feat(relay): group-scoped Target.getTargets — restore follow-popup + cross-session adopt under isolation (#40 )

Move multi-agent isolation from blunt daemon-side filtering to relay-side group scoping, so a session can adopt new tabs again (follow-popup, OAuth results, cross-session adopt-by-targetId) without ever seeing the user's or another agent's tabs. Relay (relay.rs): track client->group (announced via new local ABRelay.setGroup, or the first createTarget's agentGroup) and target->group (created tabs tagged from the createTarget reply; an explicit attachToTarget tags the target into the adopter's group = #21; a pop-up inherits its opener's group via openerTargetId). Target.getTargets returns ONLY the requesting client's group; a client that never announced a group (older daemon) gets the full list — fully backward-compatible. +5 unit tests. Daemon (browser.rs): announce_group() on connect sets relay_scoped. Adoption in discover/resync/adopt_newly_opened is re-enabled ONLY when relay_scoped; without it (launch / real CDP / older relay that didn't answer the announce) the daemon keeps strict daemon-side isolation. So this can't regress the 125/125 isolation. Extension (ab-connect 0.4.10): synthesized Target.attachedToTarget targetInfo now carries openerTargetId (pop-ups inherit opener's group) and abGroup (the tab-group title, so the relay re-attributes existing tabs after ITS own restart, since createTarget tagging won't re-run). tabScopeHints(). Back-compat verified live: new daemon + OLD relay -> announce fails -> relay_scoped=false -> strict fallback, open/eval/url all work. The new extension (publish to CWS, strip manifest key) activates follow-popup; relay+daemon ship now. 861 tests pass.
feat: rich-editor fill, box centers, screenshot downscale, disabled+docs (#41-#45)
2026-06-17 18:14:13 +09:00 · 2026-06-17 17:49:38 +09:00 · 2026-06-17 17:15:34 +09:00 · 2026-06-17 16:02:40 +09:00 · 2026-06-17 14:49:52 +09:00 · 2026-06-17 14:15:52 +09:00
21 changed files with 2091 additions and 160 deletions
@@ -205,6 +205,50 @@ chrome-use --launch --profile auto open https://x.com/home

 In CI environments, standalone mode is used automatically.

+## Site adapters — turn a website into a structured-data CLI
+
+Most "read GitHub issues" / "search Reddit" / "get my Bilibili feed" tasks don't
+need clicking and screenshotting at all — the site already has a JSON API behind
+its own login. A **site adapter** is a tiny JS function that calls that API *from
+inside your logged-in tab* (your cookies, same-origin `fetch`, the site's own
+modules) and returns clean JSON. The site can't tell it apart from you, because it
+*is* you.
+
+chrome-use ships none of these adapters — `site update` fetches the community
+[**bb-sites**](https://github.com/epiral/bb-sites) pack at runtime (like a package
+manager pulling a dependency), then runs them over chrome-use's stealth transport:
+
+```bash
+chrome-use site update                          # fetch the adapter pack (~145 commands)
+chrome-use site list                            # github/issues, reddit/search, bilibili/feed, …
+chrome-use site info github/issues              # see an adapter's args + domain
+
+# Run one — navigates to the site (reusing the tab if you're already there) and returns JSON
+chrome-use site github/issues epiral/bb-browser --json
+chrome-use site reddit/search "rust async" --json
+chrome-use site bilibili/feed --json            # works because it's your logged-in session
+```
+
+Positional args fill the adapter's declared args in order; `--key value` overrides
+by name. Adapters are authored by the bb-sites community and remain their authors'
+property — chrome-use just runs them.
+
+**Auto-sync + auto-suggest.** You rarely type `site update` yourself: chrome-use
+syncs the pack on first use and refreshes it weekly in the background (tune with
+`AGENT_BROWSER_SITES_TTL_DAYS`, disable with `AGENT_BROWSER_SITES_NO_AUTO_UPDATE=1`).
+And when you `open`/`snapshot` a page whose domain has adapters, chrome-use surfaces
+them right in the output — a `💡 site adapters for <domain>` line, plus a
+`siteAdapters` field under `--json` — so an agent reaches for the structured-data
+adapter instead of scraping the DOM:
+
+```text
+$ chrome-use open https://github.com
+💡 site adapters for github.com — prefer these for structured data:
+   github/issues, github/me, github/repo, …
+   e.g. chrome-use site github/issues --json
+✓ GitHub
+```
+
 ## Automated testing (`chrome-use test`)

 Turn the repetitive "open it, click around, check it's right" work into a
@@ -326,3 +370,6 @@ We deliberately **don't ship our own bot detector** — the strongest, most hone
 ## License

 Apache-2.0
+---
+
+> Built by **leeguooooo** — field notes on AI agents, reverse engineering & Cloudflare Workers at **[blog.misonote.com](https://blog.misonote.com)** · follow on **[X @leeguooooo](https://x.com/leeguooooo)**
@@ -63,6 +63,25 @@ chrome-use 让**任意** agent（Claude Code、Cursor、Codex、你自己的脚

 每个 `--session` 拿到**自己的彩色标签组**，多个 agent 共用同一个真实浏览器、互不干扰，也不动你自己的标签页。

+## 为什么用扩展（而非裸调试端口）
+
+其他本地工具走裸 `--remote-debugging-port`（CDP）驱动 Chrome。从 **Chrome 136** 起，每次这样连接都会弹出一个阻塞式的 **"Allow remote debugging?"** 同意框 —— 而且端口得提前开好。我们的扩展改用原生消息：**装一次，之后零确认。**
+
+| | **chrome-use**（本扩展） | web-access（裸 CDP 端口） | Claude in Chrome（chrome.debugger） |
+|---|---|---|---|
+| 连接方式 | 原生消息 —— 无端口、无 token | `--remote-debugging-port` | `chrome.debugger` |
+| **"Allow remote debugging?" 弹框** | **从不** ✅ | **每次连都弹** 🔴 | 无 |
+| 复用你的真实登录 | 是 | 是 | 是 |
+| `Runtime.enable`（CDP）泄漏¹ | **默认关闭 → 干净** ✅ | 域已启用 | 不适用 |
+| CreepJS 隐身分² | **0% stealth · 0% headless** ✅ | 真实 Chrome | 真实 Chrome |
+| 每会话标签组 / 并发 agent | **支持** ✅ | 无 | 无 |
+| 为 chrome-use CLI 打造 | 是 | 独立代理 | 单 app 助手 |
+
+> ¹ 对 [rebrowser-bot-detector](https://bot-detector.rebrowser.net/) 实测：我们的中继报 `runtimeEnableLeak: 🟢 No leak`、`navigatorWebdriver: 🟢`。
+> ² 对 [CreepJS](https://abrahamjuliot.github.io/creepjs/) 在「连接真实 Chrome」路径上实测 —— 见 [反检测](#反检测)。
+>
+> 同意框不是假想：裸端口工具**每次** attach 都会弹（Chrome 136+ 安全策略）。扩展路径从不弹。
+
 ## 安装

 ```bash
@@ -71,6 +90,15 @@ curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.

 从最新的 [GitHub Release](https://github.com/leeguooooo/chrome-use/releases) 下载对应平台的预编译二进制，安装 `chrome-use`（以及 `abs` 别名）。无需 npm，无需 token。

+<details>
+<summary>其他安装方式</summary>
+
+- **锁定版本：** `AGENT_BROWSER_VERSION=v0.27.0-fork.12 curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh`
+- **自定义路径：** `AGENT_BROWSER_BIN_DIR=$HOME/bin curl -fsSL … | sh`
+- **Windows：** 从 [Releases 页](https://github.com/leeguooooo/chrome-use/releases) 下载 `chrome-use-win32-x64.tar.gz`，把 `chrome-use.exe` 放进 PATH。
+- **npm（旧渠道）：** `npm install -g chrome-use` —— 仍在发布，但 GitHub Releases 现在是主渠道。
+</details>
+
 ### 安装 AI agent skills

 ```bash
@@ -79,6 +107,10 @@ npx skills add leeguooooo/chrome-use

 把 `skills/chrome-use` 拉进当前项目，让你的 AI agent 拿到正确的用法和预授权的 bash 权限。

+## 命令名
+
+`chrome-use`、`chrome-use`、`abs` 是**同一个二进制** —— `abs` 只是短别名。没有单独的「隐身可执行文件」；隐身是**运行时行为**（见下方 [反检测](#反检测)），根据你是连接真实 Chrome 还是 `--launch` 全新实例自动启用。
+
 ## 连接你的 Chrome

 **推荐 —— 浏览器扩展（一键，无弹窗）。** 从 Chrome 应用商店安装 [**chrome-use** 扩展](https://chromewebstore.google.com/detail/chrome-use/knfcmbamhjmaonkfnjhldjedeobeafmk)，再注册一次本地桥：
@@ -128,8 +160,83 @@ chrome-use --launch open https://example.com

 # 保留登录：用你真实的 Chrome profile 启动
 chrome-use --launch --profile auto open https://x.com/home
+# 或显式指定：--profile Default / --profile "Profile 1"
 ```

+## 站点适配器 —— 把一个网站变成「结构化数据 CLI」
+
+大多数「读 GitHub issue」「搜 Reddit」「拉我的 B 站动态」这类任务，根本不需要点击 +
+截图 —— 网站登录态背后本来就有 JSON 接口。**站点适配器**就是一小段 JS 函数，它在你
+**已登录的标签页内**调用那个接口（用你的 cookie、同源 `fetch`、网站自己的模块），返回
+干净的 JSON。网站分辨不出它和你的区别，因为它**就是你**。
+
+chrome-use 本身不附带任何适配器 —— `site update` 会在运行时拉取社区的
+[**bb-sites**](https://github.com/epiral/bb-sites) 适配器包（就像包管理器拉依赖），
+然后在 chrome-use 的隐身通道上运行它们：
+
+```bash
+chrome-use site update                          # 拉取适配器包（约 145 条命令）
+chrome-use site list                            # github/issues、reddit/search、bilibili/feed…
+chrome-use site info github/issues              # 查看某个适配器的参数 + 域名
+
+# 运行一个 —— 会导航到对应站点（已在该站点则复用当前标签页）并返回 JSON
+chrome-use site github/issues epiral/bb-browser --json
+chrome-use site reddit/search "rust async" --json
+chrome-use site bilibili/feed --json            # 能用，因为走的是你的登录态
+```
+
+位置参数按适配器声明的参数顺序填入；`--key value` 按名覆盖。适配器由 bb-sites 社区编写、
+版权归各自作者所有 —— chrome-use 只负责运行它们。
+
+**自动同步 + 自动提示。** 你基本不用手动 `site update`:chrome-use 首次使用时自动拉取,
+之后每周后台刷新一次(`AGENT_BROWSER_SITES_TTL_DAYS` 调周期,`AGENT_BROWSER_SITES_NO_AUTO_UPDATE=1`
+关闭)。而当你 `open`/`snapshot` 一个有适配器的域名时,chrome-use 会在输出里直接把可用命令
+亮出来 —— 一行 `💡 site adapters for <域名>`,`--json` 下则是 `siteAdapters` 字段 —— 这样
+agent 会直接改用结构化适配器,而不是去扒 DOM:
+
+```text
+$ chrome-use open https://github.com
+💡 site adapters for github.com — prefer these for structured data:
+   github/issues, github/me, github/repo, …
+   e.g. chrome-use site github/issues --json
+✓ GitHub
+```
+
+## 自动化测试（`chrome-use test`）
+
+把反复的「打开它、点一圈、看对不对」变成**可重跑的测试套件** —— 前端的单元测试。用 YAML 写用例；步骤复用 chrome-use 自己的命令，断言编译成一次检查：
+
+```yaml
+# smoke.yaml
+suite: chatgpt smoke
+setup:
+  - account: chatgpt/huayue          # 注入一个 cookie-use 登录（可选）
+cases:
+  - name: home loads logged in
+    steps:
+      - open: https://chatgpt.com/
+      - wait: { load: networkidle }
+    assert:
+      - url: { contains: chatgpt.com }
+      - visible: "#prompt-textarea"
+```
+
+```bash
+chrome-use test smoke.yaml                     # 启动隔离浏览器，跑用例
+chrome-use test smoke.yaml --session default   # …或对你已连接的 Chrome 跑
+```
+
+```
+suite: chatgpt smoke  (session cu-test)
+  ✓ home loads logged in   1.2s
+  ✗ composer takes text    0.8s
+      assert text "#prompt-textarea" contains "hi" → got ""
+      ↳ cu-test-artifacts/composer-takes-text.png
+2 cases · 1 passed · 1 failed
+```
+
+任一用例失败时退出码非零（可直接丢进 CI），失败用例会存截图。断言：`url` · `visible` · `hidden` · `text` · `count` · `eval`。步骤：`open` · `click` · `fill` · `type` · `press` · `wait` · `scroll` · `eval`。完整指南：`chrome-use skills get test`。发现回归？加个用例 —— 用得越多，套件越值钱。
+
 ## 反检测

 连接你真实 Chrome 时，我们**零** JS 注入 —— 浏览器指纹完全是真的。指导原则是 **native CDP/Chrome 覆盖优先于 JS 谎言**：被重定义的 getter 本身可被检测，原生覆盖则不会。
@@ -146,7 +253,9 @@ chrome-use --launch --profile auto open https://x.com/home
 | [rebrowser-bot-detector](https://bot-detector.rebrowser.net/) | `runtimeEnableLeak` 🟢 · `pwInitScripts` 🟢 |
 | [bot.sannysoft.com](https://bot.sannysoft.com) | 全绿 |

-`--launch` 独立模式下会改用一整套隐身补丁，同样过上述检测。
+CreepJS 上的 `0% stealth` 是关键数字：因为连接路径**什么都不打补丁**，根本没有可供说谎检测器抓的 override。（读 `navigator.languages` 顺序或 IP 地理位置的面板可能给个软性的「navigator」/「location」标记 —— 那反映的是*你真实 Chrome* 的语言列表和网络，不是自动化破绽。）
+
+`--launch` 独立模式（全新浏览器）会改用一整套隐身补丁，也能过上述检测 —— 唯一例外：CreepJS 报 **~20% stealth**，因为 srcdoc-iframe 的 `contentWindow` 补丁触发了它的 `hasIframeProxy` 探测（用来藏自动化的 proxy 本身成了破绽）。其余全干净（`0% headless`、sannysoft/browserscan 全绿、Cloudflare 通过）。设 **`AGENT_BROWSER_DISABLE_IFRAME_PROXY=1`** 去掉那个补丁即可拿到干净的 **0% stealth**（代价是放弃小众的 srcdoc-iframe 遮蔽）。**扩展连接路径**（你的真实 Chrome）零 JS 注入、不受影响 —— 它才是货真价实的 0% 路径。

 ### 类人输入（行为隐身）

@@ -167,6 +276,30 @@ chrome-use --launch --profile auto open https://x.com/home

 操作你的真实 Chrome 不该打断你的工作。agent **全程在后台操作**:新标签后台打开(在自己的彩色会话标签组里),**从不强制把标签拽到前台**,并用 `Emulation.setFocusEmulationEnabled` 让每个 agent 标签照常渲染、`document.hasFocus()` / `visibilityState` 仍报 `visible`。于是截图正常、页面不被降频,"标签全程隐藏"也不会变成新的机器人信号。你在自己的标签里照常工作,agent 在旁边默默干活。(想置顶某个标签仍可显式调用命令。)

+### 自己验证
+
+别光听我们说 —— 把你连接的 Chrome 指向最硬的公开检测器,自己对比:
+
+- **[CreepJS](https://abrahamjuliot.github.io/creepjs/)** —— 最全面的指纹 / 说谎检测器
+- **[bot.incolumitas.com](https://bot.incolumitas.com/)** —— 行为 + 指纹打分,方法公开
+- **[BrowserScan](https://www.browserscan.net/bot-detection)** —— Webdriver / User-Agent / CDP / Navigator
+- **[bot.sannysoft.com](https://bot.sannysoft.com)** —— 经典自动化特征清单
+- **[pixelscan.net](https://pixelscan.net/)** · **[iphey.com](https://iphey.com/)** —— 一致性与身份
+
+我们故意**不自带 bot 检测器** —— 最强、最诚实的基准,就是拿市面上最好的检测器去测你的真实浏览器。
+
+### 调参（环境变量）
+
+| 变量 | 默认 | 作用 |
+|---|---|---|
+| `AGENT_BROWSER_CAPTURE_CONSOLE` | 关 | 启用 `Runtime` 域,让 `console` / `errors` 捕获页面输出。关闭可保持最隐身的画像。 |
+| `AGENT_BROWSER_HUMANIZE` | 关 | 类人输入动作:`off`(瞬时)、`fast`(轻量缓动轨迹)、`human`(全套曲线轨迹 + 落点抖动 + 击键节奏 + 缓动滚动/拖拽)。也可用 `--humanize`。默认 `off`;自适应检测器会把 Akamai/PerimeterX/DataDome 守护的页面自动升到 `human`。 |
+| `AGENT_BROWSER_TIMEZONE` | 未设 | 仅 `--launch`。IANA id(如 `Asia/Tokyo`)原生设置时区(Intl + Date 跟随,无 JS 谎言)以匹配代理;`auto` 按 locale 推导。 |
+| `AGENT_BROWSER_BLOCK_WEBRTC` | auto | 仅 `--launch`。设了代理时自动强制 WebRTC 走代理(不泄漏真实 IP)。`1` 无代理时也隐藏本地 IP;`0` 退出。 |
+| `AGENT_BROWSER_HIDE_CANVAS` | 关 | 仅 `--launch`。加入会话稳定的 canvas/audio 指纹噪声。默认关(噪声本身就是一种「谎言」)。 |
+| `AGENT_BROWSER_ADAPTIVE_REF` | 开 | 当保存的 `@ref` 移动且 role/name 重查失败时,按指纹相似度重定位(需高分 + 明显领先,否则明确报错)。`0` 关闭。 |
+| `AGENT_BROWSER_CLICK_MODE` | _(auto)_ | 点击策略。默认先滚动入视、派发坐标点击,若被浮层遮挡则回退 DOM `.click()`。`dom` 始终用 `.click()`(适合 blur 即关的自动补全/菜单项);`coord` 严格只用坐标(遮挡时硬失败)。 |
+
 ## chrome-use 的独特之处

 - **默认 auto-connect** —— `chrome-use open` 连你现有的 Chrome 而非启新的
@@ -181,3 +314,7 @@ chrome-use --launch --profile auto open https://x.com/home
 ## License

 Apache-2.0
+
+---
+
+> 由 **leeguooooo** 打造 —— AI agent、逆向工程与 Cloudflare Workers 的实战笔记见 **[blog.misonote.com](https://blog.misonote.com)** · 关注 **[X @leeguooooo](https://x.com/leeguooooo)**
@@ -290,7 +290,7 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"

 [[package]]
 name = "chrome-use"
-version = "1.5.13"
+version = "1.5.22"
 dependencies = [
 "aes",
 "aes-gcm",
@@ -1,6 +1,6 @@
 [package]
 name = "chrome-use"
-version = "1.5.13"
+version = "1.5.22"
 edition = "2021"
 description = "Fast browser automation CLI for AI agents"
 license = "Apache-2.0"
@@ -34,11 +34,52 @@ pub enum ParseError {
 /// suggestions on an unknown command (issue #29). Not exhaustive — just the
 /// common verbs plus a few known wrong-guesses mapped to the real command.
 const KNOWN_COMMANDS: &[&str] = &[
-    "open", "navigate", "click", "fill", "type", "press", "snapshot", "screenshot", "eval", "get",
-    "text", "html", "frames", "find", "wait", "scroll", "hover", "select", "check", "uncheck",
-    "tab", "tabs", "close", "back", "forward", "reload", "sessions", "status", "daemon", "doctor",
-    "upgrade", "connect", "cookies", "mouse", "keyboard", "stream", "frame", "profiles", "title",
-    "url", "is", "drag", "dialog", "upload",
+    "open",
+    "navigate",
+    "click",
+    "fill",
+    "type",
+    "press",
+    "snapshot",
+    "screenshot",
+    "eval",
+    "get",
+    "text",
+    "html",
+    "frames",
+    "find",
+    "wait",
+    "scroll",
+    "hover",
+    "select",
+    "check",
+    "uncheck",
+    "tab",
+    "tabs",
+    "close",
+    "back",
+    "forward",
+    "reload",
+    "sessions",
+    "status",
+    "daemon",
+    "doctor",
+    "upgrade",
+    "connect",
+    "cookies",
+    "mouse",
+    "keyboard",
+    "stream",
+    "frame",
+    "profiles",
+    "title",
+    "url",
+    "is",
+    "drag",
+    "dialog",
+    "upload",
+    "site",
+    "box",
 ];

 /// Levenshtein distance, capped — small inputs only (command names).
