fix(tabs): gate the about:blank cleanup to the relay only

The previous commit closed the leftover about:blank on ANY connection — but on a
launched browser the initial about:blank is the browser's own first tab, not
daemon scratch, so it must stay. Broke e2e_tab_ids_not_reused (launched). Gate
the cleanup on agent_group().is_some() (relay only), where the about:blank is a
tab WE created. e2e_tab_ids_not_reused passes; relay scratch-blank close intact.

cli/Cargo.lock

@@ -290,7 +290,7 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chrome-use"
-version = "1.5.23"
+version = "1.5.27"
 dependencies = [
  "aes",
  "aes-gcm",

cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "chrome-use"
-version = "1.5.23"
+version = "1.5.27"
 edition = "2021"
 description = "Fast browser automation CLI for AI agents"
 license = "Apache-2.0"

cli/src/commands.rs

@@ -81,6 +81,10 @@ const KNOWN_COMMANDS: &[&str] = &[
     "site",
     "box",
     "adopt",
+    "canvas",
+    "viewport",
+    "resize",
+    "keep",
 ];
 
 /// Levenshtein distance, capped — small inputs only (command names).
@@ -1173,6 +1177,54 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
             }
             Ok(cmd)
         }
+        // Canvas/WebGL apps (Figma, games, maps, charts, drawing tools) render to a
+        // <canvas> with no DOM/refs to read. `canvas` extracts what's actually
+        // rendered: `list` enumerates canvases; `capture` saves a canvas to PNG via
+        // toDataURL (full backing-store resolution) with a CDP-screenshot fallback
+        // for WebGL contexts (no preserveDrawingBuffer) or cross-origin-tainted ones.
+        "canvas" => {
+            match rest.first().copied() {
+                Some("list") => Ok(json!({ "id": id, "action": "canvas_list" })),
+                Some("capture") => {
+                    let force_screenshot = rest.contains(&"--screenshot");
+                    let pos: Vec<&str> = rest[1..]
+                        .iter()
+                        .copied()
+                        .filter(|a| !a.starts_with("--"))
+                        .collect();
+                    // `capture [selector] [path]`: a selector starts with . # @ or is
+                    // a tag; a path contains / or ends in an image extension.
+                    let is_path = |s: &str| {
+                        s.contains('/')
+                            || s.ends_with(".png")
+                            || s.ends_with(".jpg")
+                            || s.ends_with(".jpeg")
+                            || s.ends_with(".webp")
+                    };
+                    let (selector, path) = match (pos.first(), pos.get(1)) {
+                        (Some(a), Some(b)) => (Some(*a), Some(*b)),
+                        (Some(a), None) if is_path(a) => (None, Some(*a)),
+                        (Some(a), None) => (Some(*a), None),
+                        _ => (None, None),
+                    };
+                    let mut cmd = json!({ "id": id, "action": "canvas_capture" });
+                    if let Some(s) = selector {
+                        cmd["selector"] = json!(s);
+                    }
+                    if let Some(p) = path {
+                        cmd["path"] = json!(p);
+                    }
+                    if force_screenshot {
+                        cmd["forceScreenshot"] = json!(true);
+                    }
+                    Ok(cmd)
+                }
+                _ => Err(ParseError::InvalidValue {
+                    message: "canvas needs a subcommand".to_string(),
+                    usage: "canvas list | canvas capture [selector] [path] [--screenshot]",
+                }),
+            }
+        }
         "pdf" => {
             let path = rest.first().ok_or_else(|| ParseError::MissingArguments {
                 context: "pdf".to_string(),
@@ -1324,6 +1376,10 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
         // `url` read so the response confirms which tab got adopted.
         "adopt" => Ok(json!({ "id": id, "action": "url" })),
 
+        // `keep`: leave the active tab for the user — exempt it from the daemon's
+        // auto-close/idle cleanup and remove it from the session's tab group.
+        "keep" => Ok(json!({ "id": id, "action": "keep" })),
+
         // === Stealth self-check ===
         "stealth" => {
             // `stealth [status]` — local stealth self-check: mode, live probes
@@ -1647,6 +1703,13 @@ fn parse_command_inner(args: &[String], flags: &Flags) -> Result<Value, ParseErr
         // === Mouse ===
         "mouse" => parse_mouse(&rest, &id),
 
+        // === Viewport / window size ===
+        // Top-level shortcut for `set viewport` — agents (and the author, in
+        // issue #47) reach for `viewport`/`resize` first. Uses a CDP virtual
+        // viewport, so it also works on the extension relay without yanking the
+        // user's real window around.
+        "viewport" | "resize" => parse_viewport(&rest, &id),
+
         // === Set (browser settings) ===
         "set" => parse_set(&rest, &id),
 
@@ -3095,6 +3158,97 @@ fn parse_mouse(rest: &[&str], id: &str) -> Result<Value, ParseError> {
     }
 }
 
