@hasna/browser 0.0.9 → 0.1.0

package/dist/mcp/index.js

@@ -307,6 +307,23 @@ function runMigrations(db) {
         );
         CREATE INDEX IF NOT EXISTS idx_session_tags_tag ON session_tags(tag);
       `
+    },
+    {
+      version: 6,
+      sql: `
+        CREATE TABLE IF NOT EXISTS auth_flows (
+          id                 TEXT PRIMARY KEY,
+          name               TEXT NOT NULL UNIQUE,
+          domain             TEXT NOT NULL,
+          recording_id       TEXT REFERENCES recordings(id),
+          storage_state_path TEXT,
+          created_at         TEXT DEFAULT (datetime('now')),
+          last_used          TEXT
+        );
+
+        CREATE INDEX IF NOT EXISTS idx_auth_flows_domain ON auth_flows(domain);
+        CREATE INDEX IF NOT EXISTS idx_auth_flows_name ON auth_flows(name);
+      `
     }
   ];
   for (const m of migrations) {
@@ -1418,6 +1435,188 @@ var init_dialogs = __esm(() => {
   pendingDialogs = new Map;
 });
 
+// src/engines/cdp.ts
+var exports_cdp = {};
+__export(exports_cdp, {
+  connectToExistingBrowser: () => connectToExistingBrowser,
+  CDPClient: () => CDPClient
+});
+async function connectToExistingBrowser(cdpUrl) {
+  const { chromium: chromium3 } = await import("playwright");
+  try {
+    return await chromium3.connectOverCDP(cdpUrl);
+  } catch (err) {
+    throw new BrowserError(`Failed to connect to browser at ${cdpUrl}: ${err instanceof Error ? err.message : String(err)}. Start Chrome with: google-chrome --remote-debugging-port=9222`, "CDP_CONNECT_FAILED", true);
+  }
+}
+
+class CDPClient {
+  session;
+  networkEnabled = false;
+  performanceEnabled = false;
+  constructor(session) {
+    this.session = session;
+  }
+  static async fromPage(page) {
+    try {
+      const session = await page.context().newCDPSession(page);
+      return new CDPClient(session);
+    } catch (err) {
+      throw new BrowserError(`Failed to create CDP session: ${err instanceof Error ? err.message : String(err)}`, "CDP_SESSION_FAILED");
+    }
+  }
+  async send(method, params) {
+    try {
+      return await this.session.send(method, params);
+    } catch (err) {
+      throw new BrowserError(`CDP command '${method}' failed: ${err instanceof Error ? err.message : String(err)}`, "CDP_COMMAND_FAILED");
+    }
+  }
+  on(event, handler) {
+    this.session.on(event, handler);
+  }
+  off(event, handler) {
+    this.session.off(event, handler);
+  }
+  async enableNetwork() {
+    if (!this.networkEnabled) {
+      await this.send("Network.enable");
+      this.networkEnabled = true;
+    }
+  }
+  async enablePerformance() {
+    if (!this.performanceEnabled) {
+      await this.send("Performance.enable");
+      this.performanceEnabled = true;
+    }
+  }
+  async getPerformanceMetrics() {
+    await this.enablePerformance();
+    const result = await this.send("Performance.getMetrics");
+    const m = {};
+    for (const metric of result.metrics) {
+      m[metric.name] = metric.value;
+    }
+    return {
+      js_heap_size_used: m["JSHeapUsedSize"],
+      js_heap_size_total: m["JSHeapTotalSize"],
+      dom_interactive: m["DOMInteractive"],
+      dom_complete: m["DOMComplete"],
+      load_event: m["LoadEventEnd"]
+    };
+  }
+  async startJSCoverage() {
+    await this.send("Profiler.enable");
+    await this.send("Debugger.enable");
+    await this.send("Profiler.startPreciseCoverage", {
+      callCount: false,
+      detailed: true
+    });
+  }
+  async stopJSCoverage() {
+    const result = await this.send("Profiler.takePreciseCoverage");
+    await this.send("Profiler.stopPreciseCoverage");
+    return result.result.filter((r) => r.url && !r.url.startsWith("v8-snapshot://")).map((r) => ({
+      url: r.url,
+      text: "",
+      ranges: r.functions.flatMap((f) => f.ranges.filter((rng) => rng.count > 0).map((rng) => ({ start: rng.startOffset, end: rng.endOffset })))
+    }));
+  }
+  async getCoverage() {
+    await this.startJSCoverage();
+    const js = await this.stopJSCoverage();
+    const totalBytes = js.reduce((acc, e) => acc + e.ranges.reduce((sum, r) => sum + (r.end - r.start), 0), 0);
+    return { js, css: [], totalBytes, usedBytes: totalBytes, unusedPercent: 0 };
+  }
+  async captureHAREntries(page, handler) {
+    await this.enableNetwork();
+    const requestTimings = new Map;
+    const onRequest = (params) => {
+      requestTimings.set(params.requestId, params.timestamp);
+    };
+    const onResponse = (params) => {
+      const start = requestTimings.get(params.requestId);
+      const duration = start != null ? (params.timestamp - start) * 1000 : 0;
+      handler({
+        method: "GET",
+        url: params.response.url,
+        status: params.response.status,
+        duration
+      });
+    };
+    this.on("Network.requestWillBeSent", onRequest);
+    this.on("Network.responseReceived", onResponse);
+    return () => {
+      this.off("Network.requestWillBeSent", onRequest);
+      this.off("Network.responseReceived", onResponse);
+    };
+  }
+  async detach() {
+    try {
+      await this.session.detach();
+    } catch {}
+  }
+}
+var init_cdp = __esm(() => {
+  init_types();
+});
+
+// src/lib/storage-state.ts
+var exports_storage_state = {};
+__export(exports_storage_state, {
+  saveStateFromPage: () => saveStateFromPage,
+  saveState: () => saveState,
+  loadStatePath: () => loadStatePath,
+  listStates: () => listStates,
+  deleteState: () => deleteState
+});
+import { mkdirSync as mkdirSync3, existsSync, readdirSync, unlinkSync } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir3 } from "os";
+function ensureDir() {
+  mkdirSync3(STATES_DIR, { recursive: true });
+}
+function statePath(name) {
+  return join3(STATES_DIR, `${name}.json`);
+}
+async function saveState(context, name) {
+  ensureDir();
+  const path = statePath(name);
+  const state = await context.storageState({ path });
+  return path;
+}
+async function saveStateFromPage(page, name) {
+  return saveState(page.context(), name);
+}
+function loadStatePath(name) {
+  const path = statePath(name);
+  return existsSync(path) ? path : null;
+}
+function listStates() {
+  ensureDir();
+  return readdirSync(STATES_DIR).filter((f) => f.endsWith(".json")).map((f) => {
+    const path = join3(STATES_DIR, f);
+    const stat = Bun.file(path);
+    return {
+      name: f.replace(".json", ""),
+      path,
+      modified: new Date(stat.lastModified).toISOString()
+    };
+  }).sort((a, b) => b.modified.localeCompare(a.modified));
+}
+function deleteState(name) {
+  const path = statePath(name);
+  if (existsSync(path)) {
+    unlinkSync(path);
+    return true;
+  }
+  return false;
+}
+var STATES_DIR;
+var init_storage_state = __esm(() => {
+  STATES_DIR = join3(process.env["BROWSER_DATA_DIR"] ?? join3(homedir3(), ".browser"), "states");
+});
+
 // src/lib/session.ts
 var exports_session = {};
 __export(exports_session, {
@@ -1447,6 +1646,37 @@ function createBunProxy(view) {
   return view;
 }
 async function createSession2(opts = {}) {
+  if (opts.cdpUrl) {
+    const { connectToExistingBrowser: connectToExistingBrowser2 } = await Promise.resolve().then(() => (init_cdp(), exports_cdp));
+    const cdpBrowser = await connectToExistingBrowser2(opts.cdpUrl);
+    const contexts = cdpBrowser.contexts();
+    const context = contexts.length > 0 ? contexts[0] : await cdpBrowser.newContext();
+    const pages = context.pages();
+    const page2 = pages.length > 0 ? pages[0] : await context.newPage();
+    const session2 = createSession({
+      engine: "cdp",
+      projectId: opts.projectId,
+      agentId: opts.agentId,
+      startUrl: page2.url(),
+      name: opts.name ?? "attached"
+    });
+    const cleanups2 = [];
+    if (opts.captureNetwork !== false) {
+      try {
+        cleanups2.push(enableNetworkLogging(page2, session2.id));
+      } catch {}
+    }
+    if (opts.captureConsole !== false) {
+      try {
+        cleanups2.push(enableConsoleCapture(page2, session2.id));
+      } catch {}
+    }
+    try {
+      cleanups2.push(setupDialogHandler(page2, session2.id));
+    } catch {}
+    handles.set(session2.id, { browser: cdpBrowser, bunView: null, page: page2, engine: "cdp", cleanups: cleanups2, tokenBudget: { total: 0, used: 0 }, lastActivity: Date.now(), autoGallery: opts.autoGallery ?? false });
+    return { session: session2, page: page2 };
+  }
   const engine = opts.engine === "auto" || !opts.engine ? selectEngine(opts.useCase ?? "spa_navigate" /* SPA_NAVIGATE */, opts.engine) : opts.engine;
   const resolvedEngine = engine === "auto" ? "playwright" : engine;
   let browser = null;
@@ -1472,7 +1702,22 @@ async function createSession2(opts = {}) {
     page = await context.newPage();
   } else {
     browser = await pool.acquire(opts.headless ?? true);
-    page = await getPage(browser, { viewport: opts.viewport, userAgent: opts.userAgent });
+    if (opts.storageState) {
+      const { loadStatePath: loadStatePath2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+      const statePath2 = loadStatePath2(opts.storageState);
+      if (statePath2) {
+        const context = await browser.newContext({
+          viewport: opts.viewport ?? { width: 1280, height: 720 },
+          userAgent: opts.userAgent,
+          storageState: statePath2
+        });
+        page = await context.newPage();
+      } else {
+        page = await getPage(browser, { viewport: opts.viewport, userAgent: opts.userAgent });
+      }
+    } else {
+      page = await getPage(browser, { viewport: opts.viewport, userAgent: opts.userAgent });
+    }
   }
   const sessionName = opts.name ?? (opts.startUrl ? (() => {
     try {
@@ -1977,6 +2222,66 @@ var init_snapshot = __esm(() => {
   ];
 });
 
+// src/lib/self-heal.ts
+async function healSelector(page, selector, sessionId) {
+  const attempts = [];
+  attempts.push(`selector: ${selector}`);
+  try {
+    const loc = page.locator(selector).first();
+    if (await loc.count() > 0) {
+      return { found: true, locator: loc, method: "original", healed: false, attempts };
+    }
+  } catch {}
+  if (!selector.startsWith("#") && !selector.startsWith(".") && !selector.startsWith("[") && !selector.includes(">") && !selector.includes(" ")) {
+    attempts.push(`text: "${selector}"`);
+    try {
+      const loc = page.getByText(selector, { exact: false }).first();
+      if (await loc.count() > 0) {
+        return { found: true, locator: loc, method: "text", healed: true, attempts };
+      }
+    } catch {}
+  }
+  const roleMap = {
+    button: ["button", "submit", "reset"],
+    link: ["a"],
+    input: ["input", "textarea"],
+    heading: ["h1", "h2", "h3", "h4", "h5", "h6"]
+  };
+  const nameHint = selector.replace(/^[#.]/, "").replace(/[-_]/g, " ").toLowerCase();
+  for (const [role, tags] of Object.entries(roleMap)) {
+    attempts.push(`role: ${role} name~="${nameHint}"`);
+    try {
+      const loc = page.getByRole(role, { name: new RegExp(nameHint.split(" ")[0], "i") }).first();
+      if (await loc.count() > 0) {
+        return { found: true, locator: loc, method: "role", healed: true, attempts };
+      }
+    } catch {}
+  }
+  if (selector.startsWith("#")) {
+    const idPart = selector.slice(1).split("-").pop() ?? selector.slice(1);
+    const partialSel = `[id*="${idPart}"]`;
+    attempts.push(`partial_id: ${partialSel}`);
+    try {
+      const loc = page.locator(partialSel).first();
+      if (await loc.count() > 0) {
+        return { found: true, locator: loc, method: "partial_id", healed: true, attempts };
+      }
+    } catch {}
+  }
+  if (selector.startsWith(".")) {
+    const classPart = selector.slice(1).split("-").pop() ?? selector.slice(1);
+    const partialSel = `[class*="${classPart}"]`;
+    attempts.push(`partial_class: ${partialSel}`);
+    try {
+      const loc = page.locator(partialSel).first();
+      if (await loc.count() > 0) {
+        return { found: true, locator: loc, method: "partial_class", healed: true, attempts };
+      }
+    } catch {}
+  }
+  return { found: false, locator: null, method: "none", healed: false, attempts };
+}
+
 // src/lib/actions.ts
 var exports_actions = {};
 __export(exports_actions, {
@@ -2018,11 +2323,22 @@ async function click(page, selector, opts) {
       delay: opts?.delay,
       timeout: opts?.timeout ?? 1e4
     });
-  } catch (err) {
-    if (err instanceof Error && err.message.includes("not found")) {
+    return {};
+  } catch (originalError) {
+    if (opts?.selfHeal !== false) {
+      const result = await healSelector(page, selector);
+      if (result.found && result.locator) {
+        await result.locator.click({
+          button: opts?.button ?? "left",
+          timeout: opts?.timeout ?? 1e4
+        });
+        return { healed: true, method: result.method, attempts: result.attempts };
+      }
+    }
+    if (originalError instanceof Error && originalError.message.includes("not found")) {
       throw new ElementNotFoundError(selector);
     }
-    throw new BrowserError(`Click failed on '${selector}': ${err instanceof Error ? err.message : String(err)}`, "CLICK_FAILED");