@@ -520,9 +561,37 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
        "fill" => {
            let sel = rest.first().ok_or_else(|| ParseError::MissingArguments {
                context: "fill".to_string(),
-                usage: "fill <selector> <text>",
+                usage: "fill <selector> <text> | fill <selector> --file <path> | fill <selector> --stdin",
            })?;
-            Ok(json!({ "id": id, "action": "fill", "selector": sel, "value": rest[1..].join(" ") }))
+            // Large/multiline content without shell-escaping hell (issue #41):
+            // `fill <sel> --file <path>` reads the value from a UTF-8 file, and
+            // `fill <sel> --stdin` reads it from stdin — sent verbatim, so backticks,
+            // quotes, newlines and non-ASCII pass through untouched.
+            let value = match rest.get(1).copied() {
+                Some("--file") => {
+                    let path = rest.get(2).ok_or(ParseError::InvalidValue {
+                        message: "fill --file requires a path".to_string(),
+                        usage: "fill <selector> --file <path>",
+                    })?;
+                    std::fs::read_to_string(path).map_err(|e| ParseError::InvalidValue {
+                        message: format!("fill --file: cannot read {path}: {e}"),
+                        usage: "fill <selector> --file <path>",
+                    })?
+                }
+                Some("--stdin") => {
+                    use std::io::Read;
+                    let mut buf = String::new();
+                    io::stdin()
+                        .read_to_string(&mut buf)
+                        .map_err(|e| ParseError::InvalidValue {
+                            message: format!("fill --stdin: {e}"),
+                            usage: "fill <selector> --stdin",
+                        })?;
+                    buf
+                }
+                _ => rest[1..].join(" "),
+            };
+            Ok(json!({ "id": id, "action": "fill", "selector": sel, "value": value }))
        }
        "type" => {
            // `--key-events` (alias `--keys`): send real per-character keystrokes
@@ -547,7 +616,9 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
                context: "type".to_string(),
                usage: "type <selector> <text>   (or: type --focused <text>) [--key-events]",
            })?;
-            Ok(json!({ "id": id, "action": "type", "selector": sel, "text": rest[1..].join(" "), "keyEvents": key_events }))
+            Ok(
+                json!({ "id": id, "action": "type", "selector": sel, "text": rest[1..].join(" "), "keyEvents": key_events }),
+            )
        }
        "pick" => {
            // pick <selector|@ref> --option "<text>"  — atomic combobox select:
@@ -761,7 +832,8 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
                            _ => {
                                return Err(ParseError::InvalidValue {
                                    message: format!("scroll --at: invalid coordinate `{}`", val),
-                                    usage: "scroll [direction] [amount] --at <x,y> (e.g. --at 640,400)",
+                                    usage:
+                                        "scroll [direction] [amount] --at <x,y> (e.g. --at 640,400)",
                                })
                            }
                        }
@@ -963,24 +1035,72 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
            // path: file path (contains / or . or ends with known extension)
            let mut full_page = false;
            let mut clip: Option<Value> = None;
+            let mut max_width: Option<u32> = None;
+            let mut max_height: Option<u32> = None;
+            let mut scale: Option<f64> = None;
            let mut positional: Vec<&str> = Vec::new();
            let mut i = 0;
+            // Parse a numeric value for a downscale flag (issue #42).
+            let parse_num = |i: &mut usize, flag: &str| -> Result<String, ParseError> {
+                let v = rest
+                    .get(*i + 1)
+                    .ok_or_else(|| ParseError::MissingArguments {
+                        context: format!("screenshot {flag}"),
+                        usage: "screenshot [--max-width <px>] [--max-height <px>] [--scale <0..1>]",
+                    })?;
+                *i += 1;
+                Ok(v.to_string())
+            };
            while i < rest.len() {
                match rest[i] {
                    "--full" | "-f" => full_page = true,
+                    // Downscale the saved image so retina/full-page shots fit an
+                    // agent's image reader and screenshot px line up with click px (#42).
+                    "--max-width" => {
+                        let v = parse_num(&mut i, "--max-width")?;
+                        max_width = Some(v.parse().map_err(|_| ParseError::InvalidValue {
+                            message: format!("--max-width expects a number, got '{v}'"),
+                            usage: "screenshot --max-width <px>",
+                        })?);
+                    }
+                    "--max-height" => {
+                        let v = parse_num(&mut i, "--max-height")?;
+                        max_height = Some(v.parse().map_err(|_| ParseError::InvalidValue {
+                            message: format!("--max-height expects a number, got '{v}'"),
+                            usage: "screenshot --max-height <px>",
+                        })?);
+                    }
+                    "--scale" => {
+                        let v = parse_num(&mut i, "--scale")?;
+                        let s: f64 = v.parse().map_err(|_| ParseError::InvalidValue {
+                            message: format!("--scale expects a number like 0.5, got '{v}'"),
+                            usage: "screenshot --scale <0..1>",
+                        })?;
+                        if s <= 0.0 || s > 1.0 {
+                            return Err(ParseError::InvalidValue {
+                                message: format!("--scale must be in (0, 1], got '{v}'"),
+                                usage: "screenshot --scale <0..1>",
+                            });
+                        }
+                        scale = Some(s);
+                    }
                    // `--clip x,y,w,h` captures a pixel region (issue #34).
                    "--clip" => {
-                        let raw = rest.get(i + 1).ok_or_else(|| ParseError::MissingArguments {
-                            context: "screenshot --clip".to_string(),
-                            usage: "screenshot --clip <x,y,w,h> [path]",
-                        })?;
+                        let raw = rest
+                            .get(i + 1)
+                            .ok_or_else(|| ParseError::MissingArguments {
+                                context: "screenshot --clip".to_string(),
+                                usage: "screenshot --clip <x,y,w,h> [path]",
+                            })?;
                        let nums: Vec<f64> = raw
                            .split(',')
                            .filter_map(|n| n.trim().parse::<f64>().ok())
                            .collect();
                        if nums.len() != 4 {
                            return Err(ParseError::InvalidValue {
-                                message: format!("--clip expects 'x,y,w,h' (4 numbers), got '{raw}'"),
+                                message: format!(
+                                    "--clip expects 'x,y,w,h' (4 numbers), got '{raw}'"
+                                ),
                                usage: "screenshot --clip <x,y,w,h> [path]",
                            });
                        }
@@ -1026,6 +1146,15 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
            if let Some(c) = clip {
                cmd["clip"] = c;
            }
+            if let Some(w) = max_width {
+                cmd["maxWidth"] = json!(w);
+            }
+            if let Some(h) = max_height {
+                cmd["maxHeight"] = json!(h);
+            }
+            if let Some(s) = scale {
+                cmd["scale"] = json!(s);
+            }
            if let Some(ref fmt) = flags.screenshot_format {
                cmd["format"] = json!(fmt);
            }
@@ -1147,6 +1276,47 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
            Ok(json!({ "id": id, "action": "evaluate", "script": script }))
        }

+        "site" => {
+            // `site <name>/<command> [positional...] [--key value]`. The
+            // `update`/`list`/`info` subcommands are handled CLI-side (main.rs)
+            // and never reach here — by this point `rest[0]` is a `name/cmd`
+            // adapter spec. Load it, map the args onto the adapter's declared
+            // `args`, and emit a `site` action: the daemon navigates to the
+            // adapter's @meta.domain (reusing the tab if already there) and evals
+            // the adapter function in the site's own logged-in page.
+            let spec = rest.first().ok_or(ParseError::InvalidValue {
+                message: "site requires <name>/<command> (run `chrome-use site list`)".to_string(),
+                usage: "site <name>/<command> [args]",
+            })?;
+            let adapter =
+                crate::site::load_adapter(spec).map_err(|e| ParseError::InvalidValue {
+                    message: e,
+                    usage: "site <name>/<command> [args]",
+                })?;
+            let domain = adapter
+                .domain()
+                .ok_or(ParseError::InvalidValue {
+                    message: format!("site: adapter `{spec}` @meta is missing a \"domain\""),
+                    usage: "site <name>/<command>",
+                })?
+                .to_string();
+            // Split remaining args: `--key value` → named, everything else → positional.
+            let mut positional: Vec<String> = Vec::new();
+            let mut named: Vec<(String, String)> = Vec::new();
+            let mut it = rest[1..].iter();
+            while let Some(a) = it.next() {
+                if let Some(key) = a.strip_prefix("--") {
+                    let val = it.next().map(|s| s.to_string()).unwrap_or_default();
+                    named.push((key.to_string(), val));
+                } else {
+                    positional.push(a.to_string());
+                }
+            }
+            let mapped = crate::site::map_args(&adapter, &positional, &named);
+            let script = crate::site::build_eval(&adapter, &mapped);
+            Ok(json!({ "id": id, "action": "site", "domain": domain, "script": script }))
+        }
+
        // === Stealth self-check ===
        "stealth" => {
            // `stealth [status]` — local stealth self-check: mode, live probes
@@ -4128,7 +4298,11 @@ mod tests {
    fn test_type_key_events() {
        // --key-events sends real keystrokes (for autocomplete/combobox) and must
        // not be swallowed into the typed text.
-        let cmd = parse_command(&args("type #postal 201-0001 --key-events"), &default_flags()).unwrap();
+        let cmd = parse_command(
+            &args("type #postal 201-0001 --key-events"),
+            &default_flags(),
+        )
+        .unwrap();
        assert_eq!(cmd["action"], "type");
        assert_eq!(cmd["selector"], "#postal");
        assert_eq!(cmd["text"], "201-0001");
@@ -4426,8 +4600,11 @@ mod tests {
    #[test]
    fn test_screenshot_clip() {
        // `--clip x,y,w,h` captures a pixel region (issue #34); the path still parses.
-        let cmd = parse_command(&args("screenshot --clip 10,20,200,40 out.png"), &default_flags())
-            .unwrap();
+        let cmd = parse_command(
+            &args("screenshot --clip 10,20,200,40 out.png"),
+            &default_flags(),
+        )
+        .unwrap();
        assert_eq!(cmd["action"], "screenshot");
        assert_eq!(cmd["clip"]["x"], 10.0);
        assert_eq!(cmd["clip"]["y"], 20.0);
@@ -5005,7 +5182,10 @@ mod tests {
        assert_eq!(nearest_command("sesions").as_deref(), Some("sessions"));
        assert_eq!(nearest_command("session").as_deref(), Some("sessions"));
        assert_eq!(nearest_command("clik").as_deref(), Some("click"));
-        assert_eq!(nearest_command("screenshits").as_deref(), Some("screenshot"));
+        assert_eq!(
+            nearest_command("screenshits").as_deref(),
+            Some("screenshot")
+        );
        // Nonsense with no close match stays silent.
        assert_eq!(nearest_command("xyzzy"), None);
        // The unknown-command error embeds the suggestion.
@@ -10,6 +10,7 @@ mod flags;
 mod install;
 mod native;
 mod output;
+mod site;
 mod skills;
 mod test_runner;
 #[cfg(test)]
@@ -834,6 +835,105 @@ fn main() {
        exit(test_runner::run_test(suite, &flags));
    }

+    // Handle `site`: site adapters — turn a website into a structured-data CLI by
+    // running a per-command JS adapter inside your logged-in tab. `update`/`list`/
+    // `info` are CLI-side (download/filesystem); `site <name>/<cmd> [args]` falls
+    // through to the daemon dispatch below (navigate to the adapter's domain + eval).
+    if clean.first().map(|s| s.as_str()) == Some("site") {
+        // Auto-sync the adapter pack on first use and periodically (TTL, default
+        // 7d) so adapters stay fresh without a manual `site update`. Skipped for an
+        // explicit `update` (full sync below). Best-effort: offline → cached pack.
+        // Disable with AGENT_BROWSER_SITES_NO_AUTO_UPDATE=1.
+        if clean.get(1).map(|s| s.as_str()) != Some("update") && site::needs_refresh() {
+            let rt = tokio::runtime::Runtime::new().expect("Failed to create tokio runtime");
+            match rt.block_on(site::update()) {
+                Ok(n) => {
+                    eprintln!(
+                        "{}",
+                        color::dim(&format!("site: synced {n} adapters (auto)"))
+                    )
+                }
+                Err(e) => eprintln!(
+                    "{}",
+                    color::dim(&format!(
+                        "site: auto-sync skipped ({e}); using cached adapters"
+                    ))
+                ),
+            }
+        }
+        match clean.get(1).map(|s| s.as_str()) {
+            Some("update") => {
+                let rt = tokio::runtime::Runtime::new().expect("Failed to create tokio runtime");
+                match rt.block_on(site::update()) {
+                    Ok(n) if flags.json => {
+                        println!("{}", json!({ "success": true, "adapters": n }))
+                    }
+                    Ok(n) => println!(
+                        "{} synced {} site adapters → ~/.chrome-use/sites (run `chrome-use site list`)",
+                        color::success_indicator(),
+                        n
+                    ),
+                    Err(e) => {
+                        eprintln!("{} {}", color::error_indicator(), e);
+                        exit(1);
+                    }
+                }
+                return;
+            }
+            Some("list") => {
+                match site::list_adapters() {
+                    Ok(list) if flags.json => {
+                        println!("{}", json!({ "success": true, "adapters": list }))
+                    }
+                    Ok(list) if list.is_empty() => {
+                        println!("no site adapters installed — run `chrome-use site update`")
+                    }
+                    Ok(list) => {
+                        for a in &list {
+                            println!("{a}");
+                        }
+                        eprintln!(
+                            "{}",
+                            color::dim(&format!(
+                                "{} adapters · run: chrome-use site <name>/<cmd> [args]",
+                                list.len()
+                            ))
+                        );
+                    }
+                    Err(e) => {
+                        eprintln!("{} {}", color::error_indicator(), e);
+                        exit(1);
+                    }
+                }
+                return;
+            }
+            Some("info") => {
+                let spec = clean.get(2).cloned().unwrap_or_default();
+                match site::load_adapter(&spec) {
+                    Ok(a) => println!(
+                        "{}",
+                        serde_json::to_string_pretty(&a.meta).unwrap_or_default()
+                    ),
+                    Err(e) => {
+                        eprintln!("{} {}", color::error_indicator(), e);
+                        exit(1);
+                    }
+                }
+                return;
+            }
+            // `site <name>/<cmd> [args]` → fall through to the daemon dispatch.
+            Some(spec) if spec.contains('/') => {}
+            _ => {
+                eprintln!(
+                    "{} usage: chrome-use site <name>/<cmd> [args] | site update | site list | \
+                     site info <name>/<cmd>",
+                    color::error_indicator()
+                );
+                exit(2);
+            }
+        }
+    }
+
    // Handle skills command (doesn't need daemon)
    if clean.first().map(|s| s.as_str()) == Some("skills") {
        skills::run_skills(&clean, flags.json);
@@ -1315,6 +1315,7 @@ pub async fn execute_command(cmd: &Value, state: &mut DaemonState) -> Value {
        "title" => handle_title(state).await,
        "content" => handle_content(state).await,
        "evaluate" => handle_evaluate(cmd, state).await,
+        "site" => handle_site(cmd, state).await,
        "close" => handle_close(state).await,
        "stealth_status" => handle_stealth_status(state).await,
        "snapshot" => handle_snapshot(cmd, state).await,
@@ -2477,7 +2478,10 @@ async fn handle_navigate(cmd: &Value, state: &mut DaemonState) -> Result<Value,
            wb.navigate(url).await?;
            let new_url = wb.get_url().await.unwrap_or_else(|_| url.to_string());
            let title = wb.get_title().await.unwrap_or_default();
-            return Ok(json!({ "url": new_url, "title": title }));
+            return Ok(with_site_hint(
+                json!({ "url": new_url, "title": title }),
+                url,
+            ));
        }
    }

@@ -2544,7 +2548,7 @@ async fn handle_navigate(cmd: &Value, state: &mut DaemonState) -> Result<Value,
        .unwrap_or(false)
    {
        if let Ok(Some(switched)) = mgr.reuse_tab_for_url(url).await {
-            return Ok(switched);
+            return Ok(with_site_hint(switched, url));
        }
    }

@@ -2552,7 +2556,34 @@ async fn handle_navigate(cmd: &Value, state: &mut DaemonState) -> Result<Value,
    // Adaptive humanize: sample the freshly loaded page for known behavioural
    // anti-bot vendors and escalate this session to Human if any are present.
    detect_and_set_humanize(mgr).await;
-    Ok(result)
+    Ok(with_site_hint(result, url))
+}
+
+/// Annotate a navigation/snapshot result with the `site` adapters available for
+/// the page's domain (auto-trigger): when you land on e.g. github.com, the
+/// response carries `siteAdapters: { domain, commands: ["github/issues", …] }` so
+/// the agent reaches for a structured-data adapter instead of scraping. No-op
+/// when nothing matches or the pack isn't synced yet.
+fn with_site_hint(mut result: Value, fallback_url: &str) -> Value {
+    let url = result
+        .get("url")
+        .and_then(|v| v.as_str())
+        .unwrap_or(fallback_url);
+    let host = url::Url::parse(url)
+        .ok()
+        .and_then(|u| u.host_str().map(String::from));
+    if let Some(host) = host {
+        let adapters = crate::site::adapters_for_domain(&host);
+        if !adapters.is_empty() {
+            if let Some(obj) = result.as_object_mut() {
+                obj.insert(
+                    "siteAdapters".to_string(),
+                    json!({ "domain": host, "commands": adapters }),
+                );
+            }
+        }
+    }
+    result
 }

 /// After navigation, probe the page for known anti-bot vendor fingerprints
@@ -2698,6 +2729,47 @@ async fn handle_evaluate(cmd: &Value, state: &DaemonState) -> Result<Value, Stri
    Ok(json!({ "result": result, "origin": url }))
 }

+/// Run a site adapter: navigate to its `@meta.domain` (only if we're not already
+/// there — the point is to run as you, in the page that's already open) and eval
+/// the adapter function in the site's own logged-in page. The CLI/commands.rs has
+/// already loaded the adapter and built the `script`; here we just place the page
+/// and evaluate. Never disrupts the user's foreground tab — navigation happens on
+/// the daemon's own tab (same as every other command on the relay).
