@cyberstrike-io/cyberstrike 1.1.17-beta.5 → 1.1.17-beta.7

package/hackbrowser-worker.js

@@ -8766,13 +8766,13 @@ async function fetch2(url2, options_) {
       request_.setTimeout(0);
       const headers = fromRawHeaders(response_.rawHeaders);
       if (isRedirect(response_.statusCode)) {
-        const location = headers.get("Location");
+        const location2 = headers.get("Location");
         let locationURL = null;
         try {
-          locationURL = location === null ? null : new URL(location, request.url);
+          locationURL = location2 === null ? null : new URL(location2, request.url);
         } catch {
           if (request.redirect !== "manual") {
-            reject(new FetchError(`uri requested responds with an invalid redirect URL: ${location}`, "invalid-redirect"));
+            reject(new FetchError(`uri requested responds with an invalid redirect URL: ${location2}`, "invalid-redirect"));
             finalize();
             return;
           }
@@ -17063,25 +17063,25 @@ var require_googleauth = __commonJS((exports) => {
       }
     }
     async _tryGetApplicationCredentialsFromWellKnownFile(options) {
-      let location = null;
+      let location2 = null;
       if (this._isWindows()) {
-        location = process.env["APPDATA"];
+        location2 = process.env["APPDATA"];
       } else {
         const home = process.env["HOME"];
         if (home) {
-          location = path.join(home, ".config");
+          location2 = path.join(home, ".config");
         }
       }
-      if (location) {
-        location = path.join(location, "gcloud", "application_default_credentials.json");
-        if (!fs2.existsSync(location)) {
-          location = null;
+      if (location2) {
+        location2 = path.join(location2, "gcloud", "application_default_credentials.json");
+        if (!fs2.existsSync(location2)) {
+          location2 = null;
         }
       }
-      if (!location) {
+      if (!location2) {
         return null;
       }
-      const client = await this._getApplicationCredentialsFromFilePath(location, options);
+      const client = await this._getApplicationCredentialsFromFilePath(location2, options);
       return client;
     }
     async _getApplicationCredentialsFromFilePath(filePath, options = {}) {
@@ -56573,7 +56573,7 @@ async function generateAuthToken2(options) {
 }
 function createVertexAnthropic(options = {}) {
   var _a16;
-  const location = loadOptionalSetting({
+  const location2 = loadOptionalSetting({
     settingValue: options.location,
     environmentVariableName: "GOOGLE_VERTEX_LOCATION"
   });
@@ -56581,7 +56581,7 @@ function createVertexAnthropic(options = {}) {
     settingValue: options.project,
     environmentVariableName: "GOOGLE_VERTEX_PROJECT"
   });
-  const baseURL = (_a16 = withoutTrailingSlash(options.baseURL)) != null ? _a16 : `https://${location === "global" ? "" : location + "-"}aiplatform.googleapis.com/v1/projects/${project}/locations/${location}/publishers/anthropic/models`;
+  const baseURL = (_a16 = withoutTrailingSlash(options.baseURL)) != null ? _a16 : `https://${location2 === "global" ? "" : location2 + "-"}aiplatform.googleapis.com/v1/projects/${project}/locations/${location2}/publishers/anthropic/models`;
   const createChatModel = (modelId) => {
     var _a22;
     return new AnthropicMessagesLanguageModel2(modelId, {
@@ -106258,6 +106258,80 @@ import { chromium as chromium2 } from "playwright";
 // ../hackbrowser/src/stealth.ts
 import { existsSync as existsSync2 } from "fs";
 import { chromium } from "playwright";
+
+// ../hackbrowser/src/log.ts
+var LEVEL_PRIORITY = {
+  DEBUG: 0,
+  INFO: 1,
+  WARN: 2,
+  ERROR: 3
+};
+var currentLevel = "INFO";
+var sink = defaultStderrSink;
+function defaultStderrSink(record3) {
+  const ts = new Date(record3.timestamp).toISOString();
+  let line = `${ts} ${record3.level} ${record3.service} ${record3.message}`;
+  if (record3.extra && Object.keys(record3.extra).length > 0) {
+    try {
+      line += " " + JSON.stringify(record3.extra);
+    } catch {
+      line += " [unserializable extra]";
+    }
+  }
+  process.stderr.write(line + `
+`);
+}
+function shouldLog(level) {
+  return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[currentLevel];
+}
+function emit(level, service, message, extra) {
+  if (!shouldLog(level))
+    return;
+  sink({
+    level,
+    service,
+    message,
+    extra,
+    timestamp: Date.now()
+  });
+}
+var Log;
+((Log) => {
+  function init(options) {
+    if (options.level)
+      currentLevel = options.level;
+  }
+  Log.init = init;
+  function setSink(custom4) {
+    sink = custom4;
+  }
+  Log.setSink = setSink;
+  function resetSink() {
+    sink = defaultStderrSink;
+  }
+  Log.resetSink = resetSink;
+  function create(options) {
+    const { service } = options;
+    return {
+      debug(message, extra) {
+        emit("DEBUG", service, message, extra);
+      },
+      info(message, extra) {
+        emit("INFO", service, message, extra);
+      },
+      warn(message, extra) {
+        emit("WARN", service, message, extra);
+      },
+      error(message, extra) {
+        emit("ERROR", service, message, extra);
+      }
+    };
+  }
+  Log.create = create;
+})(Log ||= {});
+
+// ../hackbrowser/src/stealth.ts
+var log2 = Log.create({ service: "hackbrowser:stealth" });
 var PLATFORM_ARGS = process.platform === "linux" ? ["--no-sandbox", "--disable-setuid-sandbox", "--disable-dev-shm-usage", "--no-zygote"] : [];
 var LAUNCH_ARGS = [
   "--disable-blink-features=AutomationControlled",
@@ -106284,20 +106358,31 @@ function findSystemChrome() {
   return candidates.find((p) => existsSync2(p));
 }
 async function connect(opts) {
-  if (opts.cdp)
+  const proxy = opts.network?.proxy;
+  if (opts.cdp) {
+    if (proxy) {
+      log2.warn("proxy config ignored: connecting to an already-running browser over CDP", {
+        server: proxy.server,
+        hint: "start that browser with its own --proxy-server, or drop the cdp option to let hackbrowser launch one"
+      });
+    }
     return chromium.connectOverCDP(opts.cdp);
+  }
+  const launch = { ...launchOptions(opts.headless), ...proxy ? { proxy } : {} };
   const chrome = findSystemChrome();
   if (chrome)
-    return chromium.launch({ ...launchOptions(opts.headless), executablePath: chrome });
-  return chromium.launch(launchOptions(opts.headless));
+    return chromium.launch({ ...launch, executablePath: chrome });
+  return chromium.launch(launch);
 }
-function contextOptions(headless = true) {
+function contextOptions(headless = true, network) {
   return {
     viewport: headless ? { width: 1920, height: 1080 } : null,
     screen: { width: 1920, height: 1080 },
     locale: "en-US",
     timezoneId: "America/New_York",
-    extraHTTPHeaders: { "Accept-Language": "en-US,en;q=0.9" }
+    extraHTTPHeaders: { "Accept-Language": "en-US,en;q=0.9" },
+    ...network?.proxy ? { proxy: network.proxy } : {},
+    ignoreHTTPSErrors: network?.ignoreHTTPSErrors ?? true
   };
 }
 var INIT_SCRIPT = `
@@ -106375,77 +106460,6 @@ if (!window.chrome) window.chrome = {};
 if (!window.chrome.runtime) window.chrome.runtime = { connect: () => {}, sendMessage: () => {} };
 `;
 
-// ../hackbrowser/src/log.ts
-var LEVEL_PRIORITY = {
-  DEBUG: 0,
-  INFO: 1,
-  WARN: 2,
-  ERROR: 3
-};
-var currentLevel = "INFO";
-var sink = defaultStderrSink;
-function defaultStderrSink(record3) {
-  const ts = new Date(record3.timestamp).toISOString();
-  let line = `${ts} ${record3.level} ${record3.service} ${record3.message}`;
-  if (record3.extra && Object.keys(record3.extra).length > 0) {
-    try {
-      line += " " + JSON.stringify(record3.extra);
-    } catch {
-      line += " [unserializable extra]";
-    }
-  }
-  process.stderr.write(line + `
-`);
-}
-function shouldLog(level) {
-  return LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[currentLevel];
-}
-function emit(level, service, message, extra) {
-  if (!shouldLog(level))
-    return;
-  sink({
-    level,
-    service,
-    message,
-    extra,
-    timestamp: Date.now()
-  });
-}
-var Log;
-((Log) => {
-  function init(options) {
-    if (options.level)
-      currentLevel = options.level;
-  }
-  Log.init = init;
-  function setSink(custom4) {
-    sink = custom4;
-  }
-  Log.setSink = setSink;
-  function resetSink() {
-    sink = defaultStderrSink;
-  }
-  Log.resetSink = resetSink;
-  function create(options) {
-    const { service } = options;
-    return {
-      debug(message, extra) {
-        emit("DEBUG", service, message, extra);
-      },
-      info(message, extra) {
-        emit("INFO", service, message, extra);
-      },
-      warn(message, extra) {
-        emit("WARN", service, message, extra);
-      },
-      error(message, extra) {
-        emit("ERROR", service, message, extra);
-      }
-    };
-  }
-  Log.create = create;
-})(Log ||= {});
-
 // ../hackbrowser/src/capture.ts
 async function snapshotPageUI(page, trigger, componentPath = "") {
   const pageUrl = page.url();
@@ -106705,7 +106719,7 @@ function flattenObject(obj, prefix, out) {
 }
 
 // ../hackbrowser/src/ingest.ts
-var log2 = Log.create({ service: "hackbrowser:ingest" });
+var log3 = Log.create({ service: "hackbrowser:ingest" });
 var authHeader = "";
 function initAuth(username, password) {
   if (!password) {
