@dipoleml/dcode-cli 1.0.0 → 1.2.0

package/dist/packages/browser-use-plugin/README.md

@@ -1,12 +1,12 @@
-# Browser Use
-
-The official built-in DCode plugin for browser automation. It ships the browser-client bootstrap module, skills, and documentation/capability manifests; the `node_repl` MCP host that exposes the `js` tool lives in `@dcode/node-repl-host`.
-
-## What it provides
-
-- `js` tool — served by the shared `node_repl` MCP host and seen by the model as `mcp__node_repl__js`. The host is shared with Computer Use, so its model-facing text is scoped to both official capabilities. Every `js` call starts in a fresh kernel; imports are limited to `node:*` builtins and absolute `file://` URLs under the skill root.
-- `scripts/browser-client.mjs` — explicitly bootstraps `agent.browsers` inside each fresh `js` kernel; BrowserControl tabs, not JavaScript globals, provide continuity.
-- `control-browser` skill — tells the agent how to bootstrap and drive an advertised DCode browser backend (Desktop IAB or CLI-managed headless CDP), select a browser and read `browser.documentation()` once, use the Playwright DOM snapshot→locator→act workflow, observe controlled and user tab registries together after a possible popup action, and request screenshots only for visual evidence.
-- `web-gui-tester` skill — layers a pure-GUI black-box testing workflow on top of `control-browser`, requiring Browser Use semantic evidence plus inspected screenshots while respecting current console, upload, and runtime capability boundaries.
-
-The IAB runtime is provided by the desktop host; the managed headless CDP runtime is provided only by an explicitly opted-in CLI process. The plugin assets define the model guidance and the effective runtime object graph; unsupported members are removed by the manifest interpreter instead of failing after invocation.
+# Browser Use
+
+The official built-in DCode plugin for browser automation. It ships the browser-client bootstrap module, skills, and documentation/capability manifests; the `node_repl` MCP host that exposes the `js` tool lives in `@dcode/node-repl-host`.
+
+## What it provides
+
+- `node_repl` MCP server — exposes a single `js` tool, which the model sees as `mcp__node_repl__js`. Shared with Computer Use, so its model-facing text is scoped to both official capabilities. (`js_reset` and `js_add_node_module_dir` were removed on 2026-09-18 along with the moduleDirs machinery: every `js` call already starts fresh, and module search roots are the host's job to inject, not the model's to configure. Imports are limited to `node:*` builtins and absolute `file://` URLs under the skill root.)
+- `scripts/browser-client.mjs` — explicitly bootstraps `agent.browsers` inside each fresh `js` kernel; BrowserControl tabs, not JavaScript globals, provide continuity.
+- `control-browser` skill — tells the agent how to bootstrap and drive an advertised DCode browser backend (Desktop IAB or CLI-managed headless CDP), select a browser and read `browser.documentation()` once, use the Playwright DOM snapshot→locator→act workflow, observe controlled and user tab registries together after a possible popup action, and request screenshots only for visual evidence.
+- `web-gui-tester` skill — layers a pure-GUI black-box testing workflow on top of `control-browser`, requiring Browser Use semantic evidence plus inspected screenshots while respecting current console, upload, and runtime capability boundaries.
+
+The IAB runtime is provided by the desktop host; the managed headless CDP runtime is provided only by an explicitly opted-in CLI process. The plugin assets define the model guidance and the effective runtime object graph; unsupported members are removed by the manifest interpreter instead of failing after invocation.

package/dist/packages/browser-use-plugin/docs/api.json

@@ -19,7 +19,7 @@
     "evaluate": "playwright.evaluate() and locator.evaluate() execute JavaScript in the page context and may change page state. Use them for page-side logic that cannot be expressed through the high-level locator API; use normal action methods when they communicate the intended interaction more clearly.",
     "screenshotOutput": "After choosing the visual branch, every screenshot call must be emitted in the same JS cell as an image block with nodeRepl.emitImage(await tab.screenshot()). Never use tab.screenshot() as the final expression or return its Uint8Array bytes directly.",
     "operationTimeout": "Routine locator, URL/load-state wait, and evaluate operations default to and are capped at 3000ms. Fixed waitForTimeout is separate; download event waiting may use up to 120000ms.",
-    "navigationWait": "After every successful `tab.goto(url)`, explicitly call `await tab.playwright.waitForLoadState({ state: \"domcontentloaded\" })` before the first title, URL, or DOM observation. Keep this confirmation in the model-visible trajectory even when goto() has already settled the backend navigation. Routine URL/load-state waits remain capped at 3000ms. networkidle is rejected by every DCode browser backend. expectNavigation without an expected URL can be satisfied by an already-loaded page; pass url when a new navigation must be proven.",
+    "navigationWait": "After every successful `tab.goto(url)`, explicitly call `await tab.playwright.waitForLoadState({ state: \"domcontentloaded\" })` before the first title, URL, or DOM observation. Keep this confirmation in the model-visible trajectory even when goto() has already settled the backend navigation. Routine URL/load-state waits remain capped at 3000ms. networkidle is rejected by the current IAB backend. expectNavigation without an expected URL can be satisfied by an already-loaded page; pass url when a new navigation must be proven.",
     "roleName": "getByRole(..., { name }) accepts a string or RegExp, including RegExp values created in the node_repl VM realm."
   },
   "types": {

package/dist/packages/browser-use-plugin/docs/overview.md

@@ -2,7 +2,7 @@
 
 The browser registry understands backend types `iab`, `extension`, and `cdp`. Playwright is a `Tab` API surface, not a backend. The desktop host normally advertises `iab`, while DCode CLI can explicitly advertise a managed headless Chromium as `cdp`. Never treat an unadvertised backend as available.
 