+async fn handle_site(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
+    let domain = cmd
+        .get("domain")
+        .and_then(|v| v.as_str())
+        .ok_or("site: missing 'domain'")?
+        .to_string();
+    let script = cmd
+        .get("script")
+        .and_then(|v| v.as_str())
+        .ok_or("site: missing 'script'")?
+        .to_string();
+
+    let current = match state.browser.as_ref() {
+        Some(mgr) => mgr.get_url().await.unwrap_or_default(),
+        None => String::new(),
+    };
+    let on_domain = url::Url::parse(&current)
+        .ok()
+        .and_then(|u| u.host_str().map(|h| h.to_string()))
+        .map(|h| h == domain || h.ends_with(&format!(".{domain}")))
+        .unwrap_or(false);
+    if !on_domain {
+        let nav = json!({ "url": format!("https://{domain}/") });
+        handle_navigate(&nav, state).await?;
+    }
+
+    let eval_cmd = json!({ "script": script });
+    let out = handle_evaluate(&eval_cmd, state).await?;
+    Ok(json!({
+        "result": out.get("result").cloned().unwrap_or(Value::Null),
+        "origin": out.get("origin").cloned().unwrap_or(Value::Null),
+        "domain": domain,
+    }))
+}
+
 /// Local stealth self-check: reports the active mode, live fingerprint probes,
 /// and the list of applied overrides — so an agent (or human) can confirm
 /// stealth is working without driving an external detector, and audit exactly
@@ -2894,6 +2966,13 @@ async fn handle_snapshot(cmd: &Value, state: &mut DaemonState) -> Result<Value,
    let ref_count = refs.len();
    let mut out = json!({ "snapshot": tree, "origin": url, "refs": refs });

+    // Auto-trigger: if this domain has site adapters, surface them so the agent
+    // pulls structured data instead of walking the tree. `with_site_hint` reads
+    // the `url` field, so pass it under that key.
+    if let Some(hint) = with_site_hint(json!({ "url": url }), &url).get("siteAdapters") {
+        out["siteAdapters"] = hint.clone();
+    }
+
    // Canvas/WebGL apps (games, map/3D viewers, drawing tools) paint to a
    // <canvas> and expose almost no accessibility tree, so `snapshot` comes back
    // near-empty and agents get stuck looking for refs that will never exist
@@ -3035,7 +3114,40 @@ async fn handle_screenshot(cmd: &Value, state: &mut DaemonState) -> Result<Value
    )
    .await?;

+    // Downscale the saved image so retina/full-page shots fit an agent's image
+    // reader and screenshot pixels line up with `click x y` CSS px (issue #42).
+    // Explicit --scale / --max-width / --max-height win; otherwise a default cap
+    // (2000px longest edge, AGENT_BROWSER_SCREENSHOT_MAX_EDGE overrides, 0 = off)
+    // applies. Annotated shots are left untouched so ref overlays stay aligned.
+    let mut resized: Option<(u32, u32)> = None;
+    if !annotate {
+        let scale = cmd.get("scale").and_then(|v| v.as_f64());
+        let max_w = cmd
+            .get("maxWidth")
+            .and_then(|v| v.as_u64())
+            .map(|v| v as u32);
+        let max_h = cmd
+            .get("maxHeight")
+            .and_then(|v| v.as_u64())
+            .map(|v| v as u32);
+        let default_edge = if scale.is_none() && max_w.is_none() && max_h.is_none() {
+            std::env::var("AGENT_BROWSER_SCREENSHOT_MAX_EDGE")
+                .ok()
+                .and_then(|s| s.parse::<u32>().ok())
+                .or(Some(2000))
+                .filter(|&e| e > 0)
+        } else {
+            None
+        };
+        resized = downscale_screenshot(&result.path, scale, max_w, max_h, default_edge);
+    }
+
    let mut response = json!({ "path": absolutize_saved_path(&result.path) });
+    if let Some((w, h)) = resized {
+        response["width"] = json!(w);
+        response["height"] = json!(h);
+        response["resized"] = json!(true);
+    }
    if !result.annotations.is_empty() {
        response["annotations"] = serde_json::to_value(&result.annotations)
            .map_err(|e| format!("Failed to serialize annotations: {}", e))?;
@@ -3051,6 +3163,56 @@ async fn handle_screenshot(cmd: &Value, state: &mut DaemonState) -> Result<Value
    Ok(response)
 }

+/// Downscale a saved screenshot in place (issue #42). Resolves the target longest
+/// edge from `scale` (fraction of current), explicit `max_w`/`max_h` caps, or a
+/// `default_edge` cap — whichever yields the smaller image. Only ever shrinks;
+/// no-op (returns None) if the image is already within bounds or can't be read.
+/// Returns the new (width, height) when it actually resized.
+fn downscale_screenshot(
+    path: &str,
+    scale: Option<f64>,
+    max_w: Option<u32>,
+    max_h: Option<u32>,
+    default_edge: Option<u32>,
+) -> Option<(u32, u32)> {
+    let img = image::open(path).ok()?;
+    let (w, h) = (img.width(), img.height());
+    if w == 0 || h == 0 {
+        return None;
+    }
+
+    // Collect candidate scale factors (≤ 1.0); the smallest wins.
+    let mut factor = 1.0f64;
+    if let Some(s) = scale {
+        factor = factor.min(s);
+    }
+    if let Some(mw) = max_w {
+        if w > mw {
+            factor = factor.min(mw as f64 / w as f64);
+        }
+    }
+    if let Some(mh) = max_h {
+        if h > mh {
+            factor = factor.min(mh as f64 / h as f64);
+        }
+    }
+    if let Some(edge) = default_edge {
+        let longest = w.max(h);
+        if longest > edge {
+            factor = factor.min(edge as f64 / longest as f64);
+        }
+    }
+
+    if factor >= 1.0 {
+        return None; // already within bounds — never upscale
+    }
+    let nw = ((w as f64 * factor).round() as u32).max(1);
+    let nh = ((h as f64 * factor).round() as u32).max(1);
+    let resized = img.resize(nw, nh, image::imageops::FilterType::Lanczos3);
+    resized.save(path).ok()?;
+    Some((resized.width(), resized.height()))
+}
+
 async fn handle_click(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
    // First-class coordinate click (issue #8.4): click a raw viewport point with
    // no element resolution. Parsed from `click <x> <y>` / `click --coords x,y`.
@@ -3209,7 +3371,7 @@ async fn handle_fill(cmd: &Value, state: &mut DaemonState) -> Result<Value, Stri
    let mgr = state.browser.as_ref().ok_or("Browser not launched")?;
    let session_id = mgr.active_session_id()?.to_string();

-    interaction::fill(
+    let engine = interaction::fill(
        &mgr.client,
        &session_id,
        &state.ref_map,
@@ -3218,7 +3380,9 @@ async fn handle_fill(cmd: &Value, state: &mut DaemonState) -> Result<Value, Stri
        &state.iframe_sessions,
    )
    .await?;
-    Ok(json!({ "filled": selector }))
+    // Echo the input path used (input/contenteditable/codemirror5/monaco/select)
+    // so the agent can confirm a rich editor was handled, not silently no-op'd (#41).
+    Ok(json!({ "filled": selector, "engine": engine }))
 }

 async fn handle_type(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
@@ -3244,8 +3408,14 @@ async fn handle_type(cmd: &Value, state: &mut DaemonState) -> Result<Value, Stri
            .get("text")
            .and_then(|v| v.as_str())
            .ok_or("Missing 'text' parameter")?;
-        interaction::type_text_into_active_context(&mgr.client, &session_id, text, None, key_events)
-            .await?;
+        interaction::type_text_into_active_context(
+            &mgr.client,
+            &session_id,
+            text,
+            None,
+            key_events,
+        )
+        .await?;
        return Ok(json!({ "typed": text, "focused": true }));
    }

@@ -3493,27 +3663,40 @@ async fn handle_scroll(cmd: &Value, state: &mut DaemonState) -> Result<Value, St
        return Ok(json!({ "scrolled": true, "via": "selector" }));
    }

-    // No selector: dispatch a real (isTrusted) wheel at a viewport coordinate.
-    // This hits the compositor and scrolls whatever scroll container is under the
-    // pointer — including cross-origin iframes that `window.scrollBy` on the top
-    // document silently no-ops on (issue #36). The coordinate is, in priority:
-    //   --at x,y  → that exact pixel
-    //   --frame n → the center of frame n from `chrome-use frames`
-    //   default   → the viewport center
-    let (x, y, via) = if let Some(at) = cmd.get("at").and_then(|v| v.as_array()) {
-        let x = at.first().and_then(|v| v.as_f64()).unwrap_or(0.0);
-        let y = at.get(1).and_then(|v| v.as_f64()).unwrap_or(0.0);
-        (x, y, "at")
-    } else if let Some(n) = cmd.get("frame").and_then(|v| v.as_u64()) {
-        let (x, y) = frame_center(mgr, &session_id, &state.iframe_sessions, n as usize).await?;
-        (x, y, "frame")
-    } else {
-        let (x, y) = viewport_center(mgr, &session_id).await?;
-        (x, y, "center")
-    };
+    // `--at x,y` / `--frame n`: dispatch a real (isTrusted) wheel at a viewport
+    // coordinate. This hits the compositor and scrolls whatever scroll container
+    // is under the pointer — including cross-origin iframes that `window.scrollBy`
+    // on the top document silently no-ops on (issue #36).
+    if cmd.get("at").is_some() || cmd.get("frame").is_some() {
+        let (x, y, via) = if let Some(at) = cmd.get("at").and_then(|v| v.as_array()) {
+            let x = at.first().and_then(|v| v.as_f64()).unwrap_or(0.0);
+            let y = at.get(1).and_then(|v| v.as_f64()).unwrap_or(0.0);
+            (x, y, "at")
+        } else {
+            let n = cmd.get("frame").and_then(|v| v.as_u64()).unwrap_or(0);
+            let (x, y) = frame_center(mgr, &session_id, &state.iframe_sessions, n as usize).await?;
+            (x, y, "frame")
+        };
+        dispatch_wheel(&mgr.client, &session_id, x, y, dx, dy).await?;
+        return Ok(json!({ "scrolled": true, "via": via, "at": [x, y] }));
+    }

-    dispatch_wheel(&mgr.client, &session_id, x, y, dx, dy).await?;
-    Ok(json!({ "scrolled": true, "via": via, "at": [x, y] }))
+    // Default (no selector/at/frame): scroll the page with `window.scrollBy`. This
+    // is the reliable path for ordinary page scrolling; a coordinate wheel at the
+    // viewport centre is NOT a dependable substitute (it no-ops on some pages,
+    // e.g. headless), so the wheel stays opt-in via `--at`/`--frame` for the
+    // cross-origin-iframe case (issue #36).
+    interaction::scroll(
+        &mgr.client,
+        &session_id,
+        &state.ref_map,
+        None,
+        dx,
+        dy,
+        &state.iframe_sessions,
+    )
+    .await?;
+    Ok(json!({ "scrolled": true, "via": "page" }))
 }

 /// Viewport center in CSS pixels, used as the default wheel landing point for
@@ -3836,12 +4019,9 @@ async fn handle_gettext(cmd: &Value, state: &mut DaemonState) -> Result<Value, S
 async fn handle_frames(_cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
    let mgr = state.browser.as_ref().ok_or("Browser not launched")?;
    let session_id = mgr.active_session_id()?.to_string();
-    let frames = super::element::collect_all_frames_text(
-        &mgr.client,
-        &session_id,
-        &state.iframe_sessions,
-    )
-    .await?;
+    let frames =
+        super::element::collect_all_frames_text(&mgr.client, &session_id, &state.iframe_sessions)
+            .await?;
    let list: Vec<Value> = frames
        .iter()
        .enumerate()
@@ -4337,7 +4517,10 @@ async fn handle_cf_status(_cmd: &Value, state: &mut DaemonState) -> Result<Value
    let url = mgr.get_url().await.unwrap_or_default();

    // 1. Is the page a Cloudflare challenge right now?
-    let probe_raw = mgr.evaluate(CF_CHALLENGE_JS, None).await.unwrap_or(Value::Null);
+    let probe_raw = mgr
+        .evaluate(CF_CHALLENGE_JS, None)
+        .await
+        .unwrap_or(Value::Null);
    let probe = parse_json_string(probe_raw, "cf challenge probe").unwrap_or(Value::Null);
    let challenged = probe
        .get("challenged")
@@ -235,6 +235,43 @@ fn prunable_target_ids(
        .collect()
 }

+/// Consecutive missing `getTargets` snapshots before an owned relay tab is
+/// pruned. >1 so a single churning/partial snapshot (other agents opening/closing
+/// tabs) or a brief cross-process-nav gap can't drop the tab the agent is driving.
+const RELAY_PRUNE_MISSES: u32 = 3;
+
+/// Debounced prune for the relay: target ids to drop, mutating per-target miss
+/// counters. A tab in `live_ids` resets to 0; an absent (non-pinned) tab
+/// increments and is pruned only at `RELAY_PRUNE_MISSES`. Counters for
+/// no-longer-tracked targets are forgotten. Pure, so the multi-agent churn
+/// tolerance is unit-testable without a live browser.
+fn debounced_prune_ids(
+    pages: &[PageInfo],
+    live_ids: &HashSet<String>,
+    pinned: Option<&str>,
+    misses: &mut HashMap<String, u32>,
+) -> Vec<String> {
+    let tracked: HashSet<&str> = pages.iter().map(|p| p.target_id.as_str()).collect();
+    misses.retain(|tid, _| tracked.contains(tid.as_str()));
+    let mut prune = Vec::new();
+    for p in pages {
+        let tid = p.target_id.as_str();
+        if live_ids.contains(tid) {
+            misses.remove(tid);
+            continue;
+        }
+        if pinned == Some(tid) {
+            continue;
+        }
+        let c = misses.entry(p.target_id.clone()).or_insert(0);
+        *c += 1;
+        if *c >= RELAY_PRUNE_MISSES {
+            prune.push(p.target_id.clone());
+        }
+    }
+    prune
+}
+
 /// Whether the resolved active page is a tab the session created (its target_id
 /// is in `created_targets`). Pure core of [`BrowserManager::active_is_session_owned`]
 /// so the relay no-hijack rule is unit-testable without a live browser.
@@ -464,6 +501,21 @@ pub struct BrowserManager {
    /// the session's commands onto the wrong page — the wrong-origin-fetch hazard
    /// in the dogfood reports. Falls back to the index if the pinned tab is gone.
    active_target_id: Option<String>,
+    /// Per-target count of CONSECUTIVE `resync_targets` snapshots in which an
+    /// owned tab was missing from `Target.getTargets`. Over the relay a single
+    /// snapshot routinely omits live tabs (multi-agent churn, a cross-process nav
+    /// briefly dropping the target), so we must not prune on one miss — that lost
+    /// the tab the agent was driving. A tab is removed only after it's been absent
+    /// for `RELAY_PRUNE_MISSES` consecutive snapshots; any snapshot that includes
+    /// it resets the counter. Keyed by stable target_id.
+    relay_target_misses: HashMap<String, u32>,
+    /// Whether the relay accepted this session's group announcement and is
+    /// therefore scoping `Target.getTargets` to our own tab group (issue #40).
+    /// When true the daemon can safely adopt new targets again (follow-popup,
+    /// cross-session adopt) — the relay has already filtered out foreign tabs.
+    /// When false (launch-on-real-CDP, or an older relay that didn't answer the
+    /// announce) the daemon keeps strict daemon-side isolation.
+    relay_scoped: bool,
    next_tab_id: u32,
    /// Whether to enable the CDP `Runtime` domain (console / error / exception capture).
    /// OFF by default for stealth: a live `Runtime.enable` is a detectable CDP signal
@@ -579,7 +631,10 @@ impl BrowserManager {
        crate::connect::log_connect_mode(
            &ws_url,
            true,
-            DAEMON_SESSION.get().map(String::as_str).unwrap_or("default"),
+            DAEMON_SESSION
+                .get()
+                .map(String::as_str)
+                .unwrap_or("default"),
        );
        let manager = if engine == "lightpanda" {
            initialize_lightpanda_manager(ws_url, process).await?
@@ -597,6 +652,8 @@ impl BrowserManager {
                visited_origins: HashSet::new(),
                created_targets: HashSet::new(),
                active_target_id: None,
+                relay_target_misses: HashMap::new(),
+                relay_scoped: false,
                next_tab_id: 1,
                capture_console: console_capture_enabled(),
            };
@@ -681,7 +738,10 @@ impl BrowserManager {
        crate::connect::log_connect_mode(
            &ws_url,
            false,
-            DAEMON_SESSION.get().map(String::as_str).unwrap_or("default"),
+            DAEMON_SESSION
+                .get()
+                .map(String::as_str)
+                .unwrap_or("default"),
        );
        let client = Arc::new(CdpClient::connect_with_headers(&ws_url, headers).await?);
        let mut manager = Self {
@@ -696,6 +756,8 @@ impl BrowserManager {
            visited_origins: HashSet::new(),
            created_targets: HashSet::new(),
            active_target_id: None,
+            relay_target_misses: HashMap::new(),
+            relay_scoped: false,
            next_tab_id: 1,
            capture_console: console_capture_enabled(),
        };
@@ -771,6 +833,10 @@ impl BrowserManager {
            )
            .await?;

+        // Announce our group FIRST so the relay scopes the getTargets below to our
+        // own tab group (issue #40). On a launched browser this is a no-op.
+        let scoped = self.announce_group().await;
+
        let page_targets: Vec<TargetInfo> = self.collect_page_targets().await?;

        if page_targets.is_empty() {
@@ -817,7 +883,19 @@ impl BrowserManager {
            self.active_page_index = 0;
            self.pin_active_target();
            self.enable_domains(&attach_result.session_id).await?;
+        } else if self.agent_group().is_some() && !scoped {
+            // STRICT MULTI-AGENT ISOLATION fallback (relay, but the group announce
+            // didn't take — e.g. an older relay). Without relay-side scoping,
+            // `page_targets` could be the USER's and OTHER agents' tabs, so this
+            // session must NOT adopt any of them — adopting foreign tabs is what let
+            // another agent's tab churn drop the tab we were driving (multi-agent
+            // failure). Open our own dedicated background tab and pin it instead.
+            self.tab_new(None, None).await?;
        } else {
+            // Either a browser WE launched (every tab is ours) or the relay has
+            // scoped getTargets to our own tab group (#40) — so `page_targets` are
+            // all ours: adopt them (this restores follow-popup + cross-session
+            // adopt under isolation, since foreign tabs were already filtered out).
            for target in &page_targets {
                let attach_result: AttachToTargetResult = self
                    .client
@@ -843,24 +921,10 @@ impl BrowserManager {
                    target_type: target.target_type.clone(),
                });
            }
-
-            if self.agent_group().is_some() {
-                // Relay: the adopted tabs above are the USER's, in their real
-                // Chrome. NEVER make one of them the agent's working tab — that is
-                // how commands drifted onto whatever page the user was viewing
-                // between steps (eval/click/get landed on the user's foreground
-                // tab; #35). Open our own dedicated background tab in the session's
-                // group and pin THAT as active. The user's tabs stay adopted (so
-                // `tab list` / explicit `tab switch` can reach them) but are never
-                // auto-selected — the agent only ever drives a tab it owns.
