdriver patch deleted navigator.webdriver, leaving it `undefined`. Real Chrome reports `false`, so `undefined` is itself a detection tell, and deleting it also removes the native `false` that Emulation.setAutomationOverride sets. Now we rely on setAutomationOverride for a native (undetectable) `false` and only force `false` via a getter as a fallback when webdriver is still `true` (older Chrome without that override) — never delete it. Verified: FullLaunch headless now reports navigator.webdriver === false (boolean), consistently.	2026-06-01 13:41:49 +09:00
leeguooooo	ad0fb424c3	fix(ux): silent-output, command aliases, and clearer connection errors - output: a success response with no data payload now prints "Done" instead of nothing (a silent exit 0 looked like a no-op). - commands: add top-level aliases for `get` status reads — `url`, `cdp-url` (and `cdp_url`), `title`, `html`, `text`, `value`, `count`, `box`, `styles`, `attr` — so `agent-browser url` no longer errors "Unknown command". - connect errors now explain the Chrome 136+ realities: - connect-failure mentions the "Allow remote debugging?" consent dialog and that remote debugging is a startup flag, not a setting. - no-Chrome error tells the user to relaunch Chrome with --remote-debugging-port (auto-connect then works). - --cdp discovery failure explains Chrome 136+ dropped the HTTP discovery endpoints and to use the default auto-connect instead.	2026-06-01 12:49:35 +09:00
leeguooooo	f62e204038	fix(stealth,hygiene): per-session stealth coverage + orphaned temp-profile sweep Stealth coverage (the fork's core value was leaking on secondary surfaces): - stealth scripts are registered per CDP session, so new tabs (`tab new`) and cross-origin iframe sessions created after the initial page had NO patches. Extract apply_stealth_via_mgr/apply_stealth_to_session and re-apply on tab_new and on iframe attach. Fixes automation markers (and FullLaunch UA) leaking in new tabs / cross-origin frames. Resource hygiene (temp profiles filled the disk): - ChromeProcess::drop already cleans the temp user-data-dir on normal exit, but a hard kill (kill -9 / version-mismatch restart / crash) skips Drop and leaks ~50MB per session. Add cleanup_orphaned_chrome_profiles() on daemon startup that sweeps agent-browser-chrome-* temp dirs NOT referenced by any live process (so an in-use profile is never deleted).	2026-06-01 12:38:57 +09:00
leeguooooo	6f4e63ba91	chore(release): bump to 0.27.0-fork.9 — upstream sync + CDP consent fix Upstream cherry-picks (onto v0.27.0 base): - security: same-origin stream command relay (#1355) - feat: hide scrollbars in headless screenshots (#1396) - chore: pnpm minimum release age + node pinning (#1377, fork-adapted) Fork fixes: - fix(connect): stop remote-debugging consent storm — is_connection_alive no longer tears down an externally-attached browser on a transient liveness timeout (was an endless prompt loop / browser freeze) - fix(connect): single consenting WebSocket — drop the throwaway verify probe so the user's one "Allow remote debugging?" click sticks to the real connection	2026-06-01 12:26:16 +09:00
leeguooooo	98622a7415	fix(connect): single consenting WebSocket — drop throwaway verify probe auto-connect resolved the DevToolsActivePort URL by first opening a verification WebSocket (verify_ws_endpoint: connect, Browser.getVersion, close) and only then opening the real connection. On Chrome 136+ the "Allow remote debugging?" consent is granted per-connection, so the user's single Allow click was consumed by the throwaway probe and the real connection (opened afterwards) asked again — surfacing as repeated prompts or a hung command after the user had already clicked Allow. resolve_cdp_from_active_port now gates the direct DevToolsActivePort URL on a consent-free TCP liveness check (tcp_port_alive) instead of a WebSocket probe, so the real connection is the single WebSocket the user consents to. A bare TCP connect does not trigger the consent flow (that fires on the CDP upgrade), and the real connect_async has no client-side timeout, so it waits for the user to click Allow at their own pace. verify_ws_endpoint removed; discovery-order tests updated, plus a guard test that resolution opens no WebSocket. Verified live: single prompt on a real Chrome attach, then open + eval + scroll x2 + eval with zero re-prompts and no freeze.	2026-06-01 12:20:22 +09:00