+    throw new BrowserError(`Click failed on '${selector}': ${originalError instanceof Error ? originalError.message : String(originalError)}`, "CLICK_FAILED");
   }
 }
 async function type(page, selector, text, opts) {
@@ -2031,17 +2347,35 @@ async function type(page, selector, text, opts) {
       await page.fill(selector, "", { timeout: opts?.timeout ?? 1e4 });
     }
     await page.type(selector, text, { delay: opts?.delay, timeout: opts?.timeout ?? 1e4 });
-  } catch (err) {
-    if (err instanceof Error && err.message.includes("not found")) {
+    return {};
+  } catch (originalError) {
+    if (opts?.selfHeal !== false) {
+      const result = await healSelector(page, selector);
+      if (result.found && result.locator) {
+        if (opts?.clear)
+          await result.locator.fill("", { timeout: opts?.timeout ?? 1e4 });
+        await result.locator.pressSequentially(text, { delay: opts?.delay, timeout: opts?.timeout ?? 1e4 });
+        return { healed: true, method: result.method, attempts: result.attempts };
+      }
+    }
+    if (originalError instanceof Error && originalError.message.includes("not found")) {
       throw new ElementNotFoundError(selector);
     }
-    throw new BrowserError(`Type failed on '${selector}': ${err instanceof Error ? err.message : String(err)}`, "TYPE_FAILED");
+    throw new BrowserError(`Type failed on '${selector}': ${originalError instanceof Error ? originalError.message : String(originalError)}`, "TYPE_FAILED");
   }
 }
-async function fill(page, selector, value, timeout = 1e4) {
+async function fill(page, selector, value, timeout = 1e4, selfHeal = true) {
   try {
     await page.fill(selector, value, { timeout });
-  } catch (err) {
+    return {};
+  } catch (originalError) {
+    if (selfHeal) {
+      const result = await healSelector(page, selector);
+      if (result.found && result.locator) {
+        await result.locator.fill(value, { timeout });
+        return { healed: true, method: result.method, attempts: result.attempts };
+      }
+    }
     throw new ElementNotFoundError(selector);
   }
 }
@@ -2166,12 +2500,39 @@ async function clickText(page, text, opts) {
     }
   }, { retries: opts?.retries ?? 1 });
 }
-async function fillForm(page, fields, submitSelector) {
+async function fillForm(page, fields, submitSelector, selfHeal = true) {
   let filled = 0;
   const errors2 = [];
+  const healedFields = [];
   for (const [selector, value] of Object.entries(fields)) {
     try {
-      const el = await page.$(selector);
+      let el = await page.$(selector);
+      if (!el && selfHeal) {
+        const result = await healSelector(page, selector);
+        if (result.found && result.locator) {
+          const handle = await result.locator.elementHandle();
+          if (handle) {
+            el = handle;
+            healedFields.push(selector);
+            const tagName2 = await result.locator.evaluate((e) => e.tagName.toLowerCase());
+            const inputType2 = await result.locator.evaluate((e) => e.type?.toLowerCase() ?? "text");
+            if (tagName2 === "select") {
+              await result.locator.selectOption(String(value));
+            } else if (tagName2 === "input" && (inputType2 === "checkbox" || inputType2 === "radio")) {
+              if (Boolean(value))
+                await result.locator.check();
+              else
+                await result.locator.uncheck();
+            } else {
+              await result.locator.fill(String(value));
+            }
+            filled++;
+            continue;
+          }
+        }
+        errors2.push(`${selector}: element not found`);
+        continue;
+      }
       if (!el) {
         errors2.push(`${selector}: element not found`);
         continue;
@@ -2198,11 +2559,21 @@ async function fillForm(page, fields, submitSelector) {
   if (submitSelector) {
     try {
       await page.click(submitSelector);
-    } catch (err) {
-      errors2.push(`submit(${submitSelector}): ${err instanceof Error ? err.message : String(err)}`);
+    } catch (submitErr) {
+      if (selfHeal) {
+        const result = await healSelector(page, submitSelector);
+        if (result.found && result.locator) {
+          await result.locator.click();
+          healedFields.push(submitSelector);
+        } else {
+          errors2.push(`submit(${submitSelector}): ${submitErr instanceof Error ? submitErr.message : String(submitErr)}`);
+        }
+      } else {
+        errors2.push(`submit(${submitSelector}): ${submitErr instanceof Error ? submitErr.message : String(submitErr)}`);
+      }
     }
   }
-  return { filled, errors: errors2, fields_attempted: Object.keys(fields).length };
+  return { filled, errors: errors2, fields_attempted: Object.keys(fields).length, ...healedFields.length > 0 ? { healed_fields: healedFields } : {} };
 }
 async function waitForText(page, text, opts) {
   const timeout = opts?.timeout ?? 1e4;
@@ -9057,6 +9428,237 @@ var init_gallery = __esm(() => {
   init_schema();
 });
 
+// src/db/recordings.ts
+import { randomUUID as randomUUID5 } from "crypto";
+function deserialize2(row) {
+  return {
+    ...row,
+    project_id: row.project_id ?? undefined,
+    start_url: row.start_url ?? undefined,
+    steps: JSON.parse(row.steps)
+  };
+}
+function createRecording(data) {
+  const db = getDatabase();
+  const id = randomUUID5();
+  db.prepare("INSERT INTO recordings (id, name, project_id, start_url, steps) VALUES (?, ?, ?, ?, ?)").run(id, data.name, data.project_id ?? null, data.start_url ?? null, JSON.stringify(data.steps ?? []));
+  return getRecording(id);
+}
+function getRecording(id) {
+  const db = getDatabase();
+  const row = db.query("SELECT * FROM recordings WHERE id = ?").get(id);
+  if (!row)
+    throw new RecordingNotFoundError(id);
+  return deserialize2(row);
+}
+function listRecordings(projectId) {
+  const db = getDatabase();
+  const rows = projectId ? db.query("SELECT * FROM recordings WHERE project_id = ? ORDER BY created_at DESC").all(projectId) : db.query("SELECT * FROM recordings ORDER BY created_at DESC").all();
+  return rows.map(deserialize2);
+}
+function updateRecording(id, data) {
+  const db = getDatabase();
+  const fields = [];
+  const values = [];
+  if (data.name !== undefined) {
+    fields.push("name = ?");
+    values.push(data.name);
+  }
+  if (data.steps !== undefined) {
+    fields.push("steps = ?");
+    values.push(JSON.stringify(data.steps));
+  }
+  if (data.start_url !== undefined) {
+    fields.push("start_url = ?");
+    values.push(data.start_url ?? null);
+  }
+  if (fields.length === 0)
+    return getRecording(id);
+  values.push(id);
+  db.prepare(`UPDATE recordings SET ${fields.join(", ")} WHERE id = ?`).run(...values);
+  return getRecording(id);
+}
+var init_recordings = __esm(() => {
+  init_schema();
+  init_types();
+});
+
+// src/lib/recorder.ts
+var exports_recorder = {};
+__export(exports_recorder, {
+  stopRecording: () => stopRecording,
+  startRecording: () => startRecording,
+  replayRecording: () => replayRecording,
+  recordStep: () => recordStep,
+  listRecordings: () => listRecordings,
+  getRecording: () => getRecording,
+  exportRecording: () => exportRecording,
+  attachPageListeners: () => attachPageListeners
+});
+function startRecording(sessionId, name, startUrl) {
+  const steps = [];
+  const recording = createRecording({ name, start_url: startUrl, steps });
+  activeRecordings.set(recording.id, {
+    id: recording.id,
+    steps,
+    cleanup: () => {}
+  });
+  return recording;
+}
+function attachPageListeners(page, recordingId) {
+  const active = activeRecordings.get(recordingId);
+  if (!active)
+    throw new BrowserError(`No active recording: ${recordingId}`, "RECORDING_NOT_ACTIVE");
+  const onFrameNav = () => {
+    active.steps.push({
+      type: "navigate",
+      url: page.url(),
+      timestamp: Date.now()
+    });
+  };
+  page.on("framenavigated", onFrameNav);
+  const cleanup = () => {
+    page.off("framenavigated", onFrameNav);
+  };
+  active.cleanup = cleanup;
+}
+function recordStep(recordingId, step) {
+  const active = activeRecordings.get(recordingId);
+  if (!active)
+    throw new BrowserError(`No active recording: ${recordingId}`, "RECORDING_NOT_ACTIVE");
+  active.steps.push({ ...step, timestamp: Date.now() });
+}
+function stopRecording(recordingId) {
+  const active = activeRecordings.get(recordingId);
+  if (!active)
+    throw new BrowserError(`No active recording: ${recordingId}`, "RECORDING_NOT_ACTIVE");
+  active.cleanup();
+  activeRecordings.delete(recordingId);
+  return updateRecording(recordingId, { steps: active.steps });
+}
+async function replayRecording(recordingId, page) {
+  const recording = getRecording(recordingId);
+  const startTime = Date.now();
+  let executed = 0;
+  let failed = 0;
+  const errors2 = [];
+  for (const step of recording.steps) {
+    try {
+      switch (step.type) {
+        case "navigate":
+          if (step.url)
+            await navigate(page, step.url);
+          break;
+        case "click":
+          if (step.selector)
+            await click(page, step.selector);
+          break;
+        case "type":
+          if (step.selector && step.value)
+            await type(page, step.selector, step.value);
+          break;
+        case "scroll":
+          await scroll(page, "down");
+          break;
+        case "hover":
+          if (step.selector) {
+            const el = await page.$(step.selector);
+            if (el)
+              await el.hover();
+          }
+          break;
+        case "evaluate":
+          if (step.value)
+            await page.evaluate(step.value);
+          break;
+        case "wait":
+          if (step.selector) {
+            await page.waitForSelector(step.selector, { timeout: 1e4 }).catch(() => {});
+          }
+          break;
+      }
+      executed++;
+    } catch (err) {
+      failed++;
+      errors2.push(`Step ${step.type} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  return {
+    recording_id: recordingId,
+    success: failed === 0,
+    steps_executed: executed,
+    steps_failed: failed,
+    errors: errors2,
+    duration_ms: Date.now() - startTime
+  };
+}
+function exportRecording(recordingId, format = "json") {
+  const recording = getRecording(recordingId);
+  if (format === "json") {
+    return JSON.stringify(recording, null, 2);
+  }
+  if (format === "playwright") {
+    const lines2 = [
+      `import { test, expect } from '@playwright/test';`,
+      ``,
+      `test('${recording.name}', async ({ page }) => {`
+    ];
+    for (const step of recording.steps) {
+      switch (step.type) {
+        case "navigate":
+          lines2.push(`  await page.goto('${step.url}');`);
+          break;
+        case "click":
+          lines2.push(`  await page.click('${step.selector}');`);
+          break;
+        case "type":
+          lines2.push(`  await page.type('${step.selector}', '${step.value}');`);
+          break;
+        case "scroll":
+          lines2.push(`  await page.evaluate(() => window.scrollBy(0, 300));`);
+          break;
+        case "evaluate":
+          lines2.push(`  await page.evaluate(${step.value});`);
+          break;
+      }
+    }
+    lines2.push(`});`);
+    return lines2.join(`
+`);
+  }
+  const lines = [
+    `const puppeteer = require('puppeteer');`,
+    ``,
+    `(async () => {`,
+    `  const browser = await puppeteer.launch();`,
+    `  const page = await browser.newPage();`
+  ];
+  for (const step of recording.steps) {
+    switch (step.type) {
+      case "navigate":
+        lines.push(`  await page.goto('${step.url}');`);
+        break;
+      case "click":
+        lines.push(`  await page.click('${step.selector}');`);
+        break;
+      case "type":
+        lines.push(`  await page.type('${step.selector}', '${step.value}');`);
+        break;
+    }
+  }
+  lines.push(`  await browser.close();`, `})();`);
+  return lines.join(`
+`);
+}
+var activeRecordings;
+var init_recorder = __esm(() => {
+  init_recordings();
+  init_actions();
+  init_types();
+  activeRecordings = new Map;
+});
+
 // src/lib/profiles.ts
 var exports_profiles = {};
 __export(exports_profiles, {
@@ -9066,23 +9668,23 @@ __export(exports_profiles, {
   deleteProfile: () => deleteProfile,
   applyProfile: () => applyProfile
 });
-import { mkdirSync as mkdirSync7, existsSync as existsSync3, readdirSync as readdirSync2, rmSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join7 } from "path";
-import { homedir as homedir7 } from "os";
+import { mkdirSync as mkdirSync8, existsSync as existsSync4, readdirSync as readdirSync3, rmSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join8 } from "path";
+import { homedir as homedir8 } from "os";
 function getProfilesDir() {
-  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join7(homedir7(), ".browser");
-  const dir = join7(dataDir, "profiles");
-  mkdirSync7(dir, { recursive: true });
+  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join8(homedir8(), ".browser");