+/// Parse a viewport / resize spec, shared by the top-level `viewport` / `resize`
+/// commands and `set viewport`. Sets a CDP device-metrics override
+/// (`Emulation.setDeviceMetricsOverride`) — a *virtual* viewport for the tab, so
+/// it works headless AND on the extension relay without physically resizing the
+/// user's real Chrome window (issue #47). Forms:
+///   viewport <width> <height> [scale] [--dpr N] [--mobile]
+///   viewport <width>x<height>        (e.g. 1280x800)
+///   viewport reset | clear           (drop the override, restore real size)
+fn parse_viewport(rest: &[&str], id: &str) -> Result<Value, ParseError> {
+    const USAGE: &str = "viewport <width> <height> [scale] [--dpr N] [--mobile] | viewport reset";
+
+    if matches!(
+        rest.first().copied(),
+        Some("reset") | Some("clear") | Some("off")
+    ) {
+        return Ok(json!({ "id": id, "action": "viewport", "reset": true }));
+    }
+
+    // Positional (non-flag) tokens. A `WxH` token counts as one positional.
+    let positionals: Vec<&str> = rest
+        .iter()
+        .copied()
+        .filter(|a| !a.starts_with("--"))
+        .collect();
+
+    let (w, h, scale_tok): (i32, i32, Option<&str>) = match positionals.first() {
+        Some(first) if first.contains('x') || first.contains('X') => {
+            let mut parts = first.split(['x', 'X']);
+            let w = parts.next().and_then(|s| s.parse::<i32>().ok());
+            let h = parts.next().and_then(|s| s.parse::<i32>().ok());
+            match (w, h) {
+                (Some(w), Some(h)) => (w, h, positionals.get(1).copied()),
+                _ => {
+                    return Err(ParseError::InvalidValue {
+                        message: format!("Invalid viewport size: {}", first),
+                        usage: USAGE,
+                    })
+                }
+            }
+        }
+        Some(w_str) => {
+            let h_str = positionals.get(1).ok_or(ParseError::MissingArguments {
+                context: "viewport".to_string(),
+                usage: USAGE,
+            })?;
+            let w = w_str.parse::<i32>().map_err(|_| ParseError::InvalidValue {
+                message: format!("Invalid width: {}", w_str),
+                usage: USAGE,
+            })?;
+            let h = h_str.parse::<i32>().map_err(|_| ParseError::InvalidValue {
+                message: format!("Invalid height: {}", h_str),
+                usage: USAGE,
+            })?;
+            (w, h, positionals.get(2).copied())
+        }
+        None => {
+            return Err(ParseError::MissingArguments {
+                context: "viewport".to_string(),
+                usage: USAGE,
+            })
+        }
+    };
+
+    let mut cmd = json!({ "id": id, "action": "viewport", "width": w, "height": h });
+
+    // Device-scale-factor: positional, overridden by --dpr / --scale.
+    let mut scale: Option<f64> = match scale_tok {
+        Some(s) => Some(s.parse::<f64>().map_err(|_| ParseError::InvalidValue {
+            message: format!("Invalid scale: {}", s),
+            usage: USAGE,
+        })?),
+        None => None,
+    };
+    if let Some(i) = rest.iter().position(|a| *a == "--dpr" || *a == "--scale") {
+        let v = rest.get(i + 1).and_then(|s| s.parse::<f64>().ok()).ok_or(
+            ParseError::InvalidValue {
+                message: "--dpr/--scale needs a number".to_string(),
+                usage: USAGE,
+            },
+        )?;
+        scale = Some(v);
+    }
+    if let Some(s) = scale {
+        cmd["deviceScaleFactor"] = json!(s);
+    }
+    if rest.contains(&"--mobile") {
+        cmd["mobile"] = json!(true);
+    }
+    Ok(cmd)
+}
+
 fn parse_set(rest: &[&str], id: &str) -> Result<Value, ParseError> {
     const VALID: &[&str] = &[
         "viewport",
@@ -3109,39 +3263,8 @@ fn parse_set(rest: &[&str], id: &str) -> Result<Value, ParseError> {
     ];
 
     match rest.first().copied() {
-        Some("viewport") => {
+        // `set viewport ...` is an alias for the top-level `viewport` command.
-            let w_str = rest.get(1).ok_or_else(|| ParseError::MissingArguments {
+        Some("viewport") => parse_viewport(&rest[1..], id),
-                context: "set viewport".to_string(),
-                usage: "set viewport <width> <height> [scale]",
-            })?;
-            let h_str = rest.get(2).ok_or_else(|| ParseError::MissingArguments {
-                context: "set viewport".to_string(),
-                usage: "set viewport <width> <height> [scale]",
-            })?;
-            let w = w_str
-                .parse::<i32>()
-                .map_err(|_| ParseError::MissingArguments {
-                    context: "set viewport".to_string(),
-                    usage: "set viewport <width> <height> [scale]",
-                })?;
-            let h = h_str
-                .parse::<i32>()
-                .map_err(|_| ParseError::MissingArguments {
-                    context: "set viewport".to_string(),
-                    usage: "set viewport <width> <height> [scale]",
-                })?;
-            let mut cmd = json!({ "id": id, "action": "viewport", "width": w, "height": h });
-            if let Some(scale_str) = rest.get(3) {
-                let scale = scale_str
-                    .parse::<f64>()
-                    .map_err(|_| ParseError::MissingArguments {
-                        context: "set viewport".to_string(),
-                        usage: "set viewport <width> <height> [scale]",
-                    })?;
-                cmd["deviceScaleFactor"] = json!(scale);
-            }
-            Ok(cmd)
-        }
         Some("device") => {
             let dev = rest.get(1).ok_or_else(|| ParseError::MissingArguments {
                 context: "set device".to_string(),
@@ -5302,6 +5425,62 @@ mod tests {
         assert!(result.is_err());
     }
 