@@ -106727,18 +106741,18 @@ async function initSession(serverUrl, targetUrl, credentialId) {
       body: JSON.stringify(payload)
     });
     if (!res.ok) {
-      log2.error("initSession failed", { status: res.status, body: await res.text().catch(() => "") });
+      log3.error("initSession failed", { status: res.status, body: await res.text().catch(() => "") });
       return null;
     }
     const data = await res.json();
     if (!data.sessionID) {
-      log2.error("initSession: no sessionID in response");
+      log3.error("initSession: no sessionID in response");
       return null;
     }
-    log2.info("session created", { sessionID: data.sessionID });
+    log3.info("session created", { sessionID: data.sessionID });
     return data.sessionID;
   } catch (err) {
-    log2.error("initSession network error", { err: String(err) });
+    log3.error("initSession network error", { err: String(err) });
     return null;
   }
 }
@@ -106767,7 +106781,7 @@ function buildIngestPayload(captured, sessionID, credentialId, accessContext) {
 async function sendIngest(captured, serverUrl, sessionID, credentialId) {
   const payload = buildIngestPayload(captured, sessionID, credentialId);
   const body = JSON.stringify(payload);
-  log2.debug("sending ingest", {
+  log3.debug("sending ingest", {
     request: captured.raw.split(`\r
 `)[0],
     uiFields: captured.uiContext?.fields.length ?? 0,
@@ -106784,14 +106798,14 @@ async function sendIngest(captured, serverUrl, sessionID, credentialId) {
       body
     });
     if (!res.ok) {
-      log2.error("ingest server error", { status: res.status, body: await res.text().catch(() => "") });
+      log3.error("ingest server error", { status: res.status, body: await res.text().catch(() => "") });
       return null;
     }
     const data = await res.json();
-    log2.debug("ingest accepted", { sessionID: data.sessionID ?? sessionID });
+    log3.debug("ingest accepted", { sessionID: data.sessionID ?? sessionID });
     return data;
   } catch (err) {
-    log2.error("ingest network error", { err: String(err) });
+    log3.error("ingest network error", { err: String(err) });
     return null;
   }
 }
@@ -106849,14 +106863,14 @@ async function registerCredential(serverUrl, sessionID, label) {
       body: JSON.stringify({ label, headers: {} })
     });
     if (!res.ok) {
-      log2.error("registerCredential failed", { status: res.status, label });
+      log3.error("registerCredential failed", { status: res.status, label });
       return null;
     }
     const data = await res.json();
-    log2.info("credential registered", { sessionID, credentialID: data.id, label });
+    log3.info("credential registered", { sessionID, credentialID: data.id, label });
     return data.id ?? null;
   } catch (err) {
-    log2.error("registerCredential network error", { err: String(err), label });
+    log3.error("registerCredential network error", { err: String(err), label });
     return null;
   }
 }
@@ -106868,22 +106882,22 @@ async function syncCredentialHeaders(serverUrl, sessionID, credentialID, headers
       body: JSON.stringify({ headers })
     });
     if (!res.ok) {
-      log2.error("syncCredentialHeaders failed", { status: res.status, credentialID });
+      log3.error("syncCredentialHeaders failed", { status: res.status, credentialID });
     } else {
-      log2.debug("credential headers synced", { credentialID });
+      log3.debug("credential headers synced", { credentialID });
     }
   } catch (err) {
-    log2.error("syncCredentialHeaders network error", { err: String(err), credentialID });
+    log3.error("syncCredentialHeaders network error", { err: String(err), credentialID });
   }
 }
 
 // ../hackbrowser/src/auth.ts
 import fs3 from "fs";
 import readline from "readline";
-var log3 = Log.create({ service: "hackbrowser:auth" });
+var log4 = Log.create({ service: "hackbrowser:auth" });
 async function loadSession(context, filePath) {
   if (!fs3.existsSync(filePath)) {
-    log3.info("no session file found", { file: filePath });
+    log4.info("no session file found", { file: filePath });
     return false;
   }
   try {
@@ -106891,10 +106905,10 @@ async function loadSession(context, filePath) {
     if (data.cookies) {
       await context.addCookies(data.cookies);
     }
-    log3.info("session loaded", { file: filePath });
+    log4.info("session loaded", { file: filePath });
     return true;
   } catch (err) {
-    log3.error("failed to load session", { file: filePath, err: String(err) });
+    log4.error("failed to load session", { file: filePath, err: String(err) });
     return false;
   }
 }
@@ -106924,7 +106938,7 @@ async function handle2FA(page) {
   for (const sel of mfaSelectors) {
     const el = await page.$(sel);
     if (el) {
-      log3.info("2FA detected", { selector: sel });
+      log4.info("2FA detected", { selector: sel });
       const code = await waitForHuman("Enter your 2FA code and press Enter:");
       await el.fill(code);
       const form = await page.$("form");
@@ -107169,13 +107183,13 @@ async function waitForManualLogin(page, label, progress) {
   };
   await injectButton();
   page.on("load", injectButton);
-  log3.info("waiting for manual login", { label: label ?? "default" });
+  log4.info("waiting for manual login", { label: label ?? "default" });
   await readyPromise;
   page.removeListener("load", injectButton);
   await page.evaluate((btnId) => {
     document.getElementById(btnId)?.remove();
   }, buttonId).catch(() => {});
-  log3.info("manual login confirmed", { label: label ?? "default" });
+  log4.info("manual login confirmed", { label: label ?? "default" });
 }
 async function autoLogin(page, credentials) {
   const userSel = credentials.usernameSelector ?? 'input[type="text"], input[type="email"], input[name*="user"], input[name*="email"], input[id*="user"], input[id*="email"]';
@@ -107191,10 +107205,10 @@ async function autoLogin(page, credentials) {
       await page.keyboard.press("Enter");
     }
     await page.waitForLoadState("domcontentloaded").catch(() => {});
-    log3.info("auto-login attempted", { username: credentials.username });
+    log4.info("auto-login attempted", { username: credentials.username });
     await handle2FA(page);
   } catch (err) {
-    log3.warn("auto-login failed, falling back to manual login", { err: String(err) });
+    log4.warn("auto-login failed, falling back to manual login", { err: String(err) });
     await waitForManualLogin(page);
   }
 }
@@ -115904,7 +115918,7 @@ Always respond with a valid JSON object. If there is nothing to explore, return:
 `;
 
 // ../hackbrowser/src/navigator.ts
-var log4 = Log.create({ service: "hackbrowser:navigator" });
+var log5 = Log.create({ service: "hackbrowser:navigator" });
 function isAuthError(err) {
   if (!err || typeof err !== "object")
     return false;
@@ -115924,20 +115938,20 @@ var cachedModel = null;
 async function resolveModel(override) {
   if (override) {
     cachedModel = override;
-    log4.info("model resolved via opts.model (cyberstrike injection)");
+    log5.info("model resolved via opts.model (cyberstrike injection)");
     return cachedModel;
   }
   if (cachedModel)
     return cachedModel;
   if (process.env.ANTHROPIC_API_KEY) {
     const model = process.env.BROWSER_AGENT_MODEL ?? "claude-sonnet-4-6";
-    log4.info("model resolved via ANTHROPIC_API_KEY", { model });
+    log5.info("model resolved via ANTHROPIC_API_KEY", { model });
     cachedModel = createAnthropic2({ apiKey: process.env.ANTHROPIC_API_KEY })(model);
     return cachedModel;
   }
   if (process.env.OPENAI_API_KEY) {
     const model = process.env.BROWSER_AGENT_MODEL ?? "gpt-4o";
-    log4.info("model resolved via OPENAI_API_KEY", { model });
+    log5.info("model resolved via OPENAI_API_KEY", { model });
     cachedModel = createOpenAI2({ apiKey: process.env.OPENAI_API_KEY })(model);
     return cachedModel;
   }
@@ -115963,7 +115977,7 @@ async function planPage(snapshot, model, usageAcc) {
       usageAcc.cacheReadTokens += result.usage.cachedInputTokens ?? 0;
     }
     const raw = result.text.trim();
-    log4.debug("planner response", { length: raw.length, raw: raw.slice(0, 500) });
+    log5.debug("planner response", { length: raw.length, raw: raw.slice(0, 500) });
     const start = raw.indexOf("{");
     const end = raw.lastIndexOf("}");
     if (start === -1 || end === -1)
@@ -115973,18 +115987,18 @@ async function planPage(snapshot, model, usageAcc) {
   };
   try {
     const plan = await attempt();
-    log4.debug("page plan", { tasks: plan.tasks.length });
+    log5.debug("page plan", { tasks: plan.tasks.length });
     return plan;
   } catch (err) {
     if (isAuthError(err))
       throw err;
-    log4.warn("planPage failed, retrying once", { err: String(err) });
+    log5.warn("planPage failed, retrying once", { err: String(err) });
     try {
       return await attempt();
     } catch (err2) {
       if (isAuthError(err2))
         throw err2;
-      log4.error("planPage failed after retry, returning empty plan", { err: String(err2) });
+      log5.error("planPage failed after retry, returning empty plan", { err: String(err2) });
       return { tasks: [] };
     }
   }
@@ -116020,7 +116034,7 @@ async function planUnexploredElements(snapshot, unexploredLabels, model, usageAc
       usageAcc.cacheReadTokens += result.usage.cachedInputTokens ?? 0;
     }
