@hasna/browser 0.0.9 → 0.1.0

package/dist/cli/index.js

@@ -2341,6 +2341,23 @@ function runMigrations(db) {
         );
         CREATE INDEX IF NOT EXISTS idx_session_tags_tag ON session_tags(tag);
       `
+    },
+    {
+      version: 6,
+      sql: `
+        CREATE TABLE IF NOT EXISTS auth_flows (
+          id                 TEXT PRIMARY KEY,
+          name               TEXT NOT NULL UNIQUE,
+          domain             TEXT NOT NULL,
+          recording_id       TEXT REFERENCES recordings(id),
+          storage_state_path TEXT,
+          created_at         TEXT DEFAULT (datetime('now')),
+          last_used          TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_auth_flows_domain ON auth_flows(domain);
+        CREATE INDEX IF NOT EXISTS idx_auth_flows_name ON auth_flows(name);
+      `
     }
   ];
   for (const m of migrations) {
@@ -3456,6 +3473,188 @@ var init_dialogs = __esm(() => {
   pendingDialogs = new Map;
 });
 
+// src/engines/cdp.ts
+var exports_cdp = {};
+__export(exports_cdp, {
+  connectToExistingBrowser: () => connectToExistingBrowser,
+  CDPClient: () => CDPClient
+});
+async function connectToExistingBrowser(cdpUrl) {
+  const { chromium: chromium3 } = await import("playwright");
+  try {
+    return await chromium3.connectOverCDP(cdpUrl);
+  } catch (err) {
+    throw new BrowserError(`Failed to connect to browser at ${cdpUrl}: ${err instanceof Error ? err.message : String(err)}. Start Chrome with: google-chrome --remote-debugging-port=9222`, "CDP_CONNECT_FAILED", true);
+  }
+}
+
+class CDPClient {
+  session;
+  networkEnabled = false;
+  performanceEnabled = false;
+  constructor(session) {
+    this.session = session;
+  }
+  static async fromPage(page) {
+    try {
+      const session = await page.context().newCDPSession(page);
+      return new CDPClient(session);
+    } catch (err) {
+      throw new BrowserError(`Failed to create CDP session: ${err instanceof Error ? err.message : String(err)}`, "CDP_SESSION_FAILED");
+    }
+  }
+  async send(method, params) {
+    try {
+      return await this.session.send(method, params);
+    } catch (err) {
+      throw new BrowserError(`CDP command '${method}' failed: ${err instanceof Error ? err.message : String(err)}`, "CDP_COMMAND_FAILED");
+    }
+  }
+  on(event, handler) {
+    this.session.on(event, handler);
+  }
+  off(event, handler) {
+    this.session.off(event, handler);
+  }
+  async enableNetwork() {
+    if (!this.networkEnabled) {
+      await this.send("Network.enable");
+      this.networkEnabled = true;
+    }
+  }
+  async enablePerformance() {
+    if (!this.performanceEnabled) {
+      await this.send("Performance.enable");
+      this.performanceEnabled = true;
+    }
+  }
+  async getPerformanceMetrics() {
+    await this.enablePerformance();
+    const result = await this.send("Performance.getMetrics");
+    const m = {};
+    for (const metric of result.metrics) {
+      m[metric.name] = metric.value;
+    }
+    return {
+      js_heap_size_used: m["JSHeapUsedSize"],
+      js_heap_size_total: m["JSHeapTotalSize"],
+      dom_interactive: m["DOMInteractive"],
+      dom_complete: m["DOMComplete"],
+      load_event: m["LoadEventEnd"]
+    };
+  }
+  async startJSCoverage() {
+    await this.send("Profiler.enable");
+    await this.send("Debugger.enable");
+    await this.send("Profiler.startPreciseCoverage", {
+      callCount: false,
+      detailed: true
+    });
+  }
+  async stopJSCoverage() {
+    const result = await this.send("Profiler.takePreciseCoverage");
+    await this.send("Profiler.stopPreciseCoverage");
+    return result.result.filter((r) => r.url && !r.url.startsWith("v8-snapshot://")).map((r) => ({
+      url: r.url,
+      text: "",
+      ranges: r.functions.flatMap((f) => f.ranges.filter((rng) => rng.count > 0).map((rng) => ({ start: rng.startOffset, end: rng.endOffset })))
+    }));
+  }
+  async getCoverage() {
+    await this.startJSCoverage();
+    const js = await this.stopJSCoverage();
+    const totalBytes = js.reduce((acc, e) => acc + e.ranges.reduce((sum, r) => sum + (r.end - r.start), 0), 0);
+    return { js, css: [], totalBytes, usedBytes: totalBytes, unusedPercent: 0 };
+  }
+  async captureHAREntries(page, handler) {
+    await this.enableNetwork();
+    const requestTimings = new Map;
+    const onRequest = (params) => {
+      requestTimings.set(params.requestId, params.timestamp);
+    };
+    const onResponse = (params) => {
+      const start = requestTimings.get(params.requestId);
+      const duration = start != null ? (params.timestamp - start) * 1000 : 0;
+      handler({
+        method: "GET",
+        url: params.response.url,
+        status: params.response.status,
+        duration
+      });
+    };
+    this.on("Network.requestWillBeSent", onRequest);
+    this.on("Network.responseReceived", onResponse);
+    return () => {
+      this.off("Network.requestWillBeSent", onRequest);
+      this.off("Network.responseReceived", onResponse);
+    };
+  }
+  async detach() {
+    try {
+      await this.session.detach();
+    } catch {}
+  }
+}
+var init_cdp = __esm(() => {
+  init_types();
+});
+
+// src/lib/storage-state.ts
+var exports_storage_state = {};
+__export(exports_storage_state, {
+  saveStateFromPage: () => saveStateFromPage,
+  saveState: () => saveState,
+  loadStatePath: () => loadStatePath,
+  listStates: () => listStates,
+  deleteState: () => deleteState
+});
+import { mkdirSync as mkdirSync3, existsSync, readdirSync, unlinkSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir3 } from "os";
+function ensureDir() {
+  mkdirSync3(STATES_DIR, { recursive: true });
+}
+function statePath(name) {
+  return join3(STATES_DIR, `${name}.json`);
+}
+async function saveState(context, name) {
+  ensureDir();
+  const path = statePath(name);
+  const state = await context.storageState({ path });
+  return path;
+}
+async function saveStateFromPage(page, name) {
+  return saveState(page.context(), name);
+}
+function loadStatePath(name) {
+  const path = statePath(name);
+  return existsSync(path) ? path : null;
+}
+function listStates() {
+  ensureDir();
+  return readdirSync(STATES_DIR).filter((f) => f.endsWith(".json")).map((f) => {
+    const path = join3(STATES_DIR, f);
+    const stat = Bun.file(path);
+    return {
+      name: f.replace(".json", ""),
+      path,
+      modified: new Date(stat.lastModified).toISOString()
+    };
+  }).sort((a, b) => b.modified.localeCompare(a.modified));
+}
+function deleteState(name) {
+  const path = statePath(name);
+  if (existsSync(path)) {
+    unlinkSync(path);
+    return true;
+  }
+  return false;
+}
+var STATES_DIR;
+var init_storage_state = __esm(() => {
+  STATES_DIR = join3(process.env["BROWSER_DATA_DIR"] ?? join3(homedir3(), ".browser"), "states");
+});
+
 // src/lib/session.ts
 var exports_session = {};
 __export(exports_session, {
@@ -3485,6 +3684,37 @@ function createBunProxy(view) {
   return view;
 }
 async function createSession2(opts = {}) {
+  if (opts.cdpUrl) {
+    const { connectToExistingBrowser: connectToExistingBrowser2 } = await Promise.resolve().then(() => (init_cdp(), exports_cdp));
+    const cdpBrowser = await connectToExistingBrowser2(opts.cdpUrl);
+    const contexts = cdpBrowser.contexts();
+    const context = contexts.length > 0 ? contexts[0] : await cdpBrowser.newContext();
+    const pages = context.pages();
+    const page2 = pages.length > 0 ? pages[0] : await context.newPage();
+    const session2 = createSession({
+      engine: "cdp",
+      projectId: opts.projectId,
+      agentId: opts.agentId,
+      startUrl: page2.url(),
+      name: opts.name ?? "attached"
+    });
+    const cleanups2 = [];
+    if (opts.captureNetwork !== false) {
+      try {
+        cleanups2.push(enableNetworkLogging(page2, session2.id));
+      } catch {}
+    }
+    if (opts.captureConsole !== false) {
+      try {
+        cleanups2.push(enableConsoleCapture(page2, session2.id));
+      } catch {}
+    }
+    try {
+      cleanups2.push(setupDialogHandler(page2, session2.id));
+    } catch {}
+    handles.set(session2.id, { browser: cdpBrowser, bunView: null, page: page2, engine: "cdp", cleanups: cleanups2, tokenBudget: { total: 0, used: 0 }, lastActivity: Date.now(), autoGallery: opts.autoGallery ?? false });
+    return { session: session2, page: page2 };
+  }
   const engine = opts.engine === "auto" || !opts.engine ? selectEngine(opts.useCase ?? "spa_navigate" /* SPA_NAVIGATE */, opts.engine) : opts.engine;
   const resolvedEngine = engine === "auto" ? "playwright" : engine;
   let browser = null;
@@ -3510,7 +3740,22 @@ async function createSession2(opts = {}) {
     page = await context.newPage();
   } else {
     browser = await pool.acquire(opts.headless ?? true);
-    page = await getPage(browser, { viewport: opts.viewport, userAgent: opts.userAgent });
+    if (opts.storageState) {
+      const { loadStatePath: loadStatePath2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+      const statePath2 = loadStatePath2(opts.storageState);
+      if (statePath2) {
+        const context = await browser.newContext({
+          viewport: opts.viewport ?? { width: 1280, height: 720 },
+          userAgent: opts.userAgent,
+          storageState: statePath2
+        });
+        page = await context.newPage();
+      } else {
+        page = await getPage(browser, { viewport: opts.viewport, userAgent: opts.userAgent });
+      }
+    } else {
+      page = await getPage(browser, { viewport: opts.viewport, userAgent: opts.userAgent });
+    }
   }
   const sessionName = opts.name ?? (opts.startUrl ? (() => {
     try {
@@ -4015,6 +4260,66 @@ var init_snapshot = __esm(() => {
   ];
 });
 
+// src/lib/self-heal.ts
+async function healSelector(page, selector, sessionId) {
+  const attempts = [];
+  attempts.push(`selector: ${selector}`);
+  try {
+    const loc = page.locator(selector).first();
+    if (await loc.count() > 0) {
+      return { found: true, locator: loc, method: "original", healed: false, attempts };
+    }
+  } catch {}
+  if (!selector.startsWith("#") && !selector.startsWith(".") && !selector.startsWith("[") && !selector.includes(">") && !selector.includes(" ")) {
+    attempts.push(`text: "${selector}"`);
+    try {
+      const loc = page.getByText(selector, { exact: false }).first();
+      if (await loc.count() > 0) {
+        return { found: true, locator: loc, method: "text", healed: true, attempts };
+      }
+    } catch {}
+  }
+  const roleMap = {
+    button: ["button", "submit", "reset"],
+    link: ["a"],
+    input: ["input", "textarea"],
+    heading: ["h1", "h2", "h3", "h4", "h5", "h6"]
+  };
+  const nameHint = selector.replace(/^[#.]/, "").replace(/[-_]/g, " ").toLowerCase();
+  for (const [role, tags] of Object.entries(roleMap)) {
+    attempts.push(`role: ${role} name~="${nameHint}"`);
+    try {
+      const loc = page.getByRole(role, { name: new RegExp(nameHint.split(" ")[0], "i") }).first();
+      if (await loc.count() > 0) {
+        return { found: true, locator: loc, method: "role", healed: true, attempts };
+      }
+    } catch {}
+  }
+  if (selector.startsWith("#")) {
+    const idPart = selector.slice(1).split("-").pop() ?? selector.slice(1);
+    const partialSel = `[id*="${idPart}"]`;
+    attempts.push(`partial_id: ${partialSel}`);
+    try {
+      const loc = page.locator(partialSel).first();
+      if (await loc.count() > 0) {
+        return { found: true, locator: loc, method: "partial_id", healed: true, attempts };
+      }
+    } catch {}
+  }
+  if (selector.startsWith(".")) {
+    const classPart = selector.slice(1).split("-").pop() ?? selector.slice(1);
+    const partialSel = `[class*="${classPart}"]`;
+    attempts.push(`partial_class: ${partialSel}`);
+    try {
+      const loc = page.locator(partialSel).first();
+      if (await loc.count() > 0) {
+        return { found: true, locator: loc, method: "partial_class", healed: true, attempts };
+      }
+    } catch {}
+  }
+  return { found: false, locator: null, method: "none", healed: false, attempts };
+}
+
 // src/lib/actions.ts
 var exports_actions = {};
 __export(exports_actions, {
@@ -4056,11 +4361,22 @@ async function click(page, selector, opts) {
       delay: opts?.delay,
       timeout: opts?.timeout ?? 1e4
     });
-  } catch (err) {
-    if (err instanceof Error && err.message.includes("not found")) {
+    return {};
+  } catch (originalError) {
+    if (opts?.selfHeal !== false) {
+      const result = await healSelector(page, selector);
+      if (result.found && result.locator) {
+        await result.locator.click({
+          button: opts?.button ?? "left",
+          timeout: opts?.timeout ?? 1e4
+        });
+        return { healed: true, method: result.method, attempts: result.attempts };
+      }
+    }
+    if (originalError instanceof Error && originalError.message.includes("not found")) {
       throw new ElementNotFoundError(selector);
     }
-    throw new BrowserError(`Click failed on '${selector}': ${err instanceof Error ? err.message : String(err)}`, "CLICK_FAILED");
+    throw new BrowserError(`Click failed on '${selector}': ${originalError instanceof Error ? originalError.message : String(originalError)}`, "CLICK_FAILED");
   }
 }
 async function type(page, selector, text, opts) {
@@ -4069,17 +4385,35 @@ async function type(page, selector, text, opts) {
       await page.fill(selector, "", { timeout: opts?.timeout ?? 1e4 });
     }
     await page.type(selector, text, { delay: opts?.delay, timeout: opts?.timeout ?? 1e4 });
-  } catch (err) {
-    if (err instanceof Error && err.message.includes("not found")) {
+    return {};
+  } catch (originalError) {
+    if (opts?.selfHeal !== false) {
+      const result = await healSelector(page, selector);
+      if (result.found && result.locator) {
+        if (opts?.clear)
+          await result.locator.fill("", { timeout: opts?.timeout ?? 1e4 });
+        await result.locator.pressSequentially(text, { delay: opts?.delay, timeout: opts?.timeout ?? 1e4 });
+        return { healed: true, method: result.method, attempts: result.attempts };
+      }
+    }
+    if (originalError instanceof Error && originalError.message.includes("not found")) {