+    #[test]
+    fn test_viewport_toplevel() {
+        let cmd = parse_command(&args("viewport 1280 800"), &default_flags()).unwrap();
+        assert_eq!(cmd["action"], "viewport");
+        assert_eq!(cmd["width"], 1280);
+        assert_eq!(cmd["height"], 800);
+        assert!(cmd.get("deviceScaleFactor").is_none());
+        assert!(cmd.get("mobile").is_none());
+    }
+
+    #[test]
+    fn test_resize_alias() {
+        let cmd = parse_command(&args("resize 700 800"), &default_flags()).unwrap();
+        assert_eq!(cmd["action"], "viewport");
+        assert_eq!(cmd["width"], 700);
+        assert_eq!(cmd["height"], 800);
+    }
+
+    #[test]
+    fn test_viewport_wxh_form() {
+        let cmd = parse_command(&args("viewport 375x812"), &default_flags()).unwrap();
+        assert_eq!(cmd["action"], "viewport");
+        assert_eq!(cmd["width"], 375);
+        assert_eq!(cmd["height"], 812);
+    }
+
+    #[test]
+    fn test_viewport_dpr_and_mobile_flags() {
+        let cmd =
+            parse_command(&args("viewport 375 812 --dpr 3 --mobile"), &default_flags()).unwrap();
+        assert_eq!(cmd["action"], "viewport");
+        assert_eq!(cmd["width"], 375);
+        assert_eq!(cmd["height"], 812);
+        assert_eq!(cmd["deviceScaleFactor"], 3.0);
+        assert_eq!(cmd["mobile"], true);
+    }
+
+    #[test]
+    fn test_viewport_reset() {
+        for spec in ["viewport reset", "viewport clear", "resize reset"] {
+            let cmd = parse_command(&args(spec), &default_flags()).unwrap();
+            assert_eq!(cmd["action"], "viewport", "{spec}");
+            assert_eq!(cmd["reset"], true, "{spec}");
+        }
+    }
+
+    #[test]
+    fn test_viewport_missing_height() {
+        assert!(parse_command(&args("viewport 1280"), &default_flags()).is_err());
+    }
+
+    #[test]
+    fn test_viewport_invalid_width() {
+        assert!(parse_command(&args("viewport abc 800"), &default_flags()).is_err());
+    }
+
     #[test]
     fn test_find_first_no_value() {
         let cmd = parse_command(&args("find first a click"), &default_flags()).unwrap();

cli/src/main.rs

@@ -305,6 +305,49 @@ fn run_session(args: &[String], session: &str, json_mode: bool) {
                 }
             }
         }
+        // Stop a specific session daemon (issue #48). Graceful: kill_stale_daemon
+        // sends SIGTERM first, so the daemon's shutdown handler runs `close()` and
+        // tidies the tabs IT created (its tab group) before exiting.
+        Some("stop") => {
+            let target = args.get(2).map(|s| s.as_str()).unwrap_or(session);
+            connection::kill_stale_daemon(target);
+            if json_mode {
+                print_json_value(json!({ "success": true, "data": { "stopped": target } }));
+            } else {
+                println!(
+                    "{} stopped session daemon: {}",
+                    color::success_indicator(),
+                    target
+                );
+            }
+        }
+        // Reclaim ALL session daemons now (issue #48) — for clearing the pile of
+        // idle daemons left after a round of automation/debugging without waiting
+        // for the idle timeout. Each is stopped gracefully (closes its own tabs);
+        // they respawn clean on next use. The `__nm-host` relay is not a tracked
+        // session daemon, so the extension/live-Chrome connection survives.
+        Some("prune") => {
+            let sessions: Vec<String> = walk_daemons()
+                .sessions
+                .into_iter()
+                .map(|s| s.name)
+                .collect();
+            for s in &sessions {
+                connection::kill_stale_daemon(s);
+            }
+            if json_mode {
+                print_json_value(json!({ "success": true, "data": { "pruned": sessions } }));
+            } else if sessions.is_empty() {
+                println!("No session daemons to prune");
+            } else {
+                println!(
+                    "{} pruned {} session daemon(s): {}",
+                    color::success_indicator(),
+                    sessions.len(),
+                    sessions.join(", ")
+                );
+            }
+        }
         None | Some(_) => {
             // Just show current session
             if json_mode {

cli/src/native/actions.rs

@@ -1317,9 +1317,12 @@ pub async fn execute_command(cmd: &Value, state: &mut DaemonState) -> Value {
         "evaluate" => handle_evaluate(cmd, state).await,
         "site" => handle_site(cmd, state).await,
         "close" => handle_close(state).await,
+        "keep" => handle_keep(state).await,
         "stealth_status" => handle_stealth_status(state).await,
         "snapshot" => handle_snapshot(cmd, state).await,
         "screenshot" => handle_screenshot(cmd, state).await,
+        "canvas_list" => handle_canvas_list(state).await,
+        "canvas_capture" => handle_canvas_capture(cmd, state).await,
         "click" => handle_click(cmd, state).await,
         "dblclick" => handle_dblclick(cmd, state).await,
         "fill" => handle_fill(cmd, state).await,
@@ -2853,6 +2856,34 @@ async fn handle_stealth_status(state: &DaemonState) -> Result<Value, String> {
     }))
 }
 
+/// `keep` — leave the ACTIVE tab for the user: stop owning it (so the daemon's
+/// `close()`/idle-shutdown won't close it) and best-effort remove it from this
+/// session's tab group so it looks like a normal user tab. The "leave for the
+/// user" half of the auto-close-on-idle cleanup: scratch tabs get closed, tabs
+/// the agent explicitly `keep`s stay. (Adopted user tabs are never owned, so
+/// they're already safe.)
+async fn handle_keep(state: &mut DaemonState) -> Result<Value, String> {
+    let mgr = state.browser.as_mut().ok_or("Browser not launched")?;
+    let target_id = mgr.active_target_id()?.to_string();
+    let session_id = mgr.active_session_id()?.to_string();
+    let was_owned = mgr.unown_target(&target_id);
+    // Best-effort: ask the extension to ungroup the tab (relay only; no-ops on a
+    // launched browser or an older extension that doesn't know ABExt.ungroupTab).
+    let _ = mgr
+        .client
+        .send_command_typed::<_, Value>(
+            "ABExt.ungroupTab",
+            &json!({ "sessionId": session_id, "targetId": target_id }),
+            None,
+        )
+        .await;
+    Ok(json!({
+        "kept": target_id,
+        "wasOwned": was_owned,
+        "note": "tab left for the user — exempt from auto-close, removed from the session tab group",
+    }))
+}
+
 async fn handle_close(state: &mut DaemonState) -> Result<Value, String> {
     if let Some(ref mgr) = state.browser {
         if let Some(ref session_name) = state.session_name {
@@ -3213,6 +3244,154 @@ fn downscale_screenshot(
     Some((resized.width(), resized.height()))
 }
 