-                self.tab_new(None, None).await?;
-            } else {
-                // A browser we launched: every tab is ours, so the first is fine.
-                self.active_page_index = 0;
-                self.pin_active_target();
-                let session_id = self.pages[0].session_id.clone();
-                self.enable_domains(&session_id).await?;
-            }
+            self.active_page_index = 0;
+            self.pin_active_target();
+            let session_id = self.pages[0].session_id.clone();
+            self.enable_domains(&session_id).await?;
        }

        Ok(())
@@ -1065,6 +1129,17 @@ impl BrowserManager {
        };

        if let Some(ref error_text) = nav_result.error_text {
+            // `data:` URLs abort over the extension relay: chrome.debugger /
+            // chrome.tabs can't drive a top-frame data: navigation, so it comes
+            // back net::ERR_ABORTED on an about:blank tab. Explain it instead of
+            // leaking the cryptic code (data: works fine under `--launch`).
+            if url.starts_with("data:") && error_text.contains("ERR_ABORTED") {
+                return Err(format!(
+                    "Navigation failed: {error_text}. Chrome blocks top-frame `data:` URLs over \
+                     the extension relay — use a real http(s):// or file:// URL, or run with \
+                     `--launch` (where data: URLs work)."
+                ));
+            }
            return Err(format!("Navigation failed: {}", error_text));
        }

@@ -1202,13 +1277,21 @@ impl BrowserManager {
    pub async fn evaluate(&self, script: &str, _args: Option<Value>) -> Result<Value, String> {
        let session_id = self.active_session_id()?.to_string();

-        // `replMode: true` matches the DevTools console: top-level `let`/`const`
-        // can be re-declared across successive `eval`s instead of throwing
-        // "Identifier 'x' has already been declared" (issue #38 — independent
-        // `eval` steps in a test suite collided in the page's shared lexical
-        // scope), and top-level `await` is allowed. Completion-value and
-        // main-world semantics are unchanged. Built as raw params so the other
-        // ~28 EvaluateParams literals don't all need a new field.
+        // `replMode: true` lets successive `eval`s re-declare top-level
+        // `let`/`const` instead of throwing "Identifier 'x' has already been
+        // declared" (issue #38 — independent `eval` steps in a test suite collided
+        // in the page's shared lexical scope). BUT replMode and `awaitPromise` are
+        // mutually exclusive in Chrome: under replMode a returned promise is NOT
+        // awaited (it serialises to `{}`), which breaks `fetch(...).then(...)` and
+        // every other async eval. So enable replMode ONLY for synchronous scripts
+        // that declare a top-level `let`/`const`; promise-returning scripts keep
+        // `awaitPromise` (no replMode) — exactly the pre-#38 behaviour.
+        let mentions_async = script.contains("await")
+            || script.contains(".then(")
+            || script.contains("fetch(")
+            || script.contains("Promise");
+        let declares = script.contains("let ") || script.contains("const ");
+        let repl_mode = declares && !mentions_async;
        let result: EvaluateResult = self
            .client
            .send_command_typed(
@@ -1216,8 +1299,8 @@ impl BrowserManager {
                &json!({
                    "expression": script,
                    "returnByValue": true,
-                    "awaitPromise": true,
-                    "replMode": true,
+                    "awaitPromise": !repl_mode,
+                    "replMode": repl_mode,
                }),
                Some(&session_id),
            )
@@ -1501,6 +1584,22 @@ impl BrowserManager {
    /// the active tab, per #7/#8.1); the caller surfaces it so the agent knows a
    /// tab opened instead of seeing the old page (issue #24-A).
    pub async fn adopt_newly_opened(&mut self, before: &HashSet<String>) -> Option<PageInfo> {
+        // STRICT MULTI-AGENT ISOLATION: on the relay this session's `before` set is
+        // only its OWN tabs, so EVERY foreign tab (the user's, other agents') looks
+        // "new" relative to it and would be adopted here — exactly the leak where a
+        // concurrent agent's tabs (github/Lark/iphone-use) showed up in this
+        // session mid-flow. A tab the agent itself opened (a pop-up) can't be
+        // distinguished from a foreign tab over the relay (no opener/window/group
+        // in the synthesized targetInfo), so don't adopt anything: the agent drives
+        // only tabs it explicitly created, and pop-ups (e.g. an OAuth/login window)
+        // are the user's. A launched browser (every tab ours) still follows pop-ups.
+        // Strict isolation only when on the relay WITHOUT group scoping: there a
+        // pop-up can't be told apart from a foreign tab, so adopt nothing. When the
+        // relay IS scoping (#40), getTargets returns only our group, so a tab that
+        // appeared after our own action is genuinely ours (a pop-up) — adopt it.
+        if self.agent_group().is_some() && !self.relay_scoped {
+            return None;
+        }
        let result: GetTargetsResult = self
            .client
            .send_command_typed("Target.getTargets", &json!({}), None)
@@ -1543,6 +1642,11 @@ impl BrowserManager {
                title: sanitize_title(&target.title),
                target_type: target.target_type.clone(),
            };
+            // A tab that appeared right after THIS session's action (a click that
+            // opened a popup/new tab) is ours — record it as owned so it's tracked,
+            // protected from churn-pruning, and cleaned up on close, consistent with
+            // strict multi-agent isolation (we only ever own tabs we created/opened).
+            self.created_targets.insert(target.target_id.clone());
            self.add_background_page(page.clone());
            let _ = self.enable_domains(&attach.session_id).await;
            if opened.is_none() {
@@ -1570,13 +1674,20 @@ impl BrowserManager {
            .filter(should_track_target)
            .collect();
        let live_ids: HashSet<String> = live.iter().map(|t| t.target_id.clone()).collect();
+        let on_relay = self.agent_group().is_some();
+        // When the relay scopes getTargets to our group (#40), `live` is already
+        // only our own tabs, so adopting unknown ones is safe (a freshly-opened
+        // pop-up). Without scoping, keep strict isolation: never adopt a tab we
+        // didn't create — it belongs to the user or another agent.
+        let strict_isolation = on_relay && !self.relay_scoped;

        for target in &live {
            if self.update_page_target_info(target) {
                continue;
            }
-            // A target this session hasn't tracked yet — attach and add it in the
-            // background so it's listable/adoptable without stealing the active tab.
+            if strict_isolation {
+                continue;
+            }
            let attach_result: AttachToTargetResult = match self
                .client
                .send_command_typed(
@@ -1607,12 +1718,26 @@ impl BrowserManager {
            let _ = self.enable_domains(&attach_result.session_id).await;
        }

-        // Drop tabs that no longer exist so `tab list` doesn't show phantom rows —
-        // but never prune the explicitly-pinned active target on a transient
-        // getTargets snapshot (issue #31; see `prunable_target_ids`).
-        let gone = prunable_target_ids(&self.pages, &live_ids, self.active_target_id.as_deref());
-        for tid in gone {
-            self.remove_page_by_target_id(&tid);
+        // Prune tabs that are gone. On a LAUNCHED browser a missing target really
+        // is closed, so prune immediately. On the RELAY a single `getTargets`
+        // snapshot routinely omits live tabs (multi-agent churn, a brief
+        // cross-process-nav gap) — dropping the tab we're driving on one bad
+        // snapshot is the failure we're fixing — so prune only after the tab has
+        // been absent for several CONSECUTIVE snapshots (debounced). The pinned
+        // active target is protected either way (issue #31).
+        let gone = if on_relay {
+            debounced_prune_ids(
+                &self.pages,
+                &live_ids,
+                self.active_target_id.as_deref(),
+                &mut self.relay_target_misses,
+            )
+        } else {
+            prunable_target_ids(&self.pages, &live_ids, self.active_target_id.as_deref())
+        };
+        for tid in &gone {
+            self.relay_target_misses.remove(tid);
+            self.remove_page_by_target_id(tid);
        }

        // Refresh url/title from each live tab. The relay only stamps target_info
@@ -1730,6 +1855,25 @@ impl BrowserManager {
        }
    }

+    /// Tell the relay which tab group this session owns so it can scope
+    /// `Target.getTargets` to us (issue #40). Only meaningful on the relay; a
+    /// no-op (returns false) on a launched/real-CDP connection. Sets and returns
+    /// `relay_scoped`: when true, the daemon can trust getTargets to contain only
+    /// our group and re-enable adopting new tabs (pop-ups, cross-session adopt).
+    async fn announce_group(&mut self) -> bool {
+        let Some(group) = self.agent_group() else {
+            self.relay_scoped = false;
+            return false;
+        };
+        let ok = self
+            .client
+            .send_command_typed::<_, Value>("ABRelay.setGroup", &json!({ "group": group }), None)
+            .await
+            .is_ok();
+        self.relay_scoped = ok;
+        ok
+    }
+
    pub async fn tab_new(
        &mut self,
        url: Option<&str>,
@@ -2522,6 +2666,8 @@ async fn initialize_lightpanda_manager(
            visited_origins: HashSet::new(),
            created_targets: HashSet::new(),
            active_target_id: None,
+            relay_target_misses: HashMap::new(),
+            relay_scoped: false,
            next_tab_id: 1,
            capture_console: console_capture_enabled(),
        };
@@ -2815,7 +2961,9 @@ mod tests {
             its tab is gone (closed, navigated across processes, or lost after an extension \
             restart). Re-attach by re-opening your target URL before retrying."
        ));
-        assert!(is_stale_target_error("unknown sessionId cb-tab-7 for Page.navigate"));
+        assert!(is_stale_target_error(
+            "unknown sessionId cb-tab-7 for Page.navigate"
+        ));
        assert!(is_stale_target_error("no attached tab for Page.navigate"));
    }

@@ -2823,8 +2971,12 @@ mod tests {
    fn stale_target_error_ignores_unrelated_failures() {
        // A genuine navigation failure (bad URL, DNS, blocked) must NOT trigger
        // the open-a-fresh-tab recovery — that would mask the real error.
-        assert!(!is_stale_target_error("Navigation failed: net::ERR_NAME_NOT_RESOLVED"));
-        assert!(!is_stale_target_error("CDP command timed out: Page.navigate"));
+        assert!(!is_stale_target_error(
+            "Navigation failed: net::ERR_NAME_NOT_RESOLVED"
+        ));
+        assert!(!is_stale_target_error(
+            "CDP command timed out: Page.navigate"
+        ));
    }

    fn page(target_id: &str) -> PageInfo {
@@ -2931,7 +3083,10 @@ mod tests {
        let dirty = "\u{200d}\u{2061}\u{200d}\u{2063}\u{200b}\u{2062}\u{feff}GitHub";
        assert_eq!(sanitize_title(dirty), "GitHub");
        // Clean titles (incl. CJK + normal punctuation) pass through untouched.
-        assert_eq!(sanitize_title("購入手続きへ - メルカリ"), "購入手続きへ - メルカリ");
+        assert_eq!(
+            sanitize_title("購入手続きへ - メルカリ"),
+            "購入手続きへ - メルカリ"
+        );
        assert_eq!(sanitize_title("  Hello World  "), "Hello World");
        // Emoji and real content survive; only the invisibles are dropped.
        assert_eq!(sanitize_title("✓ Done\u{200b}"), "✓ Done");
@@ -2963,7 +3118,47 @@ mod tests {
        // A pinned target that IS in the live set is simply not prunable anyway.
        let mut live2 = HashSet::new();
        live2.insert("A".to_string());
-        assert_eq!(prunable_target_ids(&pages, &live2, Some("A")), vec!["B".to_string()]);
+        assert_eq!(
+            prunable_target_ids(&pages, &live2, Some("A")),
+            vec!["B".to_string()]
+        );
+    }
+
+    #[test]
+    fn debounced_prune_tolerates_transient_churn() {
+        // Multi-agent churn: a single getTargets snapshot omits our owned tab "B"
+        // (another agent opened/closed tabs). It must NOT be pruned on one miss.
+        let pages = vec![page("A"), page("B")];
+        let mut misses = HashMap::new();
+        let empty: HashSet<String> = HashSet::new();
+        // Misses 1 and 2: B absent but under threshold → not pruned.
+        assert!(debounced_prune_ids(&pages, &empty, Some("A"), &mut misses).is_empty());
+        assert!(debounced_prune_ids(&pages, &empty, Some("A"), &mut misses).is_empty());
+        // Miss 3 (== RELAY_PRUNE_MISSES): genuinely gone → pruned.
+        assert_eq!(
+            debounced_prune_ids(&pages, &empty, Some("A"), &mut misses),
+            vec!["B".to_string()]
+        );
+    }
+
+    #[test]
+    fn debounced_prune_resets_on_reappearance_and_protects_pin() {
+        let pages = vec![page("A"), page("B")];
+        let mut misses = HashMap::new();
+        let empty: HashSet<String> = HashSet::new();
+        let mut live_b: HashSet<String> = HashSet::new();
+        live_b.insert("B".to_string());
+        // Two misses for B, then it reappears → counter resets, so it survives
+        // indefinitely under intermittent churn.
+        debounced_prune_ids(&pages, &empty, Some("A"), &mut misses);
+        debounced_prune_ids(&pages, &empty, Some("A"), &mut misses);
+        assert!(debounced_prune_ids(&pages, &live_b, Some("A"), &mut misses).is_empty());
+        assert!(debounced_prune_ids(&pages, &empty, Some("A"), &mut misses).is_empty()); // back to miss 1
+                                                                                         // The pinned active "A" is never pruned no matter how many misses.
+        for _ in 0..5 {
+            let gone = debounced_prune_ids(&pages, &empty, Some("A"), &mut misses);
+            assert!(!gone.contains(&"A".to_string()));
+        }
    }

    #[test]
@@ -21,6 +21,16 @@ pub async fn run_daemon(session: &str) {
    // (via the ab-connect extension) land in a per-session Chrome tab group.
    let _ = super::browser::DAEMON_SESSION.set(session.to_string());

+    // Bootstrap / refresh the site-adapter pack in the background (first-run +
+    // periodic TTL). This populates ~/.chrome-use/sites/.index.json so navigation
+    // can auto-suggest `site` commands for the page you land on, with zero added
+    // latency to any command. Best-effort; offline is a no-op.
+    if crate::site::needs_refresh() {
+        tokio::spawn(async {
+            let _ = crate::site::update().await;
+        });
+    }
+
    let socket_dir = get_daemon_socket_dir();
    if !socket_dir.exists() {
        let _ = fs::create_dir_all(&socket_dir);
@@ -35,6 +35,7 @@ fn native_test_fixture_html(name: &str) -> &'static str {
        "html5_drag_probe" => include_str!("test_fixtures/html5_drag_probe.html"),
        "pointer_capture_probe" => include_str!("test_fixtures/pointer_capture_probe.html"),
        "upload_probe" => include_str!("test_fixtures/upload_probe.html"),
+        "iframe_button_probe" => include_str!("test_fixtures/iframe_button_probe.html"),
        _ => panic!("Unknown native test fixture: {}", name),
    }
 }
@@ -573,6 +574,76 @@ async fn e2e_snapshot_and_click_ref() {
    assert_success(&resp);
 }

+/// Clicking a button INSIDE an iframe by `@ref` must deliver a TRUSTED activation
+/// (`event.isTrusted === true`), not a synthetic DOM `.click()`. Security-sensitive
+/// embedded forms (Google Payments' `保存`) reject `isTrusted:false` clicks, so an
+/// enabled submit button silently no-op'd (issue #39). The fix routes iframe-ref
+/// clicks to a real `Input.dispatchMouseEvent` on the element's own frame session.
+/// The fixture's iframe button writes `clicked:<isTrusted>` into its own text on
+/// click, which the cross-frame snapshot reads back.
+#[tokio::test]
+#[ignore]
+async fn e2e_iframe_button_click_is_trusted() {
+    let mut state = DaemonState::new();
+
+    let resp = execute_command(
+        &json!({ "id": "1", "action": "launch", "headless": true }),
+        &mut state,
+    )
+    .await;
+    assert_success(&resp);
+
+    let resp = execute_command(
+        &json!({ "id": "2", "action": "navigate", "url": native_test_fixture_url("iframe_button_probe") }),
+        &mut state,
+    )
+    .await;
+    assert_success(&resp);
+
+    // Snapshot (interactive) — the button lives in the iframe and must appear with
+    // a ref; that ref carries the frame_id so the click resolves into the frame.
+    let resp = execute_command(
+        &json!({ "id": "3", "action": "snapshot", "interactive": true }),
+        &mut state,
+    )
+    .await;
+    assert_success(&resp);
+    let snapshot = get_data(&resp)["snapshot"].as_str().unwrap_or("");
+    let ref_id = snapshot
+        .lines()
+        .find(|l| l.contains("button \"save\""))
+        .and_then(|l| l.split("ref=").nth(1))
+        .map(|r| r.trim_end_matches(']').trim())
+        .unwrap_or_else(|| panic!("iframe button not found in snapshot:\n{snapshot}"));
+
+    // Click it by ref.
+    let resp = execute_command(
+        &json!({ "id": "4", "action": "click", "selector": ref_id }),
+        &mut state,
+    )
+    .await;
+    assert_success(&resp);
+
+    tokio::time::sleep(tokio::time::Duration::from_millis(300)).await;
+
+    // The button rewrote its own text with the click's isTrusted flag; read it
+    // back across frames.
+    let resp = execute_command(
+        &json!({ "id": "5", "action": "snapshot", "interactive": true }),
+        &mut state,
+    )
+    .await;
+    assert_success(&resp);
+    let after = get_data(&resp)["snapshot"].as_str().unwrap_or("");
+    assert!(
+        after.contains("clicked:true"),
+        "iframe button click must be trusted (isTrusted:true); snapshot:\n{after}"
+    );
+
+    let resp = execute_command(&json!({ "id": "99", "action": "close" }), &mut state).await;
+    assert_success(&resp);
+}
+
 // ---------------------------------------------------------------------------
 // Screenshot
 // ---------------------------------------------------------------------------
@@ -1028,7 +1028,9 @@ async fn eval_text_in_frame(client: &CdpClient, session_id: &str, frame_id: &str
        .await
        .ok()
        .and_then(|v| v.get("executionContextId").and_then(|c| c.as_i64()));
-    let Some(ctx_id) = ctx else { return String::new() };
+    let Some(ctx_id) = ctx else {
+        return String::new();
+    };
    let res = client
        .send_command(
            "Runtime.evaluate",
@@ -1099,7 +1101,10 @@ pub async fn collect_all_frames_text(
        let (kind, text) = if is_top {
            ("top", eval_text_default(client, top_session).await)
        } else {
-            ("inline", eval_text_in_frame(client, top_session, &fid).await)
+            (
+                "inline",
+                eval_text_in_frame(client, top_session, &fid).await,
+            )
        };
        out.push(FrameText {
            frame_id: fid,
@@ -1524,9 +1529,27 @@ pub async fn get_element_input_value(
        .send_command_typed(
            "Runtime.callFunctionOn",
            &CallFunctionOnParams {
-                function_declaration:
-                    "function() { return typeof this.value === 'string' ? this.value : ''; }"
-                        .to_string(),
+                // Read rich-editor content too (issue #41): CodeMirror 5 / Monaco
+                // keep their text in a model, not `.value`; contenteditable keeps
+                // it as innerText. Falls back to `.value` for plain inputs.