+  const dir = join8(dataDir, "profiles");
+  mkdirSync8(dir, { recursive: true });
   return dir;
 }
 function getProfileDir2(name) {
-  return join7(getProfilesDir(), name);
+  return join8(getProfilesDir(), name);
 }
 async function saveProfile(page, name) {
   const dir = getProfileDir2(name);
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync8(dir, { recursive: true });
   const cookies = await page.context().cookies();
-  writeFileSync2(join7(dir, "cookies.json"), JSON.stringify(cookies, null, 2));
+  writeFileSync2(join8(dir, "cookies.json"), JSON.stringify(cookies, null, 2));
   let localStorage2 = {};
   try {
     localStorage2 = await page.evaluate(() => {
@@ -9094,11 +9696,11 @@ async function saveProfile(page, name) {
       return result;
     });
   } catch {}
-  writeFileSync2(join7(dir, "storage.json"), JSON.stringify(localStorage2, null, 2));
+  writeFileSync2(join8(dir, "storage.json"), JSON.stringify(localStorage2, null, 2));
   const savedAt = new Date().toISOString();
   const url = page.url();
   const meta = { saved_at: savedAt, url };
-  writeFileSync2(join7(dir, "meta.json"), JSON.stringify(meta, null, 2));
+  writeFileSync2(join8(dir, "meta.json"), JSON.stringify(meta, null, 2));
   return {
     name,
     saved_at: savedAt,
@@ -9109,17 +9711,17 @@ async function saveProfile(page, name) {
 }
 function loadProfile(name) {
   const dir = getProfileDir2(name);
-  if (!existsSync3(dir)) {
+  if (!existsSync4(dir)) {
     throw new Error(`Profile not found: ${name}`);
   }
-  const cookiesPath = join7(dir, "cookies.json");
-  const storagePath = join7(dir, "storage.json");
-  const metaPath2 = join7(dir, "meta.json");
-  const cookies = existsSync3(cookiesPath) ? JSON.parse(readFileSync2(cookiesPath, "utf8")) : [];
-  const localStorage2 = existsSync3(storagePath) ? JSON.parse(readFileSync2(storagePath, "utf8")) : {};
+  const cookiesPath = join8(dir, "cookies.json");
+  const storagePath = join8(dir, "storage.json");
+  const metaPath2 = join8(dir, "meta.json");
+  const cookies = existsSync4(cookiesPath) ? JSON.parse(readFileSync2(cookiesPath, "utf8")) : [];
+  const localStorage2 = existsSync4(storagePath) ? JSON.parse(readFileSync2(storagePath, "utf8")) : {};
   let savedAt = new Date().toISOString();
   let url;
-  if (existsSync3(metaPath2)) {
+  if (existsSync4(metaPath2)) {
     const meta = JSON.parse(readFileSync2(metaPath2, "utf8"));
     savedAt = meta.saved_at ?? savedAt;
     url = meta.url;
@@ -9147,33 +9749,33 @@ async function applyProfile(page, profileData) {
 }
 function listProfiles() {
   const dir = getProfilesDir();
-  if (!existsSync3(dir))
+  if (!existsSync4(dir))
     return [];
-  const entries = readdirSync2(dir, { withFileTypes: true });
+  const entries = readdirSync3(dir, { withFileTypes: true });
   const profiles = [];
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
     const name = entry.name;
-    const profileDir = join7(dir, name);
+    const profileDir = join8(dir, name);
     let savedAt = "";
     let url;
     let cookieCount = 0;
     let storageKeyCount = 0;
     try {
-      const metaPath2 = join7(profileDir, "meta.json");
-      if (existsSync3(metaPath2)) {
+      const metaPath2 = join8(profileDir, "meta.json");
+      if (existsSync4(metaPath2)) {
         const meta = JSON.parse(readFileSync2(metaPath2, "utf8"));
         savedAt = meta.saved_at ?? "";
         url = meta.url;
       }
-      const cookiesPath = join7(profileDir, "cookies.json");
-      if (existsSync3(cookiesPath)) {
+      const cookiesPath = join8(profileDir, "cookies.json");
+      if (existsSync4(cookiesPath)) {
         const cookies = JSON.parse(readFileSync2(cookiesPath, "utf8"));
         cookieCount = Array.isArray(cookies) ? cookies.length : 0;
       }
-      const storagePath = join7(profileDir, "storage.json");
-      if (existsSync3(storagePath)) {
+      const storagePath = join8(profileDir, "storage.json");
+      if (existsSync4(storagePath)) {
         const storage = JSON.parse(readFileSync2(storagePath, "utf8"));
         storageKeyCount = Object.keys(storage).length;
       }
@@ -9190,7 +9792,7 @@ function listProfiles() {
 }
 function deleteProfile(name) {
   const dir = getProfileDir2(name);
-  if (!existsSync3(dir))
+  if (!existsSync4(dir))
     return false;
   try {
     rmSync(dir, { recursive: true, force: true });
@@ -9201,6 +9803,97 @@ function deleteProfile(name) {
 }
 var init_profiles = () => {};
 
+// src/lib/sanitize.ts
+var exports_sanitize = {};
+__export(exports_sanitize, {
+  sanitizeText: () => sanitizeText,
+  sanitizeHTML: () => sanitizeHTML
+});
+function sanitizeText(text) {
+  let stripped = 0;
+  const warnings = [];
+  let clean = text;
+  for (const pattern of INJECTION_PATTERNS) {
+    pattern.lastIndex = 0;
+    const matches = clean.match(pattern);
+    if (matches) {
+      stripped += matches.length;
+      warnings.push(`Stripped ${matches.length}x: ${pattern.source}`);
+      pattern.lastIndex = 0;
+      clean = clean.replace(pattern, "[STRIPPED]");
+    }
+  }
+  return { text: clean, stripped, warnings };
+}
+function sanitizeHTML(html) {
+  let stripped = 0;
+  const warnings = [];
+  let clean = html;
+  const commentMatches = clean.match(/<!--[\s\S]*?-->/g);
+  if (commentMatches) {
+    for (const comment of commentMatches) {
+      if (comment.replace(/<!--\s*-->/g, "").trim().length > 20) {
+        stripped++;
+        warnings.push(`Stripped HTML comment (${comment.length} chars)`);
+      }
+    }
+    clean = clean.replace(/<!--[\s\S]*?-->/g, "");
+  }
+  const hiddenPatterns = [
+    /style\s*=\s*"[^"]*display\s*:\s*none[^"]*"[^>]*>[\s\S]*?<\//gi,
+    /style\s*=\s*"[^"]*visibility\s*:\s*hidden[^"]*"[^>]*>[\s\S]*?<\//gi,
+    /style\s*=\s*"[^"]*opacity\s*:\s*0[^"]*"[^>]*>[\s\S]*?<\//gi,
+    /style\s*=\s*"[^"]*font-size\s*:\s*0[^"]*"[^>]*>[\s\S]*?<\//gi,
+    /style\s*=\s*"[^"]*position\s*:\s*absolute[^"]*left\s*:\s*-\d{4,}[^"]*"[^>]*>[\s\S]*?<\//gi
+  ];
+  for (const pattern of hiddenPatterns) {
+    pattern.lastIndex = 0;
+    const matches = clean.match(pattern);
+    if (matches) {
+      stripped += matches.length;
+      warnings.push(`Stripped ${matches.length} hidden elements`);
+      pattern.lastIndex = 0;
+      clean = clean.replace(pattern, "");
+    }
+  }
+  const ariaHiddenPattern = /aria-hidden\s*=\s*"true"[^>]*>[\s\S]*?<\//gi;
+  const ariaHidden = clean.match(ariaHiddenPattern);
+  if (ariaHidden) {
+    stripped += ariaHidden.length;
+    warnings.push(`Stripped ${ariaHidden.length} aria-hidden elements`);
+    ariaHiddenPattern.lastIndex = 0;
+    clean = clean.replace(ariaHiddenPattern, "");
+  }
+  const textResult = sanitizeText(clean);
+  return {
+    text: textResult.text,
+    stripped: stripped + textResult.stripped,
+    warnings: [...warnings, ...textResult.warnings]
+  };
+}
+var INJECTION_PATTERNS;
+var init_sanitize = __esm(() => {
+  INJECTION_PATTERNS = [
+    /ignore\s+(all\s+)?previous\s+instructions/gi,
+    /ignore\s+(all\s+)?prior\s+instructions/gi,
+    /disregard\s+(all\s+)?previous/gi,
+    /forget\s+(all\s+)?previous/gi,
+    /you\s+are\s+now\s+/gi,
+    /new\s+instructions?\s*:/gi,
+    /system\s+prompt\s*:/gi,
+    /\[INST\]/gi,
+    /\[\/INST\]/gi,
+    /<\|im_start\|>/gi,
+    /<\|im_end\|>/gi,
+    /<<SYS>>/gi,
+    /<<\/SYS>>/gi,
+    /IMPORTANT:\s*ignore/gi,
+    /CRITICAL:\s*override/gi,
+    /assistant:\s/gi,
+    /human:\s/gi
+  ];
+});
+
 // src/lib/annotate.ts
 var exports_annotate = {};
 __export(exports_annotate, {
@@ -9261,26 +9954,213 @@ var init_annotate = __esm(() => {
   import_sharp3 = __toESM(require_lib(), 1);
 });
 
+// src/lib/auth-flow.ts
+var exports_auth_flow = {};
+__export(exports_auth_flow, {
+  tryReplayAuth: () => tryReplayAuth,
+  touchAuthFlow: () => touchAuthFlow,
+  saveAuthFlow: () => saveAuthFlow,
+  listAuthFlows: () => listAuthFlows,
+  isAuthRedirect: () => isAuthRedirect,
+  isAuthPage: () => isAuthPage,
+  getAuthFlowByName: () => getAuthFlowByName,
+  getAuthFlowByDomain: () => getAuthFlowByDomain,
+  getAuthFlow: () => getAuthFlow,
+  deleteAuthFlow: () => deleteAuthFlow
+});
+import { randomUUID as randomUUID10 } from "crypto";
+function saveAuthFlow(data) {
+  const db = getDatabase();
+  const id = randomUUID10();
+  db.prepare("INSERT OR REPLACE INTO auth_flows (id, name, domain, recording_id, storage_state_path) VALUES (?, ?, ?, ?, ?)").run(id, data.name, data.domain, data.recordingId ?? null, data.storageStatePath ?? null);
+  return getAuthFlow(id);
+}
+function getAuthFlow(id) {
+  const db = getDatabase();
+  return db.query("SELECT * FROM auth_flows WHERE id = ?").get(id) ?? null;
+}
+function getAuthFlowByName(name) {
+  const db = getDatabase();
+  return db.query("SELECT * FROM auth_flows WHERE name = ?").get(name) ?? null;
+}
+function getAuthFlowByDomain(domain) {
+  const db = getDatabase();
+  return db.query("SELECT * FROM auth_flows WHERE domain = ? ORDER BY last_used DESC LIMIT 1").get(domain) ?? null;
+}
+function listAuthFlows() {
+  const db = getDatabase();
+  return db.query("SELECT * FROM auth_flows ORDER BY last_used DESC, created_at DESC").all();
+}
+function deleteAuthFlow(name) {
+  const db = getDatabase();
+  const result = db.prepare("DELETE FROM auth_flows WHERE name = ?").run(name);
+  return result.changes > 0;
+}
+function touchAuthFlow(id) {
+  const db = getDatabase();
+  db.prepare("UPDATE auth_flows SET last_used = datetime('now') WHERE id = ?").run(id);
+}
+function isAuthPage(url) {
+  return AUTH_URL_PATTERNS.some((pattern) => pattern.test(url));
+}
+function isAuthRedirect(fromUrl, toUrl) {
+  if (fromUrl === toUrl)
+    return false;
+  return isAuthPage(toUrl) && !isAuthPage(fromUrl);
+}
+async function tryReplayAuth(page, domain) {
+  const flow = getAuthFlowByDomain(domain);
+  if (!flow)
+    return { replayed: false };
+  if (flow.storage_state_path) {
+    try {
+      const { existsSync: existsSync5, readFileSync: readFileSync3 } = await import("fs");
+      if (existsSync5(flow.storage_state_path)) {
+        const state = JSON.parse(readFileSync3(flow.storage_state_path, "utf8"));
+        if (state.cookies?.length) {
+          await page.context().addCookies(state.cookies);
+          await page.reload();
+          await new Promise((r) => setTimeout(r, 1000));
+          if (!isAuthPage(page.url())) {
+            touchAuthFlow(flow.id);
+            return { replayed: true, flow, method: "storage_state" };
+          }
+        }
+      }
+    } catch {}
+  }
+  if (flow.recording_id) {
+    try {
+      const { replayRecording: replayRecording2 } = await Promise.resolve().then(() => (init_recorder(), exports_recorder));
+      const result = await replayRecording2(flow.recording_id, page);
+      if (result.success) {
+        try {
+          const { saveStateFromPage: saveStateFromPage2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+          const path = await saveStateFromPage2(page, flow.name);
+          const db = getDatabase();
+          db.prepare("UPDATE auth_flows SET storage_state_path = ?, last_used = datetime('now') WHERE id = ?").run(path, flow.id);
+        } catch {}
+        touchAuthFlow(flow.id);
+        return { replayed: true, flow, method: "recording_replay" };
+      }
+    } catch {}
+  }
+  return { replayed: false, flow };
+}
+var AUTH_URL_PATTERNS;
+var init_auth_flow = __esm(() => {
+  init_schema();
+  AUTH_URL_PATTERNS = [
+    /\/login/i,
+    /\/signin/i,
+    /\/sign-in/i,
+    /\/auth/i,
+    /\/sso/i,
+    /\/oauth/i,
+    /\/cas\/login/i,
+    /accounts\.google\.com/i,
+    /login\.microsoftonline\.com/i,
+    /github\.com\/login/i,
+    /auth0\.com/i
+  ];
+});
+
+// src/lib/vision-fallback.ts
+var exports_vision_fallback = {};
+__export(exports_vision_fallback, {
+  findElementByVision: () => findElementByVision,
+  clickByVision: () => clickByVision
+});
+async function findElementByVision(page, description, opts) {
+  const model = opts?.model ?? process.env["BROWSER_VISION_MODEL"] ?? DEFAULT_MODEL;
+  const screenshot = await page.screenshot({ type: "jpeg", quality: 80 });
+  const base64 = screenshot.toString("base64");
+  const viewport = page.viewportSize() ?? { width: 1280, height: 720 };
+  const apiKey = process.env["ANTHROPIC_API_KEY"];
+  if (!apiKey) {
+    return { found: false, x: 0, y: 0, confidence: "none", description, model, error: "ANTHROPIC_API_KEY not set" };
+  }
+  try {
+    const response = await fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-api-key": apiKey,
+        "anthropic-version": "2023-06-01"
+      },
+      body: JSON.stringify({
+        model,
+        max_tokens: 256,
+        messages: [{
+          role: "user",
+          content: [
+            {
+              type: "image",
+              source: { type: "base64", media_type: "image/jpeg", data: base64 }
+            },
+            {
+              type: "text",
+              text: `Find the element matching this description: "${description}"
+
+The screenshot is ${viewport.width}x${viewport.height} pixels.