+/// `canvas list` — enumerate <canvas> elements (size, visibility, whether
+/// toDataURL is usable) so an agent can pick one to capture on a canvas/WebGL app
+/// where snapshot/DOM reads see nothing.
+async fn handle_canvas_list(state: &DaemonState) -> Result<Value, String> {
+    let mgr = state.browser.as_ref().ok_or("Browser not launched")?;
+    let js = r#"(() => [...document.querySelectorAll('canvas')].map((c, i) => {
+        const r = c.getBoundingClientRect();
+        let toDataUrl = true, tainted = false;
+        try { c.toDataURL('image/png'); } catch (e) { toDataUrl = false; tainted = true; }
+        return {
+            index: i,
+            backingWidth: c.width, backingHeight: c.height,
+            cssWidth: Math.round(r.width), cssHeight: Math.round(r.height),
+            visible: r.width > 0 && r.height > 0 && r.bottom > 0 && r.top < innerHeight,
+            id: c.id || null, className: c.className || null,
+            toDataUrl, tainted,
+        };
+    }))()"#;
+    let canvases = mgr.evaluate(js, None).await?;
+    Ok(json!({ "canvases": canvases }))
+}
+
+/// `canvas capture [selector] [path]` — save a canvas's rendered pixels to PNG.
+/// Prefers `toDataURL` (full backing-store resolution); falls back to a CDP
+/// screenshot of the canvas element when toDataURL is blank (WebGL without
+/// preserveDrawingBuffer, e.g. Figma) or throws (cross-origin tainted). This is
+/// how chrome-use "sees" canvas/WebGL apps that expose no DOM or refs.
+async fn handle_canvas_capture(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
+    let selector = cmd
+        .get("selector")
+        .and_then(|v| v.as_str())
+        .map(String::from);
+    let force_screenshot = cmd
+        .get("forceScreenshot")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+    let out_path = cmd.get("path").and_then(|v| v.as_str()).map(String::from);
+    let id = cmd.get("id").and_then(|v| v.as_str()).unwrap_or("0");
+
+    // Probe: locate the canvas, get its bbox, and try toDataURL (unless forced).
+    let probe = {
+        let mgr = state.browser.as_ref().ok_or("Browser not launched")?;
+        let sel_lit = match &selector {
+            Some(s) => serde_json::to_string(s).unwrap_or_else(|_| "null".to_string()),
+            None => "null".to_string(),
+        };
+        let js = format!(
+            r#"(() => {{
+                const sel = {sel_lit};
+                const c = sel ? document.querySelector(sel)
+                    : [...document.querySelectorAll('canvas')].sort((a,b)=>(b.width*b.height)-(a.width*a.height))[0];
+                if (!c) return {{ found: false, count: document.querySelectorAll('canvas').length }};
+                const r = c.getBoundingClientRect();
+                let dataUrl = null, err = null;
+                if ({try_data}) {{ try {{ dataUrl = c.toDataURL('image/png'); }} catch (e) {{ err = String(e && e.message || e); }} }}
+                return {{ found: true, w: c.width, h: c.height, x: r.x, y: r.y, cw: r.width, ch: r.height, dataUrl, err }};
+            }})()"#,
+            try_data = !force_screenshot
+        );
+        mgr.evaluate(&js, None).await?
+    };
+
+    if !probe
+        .get("found")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false)
+    {
+        let count = probe.get("count").and_then(|v| v.as_u64()).unwrap_or(0);
+        return Err(format!(
+            "canvas: no canvas matched{} ({count} canvas element(s) on the page — try `canvas list`)",
+            selector
+                .as_deref()
+                .map(|s| format!(" `{s}`"))
+                .unwrap_or_default()
+        ));
+    }
+    let backing_w = probe.get("w").and_then(|v| v.as_u64()).unwrap_or(0);
+    let backing_h = probe.get("h").and_then(|v| v.as_u64()).unwrap_or(0);
+
+    // Decode toDataURL if present; a WebGL canvas without preserveDrawingBuffer
+    // returns a blank PNG (tiny when compressed), so reject suspiciously small
+    // results and fall back to the screenshot path.
+    let decoded: Option<Vec<u8>> = probe
+        .get("dataUrl")
+        .and_then(|v| v.as_str())
+        .and_then(|u| u.split_once(",").map(|(_, b)| b.to_string()))
+        .and_then(|b64| {
+            base64::Engine::decode(&base64::engine::general_purpose::STANDARD, b64.as_bytes()).ok()
+        });
+    let use_data = !force_screenshot && decoded.as_ref().map(|d| d.len() > 1024).unwrap_or(false);
+
+    if use_data {
+        let bytes = decoded.unwrap();
+        let path = out_path.unwrap_or_else(|| {
+            std::env::temp_dir()
+                .join(format!("canvas-{id}.png"))
+                .to_string_lossy()
+                .into_owned()
+        });
+        std::fs::write(&path, &bytes).map_err(|e| format!("canvas: write {path}: {e}"))?;
+        Ok(json!({
+            "path": absolutize_saved_path(&path),
+            "method": "toDataURL",
+            "width": backing_w,
+            "height": backing_h,
+        }))
+    } else {
+        // Fallback: screenshot the canvas element (or its bbox clip).
+        let clip = if selector.is_none() {
+            let x = probe.get("x").and_then(|v| v.as_f64()).unwrap_or(0.0);
+            let y = probe.get("y").and_then(|v| v.as_f64()).unwrap_or(0.0);
+            let cw = probe.get("cw").and_then(|v| v.as_f64()).unwrap_or(0.0);
+            let ch = probe.get("ch").and_then(|v| v.as_f64()).unwrap_or(0.0);
+            Some((x, y, cw, ch))
+        } else {
+            None
+        };
+        let options = ScreenshotOptions {
+            selector: selector.clone(),
+            path: out_path,
+            clip,
+            ..ScreenshotOptions::default()
+        };
+        let mgr = state.browser.as_ref().ok_or("Browser not launched")?;
+        let session_id = mgr.active_session_id()?.to_string();
+        let result = screenshot::take_screenshot(
+            &mgr.client,
+            &session_id,
+            &state.ref_map,
+            &options,
+            &state.iframe_sessions,
+        )
+        .await?;
+        let why = probe
+            .get("err")
+            .and_then(|v| v.as_str())
+            .map(|e| format!("toDataURL failed ({e})"))
+            .unwrap_or_else(|| {
+                "toDataURL blank/unavailable (WebGL no preserveDrawingBuffer)".into()
+            });
+        Ok(json!({
+            "path": absolutize_saved_path(&result.path),
+            "method": "screenshot",
+            "note": format!("captured rendered pixels via screenshot — {why}"),
+        }))
+    }
+}
+
 async fn handle_click(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
     // First-class coordinate click (issue #8.4): click a raw viewport point with
     // no element resolution. Parsed from `click <x> <y>` / `click --coords x,y`.
@@ -5102,6 +5281,19 @@ async fn handle_tab_close(cmd: &Value, state: &mut DaemonState) -> Result<Value,
 