+                function_declaration: r#"function() {
+                    const el = this;
+                    const cm5 = el.closest && el.closest('.CodeMirror');
+                    if (cm5 && cm5.CodeMirror) return cm5.CodeMirror.getValue();
+                    if (window.monaco && monaco.editor) {
+                        try {
+                            const eds = monaco.editor.getEditors ? monaco.editor.getEditors() : [];
+                            const ed = eds.find(e => e.getDomNode && e.getDomNode().contains(el)) || eds[0];
+                            if (ed) return ed.getValue();
+                            const m = monaco.editor.getModels ? monaco.editor.getModels() : [];
+                            if (m[0]) return m[0].getValue();
+                        } catch (e) {}
+                    }
+                    if (typeof el.value === 'string') return el.value;
+                    if (el.isContentEditable) return el.innerText;
+                    return '';
+                }"#
+                .to_string(),
                object_id: Some(object_id),
                arguments: None,
                return_by_value: Some(true),
@@ -1604,7 +1627,15 @@ pub async fn get_element_bounding_box(
            &CallFunctionOnParams {
                function_declaration: r#"function() {
                    const r = this.getBoundingClientRect();
-                    return { x: r.x, y: r.y, width: r.width, height: r.height };
+                    const inViewport = r.bottom > 0 && r.right > 0
+                        && r.top < (innerHeight || document.documentElement.clientHeight)
+                        && r.left < (innerWidth || document.documentElement.clientWidth);
+                    return {
+                        x: r.x, y: r.y, width: r.width, height: r.height,
+                        centerX: Math.round(r.x + r.width / 2),
+                        centerY: Math.round(r.y + r.height / 2),
+                        inViewport,
+                    };
                }"#
                .to_string(),
                object_id: Some(object_id),
@@ -56,16 +56,35 @@ pub async fn click(
        .await;
    }

-    // Over the extension relay we drive the user's real, in-use Chrome, where a
-    // coordinate `Input.dispatchMouseEvent` is NOT reliably confined to our target
-    // tab — it can be delivered to whatever tab is in the foreground, and an OOPIF
-    // element's box can't be mapped to a top-viewport point at all. This twice
-    // opened an unrelated tab on the user's busy Chrome (issues #31/#36). So on the
-    // relay, never use coordinates for a normal left click: DOM-dispatch invokes
-    // the element's click in its own (frame) session, always hitting the right
-    // element in the right tab. Double/right clicks still need true pointer
-    // semantics, and `coord` mode is an explicit opt-out.
-    if mode != "coord" && button == "left" && click_count == 1 && prefer_dom_dispatch(ref_map, selector_or_ref) {
+    // An element INSIDE an iframe needs a TRUSTED activation: a DOM `.click()` is
+    // `isTrusted:false`, which security-sensitive embedded forms reject — Google
+    // Payments' enabled `保存` button silently no-ops on a synthetic click (issue
+    // #39). A coordinate `Input.dispatchMouseEvent` can't help either: `getBoxModel`
+    // for a sub-frame node returns frame-local coordinates that don't compose the
+    // iframe's offset, so the click lands in the wrong place. The frame-agnostic
+    // trusted path is keyboard activation — focus the element in its own frame, then
+    // dispatch a real Enter on the page session; Chrome routes the key to the
+    // focused element regardless of frame (same as `type --focused`), and Enter on a
+    // focused button/link fires a trusted `click`. `coord` mode opts out.
+    let in_iframe = ref_map.ref_is_in_iframe(selector_or_ref);
+    if mode != "coord" && button == "left" && click_count == 1 && in_iframe {
+        return dom_activate(
+            client,
+            session_id,
+            ref_map,
+            selector_or_ref,
+            iframe_sessions,
+        )
+        .await;
+    }
+    // On the relay (the user's real Chrome) a TOP-document coordinate click used to
+    // drift onto the foreground tab; that root cause is fixed (#5: the agent drives
+    // its own pinned tab), but DOM-dispatch stays the conservative default here.
+    if mode != "coord"
+        && button == "left"
+        && click_count == 1
+        && crate::connect::relay_url().is_some()
+    {
        return dom_click(
            client,
            session_id,
@@ -266,6 +285,71 @@ async fn dom_click(
    Ok(())
 }

+/// Trusted activation of an element inside an iframe (issue #39). Focuses the
+/// element in its own frame session, then dispatches a real Enter/Space on the
+/// page session — Chrome routes the key to the focused element across frames, and
+/// Enter/Space on a focused button/link/checkbox fires a `click` with
+/// `isTrusted: true`, which security-sensitive embedded forms (Google Payments
+/// `保存`) require. Non-activatable roles (a `div[onclick]`) can't be keyboard-
+/// activated, so they fall back to a DOM `.click()`.
+async fn dom_activate(
+    client: &CdpClient,
+    session_id: &str,
+    ref_map: &RefMap,
+    selector_or_ref: &str,
+    iframe_sessions: &HashMap<String, String>,
+) -> Result<(), String> {
+    let role = parse_ref(selector_or_ref)
+        .and_then(|r| ref_map.get(&r).map(|e| e.role.clone()))
+        .unwrap_or_default();
+    // Space toggles checkbox-like controls; Enter activates buttons/links/menus.
+    let key = match role.as_str() {
+        "checkbox" | "radio" | "switch" | "option" | "menuitemcheckbox" | "menuitemradio" => {
+            Some("space")
+        }
+        "button" | "link" | "menuitem" | "tab" | "treeitem" => Some("enter"),
+        _ => None,
+    };
+    let Some(key) = key else {
+        // Not keyboard-activatable — best effort via DOM .click() (untrusted).
+        return dom_click(
+            client,
+            session_id,
+            ref_map,
+            selector_or_ref,
+            iframe_sessions,
+        )
+        .await;
+    };
+
+    let (object_id, effective_session_id) = resolve_element_object_id(
+        client,
+        session_id,
+        ref_map,
+        selector_or_ref,
+        iframe_sessions,
+    )
+    .await?;
+    // Focus the element in its OWN frame session so the keystroke lands on it.
+    client
+        .send_command_typed::<_, Value>(
+            "Runtime.callFunctionOn",
+            &CallFunctionOnParams {
+                function_declaration: "function() { this.focus(); }".to_string(),
+                object_id: Some(object_id),
+                arguments: None,
+                return_by_value: Some(true),
+                await_promise: Some(false),
+            },
+            Some(&effective_session_id),
+        )
+        .await?;
+    // Trusted key on the page session — routed to the focused (in-frame) element.
+    press_key(client, session_id, key).await?;
+    wait_for_paint_settled(client, &effective_session_id).await;
+    Ok(())
+}
+
 /// DOM-dispatch a double-click on the element in its own session (no coordinates)
 /// — the relay/iframe-safe counterpart to a coordinate dblclick. Fires the full
 /// click,click,dblclick sequence so handlers bound to any of them respond.
@@ -319,7 +403,14 @@ pub async fn dblclick(
    if std::env::var("AGENT_BROWSER_CLICK_MODE").as_deref() != Ok("coord")
        && prefer_dom_dispatch(ref_map, selector_or_ref)
    {
-        return dom_dblclick(client, session_id, ref_map, selector_or_ref, iframe_sessions).await;
+        return dom_dblclick(
+            client,
+            session_id,
+            ref_map,
+            selector_or_ref,
+            iframe_sessions,
+        )
+        .await;
    }
    click(
        client,
@@ -387,7 +478,14 @@ pub async fn hover(
    // Coordinate `mouseMoved` drifts to the foreground tab over the relay and
    // can't reach an OOPIF — DOM-dispatch the hover there (issues #31/#36).
    if prefer_dom_dispatch(ref_map, selector_or_ref) {
-        return dom_hover(client, session_id, ref_map, selector_or_ref, iframe_sessions).await;
+        return dom_hover(
+            client,
+            session_id,
+            ref_map,
+            selector_or_ref,
+            iframe_sessions,
+        )
+        .await;
    }
    let (x, y, _w, _h, effective_session_id) = resolve_element_center(
        client,
@@ -481,7 +579,7 @@ pub async fn fill(
    selector_or_ref: &str,
    value: &str,
    iframe_sessions: &HashMap<String, String>,
-) -> Result<(), String> {
+) -> Result<String, String> {
    let (object_id, effective_session_id) = resolve_element_object_id(
        client,
        session_id,
@@ -492,14 +590,15 @@ pub async fn fill(
    .await?;

    // Emulate a real edit so framework-controlled inputs (React/Vue) and
-    // site-side listeners actually see the change (issue #25): the old path set
-    // `this.value` directly and used Input.insertText, which left React's
-    // internal value-tracker out of sync and never fired change/blur — so
-    // dependent logic (e.g. Mercari's postal-code → 都道府県 autocomplete) never
-    // ran even though the value was visible. Set the value through the element's
-    // PROTOTYPE setter (which React's _valueTracker hooks), then dispatch
-    // input → change → blur/focusout. `type <sel> <text>` remains for sites that
-    // need per-keystroke events.
+    // site-side listeners actually see the change (issue #25): set the value
+    // through the element's PROTOTYPE setter (which React's _valueTracker hooks),
+    // then dispatch input → change → blur/focusout. Beyond plain inputs, detect
+    // rich editors and use their own API/events (issue #41): CodeMirror 5 and
+    // Monaco have a model that `.value`/`textContent` can't touch; ProseMirror /
+    // contenteditable need `execCommand('insertText')` so beforeinput/input fire
+    // (a raw `textContent =` corrupts PM's doc and skips React composers).
+    // Returns the engine used so the caller can report it. `type <sel> <text>`
+    // remains for sites that need per-keystroke events.
    let fill_js = format!(
        r#"function() {{
            const el = this;
@@ -507,13 +606,43 @@ pub async fn fill(
            try {{ el.focus(); }} catch (e) {{}}
            const tag = el.tagName;
            const fire = (type, ctor) => el.dispatchEvent(new (ctor || Event)(type, {{ bubbles: true }}));
-            if (tag === 'SELECT') {{
-                el.value = v; fire('input'); fire('change'); return true;
+
+            // CodeMirror 5: a hidden <textarea> inside .CodeMirror with a live instance.
+            const cm5 = el.closest && el.closest('.CodeMirror');
+            if (cm5 && cm5.CodeMirror) {{ cm5.CodeMirror.setValue(v); return 'codemirror5'; }}
+
+            // Monaco: global `monaco`; prefer the editor whose DOM contains el.
+            if (window.monaco && monaco.editor) {{
+                try {{
+                    const eds = monaco.editor.getEditors ? monaco.editor.getEditors() : [];
+                    const ed = eds.find(e => e.getDomNode && e.getDomNode().contains(el)) || eds[0];
+                    if (ed) {{ ed.setValue(v); return 'monaco'; }}
+                    const models = monaco.editor.getModels ? monaco.editor.getModels() : [];
+                    if (models[0]) {{ models[0].setValue(v); return 'monaco'; }}
+                }} catch (e) {{}}
            }}
+
+            if (tag === 'SELECT') {{ el.value = v; fire('input'); fire('change'); return 'select'; }}
+
            if (el.isContentEditable) {{
-                el.textContent = v; fire('input', window.InputEvent || Event); fire('change');
-                try {{ el.blur(); }} catch (e) {{}} fire('focusout'); return true;
+                // ProseMirror / contenteditable: select-all then insertText fires
+                // beforeinput/input that PM and React composers listen for.
+                let ok = false;
+                try {{
+                    const sel = window.getSelection();
+                    const range = document.createRange();
+                    range.selectNodeContents(el);
+                    sel.removeAllRanges();
+                    sel.addRange(range);
+                    ok = document.execCommand('insertText', false, v);
+                }} catch (e) {{}}
+                if (!ok) {{ el.textContent = v; fire('input', window.InputEvent || Event); }}
+                fire('change');
+                try {{ el.blur(); }} catch (e) {{}}
+                fire('focusout');
+                return ok ? 'contenteditable' : 'contenteditable-fallback';
            }}
+
            const proto = tag === 'TEXTAREA' ? window.HTMLTextAreaElement.prototype
                                             : window.HTMLInputElement.prototype;
            const desc = Object.getOwnPropertyDescriptor(proto, 'value');
@@ -525,13 +654,13 @@ pub async fn fill(
            fire('change');
            try {{ el.blur(); }} catch (e) {{}}
            fire('focusout');                          // blur-triggered lookups/validation
-            return true;
+            return 'input';
        }}"#,
        val = serde_json::to_string(value).unwrap_or_default()
    );

-    client
-        .send_command_typed::<_, Value>(
+    let result: EvaluateResult = client
+        .send_command_typed(
            "Runtime.callFunctionOn",
            &CallFunctionOnParams {
                function_declaration: fill_js,
@@ -544,7 +673,11 @@ pub async fn fill(
        )
        .await?;

-    Ok(())
+    Ok(result
+        .result
+        .value
+        .and_then(|v| v.as_str().map(String::from))
+        .unwrap_or_else(|| "input".to_string()))
 }

 #[allow(clippy::too_many_arguments)]
@@ -52,6 +52,22 @@ pub struct RelayState {
    pending: HashMap<i64, (ClientId, Value)>,
    /// monotonic source of relay-global command ids
    next_global_id: i64,
+    /// Group-scoped isolation (issue #40). A tab group belongs to exactly one
+    /// agent/session; the relay scopes `Target.getTargets` per client to its own
+    /// group so the daemon can safely adopt new tabs (follow-popup, cross-session
+    /// adopt) without ever seeing the user's or another agent's tabs.
+    ///
+    /// clientId -> group name. A client that never announced a group (older
+    /// daemon) is absent here and gets the full, UNSCOPED target list — so this
+    /// is fully backward-compatible.
+    client_groups: HashMap<ClientId, String>,
+    /// targetId -> group name. Created tabs are tagged from `Target.createTarget`'s
+    /// `agentGroup`; an explicitly adopted tab is tagged to the adopter; a pop-up
+    /// inherits its opener's group (needs the extension to report `openerTargetId`).
+    target_group: HashMap<String, String>,
+    /// relay-global id of an in-flight `Target.createTarget` -> the `agentGroup`
+    /// it carried, so the reply's `targetId` can be tagged with that group.
+    pending_create: HashMap<i64, String>,
 }

 /// What to do with a raw CDP command received from a `CdpClient`.
@@ -95,6 +111,7 @@ impl RelayState {
    /// `pending` entries don't leak.
    pub fn drop_client(&mut self, client_id: ClientId) {
        self.pending.retain(|_, (cid, _)| *cid != client_id);
+        self.client_groups.remove(&client_id);
    }

    /// Route a raw CDP command `{id, method, params?, sessionId?}` from a
@@ -123,16 +140,37 @@ impl RelayState {
                    "jsVersion": ""
                }
            })),
+            // Non-CDP control message: a daemon announces which tab group
+            // (session) it owns, so getTargets can be scoped to it (issue #40).
+            "ABRelay.setGroup" => {
+                if let Some(g) = params.get("group").and_then(|g| g.as_str()) {
+                    if !g.is_empty() {
+                        self.client_groups.insert(client_id, g.to_string());
+                    }
+                }
+                ClientRoute::Local(json!({ "id": id, "result": {} }))
+            }
            // Discovery is best-effort and event-driven in real CDP; abs only
            // reads the getTargets result, so an empty ack is enough here.
            "Target.setDiscoverTargets" | "Target.setAutoAttach" => {
                ClientRoute::Local(json!({ "id": id, "result": {} }))
            }
            "Target.getTargets" => {
+                // Scope to the client's own group when it announced one; an
+                // un-announced (legacy) client gets the full list (back-compat).
+                let scoped = self.client_groups.get(&client_id).cloned();
                let infos: Vec<Value> = self
                    .targets
-                    .values()
-                    .map(|t| t.target_info.clone())
+                    .iter()
+                    .filter(|(tid, _)| match &scoped {
+                        Some(g) => self
+                            .target_group
+                            .get(*tid)
+                            .map(|tg| tg == g)
+                            .unwrap_or(false),
+                        None => true,
+                    })
+                    .map(|(_, t)| t.target_info.clone())
                    .collect();
                ClientRoute::Local(json!({ "id": id, "result": { "targetInfos": infos } }))
            }
@@ -142,9 +180,19 @@ impl RelayState {
                    .and_then(|t| t.as_str())
                    .unwrap_or("");
                match self.targets.get(target_id) {
-                    Some(entry) => ClientRoute::Local(
-                        json!({ "id": id, "result": { "sessionId": entry.session_id } }),
-                    ),
+                    Some(entry) => {
+                        let session_id = entry.session_id.clone();
+                        // Explicitly adopting a target makes it this client's
+                        // (cross-session adopt, #21) — tag it into the adopter's
+                        // group so it stays in that client's scoped getTargets and
+                        // isn't churn-pruned.
+                        if let Some(g) = self.client_groups.get(&client_id).cloned() {
+                            self.target_group.insert(target_id.to_string(), g);
+                        }
+                        ClientRoute::Local(
+                            json!({ "id": id, "result": { "sessionId": session_id } }),
+                        )
+                    }
                    None => ClientRoute::Local(json!({
                        "id": id,
                        "error": { "code": -32602, "message": format!("No such target {target_id}") }
@@ -157,6 +205,18 @@ impl RelayState {
                self.next_global_id += 1;
                let gid = self.next_global_id;
                self.pending.insert(gid, (client_id, id));
+                // Remember the group a createTarget carries so the reply's
+                // targetId can be tagged to the creating session (issue #40).
+                if method == "Target.createTarget" {
+                    if let Some(g) = params.get("agentGroup").and_then(|g| g.as_str()) {
+                        if !g.is_empty() {
+                            self.pending_create.insert(gid, g.to_string());
+                            self.client_groups
+                                .entry(client_id)
+                                .or_insert_with(|| g.to_string());
+                        }
+                    }
+                }
                ClientRoute::Forward(json!({
                    "id": gid,
                    "method": "forwardCDPCommand",
@@ -201,6 +261,17 @@ impl RelayState {
            && msg.get("method").is_none()
        {
            let gid = msg.get("id").and_then(|i| i.as_i64());
+            // A createTarget reply: tag the new tab's targetId with the group the
+            // command carried, so it lands in the creating session's scope (#40).
+            if let Some(g) = gid.and_then(|g| self.pending_create.remove(&g)) {
+                if let Some(tid) = msg
+                    .get("result")
+                    .and_then(|r| r.get("targetId"))
+                    .and_then(|t| t.as_str())
+                {
+                    self.target_group.insert(tid.to_string(), g);
+                }
+            }
            let (to, orig_id) = match gid.and_then(|g| self.pending.remove(&g)) {
                Some((client_id, orig)) => (Some(client_id), orig),
                // No mapping (stale/unknown id) — fall back to broadcasting with
@@ -241,6 +312,27 @@ impl RelayState {
                                .and_then(|s| s.as_str())
                                .unwrap_or("")
                                .to_string();
+                            // Attribute the tab to a group for scoping (issue #40),
+                            // unless we already know it (createTarget tag). An
+                            // explicit `abGroup` from the extension wins; otherwise a
+                            // pop-up inherits its opener's group via `openerTargetId`.