     const raw = result.text.trim();
-    log4.debug("unexplored planner response", { length: raw.length, raw: raw.slice(0, 500) });
+    log5.debug("unexplored planner response", { length: raw.length, raw: raw.slice(0, 500) });
     const start = raw.indexOf("{");
     const end = raw.lastIndexOf("}");
     if (start === -1 || end === -1)
@@ -116030,12 +116044,12 @@ async function planUnexploredElements(snapshot, unexploredLabels, model, usageAc
   };
   try {
     const plan = await attempt();
-    log4.debug("unexplored plan", { tasks: plan.tasks.length });
+    log5.debug("unexplored plan", { tasks: plan.tasks.length });
     return plan;
   } catch (err) {
     if (isAuthError(err))
       throw err;
-    log4.warn("planUnexploredElements failed", { err: String(err) });
+    log5.warn("planUnexploredElements failed", { err: String(err) });
     return { tasks: [] };
   }
 }
@@ -116092,7 +116106,7 @@ function validateIntelligence(raw) {
     out.revisitOn = on;
   }
   if (out.pageState === "empty" && !out.revisitReason) {
-    log4.warn("pageState='empty' without revisitReason — downgrading to 'unknown'");
+    log5.warn("pageState='empty' without revisitReason — downgrading to 'unknown'");
     out.pageState = "unknown";
     out.revisitAfter = null;
     out.revisitOn = undefined;
@@ -116285,7 +116299,7 @@ function buildPlannerSnapshot(url3, elements, globalState, credId, viewportCente
 }
 
 // ../hackbrowser/src/scanner.ts
-var log5 = Log.create({ service: "hackbrowser:scanner" });
+var log6 = Log.create({ service: "hackbrowser:scanner" });
 var MAX_ELEMENTS = 50;
 var MAX_PER_TEMPLATE = 5;
 var REVEAL_MAX_STEPS = 10;
@@ -117007,14 +117021,14 @@ function pickSample(accept) {
 }
 
 // ../hackbrowser/src/executor.ts
-var log6 = Log.create({ service: "hackbrowser:executor" });
+var log7 = Log.create({ service: "hackbrowser:executor" });
 var CLICK_TIMEOUT = 2000;
 var FILL_TIMEOUT = 3000;
 var STABILIZE_TIMEOUT = 3000;
 var STABILIZE_WAIT = 200;
 async function execute(page, element, action, value, setPendingUI, elementsBefore) {
   const urlBefore = page.url();
-  log6.info("executing", { action, elementId: element.id, label: element.label, selector: element.selector });
+  log7.info("executing", { action, elementId: element.id, label: element.label, selector: element.selector });
   let error49;
   switch (action) {
     case "fill":
@@ -117062,7 +117076,7 @@ async function executeFill(page, element, value) {
 `)[0]);
   if (!typeErr)
     return;
-  log6.warn("fill failed", { selector, error: fillErr });
+  log7.warn("fill failed", { selector, error: fillErr });
   return fillErr;
 }
 async function executeFileSelect(page, selector) {
@@ -117071,10 +117085,10 @@ async function executeFileSelect(page, selector) {
   const err = await page.setInputFiles(selector, { name: sample.name, mimeType: sample.mimeType, buffer: sample.buffer }, { timeout: FILL_TIMEOUT }).then(() => null).catch((e2) => e2.message.split(`
 `)[0]);
   if (err) {
-    log6.warn("file select failed", { selector, accept, error: err });
+    log7.warn("file select failed", { selector, accept, error: err });
     return err;
   }
-  log6.info("file selected", { selector, file: sample.name });
+  log7.info("file selected", { selector, file: sample.name });
   return;
 }
 async function executeSliderFill(page, selector, value) {
@@ -117108,7 +117122,7 @@ async function executeClick(page, element) {
   const err = await page.click(element.selector, { timeout: CLICK_TIMEOUT }).then(() => null).catch((e2) => e2.message.split(`
 `)[0]);
   if (err) {
-    log6.warn("click failed", { selector: element.selector, error: err });
+    log7.warn("click failed", { selector: element.selector, error: err });
     return err;
   }
   return;
@@ -117121,14 +117135,14 @@ async function executeSelect(page, element, value) {
   const clickErr = await page.click(element.selector, { timeout: CLICK_TIMEOUT }).then(() => null).catch((e2) => e2.message.split(`
 `)[0]);
   if (clickErr) {
-    log6.warn("select failed", { selector: element.selector, error: nativeErr });
+    log7.warn("select failed", { selector: element.selector, error: nativeErr });
     return nativeErr;
   }
   await page.waitForTimeout(300);
   const optionErr = await page.click(`role=option[name="${value}"]`, { timeout: CLICK_TIMEOUT }).then(() => null).catch(() => page.click(`text="${value}"`, { timeout: CLICK_TIMEOUT }).then(() => null).catch((e2) => e2.message.split(`
 `)[0]));
   if (optionErr) {
-    log6.warn("select option failed", { value, error: optionErr });
+    log7.warn("select option failed", { value, error: optionErr });
     return optionErr;
   }
   return;
@@ -117139,7 +117153,7 @@ async function executeNavigate(page, element) {
   const err = await page.goto(element.href, { waitUntil: "domcontentloaded", timeout: 15000 }).then(() => null).catch((e2) => e2.message.split(`
 `)[0]);
   if (err) {
-    log6.warn("navigate failed", { url: element.href, error: err });
+    log7.warn("navigate failed", { url: element.href, error: err });
     return err;
   }
   await page.waitForTimeout(400);
@@ -128177,7 +128191,7 @@ function makeMatcher(scopes) {
 }
 
 // ../hackbrowser/src/agent.ts
-var log7 = Log.create({ service: "hackbrowser:agent" });
+var log8 = Log.create({ service: "hackbrowser:agent" });
 var MAX_STEPS_PER_PAGE = 30;
 var MAX_UNPLANNED_ITERATIONS = 2;
 var OVERLAY_ESCAPE_WAIT = 400;
@@ -128187,6 +128201,12 @@ var POST_GOTO_WAIT = 400;
 var NETWORK_IDLE_TIMEOUT = 1500;
 var MAX_INLINE_DEPTH = 2;
 var LOGIN_SUCCESS_PATTERN = /POST\s+.*\/(login|signin|authenticate)\S*\s+\[200\]/i;
+var CERT_ERROR = /ERR_CERT|CERT_AUTHORITY|ERR_SSL|SSL_ERROR/i;
+function certHint(message, config3) {
+  if (!config3.network?.proxy || !CERT_ERROR.test(message))
+    return "";
+  return " — this request went through the configured proxy. If the proxy intercepts TLS, the browser must trust its CA" + " (install it in the OS certificate store) or be told to accept untrusted certificates.";
+}
 async function stabilizeAfterGoto(page) {
   await page.waitForTimeout(POST_GOTO_WAIT);
   await page.waitForLoadState("networkidle", { timeout: NETWORK_IDLE_TIMEOUT }).catch(() => {});
@@ -128194,21 +128214,36 @@ async function stabilizeAfterGoto(page) {
 function createBrowserHealth() {
   return { dead: false, reason: "" };
 }
+function lifecycleContext(browser, page) {
+  try {
+    const ctx = { connected: browser.isConnected() };
+    if (page) {
+      ctx.url = page.url();
+      ctx.openPages = page.context().pages().length;
+    }
+    return ctx;
+  } catch {
+    return {};
+  }
+}
 function attachLifecycleHandlers(browser, page, health) {
   browser.on("disconnected", () => {
     health.dead = true;
     health.reason = "browser process disconnected";
-    log7.error("browser disconnected — crawl will terminate");
+    log8.error("browser disconnected — crawl will terminate", lifecycleContext(browser, page));
   });
   page.on("close", () => {
     health.dead = true;
     health.reason = "page closed unexpectedly";
-    log7.error("page closed — crawl will terminate");
+    log8.error("page closed — crawl will terminate", lifecycleContext(browser, page));
   });
   page.on("crash", () => {
     health.dead = true;
     health.reason = "page renderer crashed";
-    log7.error("page crashed — crawl will terminate");
+    log8.error("page crashed — crawl will terminate", lifecycleContext(browser, page));
+  });
+  page.context().on("page", (p) => {
+    log8.debug("new page/popup opened", lifecycleContext(browser, p));
   });
 }
 function isBrowserDead(health) {
@@ -128243,7 +128278,7 @@ function triggerReDiscovery(globalState) {
     return;
   globalState.authPhase = "authenticated";
   globalState.pendingReDiscovery = true;
-  log7.info("login detected, re-discovery pending");
+  log8.info("login detected, re-discovery pending");
 }
 function flushReDiscovery(globalState) {
   if (!globalState.pendingReDiscovery)
@@ -128255,7 +128290,7 @@ function flushReDiscovery(globalState) {
       globalState.pageQueue.push(url3);
     }
   }
-  log7.info("post-login re-discovery flushed", {
+  log8.info("post-login re-discovery flushed", {
     pagesToRevisit: pagesToRevisit.length,
     queueSize: globalState.pageQueue.length
   });
@@ -128265,7 +128300,7 @@ function processAuthPhase(globalState) {
   if (globalState.authPhase === "anonymous") {
     const registerPage = deferred.find((d) => d.type === "register");
     if (registerPage) {
-      log7.info("phase transition: anonymous → register", { url: registerPage.url });
+      log8.info("phase transition: anonymous → register", { url: registerPage.url });
       globalState.authPhase = "registered";
       globalState.visitedPages.add(normalizeUrl(registerPage.url));
       globalState.pageQueue.push(registerPage.url);
@@ -128277,12 +128312,12 @@ function processAuthPhase(globalState) {
       const loginNormalized = normalizeUrl(loginPage.url);
       const alreadyExplored = globalState.visitedPages.has(loginNormalized);
       if (!alreadyExplored) {
-        log7.info("exploring login page to discover register link", { url: loginPage.url });
+        log8.info("exploring login page to discover register link", { url: loginPage.url });
         globalState.visitedPages.add(loginNormalized);
         globalState.pageQueue.push(loginPage.url);