 async fn handle_viewport(cmd: &Value, state: &mut DaemonState) -> Result<Value, String> {
     let mgr = state.browser.as_ref().ok_or("Browser not launched")?;
+
+    // `viewport reset` clears the device-metrics override and restores the real
+    // layout viewport (the launched window's size, or — over the relay — the
+    // user's actual Chrome window).
+    if cmd.get("reset").and_then(|v| v.as_bool()).unwrap_or(false) {
+        mgr.clear_viewport().await?;
+        state.viewport = None;
+        if let Some(ref server) = state.stream_server {
+            server.set_viewport(1280, 720).await;
+        }
+        return Ok(json!({ "reset": true }));
+    }
+
     let width = cmd.get("width").and_then(|v| v.as_i64()).unwrap_or(1280) as i32;
     let height = cmd.get("height").and_then(|v| v.as_i64()).unwrap_or(720) as i32;
     let scale = cmd

cli/src/native/browser.rs

@@ -1546,6 +1546,13 @@ impl BrowserManager {
             .ok_or_else(|| "No active page".to_string())
     }
 
+    /// Stop owning a tab — drop it from `created_targets` so it survives `close()`
+    /// and idle-shutdown (the agent is leaving it for the user). Returns true if it
+    /// was owned. Used by `keep`.
+    pub fn unown_target(&mut self, target_id: &str) -> bool {
+        self.created_targets.remove(target_id)
+    }
+
     /// Returns true if this manager was connected via CDP (as opposed to local launch).
     pub fn is_cdp_connection(&self) -> bool {
         self.browser_process.is_none()
@@ -1950,9 +1957,17 @@ impl BrowserManager {
     /// CDP browser the endpoint is strict, so we must NOT send the custom param —
     /// hence `None` there. We detect the relay by matching our `ws_url` against
     /// the live relay URL the native-messaging host published.
+    /// Whether this manager is driving the user's real Chrome through the
+    /// `ab-connect` extension relay (vs. a browser we launched or a direct CDP
+    /// endpoint). Detected by matching our `ws_url` against the live relay URL
+    /// the native-messaging host published. Used to avoid relay-unsafe CDP that
+    /// would disturb the user's window (e.g. Browser.setContentsSize, issue #47).
+    fn via_relay(&self) -> bool {
+        crate::connect::relay_url().as_deref() == Some(self.ws_url.as_str())
+    }
+
     fn agent_group(&self) -> Option<String> {
-        let via_relay = crate::connect::relay_url().as_deref() == Some(self.ws_url.as_str());
+        if !self.via_relay() {
-        if !via_relay {
             return None;
         }
         let name = DAEMON_SESSION
@@ -2055,6 +2070,46 @@ impl BrowserManager {
         self.active_page_index = index;
         self.pin_active_target();
 
+        // Close the daemon's leftover initial `about:blank` scratch tab once this
+        // real tab exists, so the session's tab group isn't left showing a stray
+        // blank page beside the work tab (every group otherwise carried one). Only
+        // on the RELAY — there the about:blank is a tab WE created as scratch; on a
+        // launched browser the initial about:blank is the browser's own first tab,
+        // which we must not close. Only when opening a real url, OWNED, still-blank.
+        if target_url != "about:blank" && self.agent_group().is_some() {
+            if let Some(new_tid) = self.pages.get(index).map(|p| p.target_id.clone()) {
+                let blanks: Vec<String> = self
+                    .pages
+                    .iter()
+                    .filter(|p| {
+                        p.target_id != new_tid
+                            && self.created_targets.contains(&p.target_id)
+                            && (p.url == "about:blank" || p.url.is_empty())
+                    })
+                    .map(|p| p.target_id.clone())
+                    .collect();
+                for tid in blanks {
+                    let _ = self
+                        .client
+                        .send_command_typed::<_, Value>(
+                            "Target.closeTarget",
+                            &CloseTargetParams {
+                                target_id: tid.clone(),
+                            },
+                            None,
+                        )
+                        .await;
+                    self.created_targets.remove(&tid);
+                    self.remove_page_by_target_id(&tid);
+                }
+                // Removing earlier pages shifts indices — re-pin the new tab.
+                if let Some(i) = self.pages.iter().position(|p| p.target_id == new_tid) {
+                    self.active_page_index = i;
+                    self.pin_active_target();
+                }
+            }
+        }
+
         Ok(json!({
             "tabId": format_tab_id(tab_id),
             "label": label,
@@ -2161,32 +2216,39 @@ impl BrowserManager {
             .await?;
 