+
+Reply with ONLY a JSON object (no markdown, no explanation):
+{"found": true, "x": <pixel_x>, "y": <pixel_y>, "confidence": "high|medium|low", "description": "<what you found>"}
+
+If you cannot find the element:
+{"found": false, "x": 0, "y": 0, "confidence": "none", "description": "not found"}`
+            }
+          ]
+        }]
+      })
+    });
+    const data = await response.json();
+    const text = data.content?.[0]?.text ?? "";
+    const jsonStr = text.replace(/```json?\n?/g, "").replace(/```/g, "").trim();
+    const result = JSON.parse(jsonStr);
+    result.model = model;
+    return result;
+  } catch (err) {
+    return {
+      found: false,
+      x: 0,
+      y: 0,
+      confidence: "none",
+      description,
+      model,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function clickByVision(page, description, opts) {
+  const result = await findElementByVision(page, description, opts);
+  if (result.found && result.x > 0 && result.y > 0) {
+    await page.mouse.click(result.x, result.y);
+  }
+  return result;
+}
+var DEFAULT_MODEL = "claude-sonnet-4-5-20250929";
+
 // src/lib/auth.ts
 var exports_auth = {};
 __export(exports_auth, {
   loginWithCredentials: () => loginWithCredentials,
   getCredentials: () => getCredentials
 });
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { join as join8 } from "path";
-import { homedir as homedir8 } from "os";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { join as join9 } from "path";
+import { homedir as homedir9 } from "os";
 async function getCredentials(service) {
   try {
-    const { getSecret } = await import(`${homedir8()}/Workspace/hasna/opensource/opensourcedev/open-secrets/src/store.js`);
+    const { getSecret } = await import(`${homedir9()}/Workspace/hasna/opensource/opensourcedev/open-secrets/src/store.js`);
     const email = getSecret(`${service}_email`) ?? getSecret(`${service}_username`) ?? getSecret(`${service}_login`);
     const password = getSecret(`${service}_password`) ?? getSecret(`${service}_pass`);
     if (email?.value && password?.value) {
       return { email: email.value, password: password.value };
     }
   } catch {}
-  const secretsPath = join8(homedir8(), ".secrets");
-  if (existsSync4(secretsPath)) {
+  const secretsPath = join9(homedir9(), ".secrets");
+  if (existsSync5(secretsPath)) {
     const content = readFileSync3(secretsPath, "utf8");
     const lines = content.split(`
 `);
@@ -9457,14 +10337,14 @@ __export(exports_dist, {
   InvalidScopeError: () => InvalidScopeError,
   EntityNotFoundError: () => EntityNotFoundError,
   DuplicateMemoryError: () => DuplicateMemoryError,
-  DEFAULT_MODEL: () => DEFAULT_MODEL,
+  DEFAULT_MODEL: () => DEFAULT_MODEL2,
   DEFAULT_CONFIG: () => DEFAULT_CONFIG
 });
 import { Database as Database2 } from "bun:sqlite";
-import { existsSync as existsSync5, mkdirSync as mkdirSync8 } from "fs";
-import { dirname, join as join9, resolve } from "path";
-import { existsSync as existsSync22, mkdirSync as mkdirSync22, readFileSync as readFileSync4, readdirSync as readdirSync3, writeFileSync as writeFileSync3, unlinkSync as unlinkSync2 } from "fs";
-import { homedir as homedir9 } from "os";
+import { existsSync as existsSync6, mkdirSync as mkdirSync9 } from "fs";
+import { dirname, join as join10, resolve } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync22, readFileSync as readFileSync4, readdirSync as readdirSync4, writeFileSync as writeFileSync3, unlinkSync as unlinkSync3 } from "fs";
+import { homedir as homedir10 } from "os";
 import { basename as basename2, dirname as dirname2, join as join22, resolve as resolve2 } from "path";
 import { existsSync as existsSync32, mkdirSync as mkdirSync32, readFileSync as readFileSync22, writeFileSync as writeFileSync22 } from "fs";
 import { homedir as homedir22 } from "os";
@@ -9478,8 +10358,8 @@ function isInMemoryDb(path) {
 function findNearestMementosDb(startDir) {
   let dir = resolve(startDir);
   while (true) {
-    const candidate = join9(dir, ".mementos", "mementos.db");
-    if (existsSync5(candidate))
+    const candidate = join10(dir, ".mementos", "mementos.db");
+    if (existsSync6(candidate))
       return candidate;
     const parent = dirname(dir);
     if (parent === dir)
@@ -9491,7 +10371,7 @@ function findNearestMementosDb(startDir) {
 function findGitRoot(startDir) {
   let dir = resolve(startDir);
   while (true) {
-    if (existsSync5(join9(dir, ".git")))
+    if (existsSync6(join10(dir, ".git")))
       return dir;
     const parent = dirname(dir);
     if (parent === dir)
@@ -9511,25 +10391,25 @@ function getDbPath() {
   if (process.env["MEMENTOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot(cwd);
     if (gitRoot) {
-      return join9(gitRoot, ".mementos", "mementos.db");
+      return join10(gitRoot, ".mementos", "mementos.db");
     }
   }
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  return join9(home, ".mementos", "mementos.db");
+  return join10(home, ".mementos", "mementos.db");
 }
-function ensureDir(filePath) {
+function ensureDir2(filePath) {
   if (isInMemoryDb(filePath))
     return;
   const dir = dirname(resolve(filePath));
-  if (!existsSync5(dir)) {
-    mkdirSync8(dir, { recursive: true });
+  if (!existsSync6(dir)) {
+    mkdirSync9(dir, { recursive: true });
   }
 }
 function getDatabase2(dbPath) {
   if (_db2)
     return _db2;
   const path = dbPath || getDbPath();
-  ensureDir(path);
+  ensureDir2(path);
   _db2 = new Database2(path, { create: true });
   _db2.run("PRAGMA journal_mode = WAL");
   _db2.run("PRAGMA busy_timeout = 5000");
@@ -11372,7 +12252,7 @@ function isValidCategory(value) {
   return VALID_CATEGORIES.includes(value);
 }
 function loadConfig() {
-  const configPath = join22(homedir9(), ".mementos", "config.json");
+  const configPath = join22(homedir10(), ".mementos", "config.json");
   let fileConfig = {};
   if (existsSync22(configPath)) {
     try {
@@ -11399,10 +12279,10 @@ function loadConfig() {
   return merged;
 }
 function profilesDir() {
-  return join22(homedir9(), ".mementos", "profiles");
+  return join22(homedir10(), ".mementos", "profiles");
 }
 function globalConfigPath() {
-  return join22(homedir9(), ".mementos", "config.json");
+  return join22(homedir10(), ".mementos", "config.json");
 }
 function readGlobalConfig() {
   const p = globalConfigPath();
@@ -11416,7 +12296,7 @@ function readGlobalConfig() {
 }
 function writeGlobalConfig(data) {
   const p = globalConfigPath();
-  ensureDir2(dirname2(p));
+  ensureDir22(dirname2(p));
   writeFileSync3(p, JSON.stringify(data, null, 2), "utf-8");
 }
 function getActiveProfile() {
@@ -11439,18 +12319,18 @@ function listProfiles2() {
   const dir = profilesDir();
   if (!existsSync22(dir))
     return [];
-  return readdirSync3(dir).filter((f) => f.endsWith(".db")).map((f) => basename2(f, ".db")).sort();
+  return readdirSync4(dir).filter((f) => f.endsWith(".db")).map((f) => basename2(f, ".db")).sort();
 }
 function deleteProfile2(name) {
   const dbPath = join22(profilesDir(), `${name}.db`);
   if (!existsSync22(dbPath))
     return false;
-  unlinkSync2(dbPath);
+  unlinkSync3(dbPath);
   if (getActiveProfile() === name)
     setActiveProfile(null);
   return true;
 }
-function ensureDir2(dir) {
+function ensureDir22(dir) {
   if (!existsSync22(dir)) {
     mkdirSync22(dir, { recursive: true });
   }
@@ -12572,7 +13452,7 @@ function writeConfig(config) {
 }
 function getActiveModel() {
   const config = readConfig();
-  return config.activeModel ?? DEFAULT_MODEL;
+  return config.activeModel ?? DEFAULT_MODEL2;
 }
 function setActiveModel(modelId) {
   const config = readConfig();
@@ -12646,7 +13526,7 @@ Return JSON with this exact shape:
     examples: finalExamples,
     count: finalExamples.length
   };
-}, DEFAULT_MODEL = "gpt-4o-mini", CONFIG_DIR, CONFIG_PATH;
+}, DEFAULT_MODEL2 = "gpt-4o-mini", CONFIG_DIR, CONFIG_PATH;
 var init_dist = __esm(() => {
   __defProp2 = Object.defineProperty;
   exports_database = {};
@@ -14082,10 +14962,10 @@ __export(exports_dist2, {
   acquireLock: () => acquireLock2
 });
 import { Database as Database3 } from "bun:sqlite";
-import { mkdirSync as mkdirSync9 } from "fs";
-import { join as join10, dirname as dirname3 } from "path";
-import { homedir as homedir10 } from "os";
-import { randomUUID as randomUUID10 } from "crypto";
+import { mkdirSync as mkdirSync10 } from "fs";
+import { join as join11, dirname as dirname3 } from "path";
+import { homedir as homedir11 } from "os";
+import { randomUUID as randomUUID11 } from "crypto";
 import { mkdirSync as mkdirSync23, copyFileSync as copyFileSync3, statSync as statSync2 } from "fs";
 import { join as join33 } from "path";
 import { homedir as homedir33 } from "os";
@@ -14099,13 +14979,13 @@ import { homedir as homedir42 } from "os";
 function getDbPath2() {
   if (process.env.CONVERSATIONS_DB_PATH)
     return process.env.CONVERSATIONS_DB_PATH;
-  return join10(homedir10(), ".conversations", "messages.db");
+  return join11(homedir11(), ".conversations", "messages.db");
 }
 function getDb() {
   if (db)
     return db;
   const dbPath = getDbPath2();
-  mkdirSync9(dirname3(dbPath), { recursive: true });
+  mkdirSync10(dirname3(dbPath), { recursive: true });
   db = new Database3(dbPath, { create: true });
   db.exec("PRAGMA journal_mode = WAL");
   db.exec("PRAGMA busy_timeout = 5000");
@@ -14465,7 +15345,7 @@ function guessMimeType(name) {
 function sendMessage(opts) {
   const db2 = getDb();
   const explicitSession = opts.session_id && opts.session_id.trim().length > 0 ? opts.session_id : undefined;
-  const sessionId = explicitSession ?? (opts.space ? `space:${opts.space}` : `${[opts.from, opts.to].sort().join("-")}-${randomUUID10().slice(0, 8)}`);
+  const sessionId = explicitSession ?? (opts.space ? `space:${opts.space}` : `${[opts.from, opts.to].sort().join("-")}-${randomUUID11().slice(0, 8)}`);
   const metadata = opts.metadata ? JSON.stringify(opts.metadata) : null;
   const normalizedPriority = opts.priority === "low" || opts.priority === "normal" || opts.priority === "high" || opts.priority === "urgent" ? opts.priority : "normal";
   const blocking = opts.blocking ? 1 : 0;
@@ -18507,11 +19387,11 @@ __export(exports_dist3, {
   AgentNotFoundError: () => AgentNotFoundError2
 });
 import { Database as Database4 } from "bun:sqlite";
-import { existsSync as existsSync6, mkdirSync as mkdirSync10 } from "fs";
-import { dirname as dirname5, join as join11, resolve as resolve3 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync11 } from "fs";
+import { dirname as dirname5, join as join12, resolve as resolve3 } from "path";
 import { existsSync as existsSync33 } from "fs";
 import { join as join34 } from "path";
-import { existsSync as existsSync23, mkdirSync as mkdirSync24, readFileSync as readFileSync6, readdirSync as readdirSync4, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync24, readFileSync as readFileSync6, readdirSync as readdirSync5, statSync as statSync3, writeFileSync as writeFileSync5 } from "fs";
 import { join as join24 } from "path";
 import { existsSync as existsSync43, readFileSync as readFileSync24, readdirSync as readdirSync22, writeFileSync as writeFileSync23 } from "fs";
 import { join as join44 } from "path";
@@ -18741,8 +19621,8 @@ function isInMemoryDb2(path) {
 function findNearestTodosDb(startDir) {
   let dir = resolve3(startDir);
   while (true) {
-    const candidate = join11(dir, ".todos", "todos.db");
-    if (existsSync6(candidate))
+    const candidate = join12(dir, ".todos", "todos.db");
+    if (existsSync7(candidate))
       return candidate;
     const parent = dirname5(dir);
     if (parent === dir)
@@ -18754,7 +19634,7 @@ function findNearestTodosDb(startDir) {
 function findGitRoot2(startDir) {
   let dir = resolve3(startDir);
   while (true) {
-    if (existsSync6(join11(dir, ".git")))
+    if (existsSync7(join12(dir, ".git")))
       return dir;
     const parent = dirname5(dir);
     if (parent === dir)
@@ -18774,18 +19654,18 @@ function getDbPath3() {
   if (process.env["TODOS_DB_SCOPE"] === "project") {
     const gitRoot = findGitRoot2(cwd);
     if (gitRoot) {
-      return join11(gitRoot, ".todos", "todos.db");
+      return join12(gitRoot, ".todos", "todos.db");
     }
   }
   const home = process.env["HOME"] || process.env["USERPROFILE"] || "~";
-  return join11(home, ".todos", "todos.db");
+  return join12(home, ".todos", "todos.db");
 }
 function ensureDir3(filePath) {
   if (isInMemoryDb2(filePath))
     return;
   const dir = dirname5(resolve3(filePath));
-  if (!existsSync6(dir)) {
-    mkdirSync10(dir, { recursive: true });
+  if (!existsSync7(dir)) {
+    mkdirSync11(dir, { recursive: true });
   }
 }
 function getDatabase3(dbPath) {
@@ -19244,14 +20124,14 @@ function ensureProject2(name, path, db2) {
   }
   return createProject3({ name, path }, d);
 }
-function ensureDir22(dir) {
+function ensureDir23(dir) {
   if (!existsSync23(dir))
     mkdirSync24(dir, { recursive: true });
 }
 function listJsonFiles(dir) {
   if (!existsSync23(dir))
     return [];
-  return readdirSync4(dir).filter((f) => f.endsWith(".json"));
+  return readdirSync5(dir).filter((f) => f.endsWith(".json"));
 }
 function readJsonFile(path) {
   try {
@@ -22116,7 +22996,7 @@ function taskToClaudeTask(task, claudeTaskId, existingMeta) {
 function pushToClaudeTaskList(taskListId, projectId, options = {}) {
   const dir = getTaskListDir(taskListId);
   if (!existsSync43(dir))
-    ensureDir22(dir);
+    ensureDir23(dir);
   const filter = {};
   if (projectId)
     filter["project_id"] = projectId;
@@ -22334,7 +23214,7 @@ function metadataKey(agent) {
 function pushToAgentTaskList(agent, taskListId, projectId, options = {}) {
   const dir = getTaskListDir2(agent, taskListId);
   if (!existsSync52(dir))
-    ensureDir22(dir);
+    ensureDir23(dir);
   const filter = {};
   if (projectId)
     filter["project_id"] = projectId;
@@ -23862,9 +24742,9 @@ __export(exports_dist4, {
   CATEGORIES: () => CATEGORIES,
   AGENT_TARGETS: () => AGENT_TARGETS
 });
-import { existsSync as existsSync7, cpSync, mkdirSync as mkdirSync11, writeFileSync as writeFileSync6, rmSync as rmSync2, readdirSync as readdirSync5, statSync as statSync4, readFileSync as readFileSync7, accessSync, constants } from "fs";
-import { join as join12, dirname as dirname6 } from "path";
-import { homedir as homedir11 } from "os";
+import { existsSync as existsSync8, cpSync, mkdirSync as mkdirSync12, writeFileSync as writeFileSync6, rmSync as rmSync2, readdirSync as readdirSync6, statSync as statSync4, readFileSync as readFileSync7, accessSync, constants } from "fs";