         return;
       }
-      log7.info("phase transition: anonymous → login (no register found)", { url: loginPage.url });
+      log8.info("phase transition: anonymous → login (no register found)", { url: loginPage.url });
       globalState.pageQueue.push(loginPage.url);
       globalState.deferredAuthPages = deferred.filter((d) => d.type !== "login");
       return;
@@ -128291,7 +128326,7 @@ function processAuthPhase(globalState) {
   if (globalState.authPhase === "registered") {
     const loginPage = deferred.find((d) => d.type === "login");
     if (loginPage) {
-      log7.info("phase transition: registered → login", { url: loginPage.url });
+      log8.info("phase transition: registered → login", { url: loginPage.url });
       getIntelligence(globalState, SINGLE_CRED).pageFingerprints.delete(normalizeUrl(loginPage.url));
       globalState.pageQueue.push(loginPage.url);
       globalState.deferredAuthPages = deferred.filter((d) => d.type !== "login");
@@ -128301,7 +128336,7 @@ function processAuthPhase(globalState) {
   if (globalState.authPhase === "authenticated") {
     const logoutPage = deferred.find((d) => d.type === "logout");
     if (logoutPage) {
-      log7.info("phase transition: authenticated → logout", { url: logoutPage.url });
+      log8.info("phase transition: authenticated → logout", { url: logoutPage.url });
       globalState.visitedPages.add(normalizeUrl(logoutPage.url));
       globalState.pageQueue.push(logoutPage.url);
       globalState.deferredAuthPages = deferred.filter((d) => d.type !== "logout");
@@ -128309,7 +128344,7 @@ function processAuthPhase(globalState) {
     }
   }
   if (globalState.deferredAuthPages.length > 0) {
-    log7.debug("clearing remaining deferred auth pages", {
+    log8.debug("clearing remaining deferred auth pages", {
       remaining: globalState.deferredAuthPages.map((d) => `${d.type}:${d.url}`)
     });
     globalState.deferredAuthPages = [];
@@ -128322,7 +128357,7 @@ function resolveScopePatterns(config3) {
 }
 function logScope(targetUrl, patterns, userProvided) {
   const normalized = patterns.map(normalizeScope).filter(Boolean);
-  log7.info("network scope", {
+  log8.info("network scope", {
     target: targetUrl,
     scope: normalized,
     source: userProvided ? "explicit (--scope)" : "auto-derived"
@@ -128342,7 +128377,7 @@ function createDryRunHandler() {
     const roles = captured.elementRoles;
     const page = captured.pageUrl;
     const visitedBy = captured.pageVisitedBy;
-    log7.info(`→ ${requestLine}  [${status}]${uiFields > 0 ? `  ui_fields:${uiFields}` : ""}${trigger ? `  trigger:${trigger}` : ""}${roles ? `  roles:[${roles.join(",")}]` : ""}${page ? `  page:${page}` : ""}${visitedBy ? `  visited_by:[${visitedBy.join(",")}]` : ""}`);
+    log8.info(`→ ${requestLine}  [${status}]${uiFields > 0 ? `  ui_fields:${uiFields}` : ""}${trigger ? `  trigger:${trigger}` : ""}${roles ? `  roles:[${roles.join(",")}]` : ""}${page ? `  page:${page}` : ""}${visitedBy ? `  visited_by:[${visitedBy.join(",")}]` : ""}`);
     if (captured.uiContext) {
       for (const f3 of captured.uiContext.fields) {
         const flags = [
@@ -128351,10 +128386,10 @@ function createDryRunHandler() {
           f3.isDisabled ? "disabled" : "",
           f3.isDisplayOnly ? "display-only" : ""
         ].filter(Boolean).join(",");
-        log7.debug(`field: ${f3.name || f3.label || "(unnamed)"}  type:${f3.type}  value:${JSON.stringify(f3.value)}${flags ? `  [${flags}]` : ""}`);
+        log8.debug(`field: ${f3.name || f3.label || "(unnamed)"}  type:${f3.type}  value:${JSON.stringify(f3.value)}${flags ? `  [${flags}]` : ""}`);
       }
       if (hiddenParams.length > 0) {
-        log7.debug(`hidden params (not in UI): ${hiddenParams.join(", ")}`);
+        log8.debug(`hidden params (not in UI): ${hiddenParams.join(", ")}`);
       }
     }
   };
@@ -128426,7 +128461,13 @@ function setupRequestInterceptor(page, inScope, onCapture, credentialId = SINGLE
       return;
     }
     const method = request.method();
-    const headers = await request.allHeaders();
+    let headers;
+    try {
+      headers = await request.allHeaders();
+    } catch {
+      log8.debug("request capture dropped — target closed mid-flight", { url: url3 });
+      return;
+    }
     const postData = request.postData() ?? null;
     const raw = buildRawRequest(method, url3, headers, postData);
     let uiContext = null;
@@ -128525,7 +128566,7 @@ function enqueueUrl(url3, globalState, inScope) {
   if (patternKey) {
     const count = globalState.pathPatternCounts.get(patternKey) ?? 0;
     if (count >= MAX_PER_PATH_PATTERN) {
-      log7.debug("path pattern limit reached, skipping", { url: normalized, patternKey, count });
+      log8.debug("path pattern limit reached, skipping", { url: normalized, patternKey, count });
       return false;
     }
     globalState.pathPatternCounts.set(patternKey, count + 1);
@@ -128536,14 +128577,14 @@ function enqueueUrl(url3, globalState, inScope) {
       const alreadyDeferred = globalState.deferredAuthPages.some((d) => d.url === normalized);
       if (!alreadyDeferred) {
         globalState.deferredAuthPages.push({ url: normalized, type: authType });
-        log7.debug("deferred auth URL", { url: normalized, type: authType });
+        log8.debug("deferred auth URL", { url: normalized, type: authType });
       }
       return false;
     }
   }
   globalState.visitedPages.add(normalized);
   globalState.pageQueue.push(url3);
-  log7.debug("enqueued URL", { url: normalized, queueSize: globalState.pageQueue.length });
+  log8.debug("enqueued URL", { url: normalized, queueSize: globalState.pageQueue.length });
   return true;
 }
 function getPathPatternKey(url3) {
@@ -128570,17 +128611,17 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
   });
   let elements = await collectElements(page);
   if (elements.length === 0) {
-    log7.debug("no elements on first collection, waiting for render");
+    log8.debug("no elements on first collection, waiting for render");
     await page.waitForTimeout(SPA_RENDER_RETRY_WAIT);
     elements = await collectElements(page);
   }
   elements = filterVisitedLinks(elements, pageUrl, globalState.visitedPages);
-  log7.debug("initial scan", { elements: elements.length });
+  log8.debug("initial scan", { elements: elements.length });
   const vcBlocked = await isViewportCenterBlocked(page);
   const snapshot = buildPlannerSnapshot(pageUrl, elements, globalState, credentialId, vcBlocked);
   csEmit(page, { type: "llm-thinking", reason: "page-plan", elements: elements.length, credential: credentialId });
   const plan = await planPage(snapshot, model, usageAcc);
-  log7.info("page plan received", {
+  log8.info("page plan received", {
     tasks: plan.tasks.length,
     pageState: plan.pageState ?? "unknown",
     revisitAfter: plan.revisitAfter ?? null
@@ -128608,12 +128649,12 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
       const lookupRole = task.type === "form" ? task.fields[0]?.role ?? task.submit.role : task.role;
       const lookupLabel = task.type === "form" ? task.fields[0]?.label ?? task.submit.label : task.label;
       if (!resolveElement(elements, lookupRole, lookupLabel) && await isViewportCenterBlocked(page)) {
-        log7.debug("task target blocked by overlay, closing overlay first", { role: lookupRole, label: lookupLabel });
+        log8.debug("task target blocked by overlay, closing overlay first", { role: lookupRole, label: lookupLabel });
         await closeOverlay(page);
         elements = filterVisitedLinks(await collectElements(page), pageUrl, globalState.visitedPages);
       }
     }
-    log7.info("executing task", {
+    log8.info("executing task", {
       step: `${steps}/${MAX_STEPS_PER_PAGE}`,
       type: task.type,
       label: task.type === "form" ? `form(${task.fields.length} fields → ${task.submit.label.slice(0, 30)})` : task.label,
@@ -128648,7 +128689,7 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
       const newPlan = await planPage(snapshot2, model, usageAcc);
       applyPlanIntelligence(newPlan, pageUrl, globalState, credentialId, page);
       if (newPlan.tasks.length > 0) {
-        log7.debug("re-plan after state change", {
+        log8.debug("re-plan after state change", {
           reason: hasStaleTargets ? hasNewElements ? "new+stale" : "stale" : "new",
           tasks: newPlan.tasks.length
         });
@@ -128666,7 +128707,7 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
       }
       const dropped = pruneStaleTasks(taskQueue, freshElements);
       if (dropped > 0) {
-        log7.debug("pruned stale tasks", { dropped });
+        log8.debug("pruned stale tasks", { dropped });
         csEmit(page, {
           type: "intelligence",
           kind: "stale-prune",
@@ -128677,7 +128718,7 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
       }
     }
     if (taskQueue.length === 0 && await isViewportCenterBlocked(page)) {
-      log7.debug("queue empty, overlay open — closing overlay");
+      log8.debug("queue empty, overlay open — closing overlay");
       await closeOverlay(page);
       if (!await isViewportCenterBlocked(page)) {
         elements = filterVisitedLinks(await collectElements(page), pageUrl, globalState.visitedPages);
@@ -128696,7 +128737,7 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