       throw new ElementNotFoundError(selector);
     }
-    throw new BrowserError(`Type failed on '${selector}': ${err instanceof Error ? err.message : String(err)}`, "TYPE_FAILED");
+    throw new BrowserError(`Type failed on '${selector}': ${originalError instanceof Error ? originalError.message : String(originalError)}`, "TYPE_FAILED");
   }
 }
-async function fill(page, selector, value, timeout = 1e4) {
+async function fill(page, selector, value, timeout = 1e4, selfHeal = true) {
   try {
     await page.fill(selector, value, { timeout });
-  } catch (err) {
+    return {};
+  } catch (originalError) {
+    if (selfHeal) {
+      const result = await healSelector(page, selector);
+      if (result.found && result.locator) {
+        await result.locator.fill(value, { timeout });
+        return { healed: true, method: result.method, attempts: result.attempts };
+      }
+    }
     throw new ElementNotFoundError(selector);
   }
 }
@@ -4204,12 +4538,39 @@ async function clickText(page, text, opts) {
     }
   }, { retries: opts?.retries ?? 1 });
 }
-async function fillForm(page, fields, submitSelector) {
+async function fillForm(page, fields, submitSelector, selfHeal = true) {
   let filled = 0;
   const errors = [];
+  const healedFields = [];
   for (const [selector, value] of Object.entries(fields)) {
     try {
-      const el = await page.$(selector);
+      let el = await page.$(selector);
+      if (!el && selfHeal) {
+        const result = await healSelector(page, selector);
+        if (result.found && result.locator) {
+          const handle = await result.locator.elementHandle();
+          if (handle) {
+            el = handle;
+            healedFields.push(selector);
+            const tagName2 = await result.locator.evaluate((e) => e.tagName.toLowerCase());
+            const inputType2 = await result.locator.evaluate((e) => e.type?.toLowerCase() ?? "text");
+            if (tagName2 === "select") {
+              await result.locator.selectOption(String(value));
+            } else if (tagName2 === "input" && (inputType2 === "checkbox" || inputType2 === "radio")) {
+              if (Boolean(value))
+                await result.locator.check();
+              else
+                await result.locator.uncheck();
+            } else {
+              await result.locator.fill(String(value));
+            }
+            filled++;
+            continue;
+          }
+        }
+        errors.push(`${selector}: element not found`);
+        continue;
+      }
       if (!el) {
         errors.push(`${selector}: element not found`);
         continue;
@@ -4236,11 +4597,21 @@ async function fillForm(page, fields, submitSelector) {
   if (submitSelector) {
     try {
       await page.click(submitSelector);
-    } catch (err) {
-      errors.push(`submit(${submitSelector}): ${err instanceof Error ? err.message : String(err)}`);
+    } catch (submitErr) {
+      if (selfHeal) {
+        const result = await healSelector(page, submitSelector);
+        if (result.found && result.locator) {
+          await result.locator.click();
+          healedFields.push(submitSelector);
+        } else {
+          errors.push(`submit(${submitSelector}): ${submitErr instanceof Error ? submitErr.message : String(submitErr)}`);
+        }
+      } else {
+        errors.push(`submit(${submitSelector}): ${submitErr instanceof Error ? submitErr.message : String(submitErr)}`);
+      }
     }
   }
-  return { filled, errors, fields_attempted: Object.keys(fields).length };
+  return { filled, errors, fields_attempted: Object.keys(fields).length, ...healedFields.length > 0 ? { healed_fields: healedFields } : {} };
 }
 async function waitForText(page, text, opts) {
   const timeout = opts?.timeout ?? 1e4;
@@ -11096,17 +11467,17 @@ var init_gallery = __esm(() => {
 });
 
 // src/lib/screenshot.ts
-import { join as join3 } from "path";
-import { mkdirSync as mkdirSync3 } from "fs";
-import { homedir as homedir3 } from "os";
+import { join as join4 } from "path";
+import { mkdirSync as mkdirSync4 } from "fs";
+import { homedir as homedir4 } from "os";
 function getDataDir2() {
-  return process.env["BROWSER_DATA_DIR"] ?? join3(homedir3(), ".browser");
+  return process.env["BROWSER_DATA_DIR"] ?? join4(homedir4(), ".browser");
 }
 function getScreenshotDir(projectId) {
-  const base = join3(getDataDir2(), "screenshots");
+  const base = join4(getDataDir2(), "screenshots");
   const date = new Date().toISOString().split("T")[0];
-  const dir = projectId ? join3(base, projectId, date) : join3(base, date);
-  mkdirSync3(dir, { recursive: true });
+  const dir = projectId ? join4(base, projectId, date) : join4(base, date);
+  mkdirSync4(dir, { recursive: true });
   return dir;
 }
 async function compressBuffer(raw, format, quality, maxWidth) {
@@ -11121,7 +11492,7 @@ async function compressBuffer(raw, format, quality, maxWidth) {
   }
 }
 async function generateThumbnail(raw, dir, stem) {
-  const thumbPath = join3(dir, `${stem}.thumb.webp`);
+  const thumbPath = join4(dir, `${stem}.thumb.webp`);
   const thumbBuffer = await import_sharp.default(raw).resize({ width: 200, withoutEnlargement: true }).webp({ quality: 70, effort: 3 }).toBuffer();
   await Bun.write(thumbPath, thumbBuffer);
   return { path: thumbPath, base64: thumbBuffer.toString("base64") };
@@ -11178,7 +11549,7 @@ async function takeScreenshot(page, opts) {
     const compressedSizeBytes = finalBuffer.length;
     const compressionRatio = originalSizeBytes > 0 ? compressedSizeBytes / originalSizeBytes : 1;
     const ext = format;
-    const screenshotPath = opts?.path ?? join3(dir, `${stem}.${ext}`);
+    const screenshotPath = opts?.path ?? join4(dir, `${stem}.${ext}`);
     await Bun.write(screenshotPath, finalBuffer);
     let thumbnailPath;
     let thumbnailBase64;
@@ -11238,12 +11609,12 @@ async function takeScreenshot(page, opts) {
 }
 async function generatePDF(page, opts) {
   try {
-    const base = join3(getDataDir2(), "pdfs");
+    const base = join4(getDataDir2(), "pdfs");
     const date = new Date().toISOString().split("T")[0];
-    const dir = opts?.projectId ? join3(base, opts.projectId, date) : join3(base, date);
-    mkdirSync3(dir, { recursive: true });
+    const dir = opts?.projectId ? join4(base, opts.projectId, date) : join4(base, date);
+    mkdirSync4(dir, { recursive: true });
     const timestamp = Date.now();
-    const pdfPath = opts?.path ?? join3(dir, `${timestamp}.pdf`);
+    const pdfPath = opts?.path ?? join4(dir, `${timestamp}.pdf`);
     const buffer = await page.pdf({
       path: pdfPath,
       format: opts?.format ?? "A4",
@@ -11570,6 +11941,17 @@ var init_recordings = __esm(() => {
 });
 
 // src/lib/recorder.ts
+var exports_recorder = {};
+__export(exports_recorder, {
+  stopRecording: () => stopRecording,
+  startRecording: () => startRecording,
+  replayRecording: () => replayRecording,
+  recordStep: () => recordStep,
+  listRecordings: () => listRecordings,
+  getRecording: () => getRecording,
+  exportRecording: () => exportRecording,
+  attachPageListeners: () => attachPageListeners
+});
 function startRecording(sessionId, name, startUrl) {
   const steps = [];
   const recording = createRecording({ name, start_url: startUrl, steps });
@@ -11580,6 +11962,23 @@ function startRecording(sessionId, name, startUrl) {
   });
   return recording;
 }
+function attachPageListeners(page, recordingId) {
+  const active = activeRecordings.get(recordingId);
+  if (!active)
+    throw new BrowserError(`No active recording: ${recordingId}`, "RECORDING_NOT_ACTIVE");
+  const onFrameNav = () => {
+    active.steps.push({
+      type: "navigate",
+      url: page.url(),
+      timestamp: Date.now()
+    });
+  };
+  page.on("framenavigated", onFrameNav);
+  const cleanup = () => {
+    page.off("framenavigated", onFrameNav);
+  };
+  active.cleanup = cleanup;
+}
 function recordStep(recordingId, step) {
   const active = activeRecordings.get(recordingId);
   if (!active)
@@ -11651,6 +12050,64 @@ async function replayRecording(recordingId, page) {
     duration_ms: Date.now() - startTime
   };
 }
+function exportRecording(recordingId, format = "json") {
+  const recording = getRecording(recordingId);
+  if (format === "json") {
+    return JSON.stringify(recording, null, 2);
+  }
+  if (format === "playwright") {
+    const lines2 = [
+      `import { test, expect } from '@playwright/test';`,
+      ``,
+      `test('${recording.name}', async ({ page }) => {`
+    ];
+    for (const step of recording.steps) {
+      switch (step.type) {
+        case "navigate":
+          lines2.push(`  await page.goto('${step.url}');`);
+          break;
+        case "click":
+          lines2.push(`  await page.click('${step.selector}');`);
+          break;
+        case "type":
+          lines2.push(`  await page.type('${step.selector}', '${step.value}');`);
+          break;
+        case "scroll":
+          lines2.push(`  await page.evaluate(() => window.scrollBy(0, 300));`);
+          break;
+        case "evaluate":
+          lines2.push(`  await page.evaluate(${step.value});`);
+          break;
+      }
+    }
+    lines2.push(`});`);
+    return lines2.join(`
+`);
+  }
+  const lines = [
+    `const puppeteer = require('puppeteer');`,
+    ``,
+    `(async () => {`,
+    `  const browser = await puppeteer.launch();`,
+    `  const page = await browser.newPage();`
+  ];
+  for (const step of recording.steps) {
+    switch (step.type) {
+      case "navigate":
+        lines.push(`  await page.goto('${step.url}');`);
+        break;
+      case "click":
+        lines.push(`  await page.click('${step.selector}');`);
+        break;
+      case "type":
+        lines.push(`  await page.type('${step.selector}', '${step.value}');`);
+        break;
+    }
+  }
+  lines.push(`  await browser.close();`, `})();`);
+  return lines.join(`
+`);
+}
 var activeRecordings;
 var init_recorder = __esm(() => {
   init_recordings();
@@ -15625,118 +16082,6 @@ var init_zod = __esm(() => {
   init_external();
 });
 
-// src/engines/cdp.ts
-class CDPClient {
-  session;
-  networkEnabled = false;
-  performanceEnabled = false;
-  constructor(session) {
-    this.session = session;
-  }
-  static async fromPage(page) {
-    try {
-      const session = await page.context().newCDPSession(page);
-      return new CDPClient(session);
-    } catch (err) {
-      throw new BrowserError(`Failed to create CDP session: ${err instanceof Error ? err.message : String(err)}`, "CDP_SESSION_FAILED");
-    }
-  }
-  async send(method, params) {
-    try {
-      return await this.session.send(method, params);
-    } catch (err) {
-      throw new BrowserError(`CDP command '${method}' failed: ${err instanceof Error ? err.message : String(err)}`, "CDP_COMMAND_FAILED");
-    }
-  }
-  on(event, handler) {
-    this.session.on(event, handler);
-  }
-  off(event, handler) {
-    this.session.off(event, handler);
-  }
-  async enableNetwork() {
-    if (!this.networkEnabled) {
-      await this.send("Network.enable");
-      this.networkEnabled = true;
-    }
-  }
-  async enablePerformance() {
-    if (!this.performanceEnabled) {
-      await this.send("Performance.enable");
-      this.performanceEnabled = true;
-    }
-  }
-  async getPerformanceMetrics() {
-    await this.enablePerformance();
-    const result = await this.send("Performance.getMetrics");
-    const m = {};
-    for (const metric of result.metrics) {
-      m[metric.name] = metric.value;
-    }
-    return {
-      js_heap_size_used: m["JSHeapUsedSize"],
-      js_heap_size_total: m["JSHeapTotalSize"],
-      dom_interactive: m["DOMInteractive"],
-      dom_complete: m["DOMComplete"],
-      load_event: m["LoadEventEnd"]
-    };
-  }
-  async startJSCoverage() {
-    await this.send("Profiler.enable");
-    await this.send("Debugger.enable");
-    await this.send("Profiler.startPreciseCoverage", {
-      callCount: false,
-      detailed: true
-    });
-  }
-  async stopJSCoverage() {
-    const result = await this.send("Profiler.takePreciseCoverage");
-    await this.send("Profiler.stopPreciseCoverage");
-    return result.result.filter((r) => r.url && !r.url.startsWith("v8-snapshot://")).map((r) => ({
-      url: r.url,
-      text: "",
-      ranges: r.functions.flatMap((f) => f.ranges.filter((rng) => rng.count > 0).map((rng) => ({ start: rng.startOffset, end: rng.endOffset })))
-    }));
-  }
-  async getCoverage() {
-    await this.startJSCoverage();
-    const js = await this.stopJSCoverage();
-    const totalBytes = js.reduce((acc, e) => acc + e.ranges.reduce((sum, r) => sum + (r.end - r.start), 0), 0);
-    return { js, css: [], totalBytes, usedBytes: totalBytes, unusedPercent: 0 };
-  }
-  async captureHAREntries(page, handler) {
-    await this.enableNetwork();
-    const requestTimings = new Map;
-    const onRequest = (params) => {
-      requestTimings.set(params.requestId, params.timestamp);
-    };
-    const onResponse = (params) => {
-      const start = requestTimings.get(params.requestId);
-      const duration = start != null ? (params.timestamp - start) * 1000 : 0;
-      handler({
-        method: "GET",
-        url: params.response.url,
-        status: params.response.status,
-        duration
-      });
-    };
-    this.on("Network.requestWillBeSent", onRequest);
-    this.on("Network.responseReceived", onResponse);
-    return () => {
-      this.off("Network.requestWillBeSent", onRequest);
-      this.off("Network.responseReceived", onResponse);
-    };
-  }
-  async detach() {
-    try {
-      await this.session.detach();
-    } catch {}
-  }
-}
-var init_cdp = __esm(() => {
-  init_types();
-});
-
 // src/lib/performance.ts
 async function getPerformanceMetrics(page) {
   const navTiming = await page.evaluate(() => {
@@ -15842,16 +16187,16 @@ __export(exports_downloads, {
   cleanStaleDownloads: () => cleanStaleDownloads
 });
 import { randomUUID as randomUUID9 } from "crypto";
-import { join as join4, basename, extname } from "path";
-import { mkdirSync as mkdirSync4, existsSync, readdirSync, statSync, unlinkSync, copyFileSync, writeFileSync, readFileSync } from "fs";
-import { homedir as homedir4 } from "os";