         // Screencast captures the actual content area, not the emulated CSS
-        // viewport, so resize the content area to match.
+        // viewport, so resize the content area to match — but ONLY for a browser
-        if let Ok(target_id) = self.active_target_id() {
+        // we launched. Over the ab-connect relay the "window" is the user's real
-            if let Ok(window_info) = self
+        // Chrome window, and Browser.setContentsSize would physically resize it
-                .client
+        // (issue #47) — the exact thing the CDP device-metrics override exists to
-                .send_command(
+        // avoid. The Emulation override above already gives the tab the requested
-                    "Browser.getWindowForTarget",
+        // CSS viewport without touching the OS window, so skip the resize there.
-                    Some(json!({ "targetId": target_id })),
+        if !self.via_relay() {
-                    None,
+            if let Ok(target_id) = self.active_target_id() {
-                )
+                if let Ok(window_info) = self
-                .await
+                    .client
-            {
+                    .send_command(
-                if let Some(window_id) = window_info.get("windowId").and_then(|v| v.as_i64()) {
+                        "Browser.getWindowForTarget",
-                    if let Err(e) = self
+                        Some(json!({ "targetId": target_id })),
-                        .client
+                        None,
-                        .send_command(
+                    )
-                            "Browser.setContentsSize",
+                    .await
-                            Some(json!({
+                {
-                                "windowId": window_id,
+                    if let Some(window_id) = window_info.get("windowId").and_then(|v| v.as_i64()) {
-                                "width": width,
+                        if let Err(e) = self
-                                "height": height,
+                            .client
-                            })),
+                            .send_command(
-                            None,
+                                "Browser.setContentsSize",
-                        )
+                                Some(json!({
-                        .await
+                                    "windowId": window_id,
-                    {
+                                    "width": width,
-                        eprintln!("Browser.setContentsSize failed (experimental CDP): {e}");
+                                    "height": height,
+                                })),
+                                None,
+                            )
+                            .await
+                        {
+                            eprintln!("Browser.setContentsSize failed (experimental CDP): {e}");
+                        }
                     }
                 }
             }
@@ -2195,6 +2257,22 @@ impl BrowserManager {
         Ok(())
     }
 
+    /// Clear the CDP device-metrics override (`viewport reset`), restoring the
+    /// tab's real layout viewport. Never touches the OS window, so it is safe on
+    /// the relay (we never physically resized the user's window — see
+    /// `set_viewport`).
+    pub async fn clear_viewport(&self) -> Result<(), String> {
+        let session_id = self.active_session_id()?;
+        self.client
+            .send_command(
+                "Emulation.clearDeviceMetricsOverride",
+                Some(json!({})),
+                Some(session_id),
+            )
+            .await?;
+        Ok(())
+    }
+
     pub async fn set_user_agent(&self, user_agent: &str) -> Result<(), String> {
         let session_id = self.active_session_id()?;
         self.client

cli/src/native/daemon.rs

@@ -130,12 +130,21 @@ pub async fn run_daemon(session: &str) {
         }
     }
 
-    // Auto-shutdown the daemon after this many ms of inactivity (no commands received).
+    // Auto-shutdown the daemon after this many ms of inactivity (no commands
-    // Disabled when unset or 0.
+    // received). On shutdown the daemon closes the tabs IT created (its per-session
-    let idle_timeout_ms = env::var("AGENT_BROWSER_IDLE_TIMEOUT_MS")
+    // tab group), so an agent that finishes a task and just stops — without ever
-        .ok()
+    // calling `close` — no longer leaves a pile of scratch tabs and a lingering
-        .and_then(|s| s.parse::<u64>().ok())
+    // tab group in the user's Chrome. The timer resets on every command, so active
-        .filter(|&ms| ms > 0);
+    // sessions are never interrupted; only genuinely-idle ones clean up.
+    //
+    // Defaults to 10 minutes. Set AGENT_BROWSER_IDLE_TIMEOUT_MS to override, or 0
+    // to disable (keep the daemon alive forever — the old behaviour). Adopted
+    // tabs (the user's own, via `adopt`) are never closed: only `created_targets`.
+    const DEFAULT_IDLE_TIMEOUT_MS: u64 = 600_000;
+    let idle_timeout_ms = match env::var("AGENT_BROWSER_IDLE_TIMEOUT_MS") {
+        Ok(s) => s.trim().parse::<u64>().ok().filter(|&ms| ms > 0),
+        Err(_) => Some(DEFAULT_IDLE_TIMEOUT_MS),
+    };
 
     let result = run_socket_server(
         &socket_path,

cli/src/output.rs

@@ -3319,9 +3319,16 @@ Core Commands:
   screenshot [path]          Take screenshot (auto-downscaled to ≤2000px long edge;
                              --max-width/--max-height/--scale to override)
   pdf <path>                 Save as PDF
+  canvas list                List <canvas> elements (size, type) on the page
+  canvas capture [sel] [path]  Save a canvas's rendered pixels to PNG — for
+                             WebGL/canvas apps (Figma, games, maps, charts) that
+                             expose no DOM. toDataURL, with a screenshot fallback.
   snapshot                   Accessibility tree with refs (for AI)
   eval <js>                  Run JavaScript
   connect <port|url>         Connect to browser via CDP
+  keep                       Leave the active tab for the user — exempt it from
+                             auto-close/idle cleanup + remove it from the session
+                             tab group (so scratch tabs get cleaned, this one stays)
   close [--all]              Close browser (--all closes every session)
 
 Navigation:
@@ -3448,11 +3455,21 @@ Confirmation:
 Sessions:
   session                    Show current session name
   session list               List active sessions
+  session stop [name]        Stop one session daemon (default: current) — graceful,
+                             closes the tabs it created
+  session prune              Stop ALL session daemons now (closes their tabs; they
+                             respawn clean on next use). For clearing idle daemons.
   sessions                   List running session daemons (alias of daemon status)
   daemon status              List running session daemons (+ relay state)
   daemon restart             Kill all session daemons; keeps the extension relay
                              up. Clears stale/cross-leaked state after an upgrade.
 