+                            if !self.target_group.contains_key(tid) {
+                                if let Some(g) = info
+                                    .get("abGroup")
+                                    .and_then(|g| g.as_str())
+                                    .filter(|g| !g.is_empty())
+                                {
+                                    self.target_group.insert(tid.to_string(), g.to_string());
+                                } else if let Some(opener) = info
+                                    .get("openerTargetId")
+                                    .and_then(|o| o.as_str())
+                                    .filter(|o| !o.is_empty())
+                                {
+                                    if let Some(g) = self.target_group.get(opener).cloned() {
+                                        self.target_group.insert(tid.to_string(), g);
+                                    }
+                                }
+                            }
                            self.targets.insert(
                                tid.to_string(),
                                TargetEntry {
@@ -255,6 +347,15 @@ impl RelayState {
                "Target.detachedFromTarget" => {
                    let gone = inner_params.get("sessionId").and_then(|s| s.as_str());
                    if let Some(gone) = gone {
+                        let gone_tids: Vec<String> = self
+                            .targets
+                            .iter()
+                            .filter(|(_, e)| e.session_id == gone)
+                            .map(|(tid, _)| tid.clone())
+                            .collect();
+                        for tid in gone_tids {
+                            self.target_group.remove(&tid);
+                        }
                        self.targets.retain(|_, e| e.session_id != gone);
                    }
                    return vec![];
@@ -557,4 +658,131 @@ mod tests {
            _ => panic!("expected ToExt"),
        }
    }
+
+    // === Group-scoped isolation (issue #40) ===
+
+    /// Drive the real create path: announce group, createTarget(agentGroup), feed
+    /// the ext reply (tags target→group) + the attachedToTarget event (creates the
+    /// entry). Returns nothing; mutates `s`.
+    fn create_in_group(s: &mut RelayState, client: ClientId, group: &str, tid: &str, sid: &str) {
+        s.route_client_command(
+            client,
+            &json!({ "id": 1, "method": "ABRelay.setGroup", "params": { "group": group } }),
+        );
+        let route = s.route_client_command(
+            client,
+            &json!({ "id": 2, "method": "Target.createTarget",
+                     "params": { "url": "about:blank", "agentGroup": group } }),
+        );
+        let gid = match route {
+            ClientRoute::Forward(env) => env["id"].as_i64().unwrap(),
+            _ => panic!("createTarget must forward"),
+        };
+        s.handle_ext_message(&json!({ "id": gid, "result": { "targetId": tid } }), "");
+        s.handle_ext_message(
+            &json!({ "method": "forwardCDPEvent", "params": {
+                "method": "Target.attachedToTarget",
+                "params": { "sessionId": sid, "targetInfo": {
+                    "targetId": tid, "type": "page", "url": "about:blank", "attached": true } } } }),
+            "",
+        );
+    }
+
+    fn get_target_ids(s: &mut RelayState, client: ClientId) -> Vec<String> {
+        match s.route_client_command(client, &json!({ "id": 9, "method": "Target.getTargets" })) {
+            ClientRoute::Local(v) => v["result"]["targetInfos"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .map(|t| t["targetId"].as_str().unwrap().to_string())
+                .collect(),
+            _ => panic!("getTargets must be local"),
+        }
+    }
+
+    #[test]
+    fn get_targets_is_scoped_to_each_clients_group() {
+        let mut s = RelayState::new();
+        create_in_group(&mut s, 1, "agent-a", "ta", "sa");
+        create_in_group(&mut s, 2, "agent-b", "tb", "sb");
+        // Each client sees ONLY its own group's tab — never the other agent's.
+        assert_eq!(get_target_ids(&mut s, 1), vec!["ta"]);
+        assert_eq!(get_target_ids(&mut s, 2), vec!["tb"]);
+    }
+
+    #[test]
+    fn legacy_client_without_group_sees_all_targets() {
+        let mut s = RelayState::new();
+        create_in_group(&mut s, 1, "agent-a", "ta", "sa");
+        create_in_group(&mut s, 2, "agent-b", "tb", "sb");
+        // Client 3 never announced a group → full, unscoped list (back-compat).
+        let mut all = get_target_ids(&mut s, 3);
+        all.sort();
+        assert_eq!(all, vec!["ta", "tb"]);
+    }
+
+    #[test]
+    fn popup_inherits_opener_group_and_is_visible_to_that_client_only() {
+        let mut s = RelayState::new();
+        create_in_group(&mut s, 1, "agent-a", "ta", "sa");
+        create_in_group(&mut s, 2, "agent-b", "tb", "sb");
+        // A pop-up that agent-a's tab opened: extension reports openerTargetId=ta.
+        s.handle_ext_message(
+            &json!({ "method": "forwardCDPEvent", "params": {
+                "method": "Target.attachedToTarget",
+                "params": { "sessionId": "sp", "targetInfo": {
+                    "targetId": "tp", "type": "page", "url": "https://oauth.example/",
+                    "attached": true, "openerTargetId": "ta" } } } }),
+            "",
+        );
+        // Only agent-a sees the pop-up; agent-b never does.
+        let mut a = get_target_ids(&mut s, 1);
+        a.sort();
+        assert_eq!(a, vec!["ta", "tp"]);
+        assert_eq!(get_target_ids(&mut s, 2), vec!["tb"]);
+    }
+
+    #[test]
+    fn explicit_attach_tags_target_into_adopter_group() {
+        let mut s = RelayState::new();
+        // A pre-existing, ungrouped tab the extension reported (e.g. user's tab).
+        s.handle_ext_message(
+            &json!({ "method": "forwardCDPEvent", "params": {
+                "method": "Target.attachedToTarget",
+                "params": { "sessionId": "su", "targetInfo": {
+                    "targetId": "tu", "type": "page", "url": "https://user.example/", "attached": true } } } }),
+            "",
+        );
+        // Client 1 (group agent-a) explicitly adopts it by targetId (#21).
+        s.route_client_command(
+            1,
+            &json!({ "id": 1, "method": "ABRelay.setGroup", "params": { "group": "agent-a" } }),
+        );
+        s.route_client_command(
+            1,
+            &json!({ "id": 2, "method": "Target.attachToTarget", "params": { "targetId": "tu" } }),
+        );
+        // Now it's in agent-a's scope and survives the scoped getTargets.
+        assert_eq!(get_target_ids(&mut s, 1), vec!["tu"]);
+        // A different agent still doesn't see it.
+        s.route_client_command(
+            2,
+            &json!({ "id": 1, "method": "ABRelay.setGroup", "params": { "group": "agent-b" } }),
+        );
+        assert!(get_target_ids(&mut s, 2).is_empty());
+    }
+
+    #[test]
+    fn detach_clears_target_group() {
+        let mut s = RelayState::new();
+        create_in_group(&mut s, 1, "agent-a", "ta", "sa");
+        assert_eq!(get_target_ids(&mut s, 1), vec!["ta"]);
+        s.handle_ext_message(
+            &json!({ "method": "forwardCDPEvent", "params": {
+                "method": "Target.detachedFromTarget", "params": { "sessionId": "sa" } } }),
+            "",
+        );
+        assert!(get_target_ids(&mut s, 1).is_empty());
+        assert!(!s.target_group.contains_key("ta"));
+    }
 }
@@ -345,7 +345,16 @@ pub async fn take_snapshot(
    frame_id: Option<&str>,
    iframe_sessions: &HashMap<String, String>,
 ) -> Result<String, String> {
-    take_snapshot_at_depth(client, session_id, options, ref_map, frame_id, iframe_sessions, 0).await
+    take_snapshot_at_depth(
+        client,
+        session_id,
+        options,
+        ref_map,
+        frame_id,
+        iframe_sessions,
+        0,
+    )
+    .await
 }

 #[allow(clippy::too_many_arguments)]
@@ -0,0 +1,28 @@
+<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>iframe button probe</title>
+  </head>
+  <body>
+    <h1>iframe button probe</h1>
+    <iframe
+      id="frame"
+      width="320"
+      height="140"
+      srcdoc="
+        <!doctype html>
+        <html>
+          <body style='margin:24px'>
+            <button id='b' style='padding:24px;font-size:22px'>save</button>
+            <script>
+              document.getElementById('b').addEventListener('click', function (e) {
+                this.textContent = 'clicked:' + e.isTrusted;
+              });
+            </script>
+          </body>
+        </html>
+      "
+    ></iframe>
+  </body>
+</html>
@@ -186,6 +186,26 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou
    }

    if let Some(data) = &resp.data {
+        // Auto-trigger: when you land on / read a page whose domain has site
+        // adapters, surface them so the agent pulls structured data via
+        // `chrome-use site <name>/<cmd>` instead of scraping the DOM. (In --json
+        // mode this same info rides along in the `siteAdapters` field above.)
+        if let Some(hint) = data.get("siteAdapters") {
+            let domain = hint.get("domain").and_then(|v| v.as_str()).unwrap_or("");
+            let cmds: Vec<&str> = hint
+                .get("commands")
+                .and_then(|v| v.as_array())
+                .map(|a| a.iter().filter_map(|v| v.as_str()).collect())
+                .unwrap_or_default();
+            if !cmds.is_empty() {
+                eprintln!("💡 site adapters for {domain} — prefer these for structured data:");
+                eprintln!("   {}", color::dim(&cmds.join(", ")));
+                eprintln!(
+                    "   {}",
+                    color::dim(&format!("e.g. chrome-use site {} --json", cmds[0]))
+                );
+            }
+        }
        // A click that opened a new tab: surface it so the agent doesn't read the
        // unchanged old page as a failed click (issue #24-A).
        if let Some(opened) = data.get("openedTab") {
@@ -228,13 +248,28 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou
        // because its response carries `url`/`title`, which later generic
        // renderers would otherwise swallow.
        if action == Some("cf_status") {
-            let challenged = data.get("challenged").and_then(|v| v.as_bool()).unwrap_or(false);
-            let rec = data.get("recommendation").and_then(|v| v.as_str()).unwrap_or("?");
+            let challenged = data
+                .get("challenged")
+                .and_then(|v| v.as_bool())
+                .unwrap_or(false);
+            let rec = data
+                .get("recommendation")
+                .and_then(|v| v.as_str())
+                .unwrap_or("?");
            let cl = data.get("clearance");
-            let present = cl.and_then(|c| c.get("present")).and_then(|v| v.as_bool()).unwrap_or(false);
-            let expired = cl.and_then(|c| c.get("expired")).and_then(|v| v.as_bool()).unwrap_or(false);
+            let present = cl
+                .and_then(|c| c.get("present"))
+                .and_then(|v| v.as_bool())
+                .unwrap_or(false);
+            let expired = cl
+                .and_then(|c| c.get("expired"))
+                .and_then(|v| v.as_bool())
+                .unwrap_or(false);
            let expires_in = cl.and_then(|c| c.get("expiresIn")).and_then(|v| v.as_i64());
-            let device = data.get("deviceVerified").and_then(|v| v.as_bool()).unwrap_or(false);
+            let device = data
+                .get("deviceVerified")
+                .and_then(|v| v.as_bool())
+                .unwrap_or(false);

            let (icon, headline) = match rec {
                "proceed" => (color::success_indicator().to_string(), "cleared — no challenge, proceed"),
@@ -243,7 +278,10 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou
                _ => (color::cyan("•").to_string(), "unknown"),
            };
            println!("{} {}", icon, headline);
-            println!("  challenged:     {}", if challenged { "yes" } else { "no" });
+            println!(
+                "  challenged:     {}",
+                if challenged { "yes" } else { "no" }
+            );
            let cl_desc = if !present {
                "absent".to_string()
            } else if expired {
@@ -254,7 +292,14 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou
                "present (session)".to_string()
            };
            println!("  cf_clearance:   {}", cl_desc);
-            println!("  device trusted: {}", if device { "yes (CF_VERIFIED_DEVICE)" } else { "no" });
+            println!(
+                "  device trusted: {}",
+                if device {
+                    "yes (CF_VERIFIED_DEVICE)"
+                } else {
+                    "no"
+                }
+            );
            return;
        }

@@ -382,7 +427,11 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou
                let count = list.len();
                println!(
                    "{}",
-                    color::bold(&format!("{} frame{}", count, if count == 1 { "" } else { "s" }))
+                    color::bold(&format!(
+                        "{} frame{}",
+                        count,
+                        if count == 1 { "" } else { "s" }
+                    ))
                );
                for f in list {
                    let idx = f.get("index").and_then(|v| v.as_i64()).unwrap_or(0);
@@ -440,6 +489,17 @@ pub fn print_response_with_opts(resp: &Response, action: Option<&str>, opts: &Ou
                println!("y:      {}", y);
                println!("width:  {}", w);
                println!("height: {}", h);
+                if let (Some(cx), Some(cy)) = (
+                    obj.get("centerX").and_then(|v| v.as_i64()),
+                    obj.get("centerY").and_then(|v| v.as_i64()),
+                ) {
+                    // Echoed in click-ready CSS px so the agent can paste straight
+                    // into `click <centerX> <centerY>` (issue #43).
+                    println!("center: {} {}", cx, cy);
+                }
+                if let Some(iv) = obj.get("inViewport").and_then(|v| v.as_bool()) {
+                    println!("inViewport: {}", iv);
+                }
            }
            return;
        }
@@ -1441,9 +1501,20 @@ Examples:
 chrome-use fill - Clear and fill an input field

 Usage: chrome-use fill <selector> <text>
+       chrome-use fill <selector> --file <path>
+       chrome-use fill <selector> --stdin

-Clears the input field and fills it with the specified text.
-This replaces any existing content in the field.
+Clears the field and fills it with the text, replacing existing content.
+Works on rich editors too (issue #41): CodeMirror 5, Monaco, ProseMirror and
+plain contenteditable are detected and set via their own API / input events,
+not a raw `.value` write — and the response echoes which `engine` was used.
+For framework inputs (React/Vue/Angular) the value goes through the native
+setter so the form registers it (no more "pristine" Save no-ops).
+
+Options:
+  --file <path>        Read the value from a UTF-8 file (large/multiline text,
+                       backticks/quotes/newlines/non-ASCII — no shell escaping)
+  --stdin              Read the value from stdin

 Global Options:
  --json               Output as JSON
@@ -1452,7 +1523,8 @@ Global Options:
 Examples:
  chrome-use fill "#email" "user@example.com"
  chrome-use fill @e3 "Hello World"
-  chrome-use fill "input[name='search']" "query"
+  chrome-use fill ".CodeMirror" --file ./article.md     # set a CodeMirror editor
+  cat post.md | chrome-use fill @e7 --stdin
 "##
        }
        "type" => {
@@ -1854,6 +1926,13 @@ Options:
  --full, -f           Capture full page (not just viewport)
  [selector]           Capture just an element (CSS or @ref), e.g. `screenshot ".header" h.png`
  --clip <x,y,w,h>     Capture a pixel region, e.g. `screenshot --clip 0,0,200,40 corner.png`
+  --max-width <px>     Downscale so the image's width ≤ px (preserves aspect)
+  --max-height <px>    Downscale so the image's height ≤ px
+  --scale <0..1>       Downscale by a factor, e.g. 0.5 (DPR-1, so screenshot px
+                       line up 1:1 with `click x y`)
+                       Default: capped at 2000px longest edge unless overridden
+                       (AGENT_BROWSER_SCREENSHOT_MAX_EDGE; 0 disables). Annotated
+                       shots are never downscaled, so ref overlays stay aligned.
  --annotate           Overlay numbered labels on interactive elements.
                       Each label [N] corresponds to ref @eN from snapshot.
                       Prints a legend mapping labels to element roles/names.
@@ -1876,6 +1955,8 @@ Examples:
  chrome-use screenshot --full ./full-page.png
  chrome-use screenshot ".header .indicator" corner.png  # just one element
  chrome-use screenshot --clip 1600,0,200,40 corner.png  # a pixel region
+  chrome-use screenshot --scale 0.5 ./half.png   # DPR-1: screenshot px == click px
+  chrome-use screenshot --max-width 1400 ./shot.png  # cap width for image readers
  chrome-use screenshot --annotate              # Labeled screenshot + legend
  chrome-use screenshot --annotate ./page.png   # Save annotated screenshot
  chrome-use screenshot --annotate --json       # JSON output with annotations
@@ -3214,7 +3295,8 @@ Core Commands:
  click <sel|x y>            Click element/@ref, or a viewport coordinate
  dblclick <sel>             Double-click element
  type <sel> <text>          Type into element
-  fill <sel> <text>          Clear and fill
+  fill <sel> <text>          Clear and fill (handles CodeMirror/Monaco/ProseMirror/
+                             contenteditable; `--file <path>`/`--stdin` for large text)
  press <key> [--hold <ms>]  Press key (Enter, Tab, Control+a). --hold keeps it
                             down <ms> then releases — precise (in-daemon), for
                             games/charge: `press d --hold 800`
@@ -3234,7 +3316,8 @@ Core Commands:
  scroll <dir> [px]          Scroll (up/down/left/right)
  scrollintoview <sel>       Scroll element into view
  wait <sel|ms>              Wait for element or time
-  screenshot [path]          Take screenshot
+  screenshot [path]          Take screenshot (auto-downscaled to ≤2000px long edge;
+                             --max-width/--max-height/--scale to override)
  pdf <path>                 Save as PDF
  snapshot                   Accessibility tree with refs (for AI)
  eval <js>                  Run JavaScript
@@ -3248,6 +3331,8 @@ Navigation:

 Get Info:  chrome-use get <what> [selector]
  text, html, value, attr <name>, title, url, count, box, styles, cdp-url
+  box <sel>  →  x,y,width,height,centerX,centerY,inViewport in CSS px (feed
+               centerX/centerY into `click x y`); value reads CodeMirror/Monaco too
  text (no selector = whole page, all frames), text --main, frames (list)

 Check State:  chrome-use is <what> <selector>
@@ -3337,6 +3422,14 @@ Batch:
  batch [--bail] ["cmd" ...]  Execute multiple commands sequentially (args or stdin)
                              --bail stops on first error (default: continue all)

+Site adapters:  turn a website into a structured-data CLI (runs as you, in your tab)
+  site update                Fetch the community adapter pack into ~/.chrome-use/sites
+  site list                  List installed adapters (name/cmd)
+  site info <name>/<cmd>     Show an adapter's @meta (args, domain, capabilities)
+  site <name>/<cmd> [args]   Run an adapter: navigate to its site + return JSON
+                             e.g. site github/issues epiral/repo, site reddit/search rust
+                             Positional args fill declared args in order; --key value overrides
+
 Auth Vault:
  auth save <name> [opts]    Save auth profile (--url, --username, --password/--password-stdin)
  auth login <name>          Login using saved credentials (waits for form fields)
@@ -3548,6 +3641,9 @@ iOS Simulator (requires Xcode and Appium):
  chrome-use -p ios device list                         # List simulators
  chrome-use -p ios swipe up                            # Swipe gesture
  chrome-use -p ios tap @e1                             # Touch element
+
+Hit a bug or rough edge? A 30-second issue genuinely sharpens this tool:
+  https://github.com/leeguooooo/chrome-use/issues
 "#
    );
 }
@@ -3630,6 +3726,7 @@ fn print_screenshot_diff(data: &serde_json::Map<String, serde_json::Value>) {

 pub fn print_version() {
    println!("chrome-use {}", env!("CARGO_PKG_VERSION"));
+    println!("report bugs / rough edges: https://github.com/leeguooooo/chrome-use/issues");
 }

 #[cfg(test)]
@@ -0,0 +1,385 @@
+//! Site adapters: turn any website into a structured-data CLI by running a small
+//! per-command JS adapter inside your real, logged-in browser tab (it reuses the
+//! site's cookies / same-origin fetch / its own webpack modules — the site thinks
+//! it's you, because it is).
+//!