leeguooooo	3d032f9e88	fix(connect): stop remote-debugging consent storm on transient liveness timeout The daemon re-validates the CDP connection before every browsing command via is_connection_alive() (Browser.getVersion, 3s timeout). It treated any timeout-or-error as "dead" and tore the connection down + reconnected. For an externally-attached browser (the stealth fork's default — the user's real Chrome), a timed-out probe is almost always Chrome being briefly busy or showing the Chrome 136+ "Allow remote debugging?" consent modal, which blocks CDP responses until the user clicks Allow. Tearing the already-consented connection down forces a reconnect that re-pops the consent prompt — repeated on every command this becomes an endless prompt loop, and the close + multiple new /devtools/browser WS probes storm Chrome into a freeze. Fix: distinguish the probe outcome. - Responded -> alive - TransportError -> dead (WS closed/reset; user closing Chrome lands here too, so zombie-socket detection is preserved) - TimedOut -> alive for an external attach (don't tear down a consented connection on transient slowness); dead for a browser we launched ourselves (a real hang worth reconnecting, and no consent modal in play). Extracted the verdict into a pure connection_alive_from_probe() with unit tests covering all outcomes. No behavior change for locally-launched browsers.	2026-06-01 11:36:00 +09:00
leeguooooo	d027659571	feat(screenshot): hide scrollbars in headless screenshots (cherry-pick b4f2f37) Cherry-picks upstream agent-browser #1396. Adds a configurable --hide-scrollbars flag (AGENT_BROWSER_HIDE_SCROLLBARS env, hideScrollbars config key, default true) that appends Chrome's --hide-scrollbars launch arg for headless (non-extension) launches so native scrollbars aren't painted into screenshots. Plumbed through flags.rs, connection.rs, main.rs, native/actions.rs and native/cdp/chrome.rs; help text in output.rs + skill-data. Fork adaptation: - the arg lands in the headless && !has_extensions block, separate from the stealth base args — no interaction with anti-detection. - dropped upstream docs/, agent-browser.schema.json and README hunks (removed or rewritten in this fork). Verified: cargo check --tests passes.	2026-06-01 10:35:20 +09:00
leeguooooo	44b6218ef9	chore(ci): adopt upstream pnpm release-age + node pinning (cherry-pick 4ad2848) Cherry-picks upstream agent-browser #1377 (chore: enforce pnpm minimum release age), adapted for the fork: - add .node-version (24); workflows read node-version-file instead of inline - pin packageManager pnpm@11.1.3; drop hard-coded pnpm/action-setup versions - pnpm-workspace.yaml: add minimumReleaseAge (48h supply-chain cooldown) + allowBuilds allowlist, keeping our trimmed packages list (no packages/*, docs) Deliberately dropped from upstream: - engines.node >=24 / engines.pnpm >=11 — would impose a Node 24 floor on end-users of the published agent-browser-stealth CLI (a compiled binary that doesn't need it). packageManager + .node-version cover dev/CI pinning. - docs/ and README hunks — those paths are removed/rewritten in this fork.	2026-06-01 10:34:27 +09:00
Chris TateandMuhtasham	e93acc68f8	Require same-origin stream commands (#1355 ) * Require same-origin stream commands Protect the per-session command relay from browser-originated cross-origin requests while preserving same-origin dashboard access. Co-authored-by: Muhtasham <20128202+Muhtasham@users.noreply.github.com> * Harden stream command origin checks Require command relay requests to come from loopback same-origin metadata and prevent request bodies from spoofing security headers. Co-authored-by: Muhtasham <20128202+Muhtasham@users.noreply.github.com> --------- Co-authored-by: Muhtasham <20128202+Muhtasham@users.noreply.github.com>	2026-06-01 10:32:44 +09:00
leeguooooo	d2a33cc005	fix(scripts): serialize all-platforms build + per-pid wait checks Two related bugs that conspired to ship stale linux binaries on 0.27.0-fork.5/.7/.8 (caught only by manually grepping the embedded version string each release): 1. build:all-platforms used `(... & npm run build:linux & wait)`. The bare `wait` waits for ALL children but exits with the LAST waited child's status, not each individually. So if linux fell over and windows succeeded last, the script reported success. Worse, when both processes shared cli/target/ and fought over cargo's filesystem locks, one would silently bail out and the missing binary just stayed at the previous release's bytes. Now serial: `npm run build:linux && npm run build:windows && npm run build:macos`. Costs ~3 extra minutes wall-clock vs. parallel; trades latency for "every release ships what it says". 2. build:macos had the same `(... & ... & wait)` parallel pattern for arm64 + x64 cross-compiles. Native cargo builds against the same target/ dir share even more state than the docker'd Linux build did, so the failure mode is the same. Now uses explicit `PID1=$!; PID2=$!; wait $PID1 \|\| exit 1; wait $PID2 \|\| exit 1` so both must succeed. Companion to the docker-compose $$ fix in `947d150` (which fixed the inside-container wait+cp eating shell vars). This one fixes the outer npm-script layer.	2026-05-09 12:58:39 +09:00