+  Lifecycle: each --session <name> spawns a background daemon that drives that
+  session's tabs. A daemon auto-shuts-down after 10 min idle (no commands) —
+  AGENT_BROWSER_IDLE_TIMEOUT_MS overrides, 0 disables — and on shutdown closes
+  the scratch tabs IT created (its tab group). Use `keep` to leave a tab for the
+  user (exempt from auto-close), `session stop/prune` to reclaim now.
+
 Chat (AI):
   chat <message>             Send a natural language instruction (single-shot)
   chat                       Start interactive chat (REPL mode when stdin is a TTY)

cli/src/site.rs

@@ -31,6 +31,10 @@ fn dirs_home() -> Option<PathBuf> {
 pub struct Adapter {
     pub meta: Value,
     pub func_src: String,
+    /// The adapter's declared `args` keys in DECLARATION order. Parsed from the
+    /// raw @meta text because `serde_json` sorts object keys alphabetically, which
+    /// would otherwise scramble positional-arg mapping for multi-arg adapters.
+    pub arg_order: Vec<String>,
 }
 
 impl Adapter {
@@ -111,7 +115,66 @@ pub fn parse_adapter(raw: &str, spec: &str) -> Result<Adapter, String> {
     if func_src.is_empty() {
         return Err(format!("site: {spec} has no function body after @meta"));
     }
-    Ok(Adapter { meta, func_src })
+    let arg_order = arg_order_from_meta(&raw[start..end]);
+    Ok(Adapter {
+        meta,
+        func_src,
+        arg_order,
+    })
+}
+
+/// Extract the `args` object's keys in DECLARATION order from the raw @meta JSON
+/// text (serde sorts them, losing order). Brace/string-aware: finds the `"args"`
+/// value object and collects only its top-level keys.
+fn arg_order_from_meta(meta_json: &str) -> Vec<String> {
+    let bytes = meta_json.as_bytes();
+    // Locate the `"args"` key, then the `{` that opens its value object.
+    let Some(args_pos) = meta_json.find("\"args\"") else {
+        return Vec::new();
+    };
+    let Some(brace_off) = meta_json[args_pos..].find('{') else {
+        return Vec::new();
+    };
+    let open = args_pos + brace_off;
+    let mut keys = Vec::new();
+    let mut depth = 0i32;
+    let mut in_str = false;
+    let mut esc = false;
+    let mut cur = String::new();
+    let mut last_str: Option<String> = None;
+    for &b in bytes.iter().skip(open) {
+        if in_str {
+            if esc {
+                esc = false;
+            } else if b == b'\\' {
+                esc = true;
+            } else if b == b'"' {
+                in_str = false;
+                last_str = Some(std::mem::take(&mut cur));
+            } else {
+                cur.push(b as char);
+            }
+            continue;
+        }
+        match b {
+            b'"' => in_str = true,
+            b'{' => depth += 1,
+            b'}' => {
+                depth -= 1;
+                if depth == 0 {
+                    break; // end of the args object
+                }
+            }
+            // A `:` at depth 1 means the preceding string was a key of `args`.
+            b':' if depth == 1 => {
+                if let Some(k) = last_str.take() {
+                    keys.push(k);
+                }
+            }
+            _ => {}
+        }
+    }
+    keys
 }
 
 /// Build the JS to eval: `(<adapter function>)(<args JSON>)`. The adapter's
@@ -325,14 +388,11 @@ pub fn adapters_for_domain(host: &str) -> Vec<String> {
 /// validates required args itself.
 pub fn map_args(adapter: &Adapter, positional: &[String], named: &[(String, String)]) -> Value {
     let mut obj = serde_json::Map::new();
-    let keys: Vec<String> = adapter
+    // Positional args fill the adapter's declared args in DECLARATION order
-        .meta
+    // (`arg_order`), not serde's alphabetized key order — otherwise a 2-arg
-        .get("args")
+    // adapter like `{projectId, path}` would map positionals to `{path, projectId}`.
-        .and_then(|a| a.as_object())
-        .map(|m| m.keys().cloned().collect())
-        .unwrap_or_default();
     for (i, val) in positional.iter().enumerate() {
-        if let Some(k) = keys.get(i) {
+        if let Some(k) = adapter.arg_order.get(i) {
             obj.insert(k.clone(), Value::String(val.clone()));
         }
     }
@@ -382,4 +442,24 @@ async function(args) { return { repo: args.repo }; }"#;
         assert!(load_adapter("noslash").is_err());
         assert!(load_adapter("../etc/passwd").is_err());
     }
+
+    // Regression: positional args must follow DECLARATION order, not serde's
+    // alphabetical key order. With `{projectId, path}` (not alphabetical),
+    // `<uuid> <file>` must map projectId←uuid, path←file — not swapped.
+    #[test]
+    fn positional_args_follow_declaration_order_not_alphabetical() {
+        let raw = r#"/* @meta
+{
+  "name": "claude-design/get-file",
+  "domain": "claude.ai",
+  "args": { "projectId": {"required": true}, "path": {"required": true} }
+}
+*/
+async function(args){ return args; }"#;
+        let a = parse_adapter(raw, "claude-design/get-file").unwrap();
+        assert_eq!(a.arg_order, vec!["projectId", "path"]);
+        let args = map_args(&a, &["the-uuid".into(), "misonote.dc.html".into()], &[]);
+        assert_eq!(args["projectId"], "the-uuid");
+        assert_eq!(args["path"], "misonote.dc.html");
+    }
 }

extensions/ab-connect/background.js

@@ -288,6 +288,19 @@ async function handleForwardCdpCommand(msg) {
   const params = msg?.params?.params || undefined
   const sessionId = typeof msg?.params?.sessionId === 'string' ? msg.params.sessionId : undefined
 