     const unexplored = findUnexploredElements(currentElements, semanticActionsDone, seenKeys);
     if (unexplored.length === 0)
       break;
-    log7.info("unexplored elements found", {
+    log8.info("unexplored elements found", {
       count: unexplored.length,
       iteration: iteration + 1,
       labels: unexplored.slice(0, 5)
@@ -128713,7 +128754,7 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
     applyPlanIntelligence(additionalPlan, pageUrl, globalState, credentialId, page);
     if (additionalPlan.tasks.length === 0)
       break;
-    log7.info("additional plan for unexplored elements", { tasks: additionalPlan.tasks.length });
+    log8.info("additional plan for unexplored elements", { tasks: additionalPlan.tasks.length });
     csEmit(page, {
       type: "plan-received",
       tasks: additionalPlan.tasks.length,
@@ -128737,7 +128778,7 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
           elements = filterVisitedLinks(await collectElements(page), pageUrl, globalState.visitedPages);
         }
       }
-      log7.info("executing additional task", {
+      log8.info("executing additional task", {
         step: `${steps}/${MAX_STEPS_PER_PAGE}`,
         type: task.type,
         label: task.type === "form" ? `form(${task.fields.length} fields → ${task.submit.label.slice(0, 30)})` : task.label,
@@ -128785,7 +128826,7 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
         }
         const dropped = pruneStaleTasks(additionalQueue, freshElements);
         if (dropped > 0) {
-          log7.debug("pruned stale additional tasks", { dropped });
+          log8.debug("pruned stale additional tasks", { dropped });
           csEmit(page, {
             type: "intelligence",
             kind: "stale-prune",
@@ -128799,7 +128840,7 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
   }
   const finalElements = await collectElements(page);
   getIntelligence(globalState, credentialId).pageFingerprints.set(pageUrl, generateFingerprint(finalElements));
-  log7.debug("fingerprint stored", { url: pageUrl, credential: credentialId });
+  log8.debug("fingerprint stored", { url: pageUrl, credential: credentialId });
   try {
     const domLinks = await collectDOMLinks(page, pageUrl, inScope);
     for (const url3 of domLinks) {
@@ -128807,7 +128848,7 @@ async function explorePageWithAI(page, pageUrl, interceptor, model, globalState,
         linksToEnqueue.push(url3);
     }
   } catch {
-    log7.debug("collectDOMLinks failed (page may have navigated)");
+    log8.debug("collectDOMLinks failed (page may have navigated)");
   }
   return linksToEnqueue;
 }
@@ -128816,7 +128857,7 @@ async function recoverFromOcclusion(page, el, original, retry) {
     return original;
   if ((await probeClickPoint(page, el.selector)).status !== "occluded")
     return original;
-  log7.debug("click occluded — clearing overlay + waiting, then retrying once", { label: el.label });
+  log8.debug("click occluded — clearing overlay + waiting, then retrying once", { label: el.label });
   await closeOverlay(page);
   await page.waitForTimeout(OVERLAY_CLEAR_WAIT);
   return retry();
@@ -128832,7 +128873,7 @@ async function recoverFromClosedContainer(page, el, original, opener, intercepto
   const openerEl = resolveElement(fresh, opener.role, opener.label);
   if (!openerEl)
     return original;
-  log7.debug("target offscreen — re-opening its container via opener, retrying once", {
+  log8.debug("target offscreen — re-opening its container via opener, retrying once", {
     target: el.label,
     opener: opener.label
   });
@@ -128845,7 +128886,7 @@ async function diagnoseOcclusion(page, el, occ) {
   if (probe.status === "occluded" && !occ.signaled.has(probe.occluder.text)) {
     occ.signaled.add(probe.occluder.text);
     occ.pending.push({ label: el.label, role: el.role, occluderText: probe.occluder.text });
-    log7.debug("action target occluded — signalling planner to dismiss overlay first", {
+    log8.debug("action target occluded — signalling planner to dismiss overlay first", {
       label: el.label,
       occluder: probe.occluder.text
     });
@@ -128875,7 +128916,7 @@ async function executeFormTask(task, page, elements, interceptor, semanticAction
       el = resolveElement(elements, field.role, field.label);
     }
     if (!el) {
-      log7.debug("form field not found", { role: field.role, label: field.label });
+      log8.debug("form field not found", { role: field.role, label: field.label });
       continue;
     }
     const action = fieldAction(field.role);
@@ -128903,7 +128944,7 @@ async function executeFormTask(task, page, elements, interceptor, semanticAction
   elements = await collectElements(page);
   const submitEl = resolveElement(elements, task.submit.role, task.submit.label);
   if (!submitEl) {
-    log7.debug("submit button not found", task.submit);
+    log8.debug("submit button not found", task.submit);
     return;
   }
   const fieldsHash = JSON.stringify(task.fields.map((f3) => [f3.label, f3.value]));
@@ -128934,7 +128975,7 @@ async function executeFormTask(task, page, elements, interceptor, semanticAction
 async function executeClickTask(task, page, elements, interceptor, semanticActionsDone, globalState, credentialId, linksToEnqueue, pageUrl, inScope, occ, nav, opener) {
   const el = resolveElement(elements, task.role, task.label);
   if (!el) {
-    log7.debug("click target not found", { role: task.role, label: task.label });
+    log8.debug("click target not found", { role: task.role, label: task.label });
     return;
   }
   const key = `${el.selector}::click::`;
@@ -129019,7 +129060,7 @@ function discoverNewElements(elements, seenKeys) {
     found = true;
   }
   if (found)
-    log7.debug("new elements discovered after action");
+    log8.debug("new elements discovered after action");
   return found;
 }
 function findUnexploredElements(elements, semanticActionsDone, seenKeys) {
@@ -129079,7 +129120,7 @@ function applyPlanIntelligence(plan, pageUrl, globalState, credentialId, page) {
   const queued = markPageEmpty(globalState, credentialId, pageUrl, plan.revisitOn);
   const intel = getIntelligence(globalState, credentialId);
   if (queued) {
-    log7.info("page marked empty for mutation-triggered revisit", {
+    log8.info("page marked empty for mutation-triggered revisit", {
       url: pageUrl,
       credential: credentialId,
       reason: plan.revisitReason,
@@ -129096,7 +129137,7 @@ function applyPlanIntelligence(plan, pageUrl, globalState, credentialId, page) {
       });
     }
   } else {
-    log7.debug("empty-state revisit rejected by hard limit", {
+    log8.debug("empty-state revisit rejected by hard limit", {
       url: pageUrl,
       credential: credentialId,
       count: intel.revisitCount.get(pageUrl) ?? 0
@@ -129121,7 +129162,7 @@ function reconcileQueue(queue, freshTasks) {
     }
   }
   if (dropped > 0)
-    log7.debug("reconcileQueue: superseded stale tasks", { dropped });
+    log8.debug("reconcileQueue: superseded stale tasks", { dropped });
   queue.unshift(...freshTasks);
 }
 function trackResult(result, interceptor, globalState, credentialId, taskMutation, page) {
@@ -129134,7 +129175,7 @@ function trackResult(result, interceptor, globalState, credentialId, taskMutatio
     if (hasSuccessfulMutation(result.httpRequests) && intel.emptyStateQueue.size > 0) {
       const drained = drainOnMutation(globalState, credentialId, taskMutation);
       if (drained.length > 0) {
-        log7.info("mutation triggered empty-state revisit drain", {
+        log8.info("mutation triggered empty-state revisit drain", {
           drained: drained.length,
           urls: drained,
           credential: credentialId,
@@ -129161,7 +129202,7 @@ async function closeOverlay(page) {
   await page.keyboard.press("Escape").catch(() => {});
   await page.waitForTimeout(OVERLAY_ESCAPE_WAIT);
   if (await isViewportCenterBlocked(page)) {
-    log7.debug("Escape failed, clicking backdrop");
+    log8.debug("Escape failed, clicking backdrop");
     const dims = await page.evaluate(() => ({ w: window.innerWidth, h: window.innerHeight })).catch(() => null);
     if (dims) {
       await page.mouse.click(dims.w / 2, dims.h / 2).catch(() => {});
@@ -129191,13 +129232,38 @@ async function dismissCookieBanner(page) {
     if (btn) {
       await btn.click().catch(() => {});
       await page.waitForTimeout(300);
-      log7.debug("cookie banner dismissed", { selector });
+      log8.debug("cookie banner dismissed", { selector });
       return;
     }
   }
 }
 async function collectDOMLinks(page, pageUrl, inScope) {
-  const hrefs = await page.$$eval("a[href]", (els) => els.map((el) => el.href).filter(Boolean));
+  const hrefs = await page.$$eval("a[href], [data-href], [onclick]", (els) => {
+    const out = [];
+    for (const el of els) {
+      const a = el;
+      if (a.tagName === "A" && a.href) {
+        out.push(a.href);
+        continue;
+      }
+      const dataHref = el.getAttribute("data-href");
+      if (dataHref)
+        out.push(dataHref);
+      const onclick = el.getAttribute("onclick");
+      if (onclick) {
+        const m2 = onclick.match(/(?:window\.)?location(?:\.href)?\s*=\s*['"]([^'"]+)['"]/) || onclick.match(/location\.assign\s*\(\s*['"]([^'"]+)['"]/) || onclick.match(/window\.open\s*\(\s*['"]([^'"]+)['"]/);