+//! The adapter format is the community **bb-sites** convention
+//! (<https://github.com/epiral/bb-sites>): one `.js` file per command, a
+//! `/* @meta {...} */` JSON header (name, description, domain, args), then an
+//! `async function(args){ ... return {...} }`. chrome-use ships none of those
+//! adapters — `chrome-use site update` fetches the upstream repo at runtime into
+//! `~/.chrome-use/sites` (like a package manager pulling a dependency), so the
+//! adapters stay the property of their authors. Running an adapter navigates to
+//! its `@meta.domain` and `eval`s the function in the site's own logged-in page.
+
+use std::path::PathBuf;
+
+use serde_json::Value;
+
+const SITES_ZIP_URL: &str = "https://github.com/epiral/bb-sites/archive/refs/heads/main.zip";
+
+/// `~/.chrome-use/sites` — where synced adapters live.
+pub fn sites_dir() -> Option<PathBuf> {
+    dirs_home().map(|h| h.join(".chrome-use").join("sites"))
+}
+
+fn dirs_home() -> Option<PathBuf> {
+    std::env::var_os("HOME").map(PathBuf::from)
+}
+
+/// Parsed adapter: its `@meta` JSON and the raw `async function(args){...}` source.
+pub struct Adapter {
+    pub meta: Value,
+    pub func_src: String,
+}
+
+impl Adapter {
+    pub fn domain(&self) -> Option<&str> {
+        self.meta.get("domain").and_then(|v| v.as_str())
+    }
+}
+
+/// Load `<sites>/<name>/<cmd>.js`, splitting the `/* @meta {...} */` header from
+/// the function body. `spec` is `name/cmd`.
+pub fn load_adapter(spec: &str) -> Result<Adapter, String> {
+    let (name, cmd) = spec
+        .split_once('/')
+        .ok_or_else(|| format!("site: expected <name>/<command>, got `{spec}`"))?;
+    if name.is_empty()
+        || cmd.is_empty()
+        || name.contains("..")
+        || cmd.contains("..")
+        || name.contains('/')
+        || cmd.contains('/')
+    {
+        return Err(format!("site: invalid adapter spec `{spec}`"));
+    }
+    let dir = sites_dir().ok_or("site: cannot resolve home dir")?;
+    let path = dir.join(name).join(format!("{cmd}.js"));
+    if !path.exists() {
+        return Err(format!(
+            "site: adapter `{spec}` not found. Run `chrome-use site update` to sync adapters, \
+             or `chrome-use site list` to see what's installed."
+        ));
+    }
+    let raw = std::fs::read_to_string(&path).map_err(|e| format!("site: read {spec}: {e}"))?;
+    parse_adapter(&raw, spec)
+}
+
+/// Split the `@meta` JSON block and the function source from an adapter file.
+pub fn parse_adapter(raw: &str, spec: &str) -> Result<Adapter, String> {
+    let start = raw
+        .find("@meta")
+        .and_then(|i| raw[i..].find('{').map(|j| i + j))
+        .ok_or_else(|| format!("site: {spec} missing /* @meta {{...}} */ header"))?;
+    // Find the matching close brace for the @meta object (brace-count, string-aware).
+    let bytes = raw.as_bytes();
+    let mut depth = 0i32;
+    let mut in_str = false;
+    let mut esc = false;
+    let mut end = None;
+    for (k, &b) in bytes.iter().enumerate().skip(start) {
+        if in_str {
+            if esc {
+                esc = false;
+            } else if b == b'\\' {
+                esc = true;
+            } else if b == b'"' {
+                in_str = false;
+            }
+            continue;
+        }
+        match b {
+            b'"' => in_str = true,
+            b'{' => depth += 1,
+            b'}' => {
+                depth -= 1;
+                if depth == 0 {
+                    end = Some(k + 1);
+                    break;
+                }
+            }
+            _ => {}
+        }
+    }
+    let end = end.ok_or_else(|| format!("site: {spec} @meta header has no closing brace"))?;
+    let meta: Value = serde_json::from_str(&raw[start..end])
+        .map_err(|e| format!("site: {spec} @meta is not valid JSON: {e}"))?;
+    // The function is everything after the meta comment's closing `*/`.
+    let after = raw[end..].find("*/").map(|i| end + i + 2).unwrap_or(end);
+    let func_src = raw[after..].trim().to_string();
+    if func_src.is_empty() {
+        return Err(format!("site: {spec} has no function body after @meta"));
+    }
+    Ok(Adapter { meta, func_src })
+}
+
+/// Build the JS to eval: `(<adapter function>)(<args JSON>)`. The adapter's
+/// `async function(args)` returns a promise; chrome-use's eval awaits it.
+pub fn build_eval(adapter: &Adapter, args: &Value) -> String {
+    let args_json = serde_json::to_string(args).unwrap_or_else(|_| "{}".to_string());
+    format!("({})({})", adapter.func_src, args_json)
+}
+
+/// List installed adapters as `name/cmd` strings (sorted).
+pub fn list_adapters() -> Result<Vec<String>, String> {
+    let dir = sites_dir().ok_or("site: cannot resolve home dir")?;
+    if !dir.exists() {
+        return Ok(Vec::new());
+    }
+    let mut out = Vec::new();
+    for site in std::fs::read_dir(&dir)
+        .map_err(|e| e.to_string())?
+        .flatten()
+    {
+        if !site.path().is_dir() {
+            continue;
+        }
+        let name = site.file_name().to_string_lossy().to_string();
+        for cmd in std::fs::read_dir(site.path())
+            .map_err(|e| e.to_string())?
+            .flatten()
+        {
+            let p = cmd.path();
+            if p.extension().and_then(|e| e.to_str()) == Some("js") {
+                if let Some(stem) = p.file_stem().and_then(|s| s.to_str()) {
+                    out.push(format!("{name}/{stem}"));
+                }
+            }
+        }
+    }
+    out.sort();
+    Ok(out)
+}
+
+/// Download the bb-sites repo zip and extract its adapters into `~/.chrome-use/sites`.
+pub async fn update() -> Result<usize, String> {
+    let dir = sites_dir().ok_or("site: cannot resolve home dir")?;
+    let client = reqwest::Client::builder()
+        .user_agent("chrome-use")
+        .build()
+        .map_err(|e| e.to_string())?;
+    let bytes = client
+        .get(SITES_ZIP_URL)
+        .send()
+        .await
+        .map_err(|e| format!("site update: download failed: {e}"))?
+        .error_for_status()
+        .map_err(|e| format!("site update: {e}"))?
+        .bytes()
+        .await
+        .map_err(|e| format!("site update: read body: {e}"))?;
+
+    let cursor = std::io::Cursor::new(bytes);
+    let mut zip = zip::ZipArchive::new(cursor).map_err(|e| format!("site update: bad zip: {e}"))?;
+    std::fs::create_dir_all(&dir).map_err(|e| e.to_string())?;
+    let mut count = 0usize;
+    for i in 0..zip.len() {
+        let mut f = zip.by_index(i).map_err(|e| e.to_string())?;
+        let Some(enclosed) = f.enclosed_name() else {
+            continue;
+        };
+        // Strip the top-level `bb-sites-main/` component from the archive path.
+        let rel: PathBuf = enclosed.components().skip(1).collect();
+        if rel.as_os_str().is_empty() {
+            continue;
+        }
+        let out = dir.join(&rel);
+        if f.is_dir() {
+            let _ = std::fs::create_dir_all(&out);
+            continue;
+        }
+        if let Some(parent) = out.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        let mut buf = Vec::new();
+        std::io::copy(&mut f, &mut buf).map_err(|e| e.to_string())?;
+        std::fs::write(&out, &buf).map_err(|e| e.to_string())?;
+        if out.extension().and_then(|e| e.to_str()) == Some("js") {
+            count += 1;
+        }
+    }
+    // Build the domain→adapters index and stamp the sync time so navigation can
+    // suggest adapters (auto-trigger) and `needs_refresh` can pace re-syncs.
+    write_domain_index(&dir);
+    if let Some(p) = last_update_path() {
+        let _ = std::fs::write(p, now_secs().to_string());
+    }
+    Ok(count)
+}
+
+/// `~/.chrome-use/sites/.last_update` — unix-seconds marker of the last sync.
+fn last_update_path() -> Option<PathBuf> {
+    sites_dir().map(|d| d.join(".last_update"))
+}
+
+/// `~/.chrome-use/sites/.index.json` — `{ "github.com": ["github/issues", …], … }`,
+/// built on `update` so navigation can look up adapters by domain without parsing
+/// all ~145 adapter files on every command.
+fn index_path() -> Option<PathBuf> {
+    sites_dir().map(|d| d.join(".index.json"))
+}
+
+fn now_secs() -> u64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs())
+        .unwrap_or(0)
+}
+
+/// Parse every installed adapter and write the domain→adapters index. Within a
+/// domain, read-only adapters are listed first (then alphabetical) so the
+/// auto-suggested example leads with a safe read, not a write action.
+fn write_domain_index(dir: &std::path::Path) {
+    let mut by_domain: std::collections::BTreeMap<String, Vec<(bool, String)>> = Default::default();
+    for spec in list_adapters().unwrap_or_default() {
+        if let Ok(a) = load_adapter(&spec) {
+            if let Some(d) = a.domain() {
+                let read_only = a
+                    .meta
+                    .get("readOnly")
+                    .and_then(|v| v.as_bool())
+                    .unwrap_or(false);
+                by_domain
+                    .entry(d.to_string())
+                    .or_default()
+                    .push((read_only, spec));
+            }
+        }
+    }
+    let ordered: std::collections::BTreeMap<String, Vec<String>> = by_domain
+        .into_iter()
+        .map(|(domain, mut v)| {
+            // read-only (true) first, then by spec name
+            v.sort_by(|a, b| b.0.cmp(&a.0).then_with(|| a.1.cmp(&b.1)));
+            (domain, v.into_iter().map(|(_, s)| s).collect())
+        })
+        .collect();
+    if let Ok(json) = serde_json::to_string(&ordered) {
+        let _ = std::fs::write(dir.join(".index.json"), json);
+    }
+}
+
+const DEFAULT_TTL_DAYS: u64 = 7;
+
+/// Whether the adapter pack should be (re)synced: true on first use (nothing
+/// installed) or when the last sync is older than the TTL. Disabled by
+/// `AGENT_BROWSER_SITES_NO_AUTO_UPDATE=1`; TTL overridable via
+/// `AGENT_BROWSER_SITES_TTL_DAYS` (0 = always).
+pub fn needs_refresh() -> bool {
+    if std::env::var_os("AGENT_BROWSER_SITES_NO_AUTO_UPDATE").is_some() {
+        return false;
+    }
+    let Some(dir) = sites_dir() else {
+        return false;
+    };
+    // First use: no adapters installed yet.
+    if list_adapters().map(|l| l.is_empty()).unwrap_or(true) {
+        let _ = &dir;
+        return true;
+    }
+    let ttl_days = std::env::var("AGENT_BROWSER_SITES_TTL_DAYS")
+        .ok()
+        .and_then(|s| s.parse::<u64>().ok())
+        .unwrap_or(DEFAULT_TTL_DAYS);
+    let ttl = ttl_days.saturating_mul(86_400);
+    match last_update_path().and_then(|p| std::fs::read_to_string(p).ok()) {
+        Some(s) => match s.trim().parse::<u64>() {
+            Ok(ts) => now_secs().saturating_sub(ts) >= ttl,
+            Err(_) => true,
+        },
+        None => true, // no marker → treat as stale
+    }
+}
+
+/// Adapters whose `@meta.domain` matches `host` (exact, or `host` is a subdomain
+/// of it) — for auto-suggesting `site` commands when you land on a known site.
+/// Reads the prebuilt `.index.json`; empty if the pack isn't synced yet.
+pub fn adapters_for_domain(host: &str) -> Vec<String> {
+    let host = host.trim_start_matches("www.");
+    let Some(raw) = index_path().and_then(|p| std::fs::read_to_string(p).ok()) else {
+        return Vec::new();
+    };
+    let Ok(idx) = serde_json::from_str::<std::collections::BTreeMap<String, Vec<String>>>(&raw)
+    else {
+        return Vec::new();
+    };
+    // Preserve the index's per-domain ordering (read-only adapters first); just
+    // dedup if a host somehow matches multiple domain keys.
+    let mut out: Vec<String> = Vec::new();
+    for (domain, specs) in idx {
+        let d = domain.trim_start_matches("www.");
+        if host == d || host.ends_with(&format!(".{d}")) {
+            for s in specs {
+                if !out.contains(&s) {
+                    out.push(s);
+                }
+            }
+        }
+    }
+    out
+}
+
+/// Map CLI args to the adapter's `args` object. Positional args fill the adapter's
+/// declared `args` keys in order; `--key value` overrides by name. The adapter
+/// validates required args itself.
+pub fn map_args(adapter: &Adapter, positional: &[String], named: &[(String, String)]) -> Value {
+    let mut obj = serde_json::Map::new();
+    let keys: Vec<String> = adapter
+        .meta
+        .get("args")
+        .and_then(|a| a.as_object())
+        .map(|m| m.keys().cloned().collect())
+        .unwrap_or_default();
+    for (i, val) in positional.iter().enumerate() {
+        if let Some(k) = keys.get(i) {
+            obj.insert(k.clone(), Value::String(val.clone()));
+        }
+    }
+    for (k, v) in named {
+        obj.insert(k.clone(), Value::String(v.clone()));
+    }
+    Value::Object(obj)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const SAMPLE: &str = r#"/* @meta
+{
+  "name": "github/issues",
+  "domain": "github.com",
+  "args": { "repo": {"required": true}, "state": {"required": false} }
+}
+*/
+
+async function(args) { return { repo: args.repo }; }"#;
+
+    #[test]
+    fn parses_meta_and_function() {
+        let a = parse_adapter(SAMPLE, "github/issues").unwrap();
+        assert_eq!(a.domain(), Some("github.com"));
+        assert!(a.func_src.starts_with("async function(args)"));
+    }
+
+    #[test]
+    fn build_eval_wraps_and_passes_args() {
+        let a = parse_adapter(SAMPLE, "github/issues").unwrap();
+        let args = map_args(
+            &a,
+            &["owner/repo".into()],
+            &[("state".into(), "closed".into())],
+        );
+        let js = build_eval(&a, &args);
+        assert!(js.contains("async function(args)"));
+        assert!(js.contains("\"repo\":\"owner/repo\""));
+        assert!(js.contains("\"state\":\"closed\""));
+    }
+
+    #[test]
+    fn rejects_bad_spec() {
+        assert!(load_adapter("noslash").is_err());
+        assert!(load_adapter("../etc/passwd").is_err());
+    }
+}
@@ -81,6 +81,35 @@ async function groupTabInto(tabId, name) {
  groupIdByName.set(name, gid)
 }

+// Group-scoped relay isolation hints (issue #40). The relay scopes
+// Target.getTargets per agent by tab group; report two things in the synthesized
+// targetInfo so it can attribute each tab:
+//   - abGroup: the tab's Chrome tab-group TITLE (= the owning session name), so
+//     the relay can re-attribute existing tabs after a restart (createTarget
+//     tagging won't re-run for already-open tabs).
+//   - openerTargetId: the targetId of the tab that opened this one, so a pop-up
+//     (window.open / target=_blank / OAuth result) inherits its opener's group
+//     and the agent that opened it can follow it — without foreign tabs leaking.
+// Best-effort: any failure yields empty strings, which the relay ignores.
+async function tabScopeHints(tabId) {
+  let openerTargetId = ''
+  let abGroup = ''
+  try {
+    const t = await chrome.tabs.get(tabId)
+    if (t) {
+      if (typeof t.openerTabId === 'number') {
+        const op = tabs.get(t.openerTabId)
+        if (op) openerTargetId = op.targetId
+      }
+      if (t.groupId != null && t.groupId >= 0 && chrome.tabGroups) {
+        const g = await chrome.tabGroups.get(t.groupId).catch(() => null)
+        if (g && g.title) abGroup = g.title
+      }
+    }
+  } catch {}
+  return { openerTargetId, abGroup }
+}
+
 function postToHost(msg) {
  try {
    if (port) port.postMessage(msg)
@@ -126,7 +155,7 @@ function connectHost() {
  } catch {}
  // Tell the daemon about everything we already have attached, then attach
  // anything new.
-  reannounceAttachedTabs()
+  void reannounceAttachedTabs()
  void attachAllTabs()
 }

@@ -140,7 +169,7 @@ async function onHostMessage(msg) {
  // Daemon (re)connected — (re)attach and announce every tab so it discovers
  // the user's existing tabs rather than racing an empty target list.
  if (msg.method === 'attachAll') {
-    reannounceAttachedTabs()
+    void reannounceAttachedTabs()
    await attachAllTabs()
    return
  }
@@ -387,12 +416,16 @@ async function attachTab(tabId) {
  sessionToTab.set(sessionId, tabId)
  rememberSessionTarget(sessionId, targetId)
  setBadge(tabId, port ? 'on' : 'connecting')
+  const { openerTargetId, abGroup } = await tabScopeHints(tabId)
  postToHost({
    method: 'forwardCDPEvent',
    params: {
      sessionId,
      method: 'Target.attachedToTarget',
-      params: { sessionId, targetInfo: { ...targetInfo, attached: true } },
+      params: {
+        sessionId,
+        targetInfo: { ...targetInfo, attached: true, openerTargetId, abGroup },
+      },
    },
  })
  return entry
@@ -434,14 +467,21 @@ async function attachAllTabs() {
  }
 }

-function reannounceAttachedTabs() {
-  for (const [, entry] of tabs.entries()) {
+async function reannounceAttachedTabs() {
+  for (const [tabId, entry] of tabs.entries()) {
+    // Re-send the group hint too (issue #40) so the relay can rebuild its
+    // targetId→group map after its own restart (createTarget tagging won't
+    // re-run for tabs that are already open).
+    const { openerTargetId, abGroup } = await tabScopeHints(tabId)
    postToHost({
      method: 'forwardCDPEvent',
      params: {
        sessionId: entry.sessionId,
        method: 'Target.attachedToTarget',
-        params: { sessionId: entry.sessionId, targetInfo: { targetId: entry.targetId, type: 'page', attached: true } },
+        params: {
+          sessionId: entry.sessionId,
+          targetInfo: { targetId: entry.targetId, type: 'page', attached: true, openerTargetId, abGroup },
+        },
      },
    })
  }
@@ -1,7 +1,7 @@
 {
  "manifest_version": 3,
  "name": "chrome-use",
-  "version": "0.4.9",
+  "version": "0.4.10",
  "description": "Let chrome-use drive your logged-in Chrome \u2014 install once, no token, no per-use confirmation.",
  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6vQIyscGIPYPZdSpPwPL0+0gxUROyRgCpmvCSDoc8XUm4qm97VbKnD9Ijc1lV22lNWZtE78gaRjt6BeSfuMgnBymnhLKjN1gU6AI5QUU0mrJyeHdWKvrKQR5FmsM2A7Xr1ykE2SiiS8zNUS3Y/6O5l+Nva7wrVy6E4a2dkBVQkOsu+DV+nEZvhIyuDY5D5SPXqNwUTWTaglwj5mjvHz36xSwCWlPmrtJ+ED0AUyrb2z4GIOmvk4kqtBVrh/UD058klLo4CkYOnIybB5aV6WYuwarfPY4bF/dLggPem+ewLNTUNBuwrxj/A4nUv0LJTuRO8rR7f8WR9qnRCY0Ic5saQIDAQAB",
  "icons": {
@@ -1,6 +1,6 @@
 {
  "name": "chrome-use",
-  "version": "1.5.13",
+  "version": "1.5.22",
  "description": "chrome-use — drive your real, logged-in Chrome from any AI agent, stealth by default",
  "type": "module",
  "packageManager": "pnpm@11.1.3",
@@ -59,6 +59,18 @@ next ref interaction.