+import { join as join5, basename, extname } from "path";
+import { mkdirSync as mkdirSync5, existsSync as existsSync2, readdirSync as readdirSync2, statSync, unlinkSync as unlinkSync2, copyFileSync, writeFileSync, readFileSync } from "fs";
+import { homedir as homedir5 } from "os";
 function getDataDir3() {
-  return process.env["BROWSER_DATA_DIR"] ?? join4(homedir4(), ".browser");
+  return process.env["BROWSER_DATA_DIR"] ?? join5(homedir5(), ".browser");
 }
 function getDownloadsDir(sessionId) {
-  const base = join4(getDataDir3(), "downloads");
-  const dir = sessionId ? join4(base, sessionId) : base;
-  mkdirSync4(dir, { recursive: true });
+  const base = join5(getDataDir3(), "downloads");
+  const dir = sessionId ? join5(base, sessionId) : base;
+  mkdirSync5(dir, { recursive: true });
   return dir;
 }
 function ensureDownloadsDir() {
@@ -15866,7 +16211,7 @@ function saveToDownloads(buffer, filename, opts) {
   const ext = extname(filename) || "";
   const stem = basename(filename, ext);
   const uniqueName = `${stem}-${id.slice(0, 8)}${ext}`;
-  const filePath = join4(dir, uniqueName);
+  const filePath = join5(dir, uniqueName);
   writeFileSync(filePath, buffer);
   const meta = {
     id,
@@ -15895,20 +16240,20 @@ function listDownloads(sessionId) {
   const dir = getDownloadsDir(sessionId);
   const results = [];
   function scanDir(d) {
-    if (!existsSync(d))
+    if (!existsSync2(d))
       return;
-    const entries = readdirSync(d);
+    const entries = readdirSync2(d);
     for (const entry of entries) {
       if (entry.endsWith(".meta.json"))
         continue;
-      const full = join4(d, entry);
+      const full = join5(d, entry);
       const stat = statSync(full);
       if (stat.isDirectory()) {
         scanDir(full);
         continue;
       }
       const mpath = metaPath(full);
-      if (!existsSync(mpath))
+      if (!existsSync2(mpath))
         continue;
       try {
         const meta = JSON.parse(readFileSync(mpath, "utf8"));
@@ -15938,9 +16283,9 @@ function deleteDownload(id, sessionId) {
   if (!file)
     return false;
   try {
-    unlinkSync(file.path);
-    if (existsSync(file.meta_path))
-      unlinkSync(file.meta_path);
+    unlinkSync2(file.path);
+    if (existsSync2(file.meta_path))
+      unlinkSync2(file.meta_path);
     return true;
   } catch {
     return false;
@@ -15990,9 +16335,9 @@ var exports_gallery_diff = {};
 __export(exports_gallery_diff, {
   diffImages: () => diffImages
 });
-import { join as join5 } from "path";
-import { mkdirSync as mkdirSync5 } from "fs";
-import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
+import { mkdirSync as mkdirSync6 } from "fs";
+import { homedir as homedir6 } from "os";
 async function diffImages(path1, path2) {
   const img1 = import_sharp2.default(path1);
   const img2 = import_sharp2.default(path2);
@@ -16023,10 +16368,10 @@ async function diffImages(path1, path2) {
       diffBuffer[i + 2] = Math.round(raw1[i + 2] * 0.4);
     }
   }
-  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join5(homedir5(), ".browser");
-  const diffDir = join5(dataDir, "diffs");
-  mkdirSync5(diffDir, { recursive: true });
-  const diffPath = join5(diffDir, `diff-${Date.now()}.webp`);
+  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join6(homedir6(), ".browser");
+  const diffDir = join6(dataDir, "diffs");
+  mkdirSync6(diffDir, { recursive: true });
+  const diffPath = join6(diffDir, `diff-${Date.now()}.webp`);
   const diffImageBuffer = await import_sharp2.default(diffBuffer, { raw: { width: w, height: h, channels } }).webp({ quality: 85 }).toBuffer();
   await Bun.write(diffPath, diffImageBuffer);
   return {
@@ -16043,9 +16388,9 @@ var init_gallery_diff = __esm(() => {
 });
 
 // src/lib/files-integration.ts
-import { join as join6 } from "path";
-import { mkdirSync as mkdirSync6, copyFileSync as copyFileSync2 } from "fs";
-import { homedir as homedir6 } from "os";
+import { join as join7 } from "path";
+import { mkdirSync as mkdirSync7, copyFileSync as copyFileSync2 } from "fs";
+import { homedir as homedir7 } from "os";
 async function persistFile(localPath, opts) {
   try {
     const mod = await import("@hasna/files");
@@ -16054,12 +16399,12 @@ async function persistFile(localPath, opts) {
       return { id: ref.id, path: ref.path ?? localPath, permanent: true, provider: "open-files" };
     }
   } catch {}
-  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join6(homedir6(), ".browser");
+  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join7(homedir7(), ".browser");
   const date = new Date().toISOString().split("T")[0];
-  const dir = join6(dataDir, "persistent", date);
-  mkdirSync6(dir, { recursive: true });
+  const dir = join7(dataDir, "persistent", date);
+  mkdirSync7(dir, { recursive: true });
   const filename = localPath.split("/").pop() ?? "file";
-  const targetPath = join6(dir, filename);
+  const targetPath = join7(dir, filename);
   copyFileSync2(localPath, targetPath);
   return {
     id: `local-${Date.now()}`,
@@ -16174,23 +16519,23 @@ __export(exports_profiles, {
   deleteProfile: () => deleteProfile,
   applyProfile: () => applyProfile
 });
-import { mkdirSync as mkdirSync7, existsSync as existsSync3, readdirSync as readdirSync2, rmSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join7 } from "path";
-import { homedir as homedir7 } from "os";
+import { mkdirSync as mkdirSync8, existsSync as existsSync4, readdirSync as readdirSync3, rmSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join8 } from "path";
+import { homedir as homedir8 } from "os";
 function getProfilesDir() {
-  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join7(homedir7(), ".browser");
-  const dir = join7(dataDir, "profiles");
-  mkdirSync7(dir, { recursive: true });
+  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join8(homedir8(), ".browser");
+  const dir = join8(dataDir, "profiles");
+  mkdirSync8(dir, { recursive: true });
   return dir;
 }
 function getProfileDir2(name) {
-  return join7(getProfilesDir(), name);
+  return join8(getProfilesDir(), name);
 }
 async function saveProfile(page, name) {
   const dir = getProfileDir2(name);
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync8(dir, { recursive: true });
   const cookies = await page.context().cookies();
-  writeFileSync2(join7(dir, "cookies.json"), JSON.stringify(cookies, null, 2));
+  writeFileSync2(join8(dir, "cookies.json"), JSON.stringify(cookies, null, 2));
   let localStorage2 = {};
   try {
     localStorage2 = await page.evaluate(() => {
@@ -16202,11 +16547,11 @@ async function saveProfile(page, name) {
       return result;
     });
   } catch {}
-  writeFileSync2(join7(dir, "storage.json"), JSON.stringify(localStorage2, null, 2));
+  writeFileSync2(join8(dir, "storage.json"), JSON.stringify(localStorage2, null, 2));
   const savedAt = new Date().toISOString();
   const url = page.url();
   const meta = { saved_at: savedAt, url };
-  writeFileSync2(join7(dir, "meta.json"), JSON.stringify(meta, null, 2));
+  writeFileSync2(join8(dir, "meta.json"), JSON.stringify(meta, null, 2));
   return {
     name,
     saved_at: savedAt,
@@ -16217,17 +16562,17 @@ async function saveProfile(page, name) {
 }
 function loadProfile(name) {
   const dir = getProfileDir2(name);
-  if (!existsSync3(dir)) {
+  if (!existsSync4(dir)) {
     throw new Error(`Profile not found: ${name}`);
   }
-  const cookiesPath = join7(dir, "cookies.json");
-  const storagePath = join7(dir, "storage.json");
-  const metaPath2 = join7(dir, "meta.json");
-  const cookies = existsSync3(cookiesPath) ? JSON.parse(readFileSync2(cookiesPath, "utf8")) : [];
-  const localStorage2 = existsSync3(storagePath) ? JSON.parse(readFileSync2(storagePath, "utf8")) : {};
+  const cookiesPath = join8(dir, "cookies.json");
+  const storagePath = join8(dir, "storage.json");
+  const metaPath2 = join8(dir, "meta.json");
+  const cookies = existsSync4(cookiesPath) ? JSON.parse(readFileSync2(cookiesPath, "utf8")) : [];
+  const localStorage2 = existsSync4(storagePath) ? JSON.parse(readFileSync2(storagePath, "utf8")) : {};
   let savedAt = new Date().toISOString();
   let url;
-  if (existsSync3(metaPath2)) {
+  if (existsSync4(metaPath2)) {
     const meta = JSON.parse(readFileSync2(metaPath2, "utf8"));
     savedAt = meta.saved_at ?? savedAt;
     url = meta.url;
@@ -16255,33 +16600,33 @@ async function applyProfile(page, profileData) {
 }
 function listProfiles() {
   const dir = getProfilesDir();
-  if (!existsSync3(dir))
+  if (!existsSync4(dir))
     return [];
-  const entries = readdirSync2(dir, { withFileTypes: true });
+  const entries = readdirSync3(dir, { withFileTypes: true });
   const profiles = [];
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
     const name = entry.name;
-    const profileDir = join7(dir, name);
+    const profileDir = join8(dir, name);
     let savedAt = "";
     let url;
     let cookieCount = 0;
     let storageKeyCount = 0;
     try {
-      const metaPath2 = join7(profileDir, "meta.json");
-      if (existsSync3(metaPath2)) {
+      const metaPath2 = join8(profileDir, "meta.json");
+      if (existsSync4(metaPath2)) {
         const meta = JSON.parse(readFileSync2(metaPath2, "utf8"));
         savedAt = meta.saved_at ?? "";
         url = meta.url;
       }
-      const cookiesPath = join7(profileDir, "cookies.json");
-      if (existsSync3(cookiesPath)) {
+      const cookiesPath = join8(profileDir, "cookies.json");
+      if (existsSync4(cookiesPath)) {
         const cookies = JSON.parse(readFileSync2(cookiesPath, "utf8"));
         cookieCount = Array.isArray(cookies) ? cookies.length : 0;
       }
-      const storagePath = join7(profileDir, "storage.json");
-      if (existsSync3(storagePath)) {
+      const storagePath = join8(profileDir, "storage.json");
+      if (existsSync4(storagePath)) {
         const storage = JSON.parse(readFileSync2(storagePath, "utf8"));
         storageKeyCount = Object.keys(storage).length;
       }
@@ -16298,7 +16643,7 @@ function listProfiles() {
 }
 function deleteProfile(name) {
   const dir = getProfileDir2(name);
-  if (!existsSync3(dir))
+  if (!existsSync4(dir))
     return false;
   try {
     rmSync(dir, { recursive: true, force: true });
@@ -16309,6 +16654,97 @@ function deleteProfile(name) {
 }
 var init_profiles = () => {};
 
+// src/lib/sanitize.ts
+var exports_sanitize = {};
+__export(exports_sanitize, {
+  sanitizeText: () => sanitizeText,
+  sanitizeHTML: () => sanitizeHTML
+});
+function sanitizeText(text) {
+  let stripped = 0;
+  const warnings = [];
+  let clean = text;
+  for (const pattern of INJECTION_PATTERNS) {
+    pattern.lastIndex = 0;
+    const matches = clean.match(pattern);
+    if (matches) {
+      stripped += matches.length;
+      warnings.push(`Stripped ${matches.length}x: ${pattern.source}`);
+      pattern.lastIndex = 0;
+      clean = clean.replace(pattern, "[STRIPPED]");
+    }
+  }
+  return { text: clean, stripped, warnings };
+}
+function sanitizeHTML(html) {
+  let stripped = 0;
+  const warnings = [];
+  let clean = html;
+  const commentMatches = clean.match(/<!--[\s\S]*?-->/g);
+  if (commentMatches) {
+    for (const comment of commentMatches) {
+      if (comment.replace(/<!--\s*-->/g, "").trim().length > 20) {
+        stripped++;
+        warnings.push(`Stripped HTML comment (${comment.length} chars)`);
+      }
+    }
+    clean = clean.replace(/<!--[\s\S]*?-->/g, "");
+  }
+  const hiddenPatterns = [
+    /style\s*=\s*"[^"]*display\s*:\s*none[^"]*"[^>]*>[\s\S]*?<\//gi,
+    /style\s*=\s*"[^"]*visibility\s*:\s*hidden[^"]*"[^>]*>[\s\S]*?<\//gi,
+    /style\s*=\s*"[^"]*opacity\s*:\s*0[^"]*"[^>]*>[\s\S]*?<\//gi,
+    /style\s*=\s*"[^"]*font-size\s*:\s*0[^"]*"[^>]*>[\s\S]*?<\//gi,
+    /style\s*=\s*"[^"]*position\s*:\s*absolute[^"]*left\s*:\s*-\d{4,}[^"]*"[^>]*>[\s\S]*?<\//gi
+  ];
+  for (const pattern of hiddenPatterns) {
+    pattern.lastIndex = 0;
+    const matches = clean.match(pattern);
+    if (matches) {
+      stripped += matches.length;
+      warnings.push(`Stripped ${matches.length} hidden elements`);
+      pattern.lastIndex = 0;
+      clean = clean.replace(pattern, "");
+    }
+  }
+  const ariaHiddenPattern = /aria-hidden\s*=\s*"true"[^>]*>[\s\S]*?<\//gi;
+  const ariaHidden = clean.match(ariaHiddenPattern);
+  if (ariaHidden) {
+    stripped += ariaHidden.length;
+    warnings.push(`Stripped ${ariaHidden.length} aria-hidden elements`);
+    ariaHiddenPattern.lastIndex = 0;
+    clean = clean.replace(ariaHiddenPattern, "");
+  }
+  const textResult = sanitizeText(clean);
+  return {
+    text: textResult.text,
+    stripped: stripped + textResult.stripped,
+    warnings: [...warnings, ...textResult.warnings]
+  };
+}
+var INJECTION_PATTERNS;
+var init_sanitize = __esm(() => {
+  INJECTION_PATTERNS = [
+    /ignore\s+(all\s+)?previous\s+instructions/gi,
+    /ignore\s+(all\s+)?prior\s+instructions/gi,
+    /disregard\s+(all\s+)?previous/gi,
+    /forget\s+(all\s+)?previous/gi,
+    /you\s+are\s+now\s+/gi,
+    /new\s+instructions?\s*:/gi,
+    /system\s+prompt\s*:/gi,
+    /\[INST\]/gi,
+    /\[\/INST\]/gi,
+    /<\|im_start\|>/gi,
+    /<\|im_end\|>/gi,
+    /<<SYS>>/gi,
+    /<<\/SYS>>/gi,
+    /IMPORTANT:\s*ignore/gi,
+    /CRITICAL:\s*override/gi,
+    /assistant:\s/gi,
+    /human:\s/gi
+  ];
+});
+
 // src/lib/annotate.ts
 var exports_annotate = {};
 __export(exports_annotate, {
@@ -16369,26 +16805,213 @@ var init_annotate = __esm(() => {
   import_sharp3 = __toESM(require_lib(), 1);
 });
 
+// src/lib/auth-flow.ts
+var exports_auth_flow = {};
+__export(exports_auth_flow, {
+  tryReplayAuth: () => tryReplayAuth,
+  touchAuthFlow: () => touchAuthFlow,
+  saveAuthFlow: () => saveAuthFlow,
+  listAuthFlows: () => listAuthFlows,
+  isAuthRedirect: () => isAuthRedirect,
+  isAuthPage: () => isAuthPage,
+  getAuthFlowByName: () => getAuthFlowByName,
+  getAuthFlowByDomain: () => getAuthFlowByDomain,
+  getAuthFlow: () => getAuthFlow,
+  deleteAuthFlow: () => deleteAuthFlow
+});
+import { randomUUID as randomUUID10 } from "crypto";
+function saveAuthFlow(data) {
+  const db = getDatabase();
+  const id = randomUUID10();