+import { join as join13, dirname as dirname6 } from "path";
+import { homedir as homedir12 } from "os";
 import { fileURLToPath } from "url";
 import { existsSync as existsSync24, readFileSync as readFileSync25, readdirSync as readdirSync23 } from "fs";
 import { join as join25 } from "path";
@@ -23975,35 +24855,35 @@ function normalizeSkillName(name) {
 function findSkillsDir() {
   let dir = __dirname2;
   for (let i = 0;i < 5; i++) {
-    const candidate = join12(dir, "skills");
-    if (existsSync7(candidate)) {
+    const candidate = join13(dir, "skills");
+    if (existsSync8(candidate)) {
       return candidate;
     }
     dir = dirname6(dir);
   }
-  return join12(__dirname2, "..", "skills");
+  return join13(__dirname2, "..", "skills");
 }
 function getSkillPath(name) {
   const skillName = normalizeSkillName(name);
-  return join12(SKILLS_DIR, skillName);
+  return join13(SKILLS_DIR, skillName);
 }
 function skillExists(name) {
-  return existsSync7(getSkillPath(name));
+  return existsSync8(getSkillPath(name));
 }
 function installSkill(name, options = {}) {
   const { targetDir = process.cwd(), overwrite = false } = options;
   const skillName = normalizeSkillName(name);
   const sourcePath = getSkillPath(name);
-  const destDir = join12(targetDir, ".skills");
-  const destPath = join12(destDir, skillName);
-  if (!existsSync7(sourcePath)) {
+  const destDir = join13(targetDir, ".skills");
+  const destPath = join13(destDir, skillName);
+  if (!existsSync8(sourcePath)) {
     return {
       skill: name,
       success: false,
       error: `Skill '${name}' not found`
     };
   }
-  if (existsSync7(destPath) && !overwrite) {
+  if (existsSync8(destPath) && !overwrite) {
     return {
       skill: name,
       success: false,
@@ -24012,10 +24892,10 @@ function installSkill(name, options = {}) {
     };
   }
   try {
-    if (!existsSync7(destDir)) {
-      mkdirSync11(destDir, { recursive: true });
+    if (!existsSync8(destDir)) {
+      mkdirSync12(destDir, { recursive: true });
     }
-    if (existsSync7(destPath) && overwrite) {
+    if (existsSync8(destPath) && overwrite) {
       rmSync2(destPath, { recursive: true, force: true });
     }
     cpSync(sourcePath, destPath, {
@@ -24054,10 +24934,10 @@ function installSkills(names, options = {}) {
   return names.map((name) => installSkill(name, options));
 }
 function updateSkillsIndex(skillsDir) {
-  const indexPath = join12(skillsDir, "index.ts");
+  const indexPath = join13(skillsDir, "index.ts");
   const meta = loadMeta(skillsDir);
   const disabledSet = new Set(meta.disabled || []);
-  const skills = readdirSync5(skillsDir).filter((f) => f.startsWith("skill-") && !f.includes(".") && !disabledSet.has(f.replace("skill-", "")));
+  const skills = readdirSync6(skillsDir).filter((f) => f.startsWith("skill-") && !f.includes(".") && !disabledSet.has(f.replace("skill-", "")));
   const exports = skills.map((s) => {
     const name = s.replace("skill-", "").replace(/-/g, "_");
     return `export * as ${name} from './${s}/src/index.js';`;
@@ -24073,11 +24953,11 @@ ${exports}
   writeFileSync6(indexPath, content);
 }
 function getMetaPath(skillsDir) {
-  return join12(skillsDir, ".meta.json");
+  return join13(skillsDir, ".meta.json");
 }
 function loadMeta(skillsDir) {
   const metaPath2 = getMetaPath(skillsDir);
-  if (existsSync7(metaPath2)) {
+  if (existsSync8(metaPath2)) {
     try {
       return JSON.parse(readFileSync7(metaPath2, "utf-8"));
     } catch {}
@@ -24092,8 +24972,8 @@ function recordInstall(skillsDir, name) {
   const skillName = normalizeSkillName(name);
   let version = "unknown";
   try {
-    const pkgPath = join12(skillsDir, skillName, "package.json");
-    if (existsSync7(pkgPath)) {
+    const pkgPath = join13(skillsDir, skillName, "package.json");
+    if (existsSync8(pkgPath)) {
       const pkg = JSON.parse(readFileSync7(pkgPath, "utf-8"));
       version = pkg.version || "unknown";
     }
@@ -24107,12 +24987,12 @@ function recordRemove(skillsDir, name) {
   saveMeta(skillsDir, meta);
 }
 function getInstallMeta(targetDir = process.cwd()) {
-  return loadMeta(join12(targetDir, ".skills"));
+  return loadMeta(join13(targetDir, ".skills"));
 }
 function disableSkill(name, targetDir = process.cwd()) {
-  const skillsDir = join12(targetDir, ".skills");
+  const skillsDir = join13(targetDir, ".skills");
   const skillName = normalizeSkillName(name);
-  if (!existsSync7(join12(skillsDir, skillName)))
+  if (!existsSync8(join13(skillsDir, skillName)))
     return false;
   const meta = loadMeta(skillsDir);
   const disabled = new Set(meta.disabled || []);
@@ -24125,7 +25005,7 @@ function disableSkill(name, targetDir = process.cwd()) {
   return true;
 }
 function enableSkill(name, targetDir = process.cwd()) {
-  const skillsDir = join12(targetDir, ".skills");
+  const skillsDir = join13(targetDir, ".skills");
   const meta = loadMeta(skillsDir);
   const disabled = new Set(meta.disabled || []);
   if (!disabled.has(name))
@@ -24137,24 +25017,24 @@ function enableSkill(name, targetDir = process.cwd()) {
   return true;
 }
 function getDisabledSkills(targetDir = process.cwd()) {
-  const meta = loadMeta(join12(targetDir, ".skills"));
+  const meta = loadMeta(join13(targetDir, ".skills"));
   return meta.disabled || [];
 }
 function getInstalledSkills(targetDir = process.cwd()) {
-  const skillsDir = join12(targetDir, ".skills");
-  if (!existsSync7(skillsDir)) {
+  const skillsDir = join13(targetDir, ".skills");
+  if (!existsSync8(skillsDir)) {
     return [];
   }
-  return readdirSync5(skillsDir).filter((f) => {
-    const fullPath = join12(skillsDir, f);
+  return readdirSync6(skillsDir).filter((f) => {
+    const fullPath = join13(skillsDir, f);
     return f.startsWith("skill-") && statSync4(fullPath).isDirectory();
   }).map((f) => f.replace("skill-", ""));
 }
 function removeSkill(name, targetDir = process.cwd()) {
   const skillName = normalizeSkillName(name);
-  const skillsDir = join12(targetDir, ".skills");
-  const skillPath = join12(skillsDir, skillName);
-  if (!existsSync7(skillPath)) {
+  const skillsDir = join13(targetDir, ".skills");
+  const skillPath = join13(skillsDir, skillName);
+  if (!existsSync8(skillPath)) {
     return false;
   }
   rmSync2(skillPath, { recursive: true, force: true });
@@ -24165,24 +25045,24 @@ function removeSkill(name, targetDir = process.cwd()) {
 function getAgentSkillsDir(agent, scope = "global", projectDir) {
   const agentDir = `.${agent}`;
   if (scope === "project") {
-    return join12(projectDir || process.cwd(), agentDir, "skills");
+    return join13(projectDir || process.cwd(), agentDir, "skills");
   }
-  return join12(homedir11(), agentDir, "skills");
+  return join13(homedir12(), agentDir, "skills");
 }
 function getAgentSkillPath(name, agent, scope = "global", projectDir) {
   const skillName = normalizeSkillName(name);
-  return join12(getAgentSkillsDir(agent, scope, projectDir), skillName);
+  return join13(getAgentSkillsDir(agent, scope, projectDir), skillName);
 }
 function installSkillForAgent(name, options, generateSkillMd) {
   const { agent, scope = "global", projectDir } = options;
   const skillName = normalizeSkillName(name);
   const sourcePath = getSkillPath(name);
-  if (!existsSync7(sourcePath)) {
+  if (!existsSync8(sourcePath)) {
     return { skill: name, success: false, error: `Skill '${name}' not found` };
   }
   let skillMdContent = null;
-  const skillMdPath = join12(sourcePath, "SKILL.md");
-  if (existsSync7(skillMdPath)) {
+  const skillMdPath = join13(sourcePath, "SKILL.md");
+  if (existsSync8(skillMdPath)) {
     skillMdContent = readFileSync7(skillMdPath, "utf-8");
   } else if (generateSkillMd) {
     skillMdContent = generateSkillMd(name);
@@ -24192,8 +25072,8 @@ function installSkillForAgent(name, options, generateSkillMd) {
   }
   const destDir = getAgentSkillPath(name, agent, scope, projectDir);
   if (scope === "global") {
-    const agentBaseDir2 = join12(homedir11(), `.${agent}`);
-    if (!existsSync7(agentBaseDir2)) {
+    const agentBaseDir2 = join13(homedir12(), `.${agent}`);
+    if (!existsSync8(agentBaseDir2)) {
       const agentLabels = {
         claude: "Claude Code",
         codex: "Codex CLI",
@@ -24216,8 +25096,8 @@ function installSkillForAgent(name, options, generateSkillMd) {
     }
   }
   try {
-    mkdirSync11(destDir, { recursive: true });
-    writeFileSync6(join12(destDir, "SKILL.md"), skillMdContent);
+    mkdirSync12(destDir, { recursive: true });
+    writeFileSync6(join13(destDir, "SKILL.md"), skillMdContent);
     return { skill: name, success: true, path: destDir };
   } catch (error) {
     return {
@@ -24230,7 +25110,7 @@ function installSkillForAgent(name, options, generateSkillMd) {
 function removeSkillForAgent(name, options) {
   const { agent, scope = "global", projectDir } = options;
   const destDir = getAgentSkillPath(name, agent, scope, projectDir);
-  if (!existsSync7(destDir)) {
+  if (!existsSync8(destDir)) {
     return false;
   }
   rmSync2(destDir, { recursive: true, force: true });
@@ -26154,7 +27034,7 @@ __export(exports_cron_manager, {
   deleteCronJob: () => deleteCronJob,
   createCronJob: () => createCronJob
 });
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 function ensureCronTable() {
   const db2 = getDatabase();
   db2.exec(`
@@ -26183,7 +27063,7 @@ function ensureCronTable() {
 function createCronJob(schedule, task, name) {
   ensureCronTable();
   const db2 = getDatabase();
-  const id = randomUUID11();
+  const id = randomUUID12();
   db2.prepare(`
     INSERT INTO cron_jobs (id, name, schedule, task_json, enabled)
     VALUES (?, ?, ?, ?, 1)
@@ -26241,7 +27121,7 @@ function getCronEvents(jobId, limit = 10) {
 async function executeCronJob(job) {
   ensureCronTable();
   const db2 = getDatabase();
-  const eventId = randomUUID11();
+  const eventId = randomUUID12();
   const startedAt = new Date().toISOString();
   db2.prepare("INSERT INTO cron_events (id, job_id, started_at) VALUES (?, ?, ?)").run(eventId, job.id, startedAt);
   try {
@@ -26332,7 +27212,7 @@ __export(exports_url_watcher, {
   deleteWatchJob: () => deleteWatchJob,
   createWatchJob: () => createWatchJob
 });
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 import { createHash } from "crypto";
 function ensureWatchTables() {
   const db2 = getDatabase();
@@ -26364,7 +27244,7 @@ function ensureWatchTables() {
 function createWatchJob(url, schedule, opts) {
   ensureWatchTables();
   const db2 = getDatabase();
-  const id = randomUUID12();
+  const id = randomUUID13();
   db2.prepare(`
     INSERT INTO watch_jobs (id, name, url, schedule, selector, extract_schema, enabled)
     VALUES (?, ?, ?, ?, ?, ?, 1)
@@ -26400,7 +27280,7 @@ function getWatchEvents(watchId, limit = 20) {
 async function checkWatchJob(job) {
   ensureWatchTables();
   const db2 = getDatabase();
-  const eventId = randomUUID12();
+  const eventId = randomUUID13();
   const checkedAt = new Date().toISOString();
   let newContent = "";
   try {
@@ -30552,23 +31432,23 @@ var NEVER = INVALID;
 init_session();
 init_actions();
 import { readFileSync as readFileSync8 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 
 // src/lib/screenshot.ts
 init_types();
 init_gallery();
 var import_sharp = __toESM(require_lib(), 1);
-import { join as join3 } from "path";
-import { mkdirSync as mkdirSync3 } from "fs";
-import { homedir as homedir3 } from "os";
+import { join as join4 } from "path";
+import { mkdirSync as mkdirSync4 } from "fs";
+import { homedir as homedir4 } from "os";
 function getDataDir2() {
-  return process.env["BROWSER_DATA_DIR"] ?? join3(homedir3(), ".browser");
+  return process.env["BROWSER_DATA_DIR"] ?? join4(homedir4(), ".browser");
 }
 function getScreenshotDir(projectId) {
-  const base = join3(getDataDir2(), "screenshots");
+  const base = join4(getDataDir2(), "screenshots");
   const date = new Date().toISOString().split("T")[0];
-  const dir = projectId ? join3(base, projectId, date) : join3(base, date);
-  mkdirSync3(dir, { recursive: true });
+  const dir = projectId ? join4(base, projectId, date) : join4(base, date);
+  mkdirSync4(dir, { recursive: true });
   return dir;
 }
 async function compressBuffer(raw, format, quality, maxWidth) {
@@ -30583,7 +31463,7 @@ async function compressBuffer(raw, format, quality, maxWidth) {
   }
 }
 async function generateThumbnail(raw, dir, stem) {
-  const thumbPath = join3(dir, `${stem}.thumb.webp`);
+  const thumbPath = join4(dir, `${stem}.thumb.webp`);
   const thumbBuffer = await import_sharp.default(raw).resize({ width: 200, withoutEnlargement: true }).webp({ quality: 70, effort: 3 }).toBuffer();
   await Bun.write(thumbPath, thumbBuffer);
   return { path: thumbPath, base64: thumbBuffer.toString("base64") };
@@ -30640,7 +31520,7 @@ async function takeScreenshot(page, opts) {
     const compressedSizeBytes = finalBuffer.length;
     const compressionRatio = originalSizeBytes > 0 ? compressedSizeBytes / originalSizeBytes : 1;
     const ext = format;
-    const screenshotPath = opts?.path ?? join3(dir, `${stem}.${ext}`);
+    const screenshotPath = opts?.path ?? join4(dir, `${stem}.${ext}`);
     await Bun.write(screenshotPath, finalBuffer);
     let thumbnailPath;
     let thumbnailBase64;
@@ -30700,12 +31580,12 @@ async function takeScreenshot(page, opts) {
 }
 async function generatePDF(page, opts) {
   try {
-    const base = join3(getDataDir2(), "pdfs");
+    const base = join4(getDataDir2(), "pdfs");
     const date = new Date().toISOString().split("T")[0];
-    const dir = opts?.projectId ? join3(base, opts.projectId, date) : join3(base, date);
-    mkdirSync3(dir, { recursive: true });
+    const dir = opts?.projectId ? join4(base, opts.projectId, date) : join4(base, date);
+    mkdirSync4(dir, { recursive: true });
     const timestamp = Date.now();
-    const pdfPath = opts?.path ?? join3(dir, `${timestamp}.pdf`);
+    const pdfPath = opts?.path ?? join4(dir, `${timestamp}.pdf`);
     const buffer = await page.pdf({
       path: pdfPath,
       format: opts?.format ?? "A4",
@@ -30726,118 +31606,8 @@ async function generatePDF(page, opts) {
 // src/mcp/index.ts
 init_network();
 
-// src/engines/cdp.ts
-init_types();
-
-class CDPClient {
-  session;
-  networkEnabled = false;
-  performanceEnabled = false;
-  constructor(session) {
-    this.session = session;
-  }
-  static async fromPage(page) {
-    try {
-      const session = await page.context().newCDPSession(page);
-      return new CDPClient(session);
-    } catch (err) {