+        if (m2)
+          out.push(m2[1]);
+      }
+    }
+    return out.map((h2) => {
+      try {
+        return new URL(h2, location.href).href;
+      } catch {
+        return "";
+      }
+    });
+  });
   const results = [];
   const seen = new Set;
   for (const href of hrefs) {
@@ -129280,7 +129346,7 @@ async function runMultiCredential(config3, credentials) {
   setPanelEnabled(panelOn);
   const usageAcc = { inputTokens: 0, outputTokens: 0, cacheReadTokens: 0, cacheWriteTokens: 0 };
   logScope(targetUrl, scopePatterns, !!config3.scope);
-  log7.info(`starting multi-credential crawl${dryRun ? " (DRY-RUN)" : ""}`, {
+  log8.info(`starting multi-credential crawl${dryRun ? " (DRY-RUN)" : ""}`, {
     target: targetUrl,
     credentials: credentials.map((c) => c.id),
     maxPages,
@@ -129289,16 +129355,20 @@ async function runMultiCredential(config3, credentials) {
   let model;
   try {
     model = await resolveModel(config3.model);
-    log7.info("AI navigation enabled");
+    log8.info("AI navigation enabled");
   } catch (err) {
     throw new Error(`AI model required: ${String(err)}`);
   }
-  const browser = await connect({ cdp: config3.cdp, headless: config3.headless ?? false });
+  const browser = await connect({
+    cdp: config3.cdp,
+    headless: config3.headless ?? false,
+    network: config3.network
+  });
   const health = createBrowserHealth();
   browser.on("disconnected", () => {
     health.dead = true;
     health.reason = "browser process disconnected";
-    log7.error("browser disconnected — multi-credential crawl will terminate");
+    log8.error("browser disconnected — multi-credential crawl will terminate", lifecycleContext(browser));
   });
   let sessionId = config3.cyberstrike.sessionID ?? "";
   if (!dryRun && !sessionId) {
@@ -129313,7 +129383,7 @@ async function runMultiCredential(config3, credentials) {
   const captureQueues = new Map;
   const lastAuthHeaders = new Map;
   for (const [credIndex, cred] of credentials.entries()) {
-    const browserContext = await browser.newContext(contextOptions(config3.headless ?? false));
+    const browserContext = await browser.newContext(contextOptions(config3.headless ?? false, config3.network));
     await browserContext.addInitScript(INIT_SCRIPT);
     if (panelOn)
       await browserContext.addInitScript(PANEL_INIT_SCRIPT);
@@ -129321,25 +129391,34 @@ async function runMultiCredential(config3, credentials) {
     page.on("close", () => {
       health.dead = true;
       health.reason = `page closed (credential: ${cred.id})`;
-      log7.error("page closed — multi-credential crawl will terminate", { credential: cred.id });
+      log8.error("page closed — multi-credential crawl will terminate", {
+        credential: cred.id,
+        ...lifecycleContext(browser, page)
+      });
     });
     page.on("crash", () => {
       health.dead = true;
       health.reason = `page crashed (credential: ${cred.id})`;
-      log7.error("page crashed — multi-credential crawl will terminate", { credential: cred.id });
+      log8.error("page crashed — multi-credential crawl will terminate", {
+        credential: cred.id,
+        ...lifecycleContext(browser, page)
+      });
+    });
+    browserContext.on("page", (p) => {
+      log8.debug("new page/popup opened", { credential: cred.id, ...lifecycleContext(browser, p) });
     });
     attachDialogAutoAccept(page);
     attachFileChooserAutoFill(page);
     const mcInitNavErr = await page.goto(targetUrl, { waitUntil: "domcontentloaded", timeout: 30000 }).then(() => null).catch((e2) => e2);
     if (mcInitNavErr) {
-      log7.warn("initial navigation failed", {
+      log8.warn("initial navigation failed", {
         credential: cred.id,
         url: targetUrl,
         err: mcInitNavErr.message.split(`
 `)[0]
       });
       if (!config3.headless && browser.isConnected()) {
-        log7.info("browser stays open — navigate manually or close the window to finish");
+        log8.info("browser stays open — navigate manually or close the window to finish");
         await waitForBrowserClose(browser, config3.signal);
       } else {
         await browser.close().catch(() => {});
@@ -129368,7 +129447,7 @@ async function runMultiCredential(config3, credentials) {
       if (registeredId) {
         credentialId = registeredId;
       } else {
-        log7.warn("credential registration failed, using label as ID", { credential: cred.id });
+        log8.warn("credential registration failed, using label as ID", { credential: cred.id });
       }
     }
     const captureQueue = [];
@@ -129394,7 +129473,7 @@ async function runMultiCredential(config3, credentials) {
       credentialId,
       sessionId
     });
-    log7.info("credential context ready", {
+    log8.info("credential context ready", {
       credential: cred.id,
       credentialId,
       sessionId: dryRun ? "dry-run" : sessionId
@@ -129419,7 +129498,7 @@ async function runMultiCredential(config3, credentials) {
   let pagesExplored = 0;
   while (pageQueue.length > 0 && pagesExplored < maxPages) {
     if (isBrowserDead(health)) {
-      log7.error("browser died, terminating multi-credential crawl", {
+      log8.error("browser died, terminating multi-credential crawl", {
         reason: health.reason,
         pagesExplored,
         captured: globalState.capturedEndpoints.size
@@ -129427,12 +129506,12 @@ async function runMultiCredential(config3, credentials) {
       break;
     }
     if (config3.signal?.aborted) {
-      log7.info("multi-credential crawl cancelled by signal", { pagesExplored, queued: pageQueue.length });
+      log8.info("multi-credential crawl cancelled by signal", { pagesExplored, queued: pageQueue.length });
       break;
     }
     const entry = pageQueue.shift();
     pagesExplored++;
-    log7.info("processing URL", {
+    log8.info("processing URL", {
       page: `${pagesExplored}/${maxPages}`,
       url: entry.url,
       contexts: entry.contexts,
@@ -129445,11 +129524,11 @@ async function runMultiCredential(config3, credentials) {
         await stabilizeAfterGoto(ctx.page);
         return { ctx, success: true, redirected: normalizeUrl(ctx.page.url()) !== normalizeUrl(entry.url) };
       } catch (err) {
-        log7.warn("navigation failed", { credential: ctx.id, url: entry.url, err: String(err) });
+        log8.warn("navigation failed", { credential: ctx.id, url: entry.url, err: String(err) });
         return { ctx, success: false, redirected: false };
       }
     }));
-    const ACCESS_DENIED_PATTERNS = /\/(login|signin|sign-in|unauthorized|forbidden|access-denied|auth)/i;
+    const ACCESS_DENIED_PATTERNS = /\/(login|signin|sign-in|unauthorized|forbidden|access-denied|authenticate)/i;
     const visitableContexts = [];
     for (const r2 of navigateResults) {
       if (!r2.success)
@@ -129457,7 +129536,7 @@ async function runMultiCredential(config3, credentials) {
       if (r2.redirected) {
         const actualPath = new URL(r2.ctx.page.url()).pathname;
         if (ACCESS_DENIED_PATTERNS.test(actualPath)) {
-          log7.info("access denied redirect, skipping explore", {
+          log8.info("access denied redirect, skipping explore", {
             credential: r2.ctx.id,
             intended: entry.url,
             redirectedTo: r2.ctx.page.url()
@@ -129465,7 +129544,7 @@ async function runMultiCredential(config3, credentials) {
           continue;
         }
         const landed = normalizeUrl(r2.ctx.page.url());
-        log7.info("redirect to different page, enqueueing landed URL", {
+        log8.info("redirect to different page, enqueueing landed URL", {
           credential: r2.ctx.id,
           intended: entry.url,
           landed
@@ -129476,7 +129555,7 @@ async function runMultiCredential(config3, credentials) {
       visitableContexts.push(r2.ctx);
     }
     if (visitableContexts.length === 0) {
-      log7.info("no contexts could access page, skipping", { url: entry.url });
+      log8.info("no contexts could access page, skipping", { url: entry.url });
       continue;
     }
     const normalizedEntryUrl = normalizeUrl(entry.url);
@@ -129500,7 +129579,7 @@ async function runMultiCredential(config3, credentials) {
     const fingerprints = [...fingerprintsByContext.values()];
     const allSameFingerprint = fingerprints.length > 0 && fingerprints.every((fp) => fp === fingerprints[0]);
     if (dryRun) {
-      log7.info("page-diff", {
+      log8.info("page-diff", {
         url: entry.url,
         fingerprintMatch: allSameFingerprint,
         elementCount: availability.size,
@@ -129508,14 +129587,14 @@ async function runMultiCredential(config3, credentials) {
       });
     }
     if (allSameFingerprint && visitableContexts.length > 1) {
-      log7.info("same fingerprint across contexts", {
+      log8.info("same fingerprint across contexts", {
         contexts: visitableContexts.map((c) => c.id)
       });
     }
     for (const ctx of visitableContexts) {
       if (isBrowserDead(health))
         break;
-      log7.info("exploring", { credential: ctx.id, url: entry.url });
+      log8.info("exploring", { credential: ctx.id, url: entry.url });
       const exploreInline = async (p, url3, depth) => {
         if (isBrowserDead(health))
           return;
@@ -129530,14 +129609,14 @@ async function runMultiCredential(config3, credentials) {