+  db.prepare("INSERT OR REPLACE INTO auth_flows (id, name, domain, recording_id, storage_state_path) VALUES (?, ?, ?, ?, ?)").run(id, data.name, data.domain, data.recordingId ?? null, data.storageStatePath ?? null);
+  return getAuthFlow(id);
+}
+function getAuthFlow(id) {
+  const db = getDatabase();
+  return db.query("SELECT * FROM auth_flows WHERE id = ?").get(id) ?? null;
+}
+function getAuthFlowByName(name) {
+  const db = getDatabase();
+  return db.query("SELECT * FROM auth_flows WHERE name = ?").get(name) ?? null;
+}
+function getAuthFlowByDomain(domain) {
+  const db = getDatabase();
+  return db.query("SELECT * FROM auth_flows WHERE domain = ? ORDER BY last_used DESC LIMIT 1").get(domain) ?? null;
+}
+function listAuthFlows() {
+  const db = getDatabase();
+  return db.query("SELECT * FROM auth_flows ORDER BY last_used DESC, created_at DESC").all();
+}
+function deleteAuthFlow(name) {
+  const db = getDatabase();
+  const result = db.prepare("DELETE FROM auth_flows WHERE name = ?").run(name);
+  return result.changes > 0;
+}
+function touchAuthFlow(id) {
+  const db = getDatabase();
+  db.prepare("UPDATE auth_flows SET last_used = datetime('now') WHERE id = ?").run(id);
+}
+function isAuthPage(url) {
+  return AUTH_URL_PATTERNS.some((pattern) => pattern.test(url));
+}
+function isAuthRedirect(fromUrl, toUrl) {
+  if (fromUrl === toUrl)
+    return false;
+  return isAuthPage(toUrl) && !isAuthPage(fromUrl);
+}
+async function tryReplayAuth(page, domain) {
+  const flow = getAuthFlowByDomain(domain);
+  if (!flow)
+    return { replayed: false };
+  if (flow.storage_state_path) {
+    try {
+      const { existsSync: existsSync5, readFileSync: readFileSync3 } = await import("fs");
+      if (existsSync5(flow.storage_state_path)) {
+        const state = JSON.parse(readFileSync3(flow.storage_state_path, "utf8"));
+        if (state.cookies?.length) {
+          await page.context().addCookies(state.cookies);
+          await page.reload();
+          await new Promise((r) => setTimeout(r, 1000));
+          if (!isAuthPage(page.url())) {
+            touchAuthFlow(flow.id);
+            return { replayed: true, flow, method: "storage_state" };
+          }
+        }
+      }
+    } catch {}
+  }
+  if (flow.recording_id) {
+    try {
+      const { replayRecording: replayRecording2 } = await Promise.resolve().then(() => (init_recorder(), exports_recorder));
+      const result = await replayRecording2(flow.recording_id, page);
+      if (result.success) {
+        try {
+          const { saveStateFromPage: saveStateFromPage2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+          const path = await saveStateFromPage2(page, flow.name);
+          const db = getDatabase();
+          db.prepare("UPDATE auth_flows SET storage_state_path = ?, last_used = datetime('now') WHERE id = ?").run(path, flow.id);
+        } catch {}
+        touchAuthFlow(flow.id);
+        return { replayed: true, flow, method: "recording_replay" };
+      }
+    } catch {}
+  }
+  return { replayed: false, flow };
+}
+var AUTH_URL_PATTERNS;
+var init_auth_flow = __esm(() => {
+  init_schema();
+  AUTH_URL_PATTERNS = [
+    /\/login/i,
+    /\/signin/i,
+    /\/sign-in/i,
+    /\/auth/i,
+    /\/sso/i,
+    /\/oauth/i,
+    /\/cas\/login/i,
+    /accounts\.google\.com/i,
+    /login\.microsoftonline\.com/i,
+    /github\.com\/login/i,
+    /auth0\.com/i
+  ];
+});
+
+// src/lib/vision-fallback.ts
+var exports_vision_fallback = {};
+__export(exports_vision_fallback, {
+  findElementByVision: () => findElementByVision,
+  clickByVision: () => clickByVision
+});
+async function findElementByVision(page, description, opts) {
+  const model = opts?.model ?? process.env["BROWSER_VISION_MODEL"] ?? DEFAULT_MODEL;
+  const screenshot = await page.screenshot({ type: "jpeg", quality: 80 });
+  const base64 = screenshot.toString("base64");
+  const viewport = page.viewportSize() ?? { width: 1280, height: 720 };
+  const apiKey = process.env["ANTHROPIC_API_KEY"];
+  if (!apiKey) {
+    return { found: false, x: 0, y: 0, confidence: "none", description, model, error: "ANTHROPIC_API_KEY not set" };
+  }
+  try {
+    const response = await fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-api-key": apiKey,
+        "anthropic-version": "2023-06-01"
+      },
+      body: JSON.stringify({
+        model,
+        max_tokens: 256,
+        messages: [{
+          role: "user",
+          content: [
+            {
+              type: "image",
+              source: { type: "base64", media_type: "image/jpeg", data: base64 }
+            },
+            {
+              type: "text",
+              text: `Find the element matching this description: "${description}"
+
+The screenshot is ${viewport.width}x${viewport.height} pixels.
+
+Reply with ONLY a JSON object (no markdown, no explanation):
+{"found": true, "x": <pixel_x>, "y": <pixel_y>, "confidence": "high|medium|low", "description": "<what you found>"}
+
+If you cannot find the element:
+{"found": false, "x": 0, "y": 0, "confidence": "none", "description": "not found"}`
+            }
+          ]
+        }]
+      })
+    });
+    const data = await response.json();
+    const text = data.content?.[0]?.text ?? "";
+    const jsonStr = text.replace(/```json?\n?/g, "").replace(/```/g, "").trim();
+    const result = JSON.parse(jsonStr);
+    result.model = model;
+    return result;
+  } catch (err) {
+    return {
+      found: false,
+      x: 0,
+      y: 0,
+      confidence: "none",
+      description,
+      model,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function clickByVision(page, description, opts) {
+  const result = await findElementByVision(page, description, opts);
+  if (result.found && result.x > 0 && result.y > 0) {
+    await page.mouse.click(result.x, result.y);
+  }
+  return result;
+}
+var DEFAULT_MODEL = "claude-sonnet-4-5-20250929";
+
 // src/lib/auth.ts
 var exports_auth = {};
 __export(exports_auth, {
   loginWithCredentials: () => loginWithCredentials,
   getCredentials: () => getCredentials
 });
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { join as join8 } from "path";
-import { homedir as homedir8 } from "os";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { join as join9 } from "path";
+import { homedir as homedir9 } from "os";
 async function getCredentials(service) {
   try {
-    const { getSecret } = await import(`${homedir8()}/Workspace/hasna/opensource/opensourcedev/open-secrets/src/store.js`);
+    const { getSecret } = await import(`${homedir9()}/Workspace/hasna/opensource/opensourcedev/open-secrets/src/store.js`);
     const email = getSecret(`${service}_email`) ?? getSecret(`${service}_username`) ?? getSecret(`${service}_login`);
     const password = getSecret(`${service}_password`) ?? getSecret(`${service}_pass`);
     if (email?.value && password?.value) {
       return { email: email.value, password: password.value };
     }
   } catch {}
-  const secretsPath = join8(homedir8(), ".secrets");
-  if (existsSync4(secretsPath)) {
+  const secretsPath = join9(homedir9(), ".secrets");
+  if (existsSync5(secretsPath)) {
     const content = readFileSync3(secretsPath, "utf8");
     const lines = content.split(`
 `);
@@ -16565,14 +17188,14 @@ __export(exports_dist, {
   InvalidScopeError: () => InvalidScopeError,
   EntityNotFoundError: () => EntityNotFoundError,
   DuplicateMemoryError: () => DuplicateMemoryError,
-  DEFAULT_MODEL: () => DEFAULT_MODEL,
+  DEFAULT_MODEL: () => DEFAULT_MODEL2,
   DEFAULT_CONFIG: () => DEFAULT_CONFIG
 });
 import { Database as Database2 } from "bun:sqlite";
-import { existsSync as existsSync5, mkdirSync as mkdirSync8 } from "fs";
-import { dirname, join as join9, resolve } from "path";
-import { existsSync as existsSync22, mkdirSync as mkdirSync22, readFileSync as readFileSync4, readdirSync as readdirSync3, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2 } from "fs";
-import { homedir as homedir9 } from "os";
+import { existsSync as existsSync6, mkdirSync as mkdirSync9 } from "fs";
+import { dirname, join as join10, resolve } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync22, readFileSync as readFileSync4, readdirSync as readdirSync4, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir10 } from "os";
 import { basename as basename2, dirname as dirname2, join as join22, resolve as resolve2 } from "path";
 import { existsSync as existsSync32, mkdirSync as mkdirSync32, readFileSync as readFileSync22, writeFileSync as writeFileSync22 } from "fs";
 import { homedir as homedir22 } from "os";
@@ -16586,8 +17209,8 @@ function isInMemoryDb(path) {
 function findNearestMementosDb(startDir) {
   let dir = resolve(startDir);
   while (true) {
-    const candidate = join9(dir, ".mementos", "mementos.db");
-    if (existsSync5(candidate))
+    const candidate = join10(dir, ".mementos", "mementos.db");
+    if (existsSync6(candidate))
       return candidate;
     const parent = dirname(dir);
     if (parent === dir)
@@ -16599,7 +17222,7 @@ function findNearestMementosDb(startDir) {
 function findGitRoot(startDir) {
   let dir = resolve(startDir);
   while (true) {
-    if (existsSync5(join9(dir, ".git")))
+    if (existsSync6(join10(dir, ".git")))
       return dir;
     const parent = dirname(dir);
     if (parent === dir)
@@ -16619,25 +17242,25 @@ function getDbPath() {
   if (process.env["MEMENTOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot(cwd);
     if (gitRoot) {
-      return join9(gitRoot, ".mementos", "mementos.db");
+      return join10(gitRoot, ".mementos", "mementos.db");
     }
   }
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  return join9(home, ".mementos", "mementos.db");
+  return join10(home, ".mementos", "mementos.db");
 }
-function ensureDir(filePath) {
+function ensureDir2(filePath) {
   if (isInMemoryDb(filePath))
     return;
   const dir = dirname(resolve(filePath));
-  if (!existsSync5(dir)) {
-    mkdirSync8(dir, { recursive: true });
+  if (!existsSync6(dir)) {
+    mkdirSync9(dir, { recursive: true });
   }
 }
 function getDatabase2(dbPath) {
   if (_db2)
     return _db2;
   const path = dbPath || getDbPath();
-  ensureDir(path);
+  ensureDir2(path);
   _db2 = new Database2(path, { create: true });
   _db2.run("PRAGMA journal_mode = WAL");
   _db2.run("PRAGMA busy_timeout = 5000");
@@ -18480,7 +19103,7 @@ function isValidCategory(value) {
   return VALID_CATEGORIES.includes(value);
 }
 function loadConfig() {
-  const configPath = join22(homedir9(), ".mementos", "config.json");
+  const configPath = join22(homedir10(), ".mementos", "config.json");
   let fileConfig = {};
   if (existsSync22(configPath)) {
     try {
@@ -18507,10 +19130,10 @@ function loadConfig() {
   return merged;
 }
 function profilesDir() {
-  return join22(homedir9(), ".mementos", "profiles");
+  return join22(homedir10(), ".mementos", "profiles");
 }
 function globalConfigPath() {
-  return join22(homedir9(), ".mementos", "config.json");
+  return join22(homedir10(), ".mementos", "config.json");
 }
 function readGlobalConfig() {
   const p = globalConfigPath();
@@ -18524,7 +19147,7 @@ function readGlobalConfig() {
 }
 function writeGlobalConfig(data) {
   const p = globalConfigPath();
-  ensureDir2(dirname2(p));
+  ensureDir22(dirname2(p));
   writeFileSync3(p, JSON.stringify(data, null, 2), "utf-8");
 }
 function getActiveProfile() {
@@ -18547,18 +19170,18 @@ function listProfiles2() {
   const dir = profilesDir();
   if (!existsSync22(dir))
     return [];
-  return readdirSync3(dir).filter((f) => f.endsWith(".db")).map((f) => basename2(f, ".db")).sort();
+  return readdirSync4(dir).filter((f) => f.endsWith(".db")).map((f) => basename2(f, ".db")).sort();
 }
 function deleteProfile2(name) {
   const dbPath = join22(profilesDir(), `${name}.db`);
   if (!existsSync22(dbPath))
     return false;
-  unlinkSync2(dbPath);
+  unlinkSync3(dbPath);
   if (getActiveProfile() === name)
     setActiveProfile(null);
   return true;
 }
-function ensureDir2(dir) {
+function ensureDir22(dir) {
   if (!existsSync22(dir)) {
     mkdirSync22(dir, { recursive: true });
   }
@@ -19680,7 +20303,7 @@ function writeConfig(config) {
 }
 function getActiveModel() {
   const config = readConfig();
-  return config.activeModel ?? DEFAULT_MODEL;
+  return config.activeModel ?? DEFAULT_MODEL2;
 }
 function setActiveModel(modelId) {
   const config = readConfig();
@@ -19754,7 +20377,7 @@ Return JSON with this exact shape:
     examples: finalExamples,
     count: finalExamples.length
   };
-}, DEFAULT_MODEL = "gpt-4o-mini", CONFIG_DIR, CONFIG_PATH;
+}, DEFAULT_MODEL2 = "gpt-4o-mini", CONFIG_DIR, CONFIG_PATH;
 var init_dist = __esm(() => {
   __defProp2 = Object.defineProperty;
   exports_database = {};
@@ -21190,10 +21813,10 @@ __export(exports_dist2, {
   acquireLock: () => acquireLock2
 });
 import { Database as Database3 } from "bun:sqlite";
-import { mkdirSync as mkdirSync9 } from "fs";
-import { join as join10, dirname as dirname3 } from "path";
-import { homedir as homedir10 } from "os";
-import { randomUUID as randomUUID10 } from "crypto";
+import { mkdirSync as mkdirSync10 } from "fs";
+import { join as join11, dirname as dirname3 } from "path";
+import { homedir as homedir11 } from "os";
+import { randomUUID as randomUUID11 } from "crypto";
 import { mkdirSync as mkdirSync23, copyFileSync as copyFileSync3, statSync as statSync2 } from "fs";
 import { join as join33 } from "path";
 import { homedir as homedir33 } from "os";
@@ -21207,13 +21830,13 @@ import { homedir as homedir42 } from "os";
 function getDbPath2() {
   if (process.env.CONVERSATIONS_DB_PATH)
     return process.env.CONVERSATIONS_DB_PATH;
-  return join10(homedir10(), ".conversations", "messages.db");
+  return join11(homedir11(), ".conversations", "messages.db");
 }
 function getDb() {
   if (db)
     return db;
   const dbPath = getDbPath2();
-  mkdirSync9(dirname3(dbPath), { recursive: true });
+  mkdirSync10(dirname3(dbPath), { recursive: true });
   db = new Database3(dbPath, { create: true });
   db.exec("PRAGMA journal_mode = WAL");
   db.exec("PRAGMA busy_timeout = 5000");
@@ -21573,7 +22196,7 @@ function guessMimeType(name) {
 function sendMessage(opts) {
   const db2 = getDb();
   const explicitSession = opts.session_id && opts.session_id.trim().length > 0 ? opts.session_id : undefined;