-      throw new BrowserError(`Failed to create CDP session: ${err instanceof Error ? err.message : String(err)}`, "CDP_SESSION_FAILED");
-    }
-  }
-  async send(method, params) {
-    try {
-      return await this.session.send(method, params);
-    } catch (err) {
-      throw new BrowserError(`CDP command '${method}' failed: ${err instanceof Error ? err.message : String(err)}`, "CDP_COMMAND_FAILED");
-    }
-  }
-  on(event, handler) {
-    this.session.on(event, handler);
-  }
-  off(event, handler) {
-    this.session.off(event, handler);
-  }
-  async enableNetwork() {
-    if (!this.networkEnabled) {
-      await this.send("Network.enable");
-      this.networkEnabled = true;
-    }
-  }
-  async enablePerformance() {
-    if (!this.performanceEnabled) {
-      await this.send("Performance.enable");
-      this.performanceEnabled = true;
-    }
-  }
-  async getPerformanceMetrics() {
-    await this.enablePerformance();
-    const result = await this.send("Performance.getMetrics");
-    const m = {};
-    for (const metric of result.metrics) {
-      m[metric.name] = metric.value;
-    }
-    return {
-      js_heap_size_used: m["JSHeapUsedSize"],
-      js_heap_size_total: m["JSHeapTotalSize"],
-      dom_interactive: m["DOMInteractive"],
-      dom_complete: m["DOMComplete"],
-      load_event: m["LoadEventEnd"]
-    };
-  }
-  async startJSCoverage() {
-    await this.send("Profiler.enable");
-    await this.send("Debugger.enable");
-    await this.send("Profiler.startPreciseCoverage", {
-      callCount: false,
-      detailed: true
-    });
-  }
-  async stopJSCoverage() {
-    const result = await this.send("Profiler.takePreciseCoverage");
-    await this.send("Profiler.stopPreciseCoverage");
-    return result.result.filter((r) => r.url && !r.url.startsWith("v8-snapshot://")).map((r) => ({
-      url: r.url,
-      text: "",
-      ranges: r.functions.flatMap((f) => f.ranges.filter((rng) => rng.count > 0).map((rng) => ({ start: rng.startOffset, end: rng.endOffset })))
-    }));
-  }
-  async getCoverage() {
-    await this.startJSCoverage();
-    const js = await this.stopJSCoverage();
-    const totalBytes = js.reduce((acc, e) => acc + e.ranges.reduce((sum, r) => sum + (r.end - r.start), 0), 0);
-    return { js, css: [], totalBytes, usedBytes: totalBytes, unusedPercent: 0 };
-  }
-  async captureHAREntries(page, handler) {
-    await this.enableNetwork();
-    const requestTimings = new Map;
-    const onRequest = (params) => {
-      requestTimings.set(params.requestId, params.timestamp);
-    };
-    const onResponse = (params) => {
-      const start = requestTimings.get(params.requestId);
-      const duration = start != null ? (params.timestamp - start) * 1000 : 0;
-      handler({
-        method: "GET",
-        url: params.response.url,
-        status: params.response.status,
-        duration
-      });
-    };
-    this.on("Network.requestWillBeSent", onRequest);
-    this.on("Network.responseReceived", onResponse);
-    return () => {
-      this.off("Network.requestWillBeSent", onRequest);
-      this.off("Network.responseReceived", onResponse);
-    };
-  }
-  async detach() {
-    try {
-      await this.session.detach();
-    } catch {}
-  }
-}
-
 // src/lib/performance.ts
+init_cdp();
 async function getPerformanceMetrics(page) {
   const navTiming = await page.evaluate(() => {
     const t = performance.timing;
@@ -30929,144 +31699,8 @@ async function setSessionStorage(page, key, value) {
   await page.evaluate(([k, v]) => sessionStorage.setItem(k, v), [key, value]);
 }
 
-// src/db/recordings.ts
-init_schema();
-init_types();
-import { randomUUID as randomUUID5 } from "crypto";
-function deserialize2(row) {
-  return {
-    ...row,
-    project_id: row.project_id ?? undefined,
-    start_url: row.start_url ?? undefined,
-    steps: JSON.parse(row.steps)
-  };
-}
-function createRecording(data) {
-  const db = getDatabase();
-  const id = randomUUID5();
-  db.prepare("INSERT INTO recordings (id, name, project_id, start_url, steps) VALUES (?, ?, ?, ?, ?)").run(id, data.name, data.project_id ?? null, data.start_url ?? null, JSON.stringify(data.steps ?? []));
-  return getRecording(id);
-}
-function getRecording(id) {
-  const db = getDatabase();
-  const row = db.query("SELECT * FROM recordings WHERE id = ?").get(id);
-  if (!row)
-    throw new RecordingNotFoundError(id);
-  return deserialize2(row);
-}
-function listRecordings(projectId) {
-  const db = getDatabase();
-  const rows = projectId ? db.query("SELECT * FROM recordings WHERE project_id = ? ORDER BY created_at DESC").all(projectId) : db.query("SELECT * FROM recordings ORDER BY created_at DESC").all();
-  return rows.map(deserialize2);
-}
-function updateRecording(id, data) {
-  const db = getDatabase();
-  const fields = [];
-  const values = [];
-  if (data.name !== undefined) {
-    fields.push("name = ?");
-    values.push(data.name);
-  }
-  if (data.steps !== undefined) {
-    fields.push("steps = ?");
-    values.push(JSON.stringify(data.steps));
-  }
-  if (data.start_url !== undefined) {
-    fields.push("start_url = ?");
-    values.push(data.start_url ?? null);
-  }
-  if (fields.length === 0)
-    return getRecording(id);
-  values.push(id);
-  db.prepare(`UPDATE recordings SET ${fields.join(", ")} WHERE id = ?`).run(...values);
-  return getRecording(id);
-}
-
-// src/lib/recorder.ts
-init_actions();
-init_types();
-var activeRecordings = new Map;
-function startRecording(sessionId, name, startUrl) {
-  const steps = [];
-  const recording = createRecording({ name, start_url: startUrl, steps });
-  activeRecordings.set(recording.id, {
-    id: recording.id,
-    steps,
-    cleanup: () => {}
-  });
-  return recording;
-}
-function recordStep(recordingId, step) {
-  const active = activeRecordings.get(recordingId);
-  if (!active)
-    throw new BrowserError(`No active recording: ${recordingId}`, "RECORDING_NOT_ACTIVE");
-  active.steps.push({ ...step, timestamp: Date.now() });
-}
-function stopRecording(recordingId) {
-  const active = activeRecordings.get(recordingId);
-  if (!active)
-    throw new BrowserError(`No active recording: ${recordingId}`, "RECORDING_NOT_ACTIVE");
-  active.cleanup();
-  activeRecordings.delete(recordingId);
-  return updateRecording(recordingId, { steps: active.steps });
-}
-async function replayRecording(recordingId, page) {
-  const recording = getRecording(recordingId);
-  const startTime = Date.now();
-  let executed = 0;
-  let failed = 0;
-  const errors2 = [];
-  for (const step of recording.steps) {
-    try {
-      switch (step.type) {
-        case "navigate":
-          if (step.url)
-            await navigate(page, step.url);
-          break;
-        case "click":
-          if (step.selector)
-            await click(page, step.selector);
-          break;
-        case "type":
-          if (step.selector && step.value)
-            await type(page, step.selector, step.value);
-          break;
-        case "scroll":
-          await scroll(page, "down");
-          break;
-        case "hover":
-          if (step.selector) {
-            const el = await page.$(step.selector);
-            if (el)
-              await el.hover();
-          }
-          break;
-        case "evaluate":
-          if (step.value)
-            await page.evaluate(step.value);
-          break;
-        case "wait":
-          if (step.selector) {
-            await page.waitForSelector(step.selector, { timeout: 1e4 }).catch(() => {});
-          }
-          break;
-      }
-      executed++;
-    } catch (err) {
-      failed++;
-      errors2.push(`Step ${step.type} failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    await new Promise((r) => setTimeout(r, 100));
-  }
-  return {
-    recording_id: recordingId,
-    success: failed === 0,
-    steps_executed: executed,
-    steps_failed: failed,
-    errors: errors2,
-    duration_ms: Date.now() - startTime
-  };
-}
+// src/mcp/index.ts
+init_recorder();
 
 // src/lib/crawler.ts
 init_types();
@@ -31249,16 +31883,16 @@ init_gallery();
 
 // src/lib/downloads.ts
 import { randomUUID as randomUUID9 } from "crypto";
-import { join as join4, basename, extname } from "path";
-import { mkdirSync as mkdirSync4, existsSync, readdirSync, statSync, unlinkSync, copyFileSync, writeFileSync, readFileSync } from "fs";
-import { homedir as homedir4 } from "os";
+import { join as join5, basename, extname } from "path";
+import { mkdirSync as mkdirSync5, existsSync as existsSync2, readdirSync as readdirSync2, statSync, unlinkSync as unlinkSync2, copyFileSync, writeFileSync, readFileSync } from "fs";
+import { homedir as homedir5 } from "os";
 function getDataDir3() {
-  return process.env["BROWSER_DATA_DIR"] ?? join4(homedir4(), ".browser");
+  return process.env["BROWSER_DATA_DIR"] ?? join5(homedir5(), ".browser");
 }
 function getDownloadsDir(sessionId) {
-  const base = join4(getDataDir3(), "downloads");
-  const dir = sessionId ? join4(base, sessionId) : base;
-  mkdirSync4(dir, { recursive: true });
+  const base = join5(getDataDir3(), "downloads");
+  const dir = sessionId ? join5(base, sessionId) : base;
+  mkdirSync5(dir, { recursive: true });
   return dir;
 }
 function metaPath(filePath) {
@@ -31270,7 +31904,7 @@ function saveToDownloads(buffer, filename, opts) {
   const ext = extname(filename) || "";
   const stem = basename(filename, ext);
   const uniqueName = `${stem}-${id.slice(0, 8)}${ext}`;
-  const filePath = join4(dir, uniqueName);
+  const filePath = join5(dir, uniqueName);
   writeFileSync(filePath, buffer);
   const meta = {
     id,
@@ -31299,20 +31933,20 @@ function listDownloads(sessionId) {
   const dir = getDownloadsDir(sessionId);
   const results = [];
   function scanDir(d) {
-    if (!existsSync(d))
+    if (!existsSync2(d))
       return;
-    const entries = readdirSync(d);
+    const entries = readdirSync2(d);
     for (const entry of entries) {
       if (entry.endsWith(".meta.json"))
         continue;
-      const full = join4(d, entry);
+      const full = join5(d, entry);
       const stat = statSync(full);
       if (stat.isDirectory()) {
         scanDir(full);
         continue;
       }
       const mpath = metaPath(full);
-      if (!existsSync(mpath))
+      if (!existsSync2(mpath))
         continue;
       try {
         const meta = JSON.parse(readFileSync(mpath, "utf8"));
@@ -31342,9 +31976,9 @@ function deleteDownload(id, sessionId) {
   if (!file)
     return false;
   try {
-    unlinkSync(file.path);
-    if (existsSync(file.meta_path))
-      unlinkSync(file.meta_path);
+    unlinkSync2(file.path);
+    if (existsSync2(file.meta_path))
+      unlinkSync2(file.meta_path);
     return true;
   } catch {
     return false;
@@ -31390,9 +32024,9 @@ function detectType(filename) {
 
 // src/lib/gallery-diff.ts
 var import_sharp2 = __toESM(require_lib(), 1);
-import { join as join5 } from "path";
-import { mkdirSync as mkdirSync5 } from "fs";
-import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
+import { mkdirSync as mkdirSync6 } from "fs";
+import { homedir as homedir6 } from "os";
 async function diffImages(path1, path2) {
   const img1 = import_sharp2.default(path1);
   const img2 = import_sharp2.default(path2);
@@ -31423,10 +32057,10 @@ async function diffImages(path1, path2) {
       diffBuffer[i + 2] = Math.round(raw1[i + 2] * 0.4);
     }
   }
-  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join5(homedir5(), ".browser");
-  const diffDir = join5(dataDir, "diffs");
-  mkdirSync5(diffDir, { recursive: true });
-  const diffPath = join5(diffDir, `diff-${Date.now()}.webp`);
+  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join6(homedir6(), ".browser");
+  const diffDir = join6(dataDir, "diffs");
+  mkdirSync6(diffDir, { recursive: true });
+  const diffPath = join6(diffDir, `diff-${Date.now()}.webp`);
   const diffImageBuffer = await import_sharp2.default(diffBuffer, { raw: { width: w, height: h, channels } }).webp({ quality: 85 }).toBuffer();
   await Bun.write(diffPath, diffImageBuffer);
   return {
@@ -31442,9 +32076,9 @@ async function diffImages(path1, path2) {
 init_snapshot();
 
 // src/lib/files-integration.ts
-import { join as join6 } from "path";
-import { mkdirSync as mkdirSync6, copyFileSync as copyFileSync2 } from "fs";
-import { homedir as homedir6 } from "os";
+import { join as join7 } from "path";
+import { mkdirSync as mkdirSync7, copyFileSync as copyFileSync2 } from "fs";
+import { homedir as homedir7 } from "os";
 async function persistFile(localPath, opts) {
   try {
     const mod = await import("@hasna/files");
@@ -31453,12 +32087,12 @@ async function persistFile(localPath, opts) {
       return { id: ref.id, path: ref.path ?? localPath, permanent: true, provider: "open-files" };
     }
   } catch {}
-  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join6(homedir6(), ".browser");
+  const dataDir = process.env["BROWSER_DATA_DIR"] ?? join7(homedir7(), ".browser");
   const date = new Date().toISOString().split("T")[0];
-  const dir = join6(dataDir, "persistent", date);
-  mkdirSync6(dir, { recursive: true });
+  const dir = join7(dataDir, "persistent", date);
+  mkdirSync7(dir, { recursive: true });
   const filename = localPath.split("/").pop() ?? "file";
-  const targetPath = join6(dir, filename);
+  const targetPath = join7(dir, filename);
   copyFileSync2(localPath, targetPath);
   return {
     id: `local-${Date.now()}`,
@@ -31468,6 +32102,9 @@ async function persistFile(localPath, opts) {
   };
 }
 
+// src/mcp/index.ts
+init_recordings();
+
 // src/db/timeline.ts
 init_schema();
 function logEvent(sessionId, eventType, details = {}) {
@@ -31565,7 +32202,7 @@ async function closeTab(page, index) {
 init_dialogs();
 init_profiles();
 init_types();
-var _pkg = JSON.parse(readFileSync8(join13(import.meta.dir, "../../package.json"), "utf8"));
+var _pkg = JSON.parse(readFileSync8(join14(import.meta.dir, "../../package.json"), "utf8"));
 var networkLogCleanup = new Map;
 var consoleCaptureCleanup = new Map;
 var harCaptures = new Map;
@@ -31612,7 +32249,7 @@ var server = new McpServer({
   name: "@hasna/browser",
   version: "0.0.1"
 });
-server.tool("browser_session_create", "Create a new browser session. If agent_id is set and already has an active session, returns the existing one (use force_new to override). If session_id is omitted on other tools, the single active session is auto-selected.", {
+server.tool("browser_session_create", "Create a new browser session. If agent_id is set and already has an active session, returns the existing one (use force_new to override). If session_id is omitted on other tools, the single active session is auto-selected. Use cdp_url to attach to an already-running Chrome instance.", {