         }
       } catch (err) {
         if (isBrowserDead(health)) {
-          log7.error("exploration aborted — browser died mid-page", {
+          log8.error("exploration aborted — browser died mid-page", {
             credential: ctx.id,
             url: entry.url,
             reason: health.reason
           });
           break;
         }
-        log7.warn("exploration error", { credential: ctx.id, url: entry.url, err: String(err) });
+        log8.warn("exploration error", { credential: ctx.id, url: entry.url, err: String(err) });
       }
     }
     for (const ctx of visitableContexts) {
@@ -129551,7 +129630,7 @@ async function runMultiCredential(config3, credentials) {
     await visitableContexts[0]?.page.waitForTimeout(300);
   }
   const browserDied = isBrowserDead(health);
-  log7.info(browserDied ? "browser died, draining captured requests" : "multi-credential exploration complete, draining remaining requests", {
+  log8.info(browserDied ? "browser died, draining captured requests" : "multi-credential exploration complete, draining remaining requests", {
     pagesExplored,
     captured: globalState.capturedEndpoints.size,
     ...browserDied ? { reason: health.reason } : {}
@@ -129559,7 +129638,7 @@ async function runMultiCredential(config3, credentials) {
   if (!browserDied)
     await contexts[0]?.page.waitForTimeout(2000).catch(() => {});
   await drainPageCaptures(captureQueues, captureHandlers, new Map, null, null);
-  log7.info("multi-credential crawl done", {
+  log8.info("multi-credential crawl done", {
     pagesExplored,
     credentials: contexts.map((c) => c.id),
     totalSteps: globalState.totalSteps,
@@ -129583,7 +129662,7 @@ async function runMultiCredential(config3, credentials) {
     await contexts[0]?.page.waitForTimeout(600).catch(() => {});
   }
   if (!config3.headless && browser.isConnected()) {
-    log7.info("crawl complete — browser stays open, close the window to finish");
+    log8.info("crawl complete — browser stays open, close the window to finish");
     await waitForBrowserClose(browser, config3.signal);
   } else if (!browserDied) {
     await browser.close().catch(() => {});
@@ -129613,7 +129692,7 @@ async function run(config3) {
   const panelOn = config3.panel ?? true;
   setPanelEnabled(panelOn);
   logScope(targetUrl, scopePatterns, !!config3.scope);
-  log7.info(`starting browser agent v2${dryRun ? " (DRY-RUN)" : ""}`, {
+  log8.info(`starting browser agent v2${dryRun ? " (DRY-RUN)" : ""}`, {
     target: targetUrl,
     maxPages,
     server: dryRun ? undefined : serverUrl,
@@ -129622,7 +129701,7 @@ async function run(config3) {
   let model = null;
   try {
     model = await resolveModel(config3.model);
-    log7.info("AI navigation enabled");
+    log8.info("AI navigation enabled");
   } catch (err) {
     throw new Error(`AI model required for v2 architecture: ${String(err)}`);
   }
@@ -129634,9 +129713,13 @@ async function run(config3) {
     }
     sessionID = created;
   }
-  const browser = await connect({ cdp: config3.cdp, headless: config3.headless ?? false });
+  const browser = await connect({
+    cdp: config3.cdp,
+    headless: config3.headless ?? false,
+    network: config3.network
+  });
   const health = createBrowserHealth();
-  const context = await browser.newContext(contextOptions(config3.headless ?? false));
+  const context = await browser.newContext(contextOptions(config3.headless ?? false, config3.network));
   await context.addInitScript(INIT_SCRIPT);
   if (panelOn)
     await context.addInitScript(PANEL_INIT_SCRIPT);
@@ -129669,10 +129752,10 @@ async function run(config3) {
   try {
     const initNavErr = await page.goto(targetUrl, { waitUntil: "domcontentloaded", timeout: 30000 }).then(() => null).catch((e2) => e2);
     if (initNavErr) {
-      log7.warn("initial navigation failed", { url: targetUrl, err: initNavErr.message.split(`
+      log8.warn("initial navigation failed", { url: targetUrl, err: initNavErr.message.split(`
 `)[0] });
       if (!config3.headless && browser.isConnected()) {
-        log7.info("browser stays open — navigate manually or close the window to finish");
+        log8.info("browser stays open — navigate manually or close the window to finish");
         await waitForBrowserClose(browser, config3.signal);
       } else {
         await browser.close().catch(() => {});
@@ -129682,7 +129765,7 @@ async function run(config3) {
         capturedEndpoints: 0,
         pagesExplored: 0,
         totalSteps: 0,
-        errors: [`Initial navigation failed: ${initNavErr.message}`],
+        errors: [`Initial navigation failed: ${initNavErr.message}${certHint(initNavErr.message, config3)}`],
         usage: usageAcc
       };
     }
@@ -129710,7 +129793,7 @@ async function run(config3) {
     }
     const globalState = createGlobalState({ outOfScope: config3.outOfScope });
     if (config3.outOfScope?.length) {
-      log7.info("out-of-scope labels", { count: config3.outOfScope.length, labels: config3.outOfScope });
+      log8.info("out-of-scope labels", { count: config3.outOfScope.length, labels: config3.outOfScope });
     }
     if (isAuthenticated) {
       globalState.authPhase = "authenticated";
@@ -129726,7 +129809,7 @@ async function run(config3) {
       try {
         const pathname = new URL(req.url()).pathname;
         if (LOGIN_SUCCESS_PATTERN.test(`${method} ${pathname} [${status}]`)) {
-          log7.info("login success detected via HTTP response");
+          log8.info("login success detected via HTTP response");
           triggerReDiscovery(globalState);
         }
       } catch {}
@@ -129734,7 +129817,7 @@ async function run(config3) {
     let pagesExplored = 0;
     while (globalState.pageQueue.length > 0 && pagesExplored < maxPages) {
       if (isBrowserDead(health)) {
-        log7.error("browser died, terminating crawl", {
+        log8.error("browser died, terminating crawl", {
           reason: health.reason,
           pagesExplored,
           captured: globalState.capturedEndpoints.size
@@ -129742,7 +129825,7 @@ async function run(config3) {
         break;
       }
       if (config3.signal?.aborted) {
-        log7.info("crawl cancelled by signal", { pagesExplored, queued: globalState.pageQueue.length });
+        log8.info("crawl cancelled by signal", { pagesExplored, queued: globalState.pageQueue.length });
         break;
       }
       const nextUrl = globalState.pageQueue.shift();
@@ -129750,28 +129833,33 @@ async function run(config3) {
       if (page.url() !== nextUrl) {
         const navErr = await page.goto(nextUrl, { waitUntil: "domcontentloaded", timeout: 15000 }).then(() => null).catch((e2) => e2);
         if (navErr) {
-          log7.warn("navigation failed", { url: nextUrl, err: navErr.message.split(`
-`)[0] });
+          const head = navErr.message.split(`
+`)[0];
+          const hint = certHint(navErr.message, config3);
+          if (hint)
+            log8.error("navigation failed", { url: nextUrl, err: head + hint });
+          else
+            log8.warn("navigation failed", { url: nextUrl, err: head });
           continue;
         }
         await stabilizeAfterGoto(page);
       }
       if (!isInScope(page.url(), inScope)) {
-        log7.info("off-host redirect, skipping", { url: page.url() });
+        log8.info("off-host redirect, skipping", { url: page.url() });
         await page.goto(targetUrl, { waitUntil: "domcontentloaded", timeout: 15000 }).catch(() => {});
         continue;
       }
       const currentUrl = normalizeUrl(page.url());
       if (currentUrl !== normalizeUrl(nextUrl) && globalState.visitedPages.has(currentUrl)) {
-        log7.info("redirect to already-explored page, skipping", {
+        log8.info("redirect to already-explored page, skipping", {
           requested: normalizeUrl(nextUrl),
           landed: currentUrl
         });
         continue;
       }
       globalState.visitedPages.add(currentUrl);
-      log7.info("exploring page", { page: `${pagesExplored}/${maxPages}`, url: currentUrl });
-      log7.debug("state", {
+      log8.info("exploring page", { page: `${pagesExplored}/${maxPages}`, url: currentUrl });
+      log8.debug("state", {
         phase: globalState.authPhase,
         queueSize: globalState.pageQueue.length,
         queue: globalState.pageQueue.slice(0, 5).map((u) => {
@@ -129798,18 +129886,18 @@ async function run(config3) {
       await expandDisclosures(page);
       const intel = getIntelligence(globalState, SINGLE_CRED);
       const oldFingerprint = intel.pageFingerprints.get(currentUrl);
-      log7.debug("fingerprint check", { url: currentUrl, hasOld: !!oldFingerprint });
+      log8.debug("fingerprint check", { url: currentUrl, hasOld: !!oldFingerprint });
       if (oldFingerprint !== undefined) {
         const currentElements = await collectElements(page);
         const newFingerprint = generateFingerprint(currentElements);
-        log7.debug("fingerprint compare", {
+        log8.debug("fingerprint compare", {
           url: currentUrl,
           match: newFingerprint === oldFingerprint,
           oldFp: oldFingerprint.slice(0, 80),
           newFp: newFingerprint.slice(0, 80)
         });
         if (newFingerprint === oldFingerprint) {
-          log7.info("page unchanged after auth, skipping exploration", { url: currentUrl });