-Start by selecting a browser and a tab. Every Browser Use JS call runs in a fresh kernel, so run the Skill bootstrap and recreate the selected browser wrapper in each call. Read its complete effective documentation once:
+Start from the browser object model. Every Browser Use JS call runs in a fresh kernel, so run the Skill bootstrap and recreate the selected browser wrapper in each call. Read its complete effective documentation once:
 
 ```js
 const browser = await agent.browsers.getDefault();
@@ -109,11 +109,12 @@ keypress? })` scrolls from the supplied viewport anchor. `dom_cua.scroll({ node_
 - CUA and DOM CUA `keypress({ keys })` treat keys as one combination, not a sequence of independent presses.
   IAB does not expose CUA/DOM CUA `downloadMedia`; use a snapshot-proven Playwright locator's
   `downloadMedia()` when the selected element exposes a downloadable media/link URL.
-- `tab.playwright` exposes the supported Playwright surface: `locator/getBy*/frameLocator`, locator actions and
+- `tab.playwright` exposes the common Playwright surface: `locator/getBy*/frameLocator`, locator actions and
   queries, `evaluate`, `domSnapshot`, `waitForURL`, `waitForLoadState`,
   `waitForTimeout`, `expectNavigation`, and download events.
 - Fixed waiting is `tab.playwright.waitForTimeout(timeoutMs)`, never `tab.waitForTimeout`. Prefer
   `locator.waitFor(...)`, `waitForURL(...)`, `waitForLoadState(...)`, or a fresh semantic observation.
-- Routine locator, URL/load-state wait, and evaluate operations default to and are capped at 3000ms. A timeout is a signal to refresh the snapshot and rebuild the locator, not to retry it unchanged.
-- IAB does not support file uploads: `waitForEvent("filechooser")` / `fileChooser.setFiles(...)` fail with
+- Routine locator, URL/load-state wait, and evaluate operations default to and are capped at 3000ms.
+  A timeout is a signal to refresh the snapshot and rebuild the locator, not to retry it unchanged.
+- IAB does not support file upload: `waitForEvent("filechooser")` / `fileChooser.setFiles(...)` fail with
   `capability_unsupported`; no fake upload success is exposed.

package/dist/packages/browser-use-plugin/docs/workflow.md

@@ -70,7 +70,7 @@ Return `{ controlledTabs, userTabs }` as that cell's final result so the model m
 
 Only load `agent.documentation.get("screenshots")` when the user explicitly requests a screenshot, visual layout/rendering/image content must be judged, or the required target is missing from the DOM snapshot (for example canvas/custom-drawn UI). Once that branch is selected, every screenshot must be emitted in the same JS cell with `nodeRepl.emitImage(await tab.screenshot())`; never leave `tab.screenshot()` as the final expression or return its `Uint8Array` bytes directly.
 
-After any Playwright timeout, strict-mode failure, or selector parse failure, do not retry the same locator. Take a fresh `domSnapshot()` and rebuild it from snapshot-proven facts. Routine locator and page-state waits fail within the 3000ms budget; use a longer fixed sleep only when no concrete state can be observed.
+After any Playwright timeout, strict-mode failure, or selector parse failure, do not retry the same locator. Take a fresh `domSnapshot()` and rebuild it from snapshot-proven facts. Routine locator and page-state waits fail within a 3000ms budget; use a longer fixed sleep only when no concrete state can be observed.
 
 Use `playwright.evaluate(...)` and locator `evaluate(...)` for page-side JavaScript that cannot be expressed through the high-level locator API. These calls execute in the page context, so keep the expression focused and use the normal action methods when they better communicate the intended interaction.
 

package/dist/packages/browser-use-plugin/scripts/build.mjs

@@ -30,6 +30,7 @@ const createBundleOptions = ({ entryPoint, outfile }) => ({
   outfile,
   platform: "node",
   target: "node24",
+  external: ["sharp"],
 });
 
 /**

package/dist/packages/browser-use-plugin/skills/control-browser/SKILL.md

@@ -15,12 +15,14 @@ The browser registry is driven from the Node REPL MCP `js` tool. In this environ
 
 ## Bootstrap every JavaScript call
 
-The `browser-client` module is the browser entry point and is available at `scripts/browser-client.mjs` under this plugin's root. Resolve that root only from `process.env.DCODE_PLUGIN_ROOT`, then convert the joined path with `pathToFileURL`. Never derive the plugin root from this skill's base directory or leave a synthetic root placeholder for the model to resolve. If the host root is unavailable or the resolved module cannot be imported, stop and report the exact setup error.
+The `browser-client` module is the browser entry point and is available at `scripts/browser-client.mjs` under this plugin's root. Resolve that root only from `process.env.DCODE_PLUGIN_ROOT` (with `CLAUDE_PLUGIN_ROOT` as a compatibility fallback), then convert the joined path with `pathToFileURL`. Never derive the plugin root from this skill's base directory or leave a synthetic root placeholder for the model to resolve. If the host root is unavailable or the resolved module cannot be imported, stop and report the exact setup error.
 
 Initialize at the start of every `mcp__node_repl__js` call that uses the browser. The bootstrap deliberately does not select a backend; apply the user's existing backend choice or the selection rules below after setup.
 