+  // Non-CDP extension commands (ABExt.*) the daemon sends. `ungroupTab` removes a
+  // tab from its per-session tab group so a `keep`-marked tab is left for the user
+  // as a normal, ungrouped tab (the group can then be cleaned up). Best-effort.
+  if (method === 'ABExt.ungroupTab') {
+    const tabId = tabIdFromSession(sessionId) ?? tabForSession(sessionId)
+    if (tabId != null && chrome.tabs.ungroup) {
+      try {
+        await chrome.tabs.ungroup(tabId)
+      } catch {}
+    }
+    return { ungrouped: tabId ?? null }
+  }
+
   // Browser-level Target methods that map onto chrome.tabs.
   if (method === 'Target.createTarget') {
     const url = typeof params?.url === 'string' && params.url ? params.url : 'about:blank'

extensions/ab-connect/manifest.json

@@ -1,8 +1,8 @@
 {
   "manifest_version": 3,
   "name": "chrome-use",
-  "version": "0.4.11",
+  "version": "0.4.12",
-  "description": "Let chrome-use drive your logged-in Chrome \u2014 install once, no token, no per-use confirmation.",
+  "description": "Let chrome-use drive your logged-in Chrome — install once, no token, no per-use confirmation.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6vQIyscGIPYPZdSpPwPL0+0gxUROyRgCpmvCSDoc8XUm4qm97VbKnD9Ijc1lV22lNWZtE78gaRjt6BeSfuMgnBymnhLKjN1gU6AI5QUU0mrJyeHdWKvrKQR5FmsM2A7Xr1ykE2SiiS8zNUS3Y/6O5l+Nva7wrVy6E4a2dkBVQkOsu+DV+nEZvhIyuDY5D5SPXqNwUTWTaglwj5mjvHz36xSwCWlPmrtJ+ED0AUyrb2z4GIOmvk4kqtBVrh/UD058klLo4CkYOnIybB5aV6WYuwarfPY4bF/dLggPem+ewLNTUNBuwrxj/A4nUv0LJTuRO8rR7f8WR9qnRCY0Ic5saQIDAQAB",
   "icons": {
     "16": "icons/icon16.png",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "chrome-use",
-  "version": "1.5.23",
+  "version": "1.5.27",
   "description": "chrome-use — drive your real, logged-in Chrome from any AI agent, stealth by default",
   "type": "module",
   "packageManager": "pnpm@11.1.3",

skill-data/core/SKILL.md

@@ -154,7 +154,17 @@ real Chrome concurrently without ever dropping or stealing each other's tabs —
 another agent's tab churn can't make your bound tab vanish or drift your commands
 onto the wrong page. Consequence: `tab list` shows only *your* session's tabs; to
 drive a specific page, navigate to it in your own tab instead of expecting a
-pre-existing or popped-up tab to appear in the list. **Anti-detection ranking: this real logged-in Chrome (extension
+pre-existing or popped-up tab to appear in the list.
+
+> **Need to read a tab the user already has open?** Use `chrome-use adopt
+> <url-substring|targetId>` — it finds that pre-existing tab (the user's own, or
+> another session's) across groups and drives it **without opening a new tab**.
+> e.g. `adopt "claude.ai/design"` then `snapshot`/`eval`/`get text` on it. On no
+> match it errors and lists the tabs it can see. This is the explicit, opt-in way
+> through the isolation above (it tags the adopted tab into your group). Great for
+> "read/extract from the page I'm looking at" without disturbing it.
+
+**Anti-detection ranking: this real logged-in Chrome (extension
 connect) > a headed launched browser > headless (forbidden).** A genuine human
 browser has no headless/automation tells at all, so prefer it for anything
 anti-bot-sensitive.
@@ -444,6 +454,13 @@ tree**, so `snapshot` comes back near-empty and refs are a dead end. `snapshot`
 detects this and prints a one-line hint. Drive them the screenshot way:
 
 ```bash
+chrome-use canvas list                 # enumerate <canvas> elements (size, type)
+chrome-use canvas capture out.png      # save the canvas's RENDERED pixels to PNG —
+                                          # toDataURL (full backing-store res, e.g.
+                                          # Figma 2522x1904), screenshot fallback for
+                                          # WebGL w/o preserveDrawingBuffer / tainted.
+                                          # Gets the RENDER, not hidden source data
+                                          # (those live in the app's binary store/API).
 chrome-use screenshot /tmp/s.png       # SEE the state (your only read path —
                                           # eval/get text return nothing useful)
 chrome-use click 640 360               # interact by viewport coordinate
@@ -774,6 +791,29 @@ chrome-use snapshot -i
 chrome-use frame main     # back to main frame
 ```
 
+### Viewport / window size (responsive & overflow debugging)
+
+To reproduce width-dependent bugs (responsive breakpoints, horizontal-overflow
+hunts, mobile layouts) set the viewport. This is a **CDP virtual viewport**
+(`Emulation.setDeviceMetricsOverride`) — it changes the layout viewport *for the
+tab* without physically resizing the OS window, so it works headless **and** over
+the extension relay without yanking the user's real Chrome window around.
+
+```bash
+chrome-use viewport 1280 800        # set width x height (alias: resize)
+chrome-use viewport 375x812         # WxH shorthand
+chrome-use viewport 375 812 --dpr 3 --mobile   # retina + mobile emulation
+chrome-use viewport reset           # clear the override, restore real size
+```
+
+```bash
+# Find what's overflowing at a narrow width:
+chrome-use viewport 375 812
+chrome-use eval 'document.documentElement.scrollWidth + " vs " + innerWidth'
+```
+
+`set viewport <w> <h> [scale]` is an equivalent alias.
+
 ### Dialogs
 
 `alert` and `beforeunload` are auto-accepted so agents never block. For