-  const sessionId = explicitSession ?? (opts.space ? `space:${opts.space}` : `${[opts.from, opts.to].sort().join("-")}-${randomUUID10().slice(0, 8)}`);
+  const sessionId = explicitSession ?? (opts.space ? `space:${opts.space}` : `${[opts.from, opts.to].sort().join("-")}-${randomUUID11().slice(0, 8)}`);
   const metadata = opts.metadata ? JSON.stringify(opts.metadata) : null;
   const normalizedPriority = opts.priority === "low" || opts.priority === "normal" || opts.priority === "high" || opts.priority === "urgent" ? opts.priority : "normal";
   const blocking = opts.blocking ? 1 : 0;
@@ -25615,11 +26238,11 @@ __export(exports_dist3, {
   AgentNotFoundError: () => AgentNotFoundError2
 });
 import { Database as Database4 } from "bun:sqlite";
-import { existsSync as existsSync6, mkdirSync as mkdirSync10 } from "fs";
-import { dirname as dirname5, join as join11, resolve as resolve3 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync11 } from "fs";
+import { dirname as dirname5, join as join12, resolve as resolve3 } from "path";
 import { existsSync as existsSync33 } from "fs";
 import { join as join34 } from "path";
-import { existsSync as existsSync23, mkdirSync as mkdirSync24, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync24, readFileSync as readFileSync6, readdirSync as readdirSync5, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
 import { join as join24 } from "path";
 import { existsSync as existsSync43, readFileSync as readFileSync24, readdirSync as readdirSync22, writeFileSync as writeFileSync23 } from "fs";
 import { join as join44 } from "path";
@@ -25849,8 +26472,8 @@ function isInMemoryDb2(path) {
 function findNearestTodosDb(startDir) {
   let dir = resolve3(startDir);
   while (true) {
-    const candidate = join11(dir, ".todos", "todos.db");
-    if (existsSync6(candidate))
+    const candidate = join12(dir, ".todos", "todos.db");
+    if (existsSync7(candidate))
       return candidate;
     const parent = dirname5(dir);
     if (parent === dir)
@@ -25862,7 +26485,7 @@ function findNearestTodosDb(startDir) {
 function findGitRoot2(startDir) {
   let dir = resolve3(startDir);
   while (true) {
-    if (existsSync6(join11(dir, ".git")))
+    if (existsSync7(join12(dir, ".git")))
       return dir;
     const parent = dirname5(dir);
     if (parent === dir)
@@ -25882,18 +26505,18 @@ function getDbPath3() {
   if (process.env["TODOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot2(cwd);
     if (gitRoot) {
-      return join11(gitRoot, ".todos", "todos.db");
+      return join12(gitRoot, ".todos", "todos.db");
     }
   }
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  return join11(home, ".todos", "todos.db");
+  return join12(home, ".todos", "todos.db");
 }
 function ensureDir3(filePath) {
   if (isInMemoryDb2(filePath))
     return;
   const dir = dirname5(resolve3(filePath));
-  if (!existsSync6(dir)) {
-    mkdirSync10(dir, { recursive: true });
+  if (!existsSync7(dir)) {
+    mkdirSync11(dir, { recursive: true });
   }
 }
 function getDatabase3(dbPath) {
@@ -26352,14 +26975,14 @@ function ensureProject2(name, path, db2) {
   }
   return createProject3({ name, path }, d);
 }
-function ensureDir22(dir) {
+function ensureDir23(dir) {
   if (!existsSync23(dir))
     mkdirSync24(dir, { recursive: true });
 }
 function listJsonFiles(dir) {
   if (!existsSync23(dir))
     return [];
-  return readdirSync4(dir).filter((f) => f.endsWith(".json"));
+  return readdirSync5(dir).filter((f) => f.endsWith(".json"));
 }
 function readJsonFile(path) {
   try {
@@ -29224,7 +29847,7 @@ function taskToClaudeTask(task, claudeTaskId, existingMeta) {
 function pushToClaudeTaskList(taskListId, projectId, options = {}) {
   const dir = getTaskListDir(taskListId);
   if (!existsSync43(dir))
-    ensureDir22(dir);
+    ensureDir23(dir);
   const filter = {};
   if (projectId)
     filter["project_id"] = projectId;
@@ -29442,7 +30065,7 @@ function metadataKey(agent) {
 function pushToAgentTaskList(agent, taskListId, projectId, options = {}) {
   const dir = getTaskListDir2(agent, taskListId);
   if (!existsSync52(dir))
-    ensureDir22(dir);
+    ensureDir23(dir);
   const filter = {};
   if (projectId)
     filter["project_id"] = projectId;
@@ -30970,9 +31593,9 @@ __export(exports_dist4, {
   CATEGORIES: () => CATEGORIES,
   AGENT_TARGETS: () => AGENT_TARGETS
 });
-import { existsSync as existsSync7, cpSync, mkdirSync as mkdirSync11, writeFileSync as writeFileSync6, rmSync as rmSync2, readdirSync as readdirSync5, statSync as statSync4, readFileSync as readFileSync7, accessSync, constants } from "fs";
-import { join as join12, dirname as dirname6 } from "path";
-import { homedir as homedir11 } from "os";
+import { existsSync as existsSync8, cpSync, mkdirSync as mkdirSync12, writeFileSync as writeFileSync6, rmSync as rmSync2, readdirSync as readdirSync6, statSync as statSync4, readFileSync as readFileSync7, accessSync, constants } from "fs";
+import { join as join13, dirname as dirname6 } from "path";
+import { homedir as homedir12 } from "os";
 import { fileURLToPath } from "url";
 import { existsSync as existsSync24, readFileSync as readFileSync25, readdirSync as readdirSync23 } from "fs";
 import { join as join25 } from "path";
@@ -31083,35 +31706,35 @@ function normalizeSkillName(name) {
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i = 0;i < 5; i++) {
-    const candidate = join12(dir, "skills");
-    if (existsSync7(candidate)) {
+    const candidate = join13(dir, "skills");
+    if (existsSync8(candidate)) {
       return candidate;
     }
     dir = dirname6(dir);
   }
-  return join12(__dirname2, "..", "skills");
+  return join13(__dirname2, "..", "skills");
 }
 function getSkillPath(name) {
   const skillName = normalizeSkillName(name);
-  return join12(SKILLS_DIR, skillName);
+  return join13(SKILLS_DIR, skillName);
 }
 function skillExists(name) {
-  return existsSync7(getSkillPath(name));
+  return existsSync8(getSkillPath(name));
 }
 function installSkill(name, options = {}) {
   const { targetDir = process.cwd(), overwrite = false } = options;
   const skillName = normalizeSkillName(name);
   const sourcePath = getSkillPath(name);
-  const destDir = join12(targetDir, ".skills");
-  const destPath = join12(destDir, skillName);
-  if (!existsSync7(sourcePath)) {
+  const destDir = join13(targetDir, ".skills");
+  const destPath = join13(destDir, skillName);
+  if (!existsSync8(sourcePath)) {
     return {
       skill: name,
       success: false,
       error: `Skill '${name}' not found`
     };
   }
-  if (existsSync7(destPath) && !overwrite) {
+  if (existsSync8(destPath) && !overwrite) {
     return {
       skill: name,
       success: false,
@@ -31120,10 +31743,10 @@ function installSkill(name, options = {}) {
     };
   }
   try {
-    if (!existsSync7(destDir)) {
-      mkdirSync11(destDir, { recursive: true });
+    if (!existsSync8(destDir)) {
+      mkdirSync12(destDir, { recursive: true });
     }
-    if (existsSync7(destPath) && overwrite) {
+    if (existsSync8(destPath) && overwrite) {
       rmSync2(destPath, { recursive: true, force: true });
     }
     cpSync(sourcePath, destPath, {
@@ -31162,10 +31785,10 @@ function installSkills(names, options = {}) {
   return names.map((name) => installSkill(name, options));
 }
 function updateSkillsIndex(skillsDir) {
-  const indexPath = join12(skillsDir, "index.ts");
+  const indexPath = join13(skillsDir, "index.ts");
   const meta = loadMeta(skillsDir);
   const disabledSet = new Set(meta.disabled || []);
-  const skills = readdirSync5(skillsDir).filter((f) => f.startsWith("skill-") && !f.includes(".") && !disabledSet.has(f.replace("skill-", "")));
+  const skills = readdirSync6(skillsDir).filter((f) => f.startsWith("skill-") && !f.includes(".") && !disabledSet.has(f.replace("skill-", "")));
   const exports = skills.map((s) => {
     const name = s.replace("skill-", "").replace(/-/g, "_");
     return `export * as ${name} from './${s}/src/index.js';`;
@@ -31181,11 +31804,11 @@ ${exports}
   writeFileSync6(indexPath, content);
 }
 function getMetaPath(skillsDir) {
-  return join12(skillsDir, ".meta.json");
+  return join13(skillsDir, ".meta.json");
 }
 function loadMeta(skillsDir) {
   const metaPath2 = getMetaPath(skillsDir);
-  if (existsSync7(metaPath2)) {
+  if (existsSync8(metaPath2)) {
     try {
       return JSON.parse(readFileSync7(metaPath2, "utf-8"));
     } catch {}
@@ -31200,8 +31823,8 @@ function recordInstall(skillsDir, name) {
   const skillName = normalizeSkillName(name);
   let version = "unknown";
   try {
-    const pkgPath = join12(skillsDir, skillName, "package.json");
-    if (existsSync7(pkgPath)) {
+    const pkgPath = join13(skillsDir, skillName, "package.json");
+    if (existsSync8(pkgPath)) {
       const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
       version = pkg.version || "unknown";
     }
@@ -31215,12 +31838,12 @@ function recordRemove(skillsDir, name) {
   saveMeta(skillsDir, meta);
 }
 function getInstallMeta(targetDir = process.cwd()) {
-  return loadMeta(join12(targetDir, ".skills"));
+  return loadMeta(join13(targetDir, ".skills"));
 }
 function disableSkill(name, targetDir = process.cwd()) {
-  const skillsDir = join12(targetDir, ".skills");
+  const skillsDir = join13(targetDir, ".skills");
   const skillName = normalizeSkillName(name);
-  if (!existsSync7(join12(skillsDir, skillName)))
+  if (!existsSync8(join13(skillsDir, skillName)))
     return false;
   const meta = loadMeta(skillsDir);
   const disabled = new Set(meta.disabled || []);
@@ -31233,7 +31856,7 @@ function disableSkill(name, targetDir = process.cwd()) {
   return true;
 }
 function enableSkill(name, targetDir = process.cwd()) {
-  const skillsDir = join12(targetDir, ".skills");
+  const skillsDir = join13(targetDir, ".skills");
   const meta = loadMeta(skillsDir);
   const disabled = new Set(meta.disabled || []);
   if (!disabled.has(name))
@@ -31245,24 +31868,24 @@ function enableSkill(name, targetDir = process.cwd()) {
   return true;
 }
 function getDisabledSkills(targetDir = process.cwd()) {
-  const meta = loadMeta(join12(targetDir, ".skills"));
+  const meta = loadMeta(join13(targetDir, ".skills"));
   return meta.disabled || [];
 }
 function getInstalledSkills(targetDir = process.cwd()) {
-  const skillsDir = join12(targetDir, ".skills");
-  if (!existsSync7(skillsDir)) {
+  const skillsDir = join13(targetDir, ".skills");
+  if (!existsSync8(skillsDir)) {
     return [];
   }
-  return readdirSync5(skillsDir).filter((f) => {
-    const fullPath = join12(skillsDir, f);
+  return readdirSync6(skillsDir).filter((f) => {
+    const fullPath = join13(skillsDir, f);
     return f.startsWith("skill-") && statSync4(fullPath).isDirectory();
   }).map((f) => f.replace("skill-", ""));
 }
 function removeSkill(name, targetDir = process.cwd()) {
   const skillName = normalizeSkillName(name);
-  const skillsDir = join12(targetDir, ".skills");
-  const skillPath = join12(skillsDir, skillName);
-  if (!existsSync7(skillPath)) {
+  const skillsDir = join13(targetDir, ".skills");
+  const skillPath = join13(skillsDir, skillName);
+  if (!existsSync8(skillPath)) {
     return false;
   }
   rmSync2(skillPath, { recursive: true, force: true });
@@ -31273,24 +31896,24 @@ function removeSkill(name, targetDir = process.cwd()) {
 function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const agentDir = `.${agent}`;
   if (scope === "project") {
-    return join12(projectDir || process.cwd(), agentDir, "skills");
+    return join13(projectDir || process.cwd(), agentDir, "skills");
   }
-  return join12(homedir11(), agentDir, "skills");
+  return join13(homedir12(), agentDir, "skills");
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(name);
-  return join12(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join13(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   const { agent, scope = "global", projectDir } = options;
   const skillName = normalizeSkillName(name);
   const sourcePath = getSkillPath(name);
-  if (!existsSync7(sourcePath)) {
+  if (!existsSync8(sourcePath)) {
     return { skill: name, success: false, error: `Skill '${name}' not found` };
   }
   let skillMdContent = null;
-  const skillMdPath = join12(sourcePath, "SKILL.md");
-  if (existsSync7(skillMdPath)) {
+  const skillMdPath = join13(sourcePath, "SKILL.md");
+  if (existsSync8(skillMdPath)) {
     skillMdContent = readFileSync7(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
     skillMdContent = generateSkillMd(name);
@@ -31300,8 +31923,8 @@ function installSkillForAgent(name, options, generateSkillMd) {
   }
   const destDir = getAgentSkillPath(name, agent, scope, projectDir);
   if (scope === "global") {
-    const agentBaseDir2 = join12(homedir11(), `.${agent}`);
-    if (!existsSync7(agentBaseDir2)) {
+    const agentBaseDir2 = join13(homedir12(), `.${agent}`);
+    if (!existsSync8(agentBaseDir2)) {
       const agentLabels = {
         claude: "Claude Code",
         codex: "Codex CLI",
@@ -31324,8 +31947,8 @@ function installSkillForAgent(name, options, generateSkillMd) {
     }
   }
   try {
-    mkdirSync11(destDir, { recursive: true });
-    writeFileSync6(join12(destDir, "SKILL.md"), skillMdContent);
+    mkdirSync12(destDir, { recursive: true });
+    writeFileSync6(join13(destDir, "SKILL.md"), skillMdContent);
     return { skill: name, success: true, path: destDir };
   } catch (error) {
     return {
@@ -31338,7 +31961,7 @@ function installSkillForAgent(name, options, generateSkillMd) {
 function removeSkillForAgent(name, options) {
   const { agent, scope = "global", projectDir } = options;
   const destDir = getAgentSkillPath(name, agent, scope, projectDir);
-  if (!existsSync7(destDir)) {
+  if (!existsSync8(destDir)) {
     return false;
   }
   rmSync2(destDir, { recursive: true, force: true });
@@ -33262,7 +33885,7 @@ __export(exports_cron_manager, {
   deleteCronJob: () => deleteCronJob,
   createCronJob: () => createCronJob
 });
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 function ensureCronTable() {
   const db2 = getDatabase();
   db2.exec(`
@@ -33291,7 +33914,7 @@ function ensureCronTable() {