 ```js
-const browserPluginRoot = process.env.DCODE_PLUGIN_ROOT;
+// 修复原因：Skill base directory 指向 skills/control-browser，不能据此拼接插件运行时资产。
+const browserPluginRoot =
+  process.env.DCODE_PLUGIN_ROOT ?? process.env.CLAUDE_PLUGIN_ROOT;
 if (!browserPluginRoot) {
   throw new Error("Browser plugin root is unavailable in the node_repl host");
 }
@@ -76,7 +78,7 @@ const browser = await agent.browsers.getDefault();
 nodeRepl.write(await browser.documentation());
 ```
 
-Do not slice, truncate, or summarize it. Only if the tool output itself reports truncation may you read it in smaller chunks. It documents every default method, the Playwright DOM snapshot→locator workflow, the snapshot-ref, `cua`, and `dom_cua` escape-hatch paths, and safety rules. Screenshot instructions are intentionally lookup-only and must not be loaded unless the visual branch below applies.
+Do not slice, truncate, or summarize it. Only if the tool output itself reports truncation may you read it in smaller chunks. It documents every default method, the Playwright DOM snapshot→locator workflow, the ref/cua/dom_cua compatibility paths, and safety rules. Screenshot instructions are intentionally lookup-only and must not be loaded unless the visual branch below applies.
 
 ## Core workflow
 
@@ -94,7 +96,7 @@ Do not slice, truncate, or summarize it. Only if the tool output itself reports
 4. If the task names a new URL, prefer the reuse-aware entry: `await agent.browsers.open(url)` reuses an existing
    same-site controlled tab (same hostname), activates it so the user sees it, and navigates in place, instead of
    stacking a new tab on every navigation. Only when the task genuinely needs a parallel independent tab, create one
-   explicitly and follow this navigation sequence:
+   explicitly and use this navigation sequence:
 
    ```js
    const tab = await browser.tabs.new();
@@ -149,9 +151,10 @@ string id, recover the same verified tab before every status/cancel batch, and p
 - `tab.dom_cua.*` — node path (`node_id` comes from `get_visible_dom()`): `click({node_id})`, `double_click({node_id})`, `scroll({node_id?,x,y})`, `keypress({keys})`, and `type({text})` after focusing the target.
 - `tab.playwright.waitForTimeout(timeoutMs)` — fixed wait for the rare case where no concrete
   page state can be observed yet. `timeoutMs` must be a non-negative integer. Do not call
-  `tab.waitForTimeout(...)`; that root-level API does not exist in this runtime. Prefer a targeted wait or fresh `domSnapshot()`
+  `tab.waitForTimeout(...)`; that root-level API does not exist. Prefer a targeted wait or fresh `domSnapshot()`
   over routine sleeps.
-- `tab.playwright.getByRole/getByText/getByLabel/getByPlaceholder/getByTestId/locator` — lazy locator builders. Prefer these when a targeted state wait or a strict DOM action is clearer than a
+- `tab.playwright.getByRole/getByText/getByLabel/getByPlaceholder/getByTestId/locator` — lazy
+  locator builders. Prefer these when a targeted state wait or a strict DOM action is clearer than a
   snapshot ref. Common terminal methods include `click`, `dblclick`, `fill`, `type`, `press`, `check`,
   `uncheck`, `selectOption`, `waitFor`, `count`, `allTextContents`, `textContent`, `innerText`,
   `getAttribute`, `isVisible`, `isEnabled`, `evaluate`, and `downloadMedia`.
@@ -161,7 +164,7 @@ string id, recover the same verified tab before every status/cancel batch, and p
 - `goto()` accepts `http:`, `https:`, and exact `about:blank`. `file:`, other `about:*`, `data:`, and
   `javascript:` targets are not navigable. A `file:` URL may still be used only as a `getForUrl()` backend-selection
   hint when multiple backends exist.
-- `networkidle` is present in the shared type but is rejected by every DCode browser backend. For
+- `networkidle` is present in the shared type but is rejected by the IAB backend. For
   `expectNavigation(...)`, pass an expected `url` when the action must prove a new navigation; without `url`, an
   already-loaded old page can satisfy the load-state waiter.