 > anyway.) Driving off pixels on the relay also risks a coordinate event drifting
 > onto the user's foreground tab — refs never do. See issue #37.

+> **Two different intents — only one is discouraged.** The rule above is about
+> *screenshot-to-locate* (using a picture to find/hit an element) — that's the bug.
+> *screenshot-to-capture* — saving a region or element to a file as a **reusable
+> image asset** (maps, charts, og-images, visual-diff baselines, report figures) —
+> is fully supported and encouraged: `screenshot [selector] [--clip x,y,w,h] <file>`.
+> Capturing a rendered map region to a PNG for a blog post is the right tool, not a
+> smell. Screenshots are auto-downscaled to ≤2000px (longest edge) so they fit an
+> image reader and their pixels line up with `click x y`; override with
+> `--max-width`/`--max-height`/`--scale`. To click something you couldn't hit by
+> ref, `box @ref` gives the element's CSS-px box + `centerX/centerY` to feed
+> straight into `click <centerX> <centerY>` — no screenshot needed.
+
 ## Before you automate: pick the cheapest tool

 Driving a browser is the heavy option. chrome-use earns its keep when you
@@ -68,6 +80,7 @@ need a **real, logged-in browser** — not for reading text off a public page.
 |---|---|
 | Discover what exists / find sources | `WebSearch` |
 | Specific facts from a static or public page | `WebFetch` or `curl` (no browser) |
+| **Structured data from a known site** (GitHub issues, Reddit/HN search, Bilibili/Twitter feed, …) — esp. behind login | `chrome-use site <name>/<cmd>` (see below) — skip snapshot+click entirely |
 | Login state, interaction, JS-rendered or anti-bot pages | **chrome-use** (this skill) |
 | A page the user saved before / an internal system | `chrome-use find-url <keywords>` (their bookmarks), then open it |
 | The user's **own already-open, logged-in** Chrome window | the **extension connect** flow (below) |
@@ -131,7 +144,17 @@ Each `--session` that connects gets its **own colored Chrome tab group** (named
 after the session) and drives only its own tabs — multiple agents share the one
 real browser without cross-talk, and the user's own tabs are never grouped. CDP
 drives the page without moving the user's mouse/keyboard, so it doesn't fight
-them for control. **Anti-detection ranking: this real logged-in Chrome (extension
+them for control.
+
+**Strict multi-agent isolation.** A session over the relay tracks and drives
+**only the tabs it created** (its own group). It does **not** adopt the user's
+existing tabs, other agents' tabs, or pop-ups (e.g. an OAuth/login window — that's
+the user's), so several agents (and other tools opening tabs) can work in the same
+real Chrome concurrently without ever dropping or stealing each other's tabs —
+another agent's tab churn can't make your bound tab vanish or drift your commands
+onto the wrong page. Consequence: `tab list` shows only *your* session's tabs; to
+drive a specific page, navigate to it in your own tab instead of expecting a
+pre-existing or popped-up tab to appear in the list. **Anti-detection ranking: this real logged-in Chrome (extension
 connect) > a headed launched browser > headless (forbidden).** A genuine human
 browser has no headless/automation tells at all, so prefer it for anything
 anti-bot-sensitive.
@@ -186,6 +209,34 @@ chrome-use eval "[...document.forms[0].elements].filter(e=>!e.validity.valid).ma
 chrome-use eval "document.querySelector('#stubborn').click()"   # direct DOM click, bypasses overlays
 ```

+## Site adapters — the cheapest path for "read structured data from site X"
+
+Before you `open` + `snapshot` + click your way through GitHub/Reddit/Bilibili/etc.,
+check whether a **site adapter** already exists. An adapter is a community-written JS
+function that hits the site's own JSON API *from inside your logged-in tab* and returns
+clean structured data — no clicking, no scraping, no screenshots. It's the same idea as
+`eval`, packaged per-site.
+
+```bash
+chrome-use site update                       # one-time: fetch the adapter pack (~145 cmds)
+chrome-use site list                         # what's installed (github/issues, reddit/search, …)
+chrome-use site info github/issues           # an adapter's args + which domain it runs on
+chrome-use site github/issues owner/repo --json   # run it → JSON (navigates there for you)
+```
+
+- Positional args fill the adapter's declared args **in order**; `--key value` overrides by name.
+- It navigates to the adapter's domain (reusing the current tab if you're already on it), so
+  login-gated feeds (`bilibili/feed`, `twitter/...`) work because they run as *you*.
+- If no adapter fits, fall back to the normal `snapshot`/`eval` loop. Adapters come from the
+  [bb-sites](https://github.com/epiral/bb-sites) community pack; chrome-use fetches & runs them.
+
+> **Auto-trigger — act on it.** chrome-use keeps the pack synced automatically (first use +
+> weekly), and when you `open`/`navigate`/`snapshot` a page whose domain has adapters it tells
+> you: a `💡 site adapters for <domain>` line on stderr, and a `siteAdapters: {domain, commands}`
+> field in `--json`. **When you see that, prefer the listed `site <name>/<cmd>` over snapshot+click
+> for reading data** — it's the cheaper, more reliable path and it's already installed. You don't
+> need to run `site update` yourself; just use the command it names.
+
 ## Quickstart

 ```bash
@@ -334,6 +385,12 @@ foreground, so prefer refs. For below-the-fold content in such a frame, scroll i
 with `scroll down N --at x,y` (a pixel over the frame) or `--frame n`. For a
 postal/autocomplete box inside the frame, `type @e "…" --key-events`.

+> **Caveat: `find text "…"` can't reach into a cross-origin iframe** — it errors
+> "Element not found" even though `snapshot -i` lists those nodes and
+> `get text` reads them. Inside cross-origin iframes, target elements by their
+> **snapshot `@ref`**, not by `find`. (`box @ref` also works on iframe refs when
+> you need a coordinate fallback.)
+
 ### When refs don't work or you don't want to snapshot

 Use semantic locators:
Author	SHA1	Message	Date
leeguooooo	5be01e292d	feat(relay): group-scoped Target.getTargets — restore follow-popup + cross-session adopt under isolation (#40 ) Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled Move multi-agent isolation from blunt daemon-side filtering to relay-side group scoping, so a session can adopt new tabs again (follow-popup, OAuth results, cross-session adopt-by-targetId) without ever seeing the user's or another agent's tabs. Relay (relay.rs): track client->group (announced via new local ABRelay.setGroup, or the first createTarget's agentGroup) and target->group (created tabs tagged from the createTarget reply; an explicit attachToTarget tags the target into the adopter's group = #21; a pop-up inherits its opener's group via openerTargetId). Target.getTargets returns ONLY the requesting client's group; a client that never announced a group (older daemon) gets the full list — fully backward-compatible. +5 unit tests. Daemon (browser.rs): announce_group() on connect sets relay_scoped. Adoption in discover/resync/adopt_newly_opened is re-enabled ONLY when relay_scoped; without it (launch / real CDP / older relay that didn't answer the announce) the daemon keeps strict daemon-side isolation. So this can't regress the 125/125 isolation. Extension (ab-connect 0.4.10): synthesized Target.attachedToTarget targetInfo now carries openerTargetId (pop-ups inherit opener's group) and abGroup (the tab-group title, so the relay re-attributes existing tabs after ITS own restart, since createTarget tagging won't re-run). tabScopeHints(). Back-compat verified live: new daemon + OLD relay -> announce fails -> relay_scoped=false -> strict fallback, open/eval/url all work. The new extension (publish to CWS, strip manifest key) activates follow-popup; relay+daemon ship now. 861 tests pass.	2026-06-17 18:14:13 +09:00
leeguooooo	a83d1b1df9	feat: rich-editor fill, box centers, screenshot downscale, disabled+docs (#41-#45) Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled Dogfooding backlog from this session's embedded-form/editor work. #41 fill on rich editors: detect CodeMirror 5 / Monaco / ProseMirror / contenteditable and set via their own API or execCommand('insertText') so beforeinput/input fire (a raw .value/textContent write no-op'd juejin's CodeMirror and skipped React composers). Response echoes the `engine` used. `fill <sel> --file <path>` / `--stdin` set large multiline text without shell-escaping. `get value` now reads CodeMirror/Monaco/contenteditable too. #42 screenshot --max-width/--max-height/--scale, plus a default 2000px longest-edge cap (AGENT_BROWSER_SCREENSHOT_MAX_EDGE; 0 disables) so retina full-page shots fit an agent's image reader and --scale 0.5 makes screenshot px line up with click px. Annotated shots are never downscaled. #43 `box @ref` (already a top-level alias of `get box`) now also returns centerX/centerY/inViewport in CSS px — feed straight into `click x y` when a ref-click no-ops (e.g. a button in a cross-origin iframe). #44 no code change needed — disabled elements already list as `button "Save" [disabled, ref=eN]`; the reporter's missing button was DOM-gated on validity. Added a skill note: `find text` can't reach into a cross-origin iframe — target those by snapshot @ref. #45 core skill now distinguishes screenshot-to-locate (discouraged) from screenshot-to-capture a reusable image asset via `screenshot [--clip] <file>` (encouraged), so agents stop over-reading the prohibition. #40 (group-scoped relay) stays deferred — needs an ab-connect extension change. Verified live: fill --file round-trips multiline+CJK+backticks; contenteditable engine=contenteditable + get value reads it back; box gives centerX/centerY/ inViewport; screenshot of retina example.com → 2000px; disabled button shows [disabled]. 856 tests pass.	2026-06-17 17:49:38 +09:00
leeguooooo	50b27ac0e0	feat(site): auto-sync + auto-suggest adapters (auto-trigger) Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled Make `site` trigger itself so an agent doesn't have to know adapters exist. Auto-sync: the pack refreshes on first use and on a TTL (default 7d), both in the `site` command path (blocking, fast) and as a non-blocking background task on daemon startup — so ~/.chrome-use/sites/.index.json is always populated with zero added latency. Tune via AGENT_BROWSER_SITES_TTL_DAYS; disable with AGENT_BROWSER_SITES_NO_AUTO_UPDATE=1. `update` now writes .last_update + a domain→adapters .index.json (read-only adapters ordered first). Auto-suggest: `open`/`navigate`/`snapshot` onto a domain with adapters attaches `siteAdapters: {domain, commands}` to the response; the CLI prints a `💡 site adapters for <domain>` hint (stderr) and the field rides along in --json. SKILL.md tells the agent to prefer the listed `site <name>/<cmd>` over scraping. This keeps the 'never auto-disrupt user tabs' guarantee — it suggests, the agent decides; nothing auto-runs on navigation. site.rs: needs_refresh/adapters_for_domain/write_domain_index + timestamp/index in update(). daemon.rs: background bootstrap. actions.rs: with_site_hint on navigate + snapshot. output.rs: hint render. Verified live: open github.com → hint leads with read-only github/issues; --json carries siteAdapters.	2026-06-17 17:15:34 +09:00
leeguooooo	d81bc01645	feat(site): bb-sites adapters — turn any site into a structured-data CLI Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled Add `chrome-use site` — run community bb-sites adapters over chrome-use's stealth transport. An adapter is a per-command JS function that calls a site's own JSON API from inside your logged-in tab (your cookies, same-origin fetch, the site's modules) and returns clean JSON — no clicking/scraping. - site update fetch the upstream bb-sites pack into ~/.chrome-use/sites - site list list installed adapters (name/cmd) - site info show an adapter's @meta (args, domain, capabilities) - site <name>/<cmd> [args] navigate to its domain (reuse tab if already there) + eval, return JSON chrome-use ships zero adapter code; `site update` fetches epiral/bb-sites at runtime (like a package manager). Adapters remain their authors' property. cli/src/site.rs (load/parse/build_eval/list/update/map_args + tests), wired via commands.rs (parse), actions.rs (handle_site), main.rs (CLI dispatch). Docs in README, README.zh, skill-data/core. Verified live: github/issues returned 30 real issues as JSON over the relay.	2026-06-17 16:02:40 +09:00
leeguooooo	c667e0e704	docs(zh): bring Chinese README to parity with English Translate the sections the zh README was missing: 为什么用扩展 (extension vs raw debug port + comparison table), 命令名 (chrome-use/abs same binary), 自动化测试 (chrome-use test YAML suite), 自己验证 (verify-yourself detector list), 调参 (env var table); fill out 反检测 (0% stealth explanation + --launch CreepJS caveat), the install 'other ways' details, and the blog/X footer. All 12 top-level sections now match EN.	2026-06-17 14:49:52 +09:00
leeguooooo	08cb8dbeb9	docs: link blog + X in README	2026-06-17 14:15:52 +09:00
leeguooooo	fd2cdcde77	chore(release): 1.5.18 — issue-reporting guidance + clear data:-over-relay error Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled	2026-06-17 14:10:07 +09:00
leeguooooo	8e001e3d88	feat(dx): guide users to file issues; clear error for data: URLs over the relay #5: the CLI never pointed users at the issue tracker. `--help` and `--version` now print the issues URL (https://github.com/leeguooooo/chrome-use/issues), so agents hitting a rough edge know where to report it (the skill already nudges). #1: navigating to a `data:` URL over the extension relay fails with a cryptic `net::ERR_ABORTED` on an about:blank tab (chrome.debugger/chrome.tabs can't drive a top-frame data: navigation; it works fine under --launch). Detect that case and explain it — use a real http(s)://file:// URL or --launch — instead of leaking the raw code. (Surfaced while stress-testing 5 concurrent agents.)	2026-06-17 14:10:04 +09:00
leeguooooo	eb2bc343a0	chore(release): 1.5.17 — complete multi-agent isolation (no foreign tab/pop-up adoption on click) Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled	2026-06-17 13:31:50 +09:00
leeguooooo	d86c9c4be2	fix(relay): don't adopt foreign tabs/pop-ups on click — completes multi-agent isolation (#last hole) After strict isolation (v1.5.16) a session's tracked set is only its OWN tabs, so in `adopt_newly_opened` (run after every click to follow a pop-up) EVERY foreign tab looks "new" relative to the session's `before` set and got adopted — a click-heavy flow on a busy shared Chrome pulled other agents'/the user's tabs (github, Lark, iphone-use) into the session mid-flow. A pop-up the agent itself opened can't be told apart from a foreign tab over the relay (the synthesized targetInfo carries no opener/window/group), so on the relay `adopt_newly_opened` now adopts nothing: the agent drives only tabs it explicitly created; pop-ups (OAuth/login windows) are the user's. Launched browsers (every tab ours) still follow pop-ups. Verified live: a fresh click-heavy relay session stays clean (only its own tabs), and 5 concurrent agents churning tabs show zero cross-agent drift.	2026-06-17 13:31:49 +09:00
leeguooooo	32c25a6627	chore(release): 1.5.16 — strict multi-agent tab isolation on the relay Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled	2026-06-17 11:50:10 +09:00
leeguooooo	a8ce3dd3f8	fix(relay): strict multi-agent isolation — a session owns only its own tabs Several agents (and other tools opening tabs) share one real Chrome via the relay. Previously every session adopted ALL tabs from Target.getTargets, so another agent's tab churn polluted the list, dropped the tab being driven, and drifted commands onto the wrong page (the W-8BEN tax tab vanished mid-flow when a concurrent iphone-use agent opened tabs). A tab group belongs to exactly one agent. On the relay a session now tracks and drives ONLY the tabs it created (its own colored group) plus pop-ups its own clicks open — it never adopts the user's or other agents' tabs: - discover_and_attach (relay): create the session's own tab and pin it; do not adopt any existing foreign tab. - resync_targets (relay): never adopt unknown targets; never prune the session's tabs on a single getTargets snapshot (multi-agent churn / cross-process-nav gaps routinely omit live tabs) — prune only after RELAY_PRUNE_MISSES consecutive absent snapshots (debounced), pinned active always protected. - adopt_newly_opened: a tab that appears right after this session's action is a pop-up we opened — record it as owned. Launched browsers (every tab ours) keep adopting all tabs. Adds debounced_prune_ids + unit tests for the churn tolerance.	2026-06-17 11:50:09 +09:00
leeguooooo	997373fd57	chore(release): 1.5.15 — trusted activation for in-iframe buttons (#39 ) Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled	2026-06-17 10:16:17 +09:00
leeguooooo	5a858af93f	fix(iframe): trusted activation for in-iframe buttons — keyboard, not synthetic click (#39 ) A DOM `.click()` is isTrusted:false, which security-sensitive embedded forms reject — Google Payments' enabled `保存` button silently no-op'd, so a cross-origin payment/checkout/KYC form could be read, scrolled, and typed into but never submitted. A coordinate click can't help either: getBoxModel for a sub-frame node returns frame-local coords that don't compose the iframe offset, so it lands wrong (verified — the same-origin probe came back isTrusted:false via the coordinate fallback). Fix: click on an in-iframe ref now focuses the element in its own frame session and dispatches a real Enter (Space for checkbox-like roles) on the page session. Chrome routes the key to the focused element across frames (same mechanism as `type --focused`), and Enter/Space on a focused button/link/checkbox fires a trusted click. Non-activatable roles fall back to DOM .click(). Adds e2e_iframe_button_click_is_trusted (+ fixture): an in-iframe button records event.isTrusted into its own text; the test asserts the ref-click delivers isTrusted:true.	2026-06-17 10:16:15 +09:00
leeguooooo	58dc02bfdc	chore(release): 1.5.14 — fix eval await regression (replMode) + default scroll; green CI (#36 , #38 ) Release binaries / Build macOS ARM64 (push) Has been cancelled Release binaries / Build macOS x64 (push) Has been cancelled Release binaries / Build Linux ARM64 (push) Has been cancelled Release binaries / Build Linux musl ARM64 (push) Has been cancelled Release binaries / Build Linux musl x64 (push) Has been cancelled Release binaries / Build Linux x64 (push) Has been cancelled Release binaries / Build Windows x64 (push) Has been cancelled Release binaries / Attach binaries to GitHub Release (push) Has been cancelled	2026-06-17 02:34:55 +09:00
leeguooooo	c47601bd7b	fix(eval): replMode only for sync let/const decls, keep awaitPromise for async (#38 ) replMode and awaitPromise are mutually exclusive in Chrome — under replMode a returned promise serialises to {} instead of being awaited, which broke every fetch/async eval (e2e_domain_filter, e2e_headers, e2e_react_tree all regressed). Enable replMode only for synchronous scripts that declare a top-level let/const (the #38 case); promise-returning scripts keep awaitPromise — restoring the pre-#38 await behaviour while still fixing the let-redeclaration collision.	2026-06-17 02:08:11 +09:00
leeguooooo	0296bc7a88	fix(scroll): keep default scroll on window.scrollBy; wheel only for --at/--frame (#36 ) The centered-wheel default no-op'd on some pages (headless e2e_hover_scroll_press regressed). Restore window.scrollBy for plain page scroll; the coordinate wheel stays opt-in via --at/--frame for cross-origin iframe content.	2026-06-17 02:01:23 +09:00
leeguooooo	32e203b908	style: cargo fmt (fixes the CI format-check failure)	2026-06-17 01:33:22 +09:00