 function createCronJob(schedule, task, name) {
   ensureCronTable();
   const db2 = getDatabase();
-  const id = randomUUID11();
+  const id = randomUUID12();
   db2.prepare(`
     INSERT INTO cron_jobs (id, name, schedule, task_json, enabled)
     VALUES (?, ?, ?, ?, 1)
@@ -33349,7 +33972,7 @@ function getCronEvents(jobId, limit = 10) {
 async function executeCronJob(job) {
   ensureCronTable();
   const db2 = getDatabase();
-  const eventId = randomUUID11();
+  const eventId = randomUUID12();
   const startedAt = new Date().toISOString();
   db2.prepare("INSERT INTO cron_events (id, job_id, started_at) VALUES (?, ?, ?)").run(eventId, job.id, startedAt);
   try {
@@ -33440,7 +34063,7 @@ __export(exports_url_watcher, {
   deleteWatchJob: () => deleteWatchJob,
   createWatchJob: () => createWatchJob
 });
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 import { createHash } from "crypto";
 function ensureWatchTables() {
   const db2 = getDatabase();
@@ -33472,7 +34095,7 @@ function ensureWatchTables() {
 function createWatchJob(url, schedule, opts) {
   ensureWatchTables();
   const db2 = getDatabase();
-  const id = randomUUID12();
+  const id = randomUUID13();
   db2.prepare(`
     INSERT INTO watch_jobs (id, name, url, schedule, selector, extract_schema, enabled)
     VALUES (?, ?, ?, ?, ?, ?, 1)
@@ -33508,7 +34131,7 @@ function getWatchEvents(watchId, limit = 20) {
 async function checkWatchJob(job) {
   ensureWatchTables();
   const db2 = getDatabase();
-  const eventId = randomUUID12();
+  const eventId = randomUUID13();
   const checkedAt = new Date().toISOString();
   let newContent = "";
   try {
@@ -33684,7 +34307,7 @@ var exports_mcp = {};
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { readFileSync as readFileSync8 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 function json(data) {
   return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
 }
@@ -33749,7 +34372,7 @@ var init_mcp = __esm(async () => {
   init_dialogs();
   init_profiles();
   init_types();
-  _pkg = JSON.parse(readFileSync8(join13(import.meta.dir, "../../package.json"), "utf8"));
+  _pkg = JSON.parse(readFileSync8(join14(import.meta.dir, "../../package.json"), "utf8"));
   networkLogCleanup = new Map;
   consoleCaptureCleanup = new Map;
   harCaptures = new Map;
@@ -33757,7 +34380,7 @@ var init_mcp = __esm(async () => {
     name: "@hasna/browser",
     version: "0.0.1"
   });
-  server.tool("browser_session_create", "Create a new browser session. If agent_id is set and already has an active session, returns the existing one (use force_new to override). If session_id is omitted on other tools, the single active session is auto-selected.", {
+  server.tool("browser_session_create", "Create a new browser session. If agent_id is set and already has an active session, returns the existing one (use force_new to override). If session_id is omitted on other tools, the single active session is auto-selected. Use cdp_url to attach to an already-running Chrome instance.", {
     engine: exports_external.enum(["playwright", "cdp", "lightpanda", "bun", "auto"]).optional().default("auto"),
     use_case: exports_external.string().optional(),
     project_id: exports_external.string().optional(),
@@ -33768,9 +34391,11 @@ var init_mcp = __esm(async () => {
     viewport_height: exports_external.number().optional().default(720),
     stealth: exports_external.boolean().optional().default(false),
     auto_gallery: exports_external.boolean().optional().default(false),
+    storage_state: exports_external.string().optional().describe("Name of saved storage state to load (restores cookies/auth from previous session)"),
     force_new: exports_external.boolean().optional().default(false).describe("Force create a new session even if agent already has one"),
-    tags: exports_external.array(exports_external.string()).optional()
-  }, async ({ engine, use_case, project_id, agent_id, start_url, headless, viewport_width, viewport_height, stealth, auto_gallery, force_new, tags }) => {
+    tags: exports_external.array(exports_external.string()).optional(),
+    cdp_url: exports_external.string().optional().describe("Connect to existing Chrome via CDP (e.g. http://localhost:9222). Start Chrome with --remote-debugging-port=9222")
+  }, async ({ engine, use_case, project_id, agent_id, start_url, headless, viewport_width, viewport_height, stealth, auto_gallery, storage_state, force_new, tags, cdp_url }) => {
     try {
       if (agent_id && !force_new) {
         const existing = getActiveSessionForAgent2(agent_id);
@@ -33786,7 +34411,9 @@ var init_mcp = __esm(async () => {
         headless,
         viewport: { width: viewport_width, height: viewport_height },
         stealth,
-        autoGallery: auto_gallery
+        autoGallery: auto_gallery,
+        storageState: storage_state,
+        cdpUrl: cdp_url
       });
       if (tags?.length) {
         const { addSessionTag: addSessionTag2 } = await Promise.resolve().then(() => (init_sessions(), exports_sessions));
@@ -33946,7 +34573,7 @@ var init_mcp = __esm(async () => {
       return err(e);
     }
   });
-  server.tool("browser_click", "Click an element by ref (from snapshot) or CSS selector. Prefer ref for reliability.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), ref: exports_external.string().optional(), button: exports_external.enum(["left", "right", "middle"]).optional(), timeout: exports_external.number().optional() }, async ({ session_id, selector, ref, button, timeout }) => {
+  server.tool("browser_click", "Click an element by ref (from snapshot) or CSS selector. Prefer ref for reliability. Self-healing auto-tries fallback selectors if element not found.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), ref: exports_external.string().optional(), button: exports_external.enum(["left", "right", "middle"]).optional(), timeout: exports_external.number().optional(), self_heal: exports_external.boolean().optional().default(true).describe("Auto-try fallback selectors if element not found") }, async ({ session_id, selector, ref, button, timeout, self_heal }) => {
     try {
       const sid = resolveSessionId(session_id);
       const page = getSessionPage(sid);
@@ -33957,14 +34584,17 @@ var init_mcp = __esm(async () => {
       }
       if (!selector)
         return err(new Error("Either ref or selector is required"));
-      await click(page, selector, { button, timeout });
-      logEvent(sid, "click", { selector, method: "selector" });
+      const healInfo = await click(page, selector, { button, timeout, selfHeal: self_heal });
+      logEvent(sid, "click", { selector, method: healInfo.healed ? "healed" : "selector" });
+      if (healInfo.healed) {
+        return json({ clicked: selector, method: "healed", heal_method: healInfo.method, attempts: healInfo.attempts });
+      }
       return json({ clicked: selector, method: "selector" });
     } catch (e) {
       return errWithScreenshot(e, session_id);
     }
   });
-  server.tool("browser_type", "Type text into an element by ref or selector. Prefer ref.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), ref: exports_external.string().optional(), text: exports_external.string(), clear: exports_external.boolean().optional().default(false), delay: exports_external.number().optional() }, async ({ session_id, selector, ref, text, clear, delay }) => {
+  server.tool("browser_type", "Type text into an element by ref or selector. Prefer ref. Self-healing auto-tries fallback selectors if element not found.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), ref: exports_external.string().optional(), text: exports_external.string(), clear: exports_external.boolean().optional().default(false), delay: exports_external.number().optional(), self_heal: exports_external.boolean().optional().default(true).describe("Auto-try fallback selectors if element not found") }, async ({ session_id, selector, ref, text, clear, delay, self_heal }) => {
     try {
       const sid = resolveSessionId(session_id);
       const page = getSessionPage(sid);
@@ -33975,8 +34605,11 @@ var init_mcp = __esm(async () => {
       }
       if (!selector)
         return err(new Error("Either ref or selector is required"));
-      await type(page, selector, text, { clear, delay });
-      logEvent(sid, "type", { selector, text: text.slice(0, 100) });
+      const healInfo = await type(page, selector, text, { clear, delay, selfHeal: self_heal });
+      logEvent(sid, "type", { selector, text: text.slice(0, 100), method: healInfo.healed ? "healed" : "selector" });
+      if (healInfo.healed) {
+        return json({ typed: text, selector, method: "healed", heal_method: healInfo.method, attempts: healInfo.attempts });
+      }
       return json({ typed: text, selector, method: "selector" });
     } catch (e) {
       return errWithScreenshot(e, session_id);
@@ -34070,20 +34703,32 @@ var init_mcp = __esm(async () => {
       return err(e);
     }
   });
-  server.tool("browser_get_text", "Get text content from the page or a selector", { session_id: exports_external.string().optional(), selector: exports_external.string().optional() }, async ({ session_id, selector }) => {
+  server.tool("browser_get_text", "Get text content from the page or a selector. Sanitizes prompt injection by default.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), sanitize: exports_external.boolean().optional().default(true).describe("Strip prompt injection patterns from text (default: true)") }, async ({ session_id, selector, sanitize }) => {
     try {
       const sid = resolveSessionId(session_id);
       const page = getSessionPage(sid);
-      return json({ text: await getText(page, selector) });
+      const text = await getText(page, selector);
+      if (sanitize) {
+        const { sanitizeText: sanitizeText2 } = await Promise.resolve().then(() => (init_sanitize(), exports_sanitize));
+        const sanitized = sanitizeText2(text);
+        return json({ text: sanitized.text, stripped: sanitized.stripped, warnings: sanitized.warnings });
+      }
+      return json({ text });
     } catch (e) {
       return err(e);
     }
   });
-  server.tool("browser_get_html", "Get HTML content from the page or a selector", { session_id: exports_external.string().optional(), selector: exports_external.string().optional() }, async ({ session_id, selector }) => {
+  server.tool("browser_get_html", "Get HTML content from the page or a selector. Sanitizes prompt injection by default.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), sanitize: exports_external.boolean().optional().default(true).describe("Strip prompt injection patterns and hidden elements from HTML (default: true)") }, async ({ session_id, selector, sanitize }) => {
     try {
       const sid = resolveSessionId(session_id);
       const page = getSessionPage(sid);
-      return json({ html: await getHTML(page, selector) });
+      const html = await getHTML(page, selector);
+      if (sanitize) {
+        const { sanitizeHTML: sanitizeHTML2 } = await Promise.resolve().then(() => (init_sanitize(), exports_sanitize));
+        const sanitized = sanitizeHTML2(html);
+        return json({ html: sanitized.text, stripped: sanitized.stripped, warnings: sanitized.warnings });
+      }
+      return json({ html });
     } catch (e) {
       return err(e);
     }
@@ -34098,16 +34743,32 @@ var init_mcp = __esm(async () => {
       return err(e);
     }
   });
-  server.tool("browser_extract", "Extract content from the page in a specified format", {
+  server.tool("browser_extract", "Extract content from the page in a specified format. Sanitizes prompt injection by default.", {
     session_id: exports_external.string().optional(),
     format: exports_external.enum(["text", "html", "links", "table", "structured"]).optional().default("text"),
     selector: exports_external.string().optional(),
-    schema: exports_external.record(exports_external.string()).optional()
-  }, async ({ session_id, format, selector, schema }) => {
+    schema: exports_external.record(exports_external.string()).optional(),
+    sanitize: exports_external.boolean().optional().default(true).describe("Strip prompt injection patterns from extracted content (default: true)")
+  }, async ({ session_id, format, selector, schema, sanitize }) => {
     try {
       const sid = resolveSessionId(session_id);
       const page = getSessionPage(sid);
       const result = await extract(page, { format, selector, schema });
+      if (sanitize) {
+        const { sanitizeText: sanitizeText2, sanitizeHTML: sanitizeHTML2 } = await Promise.resolve().then(() => (init_sanitize(), exports_sanitize));
+        if (result.text) {
+          const s = sanitizeText2(result.text);
+          result.text = s.text;
+          result.stripped = s.stripped;
+          result.warnings = s.warnings;
+        }
+        if (result.html) {
+          const s = sanitizeHTML2(result.html);
+          result.html = s.text;
+          result.stripped = s.stripped;
+          result.warnings = s.warnings;
+        }
+      }
       return json(result);
     } catch (e) {
       return err(e);
@@ -34124,17 +34785,27 @@ var init_mcp = __esm(async () => {
       return err(e);
     }
   });
-  server.tool("browser_snapshot", "Get accessibility snapshot with element refs (@e0, @e1...). Use compact=true (default) for token-efficient output. Use refs in browser_click, browser_type, etc.", {
+  server.tool("browser_snapshot", "Get accessibility snapshot with element refs (@e0, @e1...). Use compact=true (default) for token-efficient output. Use refs in browser_click, browser_type, etc. Sanitizes prompt injection by default.", {
     session_id: exports_external.string().optional(),
     compact: exports_external.boolean().optional().default(true),
     max_refs: exports_external.number().optional().default(50),
-    full_tree: exports_external.boolean().optional().default(false)
-  }, async ({ session_id, compact, max_refs, full_tree }) => {
+    full_tree: exports_external.boolean().optional().default(false),
+    sanitize: exports_external.boolean().optional().default(true).describe("Strip prompt injection patterns from snapshot text (default: true)")