   engine: exports_external.enum(["playwright", "cdp", "lightpanda", "bun", "auto"]).optional().default("auto"),
   use_case: exports_external.string().optional(),
   project_id: exports_external.string().optional(),
@@ -31623,9 +32260,11 @@ server.tool("browser_session_create", "Create a new browser session. If agent_id
   viewport_height: exports_external.number().optional().default(720),
   stealth: exports_external.boolean().optional().default(false),
   auto_gallery: exports_external.boolean().optional().default(false),
+  storage_state: exports_external.string().optional().describe("Name of saved storage state to load (restores cookies/auth from previous session)"),
   force_new: exports_external.boolean().optional().default(false).describe("Force create a new session even if agent already has one"),
-  tags: exports_external.array(exports_external.string()).optional()
-}, async ({ engine, use_case, project_id, agent_id, start_url, headless, viewport_width, viewport_height, stealth, auto_gallery, force_new, tags }) => {
+  tags: exports_external.array(exports_external.string()).optional(),
+  cdp_url: exports_external.string().optional().describe("Connect to existing Chrome via CDP (e.g. http://localhost:9222). Start Chrome with --remote-debugging-port=9222")
+}, async ({ engine, use_case, project_id, agent_id, start_url, headless, viewport_width, viewport_height, stealth, auto_gallery, storage_state, force_new, tags, cdp_url }) => {
   try {
     if (agent_id && !force_new) {
       const existing = getActiveSessionForAgent2(agent_id);
@@ -31641,7 +32280,9 @@ server.tool("browser_session_create", "Create a new browser session. If agent_id
       headless,
       viewport: { width: viewport_width, height: viewport_height },
       stealth,
-      autoGallery: auto_gallery
+      autoGallery: auto_gallery,
+      storageState: storage_state,
+      cdpUrl: cdp_url
     });
     if (tags?.length) {
       const { addSessionTag: addSessionTag2 } = await Promise.resolve().then(() => (init_sessions(), exports_sessions));
@@ -31801,7 +32442,7 @@ server.tool("browser_reload", "Reload the current page", { session_id: exports_e
     return err(e);
   }
 });
-server.tool("browser_click", "Click an element by ref (from snapshot) or CSS selector. Prefer ref for reliability.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), ref: exports_external.string().optional(), button: exports_external.enum(["left", "right", "middle"]).optional(), timeout: exports_external.number().optional() }, async ({ session_id, selector, ref, button, timeout }) => {
+server.tool("browser_click", "Click an element by ref (from snapshot) or CSS selector. Prefer ref for reliability. Self-healing auto-tries fallback selectors if element not found.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), ref: exports_external.string().optional(), button: exports_external.enum(["left", "right", "middle"]).optional(), timeout: exports_external.number().optional(), self_heal: exports_external.boolean().optional().default(true).describe("Auto-try fallback selectors if element not found") }, async ({ session_id, selector, ref, button, timeout, self_heal }) => {
   try {
     const sid = resolveSessionId(session_id);
     const page = getSessionPage(sid);
@@ -31812,14 +32453,17 @@ server.tool("browser_click", "Click an element by ref (from snapshot) or CSS sel
     }
     if (!selector)
       return err(new Error("Either ref or selector is required"));
-    await click(page, selector, { button, timeout });
-    logEvent(sid, "click", { selector, method: "selector" });
+    const healInfo = await click(page, selector, { button, timeout, selfHeal: self_heal });
+    logEvent(sid, "click", { selector, method: healInfo.healed ? "healed" : "selector" });
+    if (healInfo.healed) {
+      return json({ clicked: selector, method: "healed", heal_method: healInfo.method, attempts: healInfo.attempts });
+    }
     return json({ clicked: selector, method: "selector" });
   } catch (e) {
     return errWithScreenshot(e, session_id);
   }
 });
-server.tool("browser_type", "Type text into an element by ref or selector. Prefer ref.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), ref: exports_external.string().optional(), text: exports_external.string(), clear: exports_external.boolean().optional().default(false), delay: exports_external.number().optional() }, async ({ session_id, selector, ref, text, clear, delay }) => {
+server.tool("browser_type", "Type text into an element by ref or selector. Prefer ref. Self-healing auto-tries fallback selectors if element not found.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), ref: exports_external.string().optional(), text: exports_external.string(), clear: exports_external.boolean().optional().default(false), delay: exports_external.number().optional(), self_heal: exports_external.boolean().optional().default(true).describe("Auto-try fallback selectors if element not found") }, async ({ session_id, selector, ref, text, clear, delay, self_heal }) => {
   try {
     const sid = resolveSessionId(session_id);
     const page = getSessionPage(sid);
@@ -31830,8 +32474,11 @@ server.tool("browser_type", "Type text into an element by ref or selector. Prefe
     }
     if (!selector)
       return err(new Error("Either ref or selector is required"));
-    await type(page, selector, text, { clear, delay });
-    logEvent(sid, "type", { selector, text: text.slice(0, 100) });
+    const healInfo = await type(page, selector, text, { clear, delay, selfHeal: self_heal });
+    logEvent(sid, "type", { selector, text: text.slice(0, 100), method: healInfo.healed ? "healed" : "selector" });
+    if (healInfo.healed) {
+      return json({ typed: text, selector, method: "healed", heal_method: healInfo.method, attempts: healInfo.attempts });
+    }
     return json({ typed: text, selector, method: "selector" });
   } catch (e) {
     return errWithScreenshot(e, session_id);
@@ -31925,20 +32572,32 @@ server.tool("browser_wait", "Wait for a selector to appear", { session_id: expor
     return err(e);
   }
 });
-server.tool("browser_get_text", "Get text content from the page or a selector", { session_id: exports_external.string().optional(), selector: exports_external.string().optional() }, async ({ session_id, selector }) => {
+server.tool("browser_get_text", "Get text content from the page or a selector. Sanitizes prompt injection by default.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), sanitize: exports_external.boolean().optional().default(true).describe("Strip prompt injection patterns from text (default: true)") }, async ({ session_id, selector, sanitize }) => {
   try {
     const sid = resolveSessionId(session_id);
     const page = getSessionPage(sid);
-    return json({ text: await getText(page, selector) });
+    const text = await getText(page, selector);
+    if (sanitize) {
+      const { sanitizeText: sanitizeText2 } = await Promise.resolve().then(() => (init_sanitize(), exports_sanitize));
+      const sanitized = sanitizeText2(text);
+      return json({ text: sanitized.text, stripped: sanitized.stripped, warnings: sanitized.warnings });
+    }
+    return json({ text });
   } catch (e) {
     return err(e);
   }
 });
-server.tool("browser_get_html", "Get HTML content from the page or a selector", { session_id: exports_external.string().optional(), selector: exports_external.string().optional() }, async ({ session_id, selector }) => {
+server.tool("browser_get_html", "Get HTML content from the page or a selector. Sanitizes prompt injection by default.", { session_id: exports_external.string().optional(), selector: exports_external.string().optional(), sanitize: exports_external.boolean().optional().default(true).describe("Strip prompt injection patterns and hidden elements from HTML (default: true)") }, async ({ session_id, selector, sanitize }) => {
   try {
     const sid = resolveSessionId(session_id);
     const page = getSessionPage(sid);
-    return json({ html: await getHTML(page, selector) });
+    const html = await getHTML(page, selector);
+    if (sanitize) {
+      const { sanitizeHTML: sanitizeHTML2 } = await Promise.resolve().then(() => (init_sanitize(), exports_sanitize));
+      const sanitized = sanitizeHTML2(html);
+      return json({ html: sanitized.text, stripped: sanitized.stripped, warnings: sanitized.warnings });
+    }
+    return json({ html });
   } catch (e) {
     return err(e);
   }
@@ -31953,16 +32612,32 @@ server.tool("browser_get_links", "Get all links from the current page", { sessio
     return err(e);
   }
 });
-server.tool("browser_extract", "Extract content from the page in a specified format", {
+server.tool("browser_extract", "Extract content from the page in a specified format. Sanitizes prompt injection by default.", {
   session_id: exports_external.string().optional(),
   format: exports_external.enum(["text", "html", "links", "table", "structured"]).optional().default("text"),
   selector: exports_external.string().optional(),
-  schema: exports_external.record(exports_external.string()).optional()
-}, async ({ session_id, format, selector, schema }) => {
+  schema: exports_external.record(exports_external.string()).optional(),
+  sanitize: exports_external.boolean().optional().default(true).describe("Strip prompt injection patterns from extracted content (default: true)")
+}, async ({ session_id, format, selector, schema, sanitize }) => {
   try {
     const sid = resolveSessionId(session_id);
     const page = getSessionPage(sid);
     const result = await extract(page, { format, selector, schema });
+    if (sanitize) {
+      const { sanitizeText: sanitizeText2, sanitizeHTML: sanitizeHTML2 } = await Promise.resolve().then(() => (init_sanitize(), exports_sanitize));
+      if (result.text) {
+        const s = sanitizeText2(result.text);
+        result.text = s.text;
+        result.stripped = s.stripped;
+        result.warnings = s.warnings;
+      }
+      if (result.html) {
+        const s = sanitizeHTML2(result.html);
+        result.html = s.text;
+        result.stripped = s.stripped;
+        result.warnings = s.warnings;
+      }
+    }
     return json(result);
   } catch (e) {
     return err(e);
@@ -31979,17 +32654,27 @@ server.tool("browser_find", "Find elements matching a selector and return their
     return err(e);
   }
 });
-server.tool("browser_snapshot", "Get accessibility snapshot with element refs (@e0, @e1...). Use compact=true (default) for token-efficient output. Use refs in browser_click, browser_type, etc.", {
+server.tool("browser_snapshot", "Get accessibility snapshot with element refs (@e0, @e1...). Use compact=true (default) for token-efficient output. Use refs in browser_click, browser_type, etc. Sanitizes prompt injection by default.", {
   session_id: exports_external.string().optional(),
   compact: exports_external.boolean().optional().default(true),
   max_refs: exports_external.number().optional().default(50),
-  full_tree: exports_external.boolean().optional().default(false)
-}, async ({ session_id, compact, max_refs, full_tree }) => {
+  full_tree: exports_external.boolean().optional().default(false),
+  sanitize: exports_external.boolean().optional().default(true).describe("Strip prompt injection patterns from snapshot text (default: true)")
+}, async ({ session_id, compact, max_refs, full_tree, sanitize }) => {
   try {
     const sid = resolveSessionId(session_id);
     const page = getSessionPage(sid);
     const result = await takeSnapshot(page, sid);
     setLastSnapshot(sid, result);
+    let injection_warnings;
+    if (sanitize) {
+      const { sanitizeText: sanitizeText2 } = await Promise.resolve().then(() => (init_sanitize(), exports_sanitize));
+      const sanitized = sanitizeText2(result.tree);
+      if (sanitized.stripped > 0) {
+        injection_warnings = sanitized.warnings;
+        result.tree = sanitized.text;
+      }
+    }
     const refEntries = Object.entries(result.refs).slice(0, max_refs);
     const limitedRefs = Object.fromEntries(refEntries);
     const truncated = Object.keys(result.refs).length > max_refs;
@@ -32001,27 +32686,29 @@ server.tool("browser_snapshot", "Get accessibility snapshot with element refs (@
         interactive_count: result.interactive_count,
         shown_count: refEntries.length,
         truncated,
-        refs: limitedRefs
+        refs: limitedRefs,
+        ...injection_warnings ? { injection_warnings } : {}
       });
     }
     const tree = full_tree ? result.tree : result.tree.slice(0, 5000) + (result.tree.length > 5000 ? `
 ... (truncated \u2014 use full_tree=true for complete)` : "");
-    return json({ snapshot: tree, refs: limitedRefs, interactive_count: result.interactive_count, truncated });
+    return json({ snapshot: tree, refs: limitedRefs, interactive_count: result.interactive_count, truncated, ...injection_warnings ? { injection_warnings } : {} });
   } catch (e) {
     return err(e);
   }
 });
-server.tool("browser_screenshot", "Take a screenshot. Use annotate=true to overlay numbered labels on interactive elements for visual+ref workflows.", {
+server.tool("browser_screenshot", "Take a screenshot. Use selector to capture a specific element/section instead of the full page. Use detail='high' for AI-readable full image, 'low' for fast thumbnail. Use annotate=true to overlay numbered labels on interactive elements.", {
   session_id: exports_external.string().optional(),
-  selector: exports_external.string().optional(),
+  selector: exports_external.string().optional().describe("CSS selector to screenshot a specific section (e.g. '#main', '.header', 'form')"),
   full_page: exports_external.boolean().optional().default(false),
   format: exports_external.enum(["png", "jpeg", "webp"]).optional().default("webp"),
   quality: exports_external.number().optional().default(60),
   max_width: exports_external.number().optional().default(800),
   compress: exports_external.boolean().optional().default(true),
   thumbnail: exports_external.boolean().optional().default(true),
-  annotate: exports_external.boolean().optional().default(false)
-}, async ({ session_id, selector, full_page, format, quality, max_width, compress, thumbnail, annotate }) => {
+  annotate: exports_external.boolean().optional().default(false),
+  detail: exports_external.enum(["low", "high"]).optional().default("low").describe("'low' = thumbnail only (fast, saves tokens). 'high' = full readable image in base64 (larger but AI can read text).")