+          log8.info("page unchanged after auth, skipping exploration", { url: currentUrl });
           const domLinks = await collectDOMLinks(page, currentUrl, inScope);
           for (const url3 of domLinks) {
             enqueueUrl(url3, globalState, inScope);
@@ -129818,7 +129906,7 @@ async function run(config3) {
           await page.waitForTimeout(300);
           continue;
         }
-        log7.info("page changed after auth, re-exploring", { url: currentUrl });
+        log8.info("page changed after auth, re-exploring", { url: currentUrl });
       }
       const exploreInline = async (p, url3, depth) => {
         if (isBrowserDead(health))
@@ -129832,10 +129920,10 @@ async function run(config3) {
         discovered = await explorePageWithAI(page, currentUrl, interceptor, model, globalState, inScope, SINGLE_CRED, maxPages, usageAcc, { explore: exploreInline, depth: 0 });
       } catch (err) {
         if (isBrowserDead(health)) {
-          log7.error("exploration aborted — browser died mid-page", { url: currentUrl, reason: health.reason });
+          log8.error("exploration aborted — browser died mid-page", { url: currentUrl, reason: health.reason });
           break;
         }
-        log7.warn("exploration error", { url: currentUrl, err: String(err) });
+        log8.warn("exploration error", { url: currentUrl, err: String(err) });
       }
       let newEnqueued = 0;
       for (const url3 of discovered) {
@@ -129843,7 +129931,7 @@ async function run(config3) {
           newEnqueued++;
       }
       if (discovered.length > 0) {
-        log7.debug("discovered links", {
+        log8.debug("discovered links", {
           found: discovered.length,
           enqueued: newEnqueued,
           queueSize: globalState.pageQueue.length
@@ -129852,7 +129940,7 @@ async function run(config3) {
       flushReDiscovery(globalState);
       await page.waitForTimeout(300);
       if (globalState.pageQueue.length === 0 && globalState.deferredAuthPages.length > 0) {
-        log7.debug("queue empty, processing auth phase", {
+        log8.debug("queue empty, processing auth phase", {
           phase: globalState.authPhase,
           deferred: globalState.deferredAuthPages.map((d) => d.type)
         });
@@ -129860,7 +129948,7 @@ async function run(config3) {
       }
     }
     const browserDied = isBrowserDead(health);
-    log7.info(browserDied ? "browser died, draining captured requests" : "exploration complete, draining remaining requests", {
+    log8.info(browserDied ? "browser died, draining captured requests" : "exploration complete, draining remaining requests", {
       pagesExplored,
       captured: globalState.capturedEndpoints.size,
       ...browserDied ? { reason: health.reason } : {}
@@ -129871,7 +129959,7 @@ async function run(config3) {
       const captured = captureQueue.shift();
       await handleCapture(captured);
     }
-    log7.info("done", {
+    log8.info("done", {
       pagesExplored,
       totalSteps: globalState.totalSteps,
       capturedEndpoints: globalState.capturedEndpoints.size,
@@ -129895,7 +129983,7 @@ async function run(config3) {
       }
     }
     if (!config3.headless && browser.isConnected()) {
-      log7.info("crawl complete — browser stays open, close the window to finish");
+      log8.info("crawl complete — browser stays open, close the window to finish");
       const postCrawlDrain = setInterval(async () => {
         while (captureQueue.length > 0) {
           const captured = captureQueue.shift();
@@ -129921,7 +130009,7 @@ async function run(config3) {
 }
 
 // ../hackbrowser/src/api.ts
-var log8 = Log.create({ service: "hackbrowser:api" });
+var log9 = Log.create({ service: "hackbrowser:api" });
 function preflightCheck() {
   if (findSystemChrome())
     return;
@@ -129963,6 +130051,7 @@ function toAgentConfig(opts) {
     dryRun: opts.dryRun,
     panel: opts.panel,
     model: opts.model,
+    network: opts.network,
     cdp: opts.cdp,
     signal: opts.signal
   };
@@ -129979,7 +130068,7 @@ async function runCrawl(opts) {
     setEventSink(opts.eventSink);
   const config3 = toAgentConfig(opts);
   try {
-    log8.info("runCrawl starting", {
+    log9.info("runCrawl starting", {
       url: opts.url,
       multiCred: !!opts.multiCredentials?.length,
       headless: opts.headless,
@@ -129987,7 +130076,7 @@ async function runCrawl(opts) {
       eventSink: !!opts.eventSink
     });
     const result = await run(config3);
-    log8.info("runCrawl done", {
+    log9.info("runCrawl done", {
       sessionID: result.sessionID,
       capturedEndpoints: result.capturedEndpoints,
       pagesExplored: result.pagesExplored
@@ -129995,7 +130084,7 @@ async function runCrawl(opts) {
     return result;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log8.error("runCrawl failed", { err: message });
+    log9.error("runCrawl failed", { err: message });
     return {
       sessionID: opts.sessionID ?? "",
       capturedEndpoints: 0,
@@ -130014,6 +130103,7 @@ async function runCrawl(opts) {
 
 // src/hackbrowser-subprocess/hackbrowser-worker.ts
 import readline2 from "readline";
+import tls from "node:tls";
 function send(msg) {
   process.stdout.write(JSON.stringify(msg) + `
 `);
@@ -130058,9 +130148,35 @@ function applyAnthropicBearerBody(body, opts) {
     return body;
   }
 }
+function applyTransport(desc, init) {
+  const n = desc.network;
+  if (!n)
+    return init;
+  const out = { ...init ?? {} };
+  if (n.proxy)
+    out.proxy = n.proxy;
+  const tls2 = {};
+  if (n.rejectUnauthorized !== undefined)
+    tls2.rejectUnauthorized = n.rejectUnauthorized;
+  if (n.ca)
+    tls2.ca = n.ca;
+  if (n.cert)
+    tls2.cert = n.cert;
+  if (n.key)
+    tls2.key = n.key;
+  if (n.passphrase)
+    tls2.passphrase = n.passphrase;
+  if (Object.keys(tls2).length > 0)
+    out.tls = tls2;
+  return out;
+}
+function shouldUseCopilotResponsesApi(modelID) {
+  const match = /^gpt-(\d+)/.exec(modelID);
+  return match !== null && Number(match[1]) >= 5 && !modelID.startsWith("gpt-5-mini");
+}
 function createModelFromDescriptor(desc) {
   const stripSampling = desc.supportsTemperature === false;
-  const samplingFetch = stripSampling ? (input, init) => fetch(input, init ? { ...init, body: stripSamplingParams(init.body) } : init) : undefined;
+  const samplingFetch = stripSampling || desc.network ? (input, init) => fetch(input, applyTransport(desc, init && stripSampling ? { ...init, body: stripSamplingParams(init.body) } : init)) : undefined;
   if (desc.npm.includes("anthropic")) {
     if (desc.authToken) {
       const token = desc.authToken;
@@ -130078,7 +130194,7 @@ function createModelFromDescriptor(desc) {
             userId: desc.anthropicUserId,
             systemPrefix: desc.anthropicSystemPrefix
           });
-          return fetch(url3, { ...init, headers, body });
+          return fetch(url3, applyTransport(desc, { ...init, headers, body }));
         }
       };
       if (desc.baseURL)
@@ -130114,11 +130230,11 @@ function createModelFromDescriptor(desc) {
         const version3 = typeof CYBERSTRIKE_VERSION === "string" ? CYBERSTRIKE_VERSION : "local";
         headers.set("User-Agent", `cyberstrike/${version3}`);
         headers.set("Openai-Intent", "conversation-edits");
-        return fetch(url3, {
+        return fetch(url3, applyTransport(desc, {
           ...init,
           headers,
           body: stripSampling ? stripSamplingParams(init?.body) : init?.body
-        });
+        }));
       }
     };
     if (desc.baseURL)
@@ -130126,7 +130242,17 @@ function createModelFromDescriptor(desc) {
     if (desc.headers)
       opts2.headers = desc.headers;
     const sdk2 = factory10(opts2);
-    return sdk2.languageModel(desc.modelApiId);
+    const api2 = sdk2.responses === undefined && sdk2.chat === undefined ? "languageModel" : shouldUseCopilotResponsesApi(desc.modelApiId) ? "responses" : "chat";
+    send({
+      type: "log",
+      level: "info",
+      service: "hackbrowser:worker",
+      message: `copilot model "${desc.modelApiId}" -> ${api2} API`,
+      extra: { model: desc.modelApiId, api: api2 }
+    });
+    if (api2 === "languageModel")
+      return sdk2.languageModel(desc.modelApiId);
+    return api2 === "responses" ? sdk2.responses(desc.modelApiId) : sdk2.chat(desc.modelApiId);
   }
   const factory7 = BUNDLED_PROVIDERS[desc.npm];
   if (!factory7) {
@@ -130178,13 +130304,26 @@ function buildCrawlOptions(opts, signal) {
     cyberstrikeUrl: opts.cyberstrikeUrl,
     model,
     cdp: opts.cdp,
+    network: opts.network,
     logSink,
     eventSink: eventSink2,
     signal,
     ...credentialFields
   };
 }
+function trustSystemCertificates() {
+  try {
+    const t2 = tls;
+    if (typeof t2.getCACertificates !== "function" || typeof t2.setDefaultCACertificates !== "function")
+      return;
+    const system = t2.getCACertificates("system");
+    if (system.length === 0)
+      return;
+    t2.setDefaultCACertificates([...t2.getCACertificates("default"), ...system]);
+  } catch {}
+}
 async function main() {
+  trustSystemCertificates();
   const controller = new AbortController;
   const rl = readline2.createInterface({ input: process.stdin, terminal: false });
   let started = false;
@@ -130239,3 +130378,6 @@ main().catch((err) => {
 `);
   process.exitCode = 1;
 });
+export {
+  applyTransport
+};