+  }, async ({ session_id, compact, max_refs, full_tree, sanitize }) => {
     try {
       const sid = resolveSessionId(session_id);
       const page = getSessionPage(sid);
       const result = await takeSnapshot(page, sid);
       setLastSnapshot(sid, result);
+      let injection_warnings;
+      if (sanitize) {
+        const { sanitizeText: sanitizeText2 } = await Promise.resolve().then(() => (init_sanitize(), exports_sanitize));
+        const sanitized = sanitizeText2(result.tree);
+        if (sanitized.stripped > 0) {
+          injection_warnings = sanitized.warnings;
+          result.tree = sanitized.text;
+        }
+      }
       const refEntries = Object.entries(result.refs).slice(0, max_refs);
       const limitedRefs = Object.fromEntries(refEntries);
       const truncated = Object.keys(result.refs).length > max_refs;
@@ -34146,27 +34817,29 @@ var init_mcp = __esm(async () => {
           interactive_count: result.interactive_count,
           shown_count: refEntries.length,
           truncated,
-          refs: limitedRefs
+          refs: limitedRefs,
+          ...injection_warnings ? { injection_warnings } : {}
         });
       }
       const tree = full_tree ? result.tree : result.tree.slice(0, 5000) + (result.tree.length > 5000 ? `
 ... (truncated \u2014 use full_tree=true for complete)` : "");
-      return json({ snapshot: tree, refs: limitedRefs, interactive_count: result.interactive_count, truncated });
+      return json({ snapshot: tree, refs: limitedRefs, interactive_count: result.interactive_count, truncated, ...injection_warnings ? { injection_warnings } : {} });
     } catch (e) {
       return err(e);
     }
   });
-  server.tool("browser_screenshot", "Take a screenshot. Use annotate=true to overlay numbered labels on interactive elements for visual+ref workflows.", {
+  server.tool("browser_screenshot", "Take a screenshot. Use selector to capture a specific element/section instead of the full page. Use detail='high' for AI-readable full image, 'low' for fast thumbnail. Use annotate=true to overlay numbered labels on interactive elements.", {
     session_id: exports_external.string().optional(),
-    selector: exports_external.string().optional(),
+    selector: exports_external.string().optional().describe("CSS selector to screenshot a specific section (e.g. '#main', '.header', 'form')"),
     full_page: exports_external.boolean().optional().default(false),
     format: exports_external.enum(["png", "jpeg", "webp"]).optional().default("webp"),
     quality: exports_external.number().optional().default(60),
     max_width: exports_external.number().optional().default(800),
     compress: exports_external.boolean().optional().default(true),
     thumbnail: exports_external.boolean().optional().default(true),
-    annotate: exports_external.boolean().optional().default(false)
-  }, async ({ session_id, selector, full_page, format, quality, max_width, compress, thumbnail, annotate }) => {
+    annotate: exports_external.boolean().optional().default(false),
+    detail: exports_external.enum(["low", "high"]).optional().default("low").describe("'low' = thumbnail only (fast, saves tokens). 'high' = full readable image in base64 (larger but AI can read text).")
+  }, async ({ session_id, selector, full_page, format, quality, max_width, compress, thumbnail, annotate, detail }) => {
     try {
       const sid = resolveSessionId(session_id);
       const page = getSessionPage(sid);
@@ -34183,7 +34856,9 @@ var init_mcp = __esm(async () => {
           annotation_count: annotated.annotations.length
         });
       }
-      const result = await takeScreenshot(page, { selector, fullPage: full_page, format, quality, maxWidth: max_width, compress, thumbnail });
+      const effectiveMaxWidth = detail === "high" ? 1280 : max_width;
+      const effectiveQuality = detail === "high" ? 75 : quality;
+      const result = await takeScreenshot(page, { selector, fullPage: full_page, format, quality: effectiveQuality, maxWidth: effectiveMaxWidth, compress, thumbnail });
       result.url = page.url();
       try {
         const buf = Buffer.from(result.base64, "base64");
@@ -34192,12 +34867,12 @@ var init_mcp = __esm(async () => {
         result.download_id = dl.id;
       } catch {}
       result.estimated_tokens = Math.ceil(result.base64.length / 4);
-      if (result.base64.length > 20000) {
+      if (detail !== "high" && result.base64.length > 40000) {
         result.base64_truncated = true;
         result.full_image_path = result.path;
         result.base64 = result.thumbnail_base64 ?? "";
       }
-      logEvent(sid, "screenshot", { path: result.path });
+      logEvent(sid, "screenshot", { path: result.path, detail, selector });
       return json(result);
     } catch (e) {
       return err(e);
@@ -34603,6 +35278,94 @@ var init_mcp = __esm(async () => {
       return err(e);
     }
   });
+  server.tool("browser_session_save_state", "Save current session's auth state (cookies, localStorage) for reuse. Use after login to avoid re-authenticating.", { session_id: exports_external.string().optional(), name: exports_external.string().describe("Name for this state (e.g. 'github', 'gmail')") }, async ({ session_id, name }) => {
+    try {
+      const sid = resolveSessionId(session_id);
+      const page = getSessionPage(sid);
+      const { saveStateFromPage: saveStateFromPage2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+      const path = await saveStateFromPage2(page, name);
+      return json({ saved: true, name, path });
+    } catch (e) {
+      return err(e);
+    }
+  });
+  server.tool("browser_session_list_states", "List all saved storage states (auth snapshots)", {}, async () => {
+    try {
+      const { listStates: listStates2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+      const states = listStates2();
+      return json({ states, count: states.length });
+    } catch (e) {
+      return err(e);
+    }
+  });
+  server.tool("browser_session_delete_state", "Delete a saved storage state", { name: exports_external.string() }, async ({ name }) => {
+    try {
+      const { deleteState: deleteState2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+      return json({ deleted: deleteState2(name), name });
+    } catch (e) {
+      return err(e);
+    }
+  });
+  server.tool("browser_auth_record", "Start recording a login flow. Navigate to the login page, perform the login, then call browser_auth_stop to save.", { session_id: exports_external.string().optional(), name: exports_external.string().describe("Name for this auth flow (e.g. 'github', 'gmail')"), start_url: exports_external.string().optional().describe("Login page URL") }, async ({ session_id, name, start_url }) => {
+    try {
+      const sid = resolveSessionId(session_id);
+      const page = getSessionPage(sid);
+      if (start_url)
+        await navigate(page, start_url);
+      const recording = startRecording(sid, `auth-${name}`, page.url());
+      return json({ recording_id: recording.id, name, message: "Recording started. Perform login, then call browser_auth_stop." });
+    } catch (e) {
+      return err(e);
+    }
+  });
+  server.tool("browser_auth_stop", "Stop recording a login flow and save as a reusable auth flow with storage state.", { session_id: exports_external.string().optional(), name: exports_external.string(), recording_id: exports_external.string() }, async ({ session_id, name, recording_id }) => {
+    try {
+      const sid = resolveSessionId(session_id);
+      const page = getSessionPage(sid);
+      const recording = stopRecording(recording_id);
+      const { saveStateFromPage: saveStateFromPage2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+      const statePath2 = await saveStateFromPage2(page, name);
+      let domain = "";
+      try {
+        domain = new URL(page.url()).hostname;
+      } catch {}
+      const { saveAuthFlow: saveAuthFlow2 } = await Promise.resolve().then(() => (init_auth_flow(), exports_auth_flow));
+      const flow = saveAuthFlow2({ name, domain, recordingId: recording.id, storageStatePath: statePath2 });
+      return json({ flow, recording_steps: recording.steps.length });
+    } catch (e) {
+      return err(e);
+    }
+  });
+  server.tool("browser_auth_replay", "Manually replay a saved auth flow for a domain", { session_id: exports_external.string().optional(), name: exports_external.string().describe("Auth flow name to replay") }, async ({ session_id, name }) => {
+    try {
+      const sid = resolveSessionId(session_id);
+      const page = getSessionPage(sid);
+      const { getAuthFlowByName: getAuthFlowByName2, tryReplayAuth: tryReplayAuth2 } = await Promise.resolve().then(() => (init_auth_flow(), exports_auth_flow));
+      const flow = getAuthFlowByName2(name);
+      if (!flow)
+        return err(new Error(`Auth flow '${name}' not found`));
+      const result = await tryReplayAuth2(page, flow.domain);
+      return json(result);
+    } catch (e) {
+      return err(e);
+    }
+  });
+  server.tool("browser_auth_list", "List all saved auth flows", {}, async () => {
+    try {
+      const { listAuthFlows: listAuthFlows2 } = await Promise.resolve().then(() => (init_auth_flow(), exports_auth_flow));
+      return json({ flows: listAuthFlows2() });
+    } catch (e) {
+      return err(e);
+    }
+  });
+  server.tool("browser_auth_delete", "Delete a saved auth flow", { name: exports_external.string() }, async ({ name }) => {
+    try {
+      const { deleteAuthFlow: deleteAuthFlow2 } = await Promise.resolve().then(() => (init_auth_flow(), exports_auth_flow));
+      return json({ deleted: deleteAuthFlow2(name) });
+    } catch (e) {
+      return err(e);
+    }
+  });
   server.tool("browser_click_text", "Click an element by its visible text content", { session_id: exports_external.string().optional(), text: exports_external.string(), exact: exports_external.boolean().optional().default(false), timeout: exports_external.number().optional() }, async ({ session_id, text, exact, timeout }) => {
     try {
       const sid = resolveSessionId(session_id);
@@ -34613,20 +35376,45 @@ var init_mcp = __esm(async () => {
       return err(e);
     }
   });
-  server.tool("browser_fill_form", "Fill multiple form fields in one call. Fields map: { selector: value }. Handles text, checkboxes, selects.", {
+  server.tool("browser_fill_form", "Fill multiple form fields in one call. Fields map: { selector: value }. Handles text, checkboxes, selects. Self-healing auto-tries fallback selectors per field.", {
     session_id: exports_external.string().optional(),
     fields: exports_external.record(exports_external.union([exports_external.string(), exports_external.boolean()])),
-    submit_selector: exports_external.string().optional()
-  }, async ({ session_id, fields, submit_selector }) => {
+    submit_selector: exports_external.string().optional(),
+    self_heal: exports_external.boolean().optional().default(true).describe("Auto-try fallback selectors if element not found")
+  }, async ({ session_id, fields, submit_selector, self_heal }) => {
     try {
       const sid = resolveSessionId(session_id);
       const page = getSessionPage(sid);
-      const result = await fillForm(page, fields, submit_selector);
+      const result = await fillForm(page, fields, submit_selector, self_heal);
       return json(result);
     } catch (e) {
       return errWithScreenshot(e, session_id);
     }
   });
+  server.tool("browser_find_visual", "Find an element using AI vision when selectors and a11y refs fail. Useful for canvas, images, custom widgets. Takes a screenshot and asks a vision model to locate the element.", {
+    session_id: exports_external.string().optional(),
+    description: exports_external.string().describe("Natural language description of the element to find (e.g. 'the blue Submit button', 'the search icon in the top right')"),
+    click: exports_external.boolean().optional().default(false).describe("Click the element after finding it"),
+    model: exports_external.string().optional().describe("Vision model to use (default: claude-sonnet-4-5-20250929)")
+  }, async ({ session_id, description, click: doClick, model }) => {
+    try {
+      const sid = resolveSessionId(session_id);
+      const page = getSessionPage(sid);
+      if (doClick) {
+        const { clickByVision: clickByVision2 } = await Promise.resolve().then(() => exports_vision_fallback);
+        const result = await clickByVision2(page, description, { model });
+        logEvent(sid, "vision_click", { query: description, ...result });
+        return json(result);
+      } else {
+        const { findElementByVision: findElementByVision2 } = await Promise.resolve().then(() => exports_vision_fallback);
+        const result = await findElementByVision2(page, description, { model });
+        logEvent(sid, "vision_find", { query: description, ...result });
+        return json(result);
+      }
+    } catch (e) {
+      return err(e);
+    }
+  });
   server.tool("browser_wait_for_text", "Wait until specific text appears on the page", { session_id: exports_external.string().optional(), text: exports_external.string(), timeout: exports_external.number().optional().default(1e4), exact: exports_external.boolean().optional().default(false) }, async ({ session_id, text, timeout, exact }) => {
     try {
       const sid = resolveSessionId(session_id);
@@ -35047,6 +35835,7 @@ var init_mcp = __esm(async () => {
           { tool: "browser_wait", description: "Wait for a selector to appear" },
           { tool: "browser_wait_for_text", description: "Wait for text to appear" },
           { tool: "browser_fill_form", description: "Fill multiple form fields at once" },
+          { tool: "browser_find_visual", description: "Find element using AI vision (for canvas, images, custom widgets)" },
           { tool: "browser_handle_dialog", description: "Accept or dismiss a dialog" }
         ],
         Extraction: [
@@ -35075,7 +35864,10 @@ var init_mcp = __esm(async () => {
           { tool: "browser_profile_save", description: "Save cookies + localStorage as profile" },
