leeguooooo
1b3d41e579
Reported: a single `click @ref` could hang 5+ minutes, with multiple queued click invocations adding up to 7+ minutes — worst case 30s timeout × 3 CDP calls × N parallel processes: - verify_ref_identity (Accessibility.getPartialAXTree) → default 30s - resolveNode / getBoxModel → default 30s - wait_for_paint_settled (Runtime.evaluate awaitPromise) → default 30s The latter two are best-effort defenses added in fork.3-5 to fix SPA race / DOM-reuse bugs. They should never block a real click for 30s — the unguarded code path was always faster than the guarded path-that-hangs. - verify_ref_identity capped at 1s (skips check on timeout) - wait_for_paint_settled capped at 500ms (skips wait on timeout) Both skip-on-timeout intentionally: the worst case is the click behaves like fork.2 (race-prone but fast), which is strictly better than the user pkilling stuck processes. Also rewrites the misleading "Chrome 144+ chrome://inspect tip" in the auto-connect failure message — the toggle exposes target discovery only, not the /json/version HTTP API the auto-connect flow expects (verified by user: lsof shows :9222 listening but curl /json/version returns 404).
agent-browser-stealth
Stealth fork of agent-browser — connects to your real Chrome, shares your login sessions, and is undetectable by anti-bot systems.
For basic usage, commands, and API reference, see the upstream documentation.
Why this fork?
agent-browser launches a fresh browser with an empty profile. You need to log in again, and websites can detect it's automated.
agent-browser-stealth connects to your existing Chrome. Your cookies, sessions, and browser fingerprint are all real — because it IS your real browser.
| agent-browser | agent-browser-stealth | |
|---|---|---|
| Browser | Launches new Chrome | Connects to your Chrome |
| Login state | Empty, need to re-login | Your existing sessions |
| Fingerprint | Automation markers present | Your real fingerprint |
| User collaboration | Separate window | Same window, take over anytime |
| CAPTCHA | Agent stuck | You solve it, agent continues |
Install
npm install -g agent-browser-stealth
Install the AI agent skills
The repo ships SKILL.md files for Claude Code, Cursor, etc. Pull them into the current project with skills.sh:
npx skills add leeguooooo/agent-browser-stealth
This drops skills/agent-browser (and the specialized skill-data/{core,electron,slack,dogfood,agentcore,vercel-sandbox}) into your project so your AI agent gets the right usage patterns and pre-approved bash permissions for agent-browser, agent-browser-stealth, and abs.
Setup (one time)
Enable Chrome DevTools Protocol in your Chrome:
- Open
chrome://inspect/#remote-debuggingin Chrome - Toggle the switch on
That's it. This setting persists across Chrome restarts.
Usage
# Connect to your Chrome and navigate
agent-browser open https://example.com
# Everything works through your logged-in browser
agent-browser click "Post"
agent-browser fill "Title" "Hello World"
agent-browser screenshot ./page.png
The agent operates in your Chrome — you'll see tabs opening, pages loading, clicks happening in real time. You can take over at any point (e.g. solve a CAPTCHA), then let the agent continue.
Standalone mode
If you need a separate browser (CI, testing, etc.):
agent-browser --launch open https://example.com
In CI environments, standalone mode is used automatically.
Anti-detection
When connected to your real Chrome, we inject zero JavaScript patches. Your browser's fingerprint is completely genuine.
The only thing we do is call Emulation.setAutomationOverride via CDP to set navigator.webdriver = false at the native Chrome level — undetectable by lie-detection systems like CreepJS.
Test results (connected to real Chrome):
| Test site | Result |
|---|---|
| CreepJS | 0% stealth, 0% headless |
| bot.sannysoft.com | All green |
| Cloudflare Turnstile | Passed |
When using --launch mode (standalone browser), a full suite of 32 stealth patches is applied for headless Chrome.
Differences from upstream
Based on agent-browser v0.27.0. Changes:
- Auto-connect is default —
agent-browser open <url>connects to your Chrome instead of launching a new one - CDP-native stealth —
Emulation.setAutomationOverrideinstead of JS patches - Dual stealth mode — zero patches for real Chrome, full patches for
--launchmode --launch/--newflag — explicitly start a standalone browser- CI auto-detection — standalone mode when
CIenv var is set
All upstream features (commands, snapshots, screenshots, recordings, tabs, sessions, etc.) work the same. See the upstream repo for full documentation.
License
Apache-2.0 (same as upstream)