@doppelgangerdev/doppelganger 0.7.0 → 0.7.3

package/README.md

@@ -130,6 +130,7 @@ node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
 | `SESSION_SECRET` | Signs session cookies. Required. | — |
 | `ALLOWED_IPS` | Comma list for basic IP allowlisting. | none (open) |
 | `TRUST_PROXY` | Honor `X-Forwarded-*` when behind a reverse proxy. | `0` |
+| `ALLOW_PRIVATE_NETWORKS` | Allow scraping local/private IPs (SSRF risk). | `true` |
 | `VITE_DEV_PORT` | Port for front-end dev server. | `5173` |
 | `VITE_BACKEND_PORT` | Backend port for proxying + scripts. | `11345` |
 | `DB_TYPE` | Optional database type overriding disk storage. Set to `postgres` to use PostgreSQL. | — |
@@ -190,18 +191,27 @@ Proxies can be defined via the UI or `data/proxies.json`:
 
 # API Surface
 
-- **Task execution** (`POST /tasks/:id/api`)
-  - Headers: `x-api-key` or `Authorization: Bearer <key>`.
-  - Body: `{ "variables": { ... } }` to override task variables or provide runtime data.
-- **Settings**:
-  - `/api/settings/api-key` — GET current, POST regen.
-  - `/api/settings/user-agent` — toggle system vs custom list.
-  - `/api/settings/proxies*` — GET/POST/PUT/DELETE plus rotation toggles.
-- **Clear data**:
-  - `POST /api/clear-screenshots` — removes files in `public/captures`.
-  - `POST /api/clear-cookies` — deletes `storage_state.json`.
+Doppelganger exposes a comprehensive REST API for integration with agents (like OpenClaw) or custom automation scripts. All endpoints are hosted locally, typically on port `11345`.
 
-Authentication enforces sessions (`/api/auth/login`, `/api/auth/logout`, `/api/auth/me`); read `server.js` to see the guard/middleware logic.
+**Authentication:** 
+If enabled, provide the `x-api-key` header or `Authorization: Bearer <key>`. For internal network use, this may be optional depending on your settings.
+
+
+### Task Management API
+*   **`GET /api/tasks`**: List all saved automation profiles.
+*   **`POST /api/tasks`**: Create a new task profile.
+*   **`PUT /api/tasks/:id`**: Update an existing task profile.
+*   **`POST /api/tasks/:id/api`**: Execute a predefined task. Pass `{"variables": {}}` in the body to override execution variables dynamically.
+
+### Execution & Logging API
+*   **`GET /api/executions`**: Retrieve paginated logs of all past runs.
+*   **`GET /api/executions/:id`**: View the exact steps, result JSON, and configuration state of a specific run.
+
+### Data Management API
+*   **`GET /api/data/captures`**: List generated screenshots, videos, and downloads.
+*   **`DELETE /api/data/captures/:name`**: Delete a specific capture.
+*   **`POST /api/clear-screenshots`**: Removes all files in `public/captures`.
+*   **`POST /api/clear-cookies`**: Deletes `storage_state.json`.
 
 # Task Scripting Tips
 
@@ -231,7 +241,7 @@ Authentication enforces sessions (`/api/auth/login`, `/api/auth/logout`, `/api/a
 
 - **“Session expired”** in the UI: confirm `SESSION_SECRET` is consistent and cookies aren’t blocked by your browser.
 - **Proxy import fails**: inspect `data/proxies.json` for valid URLs; the backend validates `server` as a string.
-- **API key lost**: regenerate from Settings → System tab; the UI copies it automatically.
+- **API key lost**: copy from Settings → System tab.
 
 # Data Lifecycle
 
@@ -272,7 +282,9 @@ Authentication enforces sessions (`/api/auth/login`, `/api/auth/logout`, `/api/a
 - [ ] **Companion app** — build a lightweight companion app that mirrors critical dashboard notifications (failures, capture completions, proxy issues) so operators can stay informed without opening the full UI.
 - [ ] **Community presets hub** — build a marketplace where users can publish task/workspace presets, browse and download others’ submissions, and choose to offer each preset either for free or as a paid template so creators can monetize standalone workflows while keeping the free option available.
 - [ ] **Database Tab / Local CRM** — add a built-in spreadsheet-like interface for viewing and managing extracted data (CRM-style) entirely within the app, without requiring external tools.
+- [ ] **iframe interaction support** — add the ability to target and interact with elements inside iframes in the task editor.
 - [x] **Autosave** — automatically persist task changes and editor state at regular intervals so operators don't lose work on long-running or complex workflow designs.
+- [ ] **Highlight tool** — add a feature to highlight elements on the page (similar to a browser's inspect tool) to easily pick selectors and build workflows.
 
 # Security Considerations