+}, async ({ session_id, selector, full_page, format, quality, max_width, compress, thumbnail, annotate, detail }) => {
   try {
     const sid = resolveSessionId(session_id);
     const page = getSessionPage(sid);
@@ -32038,7 +32725,9 @@ server.tool("browser_screenshot", "Take a screenshot. Use annotate=true to overl
         annotation_count: annotated.annotations.length
       });
     }
-    const result = await takeScreenshot(page, { selector, fullPage: full_page, format, quality, maxWidth: max_width, compress, thumbnail });
+    const effectiveMaxWidth = detail === "high" ? 1280 : max_width;
+    const effectiveQuality = detail === "high" ? 75 : quality;
+    const result = await takeScreenshot(page, { selector, fullPage: full_page, format, quality: effectiveQuality, maxWidth: effectiveMaxWidth, compress, thumbnail });
     result.url = page.url();
     try {
       const buf = Buffer.from(result.base64, "base64");
@@ -32047,12 +32736,12 @@ server.tool("browser_screenshot", "Take a screenshot. Use annotate=true to overl
       result.download_id = dl.id;
     } catch {}
     result.estimated_tokens = Math.ceil(result.base64.length / 4);
-    if (result.base64.length > 20000) {
+    if (detail !== "high" && result.base64.length > 40000) {
       result.base64_truncated = true;
       result.full_image_path = result.path;
       result.base64 = result.thumbnail_base64 ?? "";
     }
-    logEvent(sid, "screenshot", { path: result.path });
+    logEvent(sid, "screenshot", { path: result.path, detail, selector });
     return json(result);
   } catch (e) {
     return err(e);
@@ -32458,6 +33147,94 @@ server.tool("browser_session_untag", "Remove a tag from a session", { session_id
     return err(e);
   }
 });
+server.tool("browser_session_save_state", "Save current session's auth state (cookies, localStorage) for reuse. Use after login to avoid re-authenticating.", { session_id: exports_external.string().optional(), name: exports_external.string().describe("Name for this state (e.g. 'github', 'gmail')") }, async ({ session_id, name }) => {
+  try {
+    const sid = resolveSessionId(session_id);
+    const page = getSessionPage(sid);
+    const { saveStateFromPage: saveStateFromPage2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+    const path = await saveStateFromPage2(page, name);
+    return json({ saved: true, name, path });
+  } catch (e) {
+    return err(e);
+  }
+});
+server.tool("browser_session_list_states", "List all saved storage states (auth snapshots)", {}, async () => {
+  try {
+    const { listStates: listStates2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+    const states = listStates2();
+    return json({ states, count: states.length });
+  } catch (e) {
+    return err(e);
+  }
+});
+server.tool("browser_session_delete_state", "Delete a saved storage state", { name: exports_external.string() }, async ({ name }) => {
+  try {
+    const { deleteState: deleteState2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+    return json({ deleted: deleteState2(name), name });
+  } catch (e) {
+    return err(e);
+  }
+});
+server.tool("browser_auth_record", "Start recording a login flow. Navigate to the login page, perform the login, then call browser_auth_stop to save.", { session_id: exports_external.string().optional(), name: exports_external.string().describe("Name for this auth flow (e.g. 'github', 'gmail')"), start_url: exports_external.string().optional().describe("Login page URL") }, async ({ session_id, name, start_url }) => {
+  try {
+    const sid = resolveSessionId(session_id);
+    const page = getSessionPage(sid);
+    if (start_url)
+      await navigate(page, start_url);
+    const recording = startRecording(sid, `auth-${name}`, page.url());
+    return json({ recording_id: recording.id, name, message: "Recording started. Perform login, then call browser_auth_stop." });
+  } catch (e) {
+    return err(e);
+  }
+});
+server.tool("browser_auth_stop", "Stop recording a login flow and save as a reusable auth flow with storage state.", { session_id: exports_external.string().optional(), name: exports_external.string(), recording_id: exports_external.string() }, async ({ session_id, name, recording_id }) => {
+  try {
+    const sid = resolveSessionId(session_id);
+    const page = getSessionPage(sid);
+    const recording = stopRecording(recording_id);
+    const { saveStateFromPage: saveStateFromPage2 } = await Promise.resolve().then(() => (init_storage_state(), exports_storage_state));
+    const statePath2 = await saveStateFromPage2(page, name);
+    let domain = "";
+    try {
+      domain = new URL(page.url()).hostname;
+    } catch {}
+    const { saveAuthFlow: saveAuthFlow2 } = await Promise.resolve().then(() => (init_auth_flow(), exports_auth_flow));
+    const flow = saveAuthFlow2({ name, domain, recordingId: recording.id, storageStatePath: statePath2 });
+    return json({ flow, recording_steps: recording.steps.length });
+  } catch (e) {
+    return err(e);
+  }
+});
+server.tool("browser_auth_replay", "Manually replay a saved auth flow for a domain", { session_id: exports_external.string().optional(), name: exports_external.string().describe("Auth flow name to replay") }, async ({ session_id, name }) => {
+  try {
+    const sid = resolveSessionId(session_id);
+    const page = getSessionPage(sid);
+    const { getAuthFlowByName: getAuthFlowByName2, tryReplayAuth: tryReplayAuth2 } = await Promise.resolve().then(() => (init_auth_flow(), exports_auth_flow));
+    const flow = getAuthFlowByName2(name);
+    if (!flow)
+      return err(new Error(`Auth flow '${name}' not found`));
+    const result = await tryReplayAuth2(page, flow.domain);
+    return json(result);
+  } catch (e) {
+    return err(e);
+  }
+});
+server.tool("browser_auth_list", "List all saved auth flows", {}, async () => {
+  try {
+    const { listAuthFlows: listAuthFlows2 } = await Promise.resolve().then(() => (init_auth_flow(), exports_auth_flow));
+    return json({ flows: listAuthFlows2() });
+  } catch (e) {
+    return err(e);
+  }
+});
+server.tool("browser_auth_delete", "Delete a saved auth flow", { name: exports_external.string() }, async ({ name }) => {
+  try {
+    const { deleteAuthFlow: deleteAuthFlow2 } = await Promise.resolve().then(() => (init_auth_flow(), exports_auth_flow));
+    return json({ deleted: deleteAuthFlow2(name) });
+  } catch (e) {
+    return err(e);
+  }
+});
 server.tool("browser_click_text", "Click an element by its visible text content", { session_id: exports_external.string().optional(), text: exports_external.string(), exact: exports_external.boolean().optional().default(false), timeout: exports_external.number().optional() }, async ({ session_id, text, exact, timeout }) => {
   try {
     const sid = resolveSessionId(session_id);
@@ -32468,20 +33245,45 @@ server.tool("browser_click_text", "Click an element by its visible text content"
     return err(e);
   }
 });
-server.tool("browser_fill_form", "Fill multiple form fields in one call. Fields map: { selector: value }. Handles text, checkboxes, selects.", {
+server.tool("browser_fill_form", "Fill multiple form fields in one call. Fields map: { selector: value }. Handles text, checkboxes, selects. Self-healing auto-tries fallback selectors per field.", {
   session_id: exports_external.string().optional(),
   fields: exports_external.record(exports_external.union([exports_external.string(), exports_external.boolean()])),
-  submit_selector: exports_external.string().optional()
-}, async ({ session_id, fields, submit_selector }) => {
+  submit_selector: exports_external.string().optional(),
+  self_heal: exports_external.boolean().optional().default(true).describe("Auto-try fallback selectors if element not found")
+}, async ({ session_id, fields, submit_selector, self_heal }) => {
   try {
     const sid = resolveSessionId(session_id);
     const page = getSessionPage(sid);
-    const result = await fillForm(page, fields, submit_selector);
+    const result = await fillForm(page, fields, submit_selector, self_heal);
     return json(result);
   } catch (e) {
     return errWithScreenshot(e, session_id);
   }
 });
+server.tool("browser_find_visual", "Find an element using AI vision when selectors and a11y refs fail. Useful for canvas, images, custom widgets. Takes a screenshot and asks a vision model to locate the element.", {
+  session_id: exports_external.string().optional(),
+  description: exports_external.string().describe("Natural language description of the element to find (e.g. 'the blue Submit button', 'the search icon in the top right')"),
+  click: exports_external.boolean().optional().default(false).describe("Click the element after finding it"),
+  model: exports_external.string().optional().describe("Vision model to use (default: claude-sonnet-4-5-20250929)")
+}, async ({ session_id, description, click: doClick, model }) => {
+  try {
+    const sid = resolveSessionId(session_id);
+    const page = getSessionPage(sid);
+    if (doClick) {
+      const { clickByVision: clickByVision2 } = await Promise.resolve().then(() => exports_vision_fallback);
+      const result = await clickByVision2(page, description, { model });
+      logEvent(sid, "vision_click", { query: description, ...result });
+      return json(result);
+    } else {
+      const { findElementByVision: findElementByVision2 } = await Promise.resolve().then(() => exports_vision_fallback);
+      const result = await findElementByVision2(page, description, { model });
+      logEvent(sid, "vision_find", { query: description, ...result });
+      return json(result);
+    }
+  } catch (e) {
+    return err(e);
+  }
+});
 server.tool("browser_wait_for_text", "Wait until specific text appears on the page", { session_id: exports_external.string().optional(), text: exports_external.string(), timeout: exports_external.number().optional().default(1e4), exact: exports_external.boolean().optional().default(false) }, async ({ session_id, text, timeout, exact }) => {
   try {
     const sid = resolveSessionId(session_id);
@@ -32902,6 +33704,7 @@ server.tool("browser_help", "Show all available browser tools grouped by categor
         { tool: "browser_wait", description: "Wait for a selector to appear" },
         { tool: "browser_wait_for_text", description: "Wait for text to appear" },
         { tool: "browser_fill_form", description: "Fill multiple form fields at once" },
+        { tool: "browser_find_visual", description: "Find element using AI vision (for canvas, images, custom widgets)" },
         { tool: "browser_handle_dialog", description: "Accept or dismiss a dialog" }
       ],
       Extraction: [
@@ -32930,7 +33733,10 @@ server.tool("browser_help", "Show all available browser tools grouped by categor
         { tool: "browser_profile_save", description: "Save cookies + localStorage as profile" },
         { tool: "browser_profile_load", description: "Load and apply a saved profile" },
         { tool: "browser_profile_list", description: "List saved profiles" },
-        { tool: "browser_profile_delete", description: "Delete a saved profile" }
+        { tool: "browser_profile_delete", description: "Delete a saved profile" },
+        { tool: "browser_session_save_state", description: "Save auth state (Playwright storageState) for reuse" },
+        { tool: "browser_session_list_states", description: "List saved storage states" },
+        { tool: "browser_session_delete_state", description: "Delete a saved storage state" }
       ],
       Network: [
         { tool: "browser_network_log", description: "Get captured network requests" },
@@ -32954,6 +33760,13 @@ server.tool("browser_help", "Show all available browser tools grouped by categor
         { tool: "browser_record_replay", description: "Replay a recorded sequence" },
         { tool: "browser_recordings_list", description: "List all recordings" }
       ],
+      Auth: [
+        { tool: "browser_auth_record", description: "Start recording a login flow" },
+        { tool: "browser_auth_stop", description: "Stop recording and save auth flow" },
+        { tool: "browser_auth_replay", description: "Replay a saved auth flow" },
+        { tool: "browser_auth_list", description: "List all saved auth flows" },
+        { tool: "browser_auth_delete", description: "Delete a saved auth flow" }
+      ],
       Crawl: [
         { tool: "browser_crawl", description: "Crawl a URL recursively" }
       ],
@@ -33010,7 +33823,8 @@ server.tool("browser_help", "Show all available browser tools grouped by categor
         { tool: "browser_snapshot_diff", description: "Diff current snapshot vs previous" },
         { tool: "browser_watch_start", description: "Watch page for DOM changes" },
         { tool: "browser_watch_get_changes", description: "Get captured DOM changes" },
-        { tool: "browser_watch_stop", description: "Stop DOM watcher" }
+        { tool: "browser_watch_stop", description: "Stop DOM watcher" },
+        { tool: "browser_parallel", description: "Execute actions across multiple sessions in parallel" }
       ]
     };
     const totalTools = Object.values(groups).reduce((sum, g) => sum + g.length, 0);
@@ -33293,6 +34107,82 @@ server.tool("browser_batch", "Execute multiple browser actions in one call. Retu
     return err(e);
   }
 });
+server.tool("browser_parallel", "Execute actions across multiple sessions in parallel. Each action targets a different session. Returns results array.", {
+  actions: exports_external.array(exports_external.object({
+    session_id: exports_external.string().describe("Target session ID"),
+    tool: exports_external.string().describe("Tool name (e.g. browser_navigate, browser_screenshot, browser_click)"),
+    args: exports_external.record(exports_external.unknown()).optional().default({})
+  })),
+  timeout: exports_external.number().optional().default(30000).describe("Timeout per action in ms")
+}, async ({ actions, timeout }) => {
+  try {
+    const t0 = Date.now();
+    const promises = actions.map(async (action, index) => {
+      try {
+        const sid = action.session_id;
+        const page = getSessionPage(sid);
+        const args = action.args;
+        const toolName = action.tool.replace(/^browser_/, "");
+        const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`Timeout after ${timeout}ms`)), timeout));
+        const actionPromise = (async () => {
+          switch (toolName) {
+            case "navigate": {
+              await navigate(page, args.url);
+              const title = await page.title();
+              return { url: page.url(), title };
+            }
+            case "screenshot": {
+              const result2 = await takeScreenshot(page, {
+                maxWidth: args.max_width ?? 800,
+                quality: args.quality ?? 60
+              });
+              return { path: result2.path, size_bytes: result2.size_bytes };
+            }
+            case "click": {
+              if (args.selector)
+                await click(page, args.selector);
+              return { clicked: args.selector };
+            }
+            case "type": {
+              if (args.selector && args.text)
+                await type(page, args.selector, args.text);
+              return { typed: args.text };
+            }
+            case "get_text": {
+              const text = await getText(page);
+              return { text: text.slice(0, 1000), length: text.length };
+            }
+            case "get_links": {
+              const links = await getLinks(page);
+              return { links, count: links.length };
+            }
+            case "snapshot": {
+              const snap = await takeSnapshot(page, sid);
+              return { interactive_count: snap.interactive_count, refs_count: Object.keys(snap.refs).length };
+            }
+            case "evaluate": {
+              const result2 = await page.evaluate(args.expression);
+              return { result: result2 };
+            }
+            default:
+              return { error: `Unknown tool: ${action.tool}` };
+          }
+        })();
+        const result = await Promise.race([actionPromise, timeoutPromise]);
+        return { index, session_id: sid, tool: action.tool, success: true, result };
+      } catch (e) {
+        return { index, session_id: action.session_id, tool: action.tool, success: false, error: e instanceof Error ? e.message : String(e) };
+      }
+    });
+    const results = await Promise.all(promises);
+    const duration_ms = Date.now() - t0;
+    const succeeded = results.filter((r) => r.success).length;
+    const failed = results.filter((r) => !r.success).length;
+    return json({ results, duration_ms, succeeded, failed, total: actions.length });
+  } catch (e) {
+    return err(e);
+  }
+});
 server.tool("browser_pool_status", "Get status of the pre-warmed browser session pool.", {}, async () => {
   try {
     return json({ message: "Session pool not yet implemented in this version. Coming in v0.0.6+", ready: 0, total: 0 });