           { tool: "browser_profile_load", description: "Load and apply a saved profile" },
           { tool: "browser_profile_list", description: "List saved profiles" },
-          { tool: "browser_profile_delete", description: "Delete a saved profile" }
+          { tool: "browser_profile_delete", description: "Delete a saved profile" },
+          { tool: "browser_session_save_state", description: "Save auth state (Playwright storageState) for reuse" },
+          { tool: "browser_session_list_states", description: "List saved storage states" },
+          { tool: "browser_session_delete_state", description: "Delete a saved storage state" }
         ],
         Network: [
           { tool: "browser_network_log", description: "Get captured network requests" },
@@ -35099,6 +35891,13 @@ var init_mcp = __esm(async () => {
           { tool: "browser_record_replay", description: "Replay a recorded sequence" },
           { tool: "browser_recordings_list", description: "List all recordings" }
         ],
+        Auth: [
+          { tool: "browser_auth_record", description: "Start recording a login flow" },
+          { tool: "browser_auth_stop", description: "Stop recording and save auth flow" },
+          { tool: "browser_auth_replay", description: "Replay a saved auth flow" },
+          { tool: "browser_auth_list", description: "List all saved auth flows" },
+          { tool: "browser_auth_delete", description: "Delete a saved auth flow" }
+        ],
         Crawl: [
           { tool: "browser_crawl", description: "Crawl a URL recursively" }
         ],
@@ -35155,7 +35954,8 @@ var init_mcp = __esm(async () => {
           { tool: "browser_snapshot_diff", description: "Diff current snapshot vs previous" },
           { tool: "browser_watch_start", description: "Watch page for DOM changes" },
           { tool: "browser_watch_get_changes", description: "Get captured DOM changes" },
-          { tool: "browser_watch_stop", description: "Stop DOM watcher" }
+          { tool: "browser_watch_stop", description: "Stop DOM watcher" },
+          { tool: "browser_parallel", description: "Execute actions across multiple sessions in parallel" }
         ]
       };
       const totalTools = Object.values(groups).reduce((sum, g) => sum + g.length, 0);
@@ -35438,6 +36238,82 @@ var init_mcp = __esm(async () => {
       return err(e);
     }
   });
+  server.tool("browser_parallel", "Execute actions across multiple sessions in parallel. Each action targets a different session. Returns results array.", {
+    actions: exports_external.array(exports_external.object({
+      session_id: exports_external.string().describe("Target session ID"),
+      tool: exports_external.string().describe("Tool name (e.g. browser_navigate, browser_screenshot, browser_click)"),
+      args: exports_external.record(exports_external.unknown()).optional().default({})
+    })),
+    timeout: exports_external.number().optional().default(30000).describe("Timeout per action in ms")
+  }, async ({ actions, timeout }) => {
+    try {
+      const t0 = Date.now();
+      const promises = actions.map(async (action, index) => {
+        try {
+          const sid = action.session_id;
+          const page = getSessionPage(sid);
+          const args = action.args;
+          const toolName = action.tool.replace(/^browser_/, "");
+          const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`Timeout after ${timeout}ms`)), timeout));
+          const actionPromise = (async () => {
+            switch (toolName) {
+              case "navigate": {
+                await navigate(page, args.url);
+                const title = await page.title();
+                return { url: page.url(), title };
+              }
+              case "screenshot": {
+                const result2 = await takeScreenshot(page, {
+                  maxWidth: args.max_width ?? 800,
+                  quality: args.quality ?? 60
+                });
+                return { path: result2.path, size_bytes: result2.size_bytes };
+              }
+              case "click": {
+                if (args.selector)
+                  await click(page, args.selector);
+                return { clicked: args.selector };
+              }
+              case "type": {
+                if (args.selector && args.text)
+                  await type(page, args.selector, args.text);
+                return { typed: args.text };
+              }
+              case "get_text": {
+                const text = await getText(page);
+                return { text: text.slice(0, 1000), length: text.length };
+              }
+              case "get_links": {
+                const links = await getLinks(page);
+                return { links, count: links.length };
+              }
+              case "snapshot": {
+                const snap = await takeSnapshot(page, sid);
+                return { interactive_count: snap.interactive_count, refs_count: Object.keys(snap.refs).length };
+              }
+              case "evaluate": {
+                const result2 = await page.evaluate(args.expression);
+                return { result: result2 };
+              }
+              default:
+                return { error: `Unknown tool: ${action.tool}` };
+            }
+          })();
+          const result = await Promise.race([actionPromise, timeoutPromise]);
+          return { index, session_id: sid, tool: action.tool, success: true, result };
+        } catch (e) {
+          return { index, session_id: action.session_id, tool: action.tool, success: false, error: e instanceof Error ? e.message : String(e) };
+        }
+      });
+      const results = await Promise.all(promises);
+      const duration_ms = Date.now() - t0;
+      const succeeded = results.filter((r) => r.success).length;
+      const failed = results.filter((r) => !r.success).length;
+      return json({ results, duration_ms, succeeded, failed, total: actions.length });
+    } catch (e) {
+      return err(e);
+    }
+  });
   server.tool("browser_pool_status", "Get status of the pre-warmed browser session pool.", {}, async () => {
     try {
       return json({ message: "Session pool not yet implemented in this version. Coming in v0.0.6+", ready: 0, total: 0 });
@@ -35592,10 +36468,10 @@ __export(exports_snapshots, {
   deleteSnapshot: () => deleteSnapshot,
   createSnapshot: () => createSnapshot
 });
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 function createSnapshot(data) {
   const db2 = getDatabase();
-  const id = randomUUID13();
+  const id = randomUUID14();
   db2.prepare("INSERT INTO snapshots (id, session_id, url, title, html, screenshot_path) VALUES (?, ?, ?, ?, ?, ?)").run(id, data.session_id, data.url, data.title ?? null, data.html ?? null, data.screenshot_path ?? null);
   return getSnapshot(id);
 }
@@ -35621,8 +36497,8 @@ var init_snapshots = __esm(() => {
 
 // src/server/index.ts
 var exports_server = {};
-import { join as join14 } from "path";
-import { existsSync as existsSync8 } from "fs";
+import { join as join15 } from "path";
+import { existsSync as existsSync9 } from "fs";
 function ok(data, status = 200) {
   return new Response(JSON.stringify(data), {
     status,
@@ -35872,14 +36748,14 @@ var init_server = __esm(() => {
         if (path.match(/^\/api\/gallery\/([^/]+)\/thumbnail$/) && method === "GET") {
           const id = path.split("/")[3];
           const entry = getEntry(id);
-          if (!entry?.thumbnail_path || !existsSync8(entry.thumbnail_path))
+          if (!entry?.thumbnail_path || !existsSync9(entry.thumbnail_path))
             return notFound("Thumbnail not found");
           return new Response(Bun.file(entry.thumbnail_path), { headers: { ...CORS_HEADERS } });
         }
         if (path.match(/^\/api\/gallery\/([^/]+)\/image$/) && method === "GET") {
           const id = path.split("/")[3];
           const entry = getEntry(id);
-          if (!entry?.path || !existsSync8(entry.path))
+          if (!entry?.path || !existsSync9(entry.path))
             return notFound("Image not found");
           return new Response(Bun.file(entry.path), { headers: { ...CORS_HEADERS } });
         }
@@ -35907,7 +36783,7 @@ var init_server = __esm(() => {
         if (path.match(/^\/api\/downloads\/([^/]+)\/raw$/) && method === "GET") {
           const id = path.split("/")[3];
           const file = getDownload(id);
-          if (!file || !existsSync8(file.path))
+          if (!file || !existsSync9(file.path))
             return notFound("Download not found");
           return new Response(Bun.file(file.path), { headers: { ...CORS_HEADERS } });
         }
@@ -35915,13 +36791,13 @@ var init_server = __esm(() => {
           const id = path.split("/")[3];
           return ok({ deleted: deleteDownload(id) });
         }
-        const dashboardDist = join14(import.meta.dir, "../../dashboard/dist");
-        if (existsSync8(dashboardDist)) {
-          const filePath = path === "/" ? join14(dashboardDist, "index.html") : join14(dashboardDist, path);
-          if (existsSync8(filePath)) {
+        const dashboardDist = join15(import.meta.dir, "../../dashboard/dist");
+        if (existsSync9(dashboardDist)) {
+          const filePath = path === "/" ? join15(dashboardDist, "index.html") : join15(dashboardDist, path);
+          if (existsSync9(filePath)) {
             return new Response(Bun.file(filePath), { headers: CORS_HEADERS });
           }
-          return new Response(Bun.file(join14(dashboardDist, "index.html")), { headers: CORS_HEADERS });
+          return new Response(Bun.file(join15(dashboardDist, "index.html")), { headers: CORS_HEADERS });
         }
         if (path === "/" || path === "") {
           return new Response("@hasna/browser REST API running. Dashboard not built.", {
@@ -35964,9 +36840,9 @@ init_recorder();
 init_recordings();
 init_lightpanda();
 import { readFileSync as readFileSync9 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import chalk from "chalk";
-var pkg = JSON.parse(readFileSync9(join15(import.meta.dir, "../../package.json"), "utf8"));
+var pkg = JSON.parse(readFileSync9(join16(import.meta.dir, "../../package.json"), "utf8"));
 var program2 = new Command;
 program2.name("browser").description("@hasna/browser \u2014 general-purpose browser agent CLI").version(pkg.version);
 program2.command("navigate <url>").description("Navigate to a URL and optionally take a screenshot").option("--engine <engine>", "Browser engine: playwright|cdp|lightpanda|auto", "auto").option("--screenshot", "Take a screenshot after navigation").option("--extract", "Extract page text after navigation").option("--headed", "Run in headed (visible) mode").option("--json", "Output as JSON").action(async (url, opts) => {
@@ -36100,6 +36976,22 @@ sessionCmd.command("close <id>").description("Close a session").action(async (id
   await closeSession2(id);
   console.log(chalk.green(`\u2713 Session closed: ${id}`));
 });
+sessionCmd.command("save-state <name>").description("Save current session auth state for reuse").requiredOption("--session <id>", "Session ID").action(async (name, opts) => {
+  const page = getSessionPage(opts.session);
+  const { saveStateFromPage: saveStateFromPage2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+  const path = await saveStateFromPage2(page, name);
+  console.log(chalk.green(`\u2713 State saved: ${name}`));
+  console.log(chalk.gray(`  Path: ${path}`));
+});
+sessionCmd.command("list-states").description("List saved auth states").action(async () => {
+  const { listStates: listStates2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+  const states = listStates2();
+  if (states.length === 0) {
+    console.log(chalk.gray("No saved states"));
+    return;
+  }
+  states.forEach((s) => console.log(`${s.name} ${chalk.gray(s.modified)}`));
+});
 var recordCmd = program2.command("record").description("Manage action recordings");
 recordCmd.command("start <name>").description("Start recording actions in a new session").option("--url <url>", "Start URL").option("--engine <engine>", "Browser engine", "auto").option("--headed", "Run in headed (visible) mode").action(async (name, opts) => {
   const { session } = await createSession2({ engine: opts.engine, startUrl: opts.url, headless: !opts.headed });
@@ -36162,6 +37054,19 @@ projectCmd.command("list").description("List all projects").action(() => {
     projects.forEach((p) => console.log(`${p.id} "${p.name}" ${p.path}`));
   }
 });
+program2.command("attach").description("Attach to a running Chrome browser via CDP").option("--port <port>", "Chrome debugging port", "9222").option("--host <host>", "Chrome debugging host", "localhost").option("--json", "Output as JSON").action(async (opts) => {
+  const cdpUrl = `http://${opts.host}:${opts.port}`;
+  const { session, page } = await createSession2({ cdpUrl });
+  const title = await page.title();
+  const url = page.url();
+  if (opts.json) {
+    console.log(JSON.stringify({ session_id: session.id, url, title, cdp_url: cdpUrl }));
+  } else {
+    console.log(chalk.green(`\u2713 Attached to Chrome at ${cdpUrl}`));
+    console.log(chalk.blue(`  Session: ${session.id}`));
+    console.log(chalk.blue(`  Page: ${title} (${url})`));
+  }
+});
 program2.command("install-browser").description("Install a browser engine").option("--engine <engine>", "Engine to install: lightpanda|chromium", "chromium").action(async (opts) => {
   if (opts.engine === "chromium") {
     const { execSync: execSync3 } = await import("child_process");
@@ -36253,11 +37158,11 @@ galleryCmd.command("stats").description("Show gallery statistics").option("--pro
 });
 galleryCmd.command("clean").description("Delete gallery entries with missing files").action(async () => {
   const { listEntries: listEntries2, deleteEntry: deleteEntry2 } = await Promise.resolve().then(() => (init_gallery(), exports_gallery));
-  const { existsSync: existsSync9 } = await import("fs");
+  const { existsSync: existsSync10 } = await import("fs");
   const entries = listEntries2({ limit: 9999 });
   let removed = 0;
   for (const e of entries) {
-    if (!existsSync9(e.path)) {
+    if (!existsSync10(e.path)) {
       deleteEntry2(e.id);
       removed++;
     }