@jackwener/opencli 1.5.6 → 1.5.7

package/src/browser/mcp.ts

@@ -57,21 +57,30 @@ export class BrowserBridge implements IBrowserFactory {
   }
 
   private async _ensureDaemon(timeoutSeconds?: number): Promise<void> {
-    // Use default if not provided, zero, or negative
     const effectiveSeconds = (timeoutSeconds && timeoutSeconds > 0) ? timeoutSeconds : Math.ceil(DAEMON_SPAWN_TIMEOUT / 1000);
     const timeoutMs = effectiveSeconds * 1000;
 
+    // Fast path: extension already connected
     if (await isExtensionConnected()) return;
+
+    // Daemon running but no extension — wait for extension with progress
     if (await isDaemonRunning()) {
+      if (process.env.OPENCLI_VERBOSE || process.stderr.isTTY) {
+        process.stderr.write('⏳ Waiting for Chrome extension to connect...\n');
+        process.stderr.write('   Make sure Chrome is open and the OpenCLI extension is enabled.\n');
+      }
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        await new Promise(resolve => setTimeout(resolve, 200));
+        if (await isExtensionConnected()) return;
+      }
       throw new Error(
         'Daemon is running but the Browser Extension is not connected.\n' +
         'Please install and enable the opencli Browser Bridge extension in Chrome.',
       );
     }
 
-    // Find daemon relative to this file — works for both:
-    //   npx tsx src/main.ts  → src/browser/mcp.ts  → src/daemon.ts
-    //   node dist/main.js    → dist/browser/mcp.js → dist/daemon.js
+    // No daemon — spawn one
     const __dirname = path.dirname(fileURLToPath(import.meta.url));
     const parentDir = path.resolve(__dirname, '..');
     const daemonTs = path.join(parentDir, 'daemon.ts');
@@ -79,12 +88,10 @@ export class BrowserBridge implements IBrowserFactory {
     const isTs = fs.existsSync(daemonTs);
     const daemonPath = isTs ? daemonTs : daemonJs;
 
-    if (process.env.OPENCLI_VERBOSE) {
-      console.error(`[opencli] Starting daemon (${isTs ? 'ts' : 'js'})...`);
+    if (process.env.OPENCLI_VERBOSE || process.stderr.isTTY) {
+      process.stderr.write('⏳ Starting daemon...\n');
     }
 
-    // For compiled .js, use the current node binary directly (fast).
-    // For .ts dev mode, node can't run .ts files — use tsx via --import.
     const spawnArgs = isTs
       ? [process.execPath, '--import', 'tsx/esm', daemonPath]
       : [process.execPath, daemonPath];
@@ -96,15 +103,13 @@ export class BrowserBridge implements IBrowserFactory {
     });
     this._daemonProc.unref();
 
-    // Wait for daemon to be ready AND extension to connect (exponential backoff)
-    const backoffs = [50, 100, 200, 400, 800, 1500, 3000];
+    // Wait for daemon + extension with faster polling
     const deadline = Date.now() + timeoutMs;
-    for (let i = 0; Date.now() < deadline; i++) {
-      await new Promise(resolve => setTimeout(resolve, backoffs[Math.min(i, backoffs.length - 1)]));
+    while (Date.now() < deadline) {
+      await new Promise(resolve => setTimeout(resolve, 200));
       if (await isExtensionConnected()) return;
     }
 
-    // Daemon might be up but extension not connected — give a useful error
     if (await isDaemonRunning()) {
       throw new Error(
         'Daemon is running but the Browser Extension is not connected.\n' +

package/src/browser/page.test.ts

@@ -0,0 +1,58 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const { sendCommandMock } = vi.hoisted(() => ({
+  sendCommandMock: vi.fn(),
+}));
+
+vi.mock('./daemon-client.js', () => ({
+  sendCommand: sendCommandMock,
+}));
+
+import { Page } from './page.js';
+
+describe('Page.getCurrentUrl', () => {
+  beforeEach(() => {
+    sendCommandMock.mockReset();
+  });
+
+  it('reads the real browser URL when no local navigation cache exists', async () => {
+    sendCommandMock.mockResolvedValueOnce('https://notebooklm.google.com/notebook/nb-live');
+
+    const page = new Page('site:notebooklm');
+    const url = await page.getCurrentUrl();
+
+    expect(url).toBe('https://notebooklm.google.com/notebook/nb-live');
+    expect(sendCommandMock).toHaveBeenCalledTimes(1);
+    expect(sendCommandMock).toHaveBeenCalledWith('exec', expect.objectContaining({
+      workspace: 'site:notebooklm',
+    }));
+  });
+
+  it('caches the discovered browser URL for later reads', async () => {
+    sendCommandMock.mockResolvedValueOnce('https://notebooklm.google.com/notebook/nb-live');
+
+    const page = new Page('site:notebooklm');
+    expect(await page.getCurrentUrl()).toBe('https://notebooklm.google.com/notebook/nb-live');
+    expect(await page.getCurrentUrl()).toBe('https://notebooklm.google.com/notebook/nb-live');
+
+    expect(sendCommandMock).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('Page.evaluate', () => {
+  beforeEach(() => {
+    sendCommandMock.mockReset();
+  });
+
+  it('retries once when the inspected target navigated during exec', async () => {
+    sendCommandMock
+      .mockRejectedValueOnce(new Error('{"code":-32000,"message":"Inspected target navigated or closed"}'))
+      .mockResolvedValueOnce(42);
+
+    const page = new Page('site:notebooklm');
+    const value = await page.evaluate('21 + 21');
+
+    expect(value).toBe(42);
+    expect(sendCommandMock).toHaveBeenCalledTimes(2);
+  });
+});

package/src/browser/page.ts

@@ -108,7 +108,17 @@ export class Page implements IPage {
   }
 
   async getCurrentUrl(): Promise<string | null> {
-    return this._lastUrl;
+    if (this._lastUrl) return this._lastUrl;
+    try {
+      const current = await this.evaluate('window.location.href');
+      if (typeof current === 'string' && current) {
+        this._lastUrl = current;
+        return current;
+      }
+    } catch {
+      // Best-effort: some commands may run before a debuggable tab is ready.
+    }
+    return null;
   }
 
   /** Close the automation window in the extension */
@@ -122,7 +132,13 @@ export class Page implements IPage {
 
   async evaluate(js: string): Promise<unknown> {
     const code = wrapForEval(js);
-    return sendCommand('exec', { code, ...this._cmdOpts() });
+    try {
+      return await sendCommand('exec', { code, ...this._cmdOpts() });
+    } catch (err) {
+      if (!isRetryableSettleError(err)) throw err;
+      await new Promise((resolve) => setTimeout(resolve, 200));
+      return sendCommand('exec', { code, ...this._cmdOpts() });
+    }
   }
 
   async getCookies(opts: { domain?: string; url?: string } = {}): Promise<BrowserCookie[]> {

package/src/browser/stealth.test.ts

@@ -0,0 +1,153 @@
+import { describe, it, expect } from 'vitest';
+import { generateStealthJs } from './stealth.js';
+
+/**
+ * Tests for the stealth anti-detection module.
+ *
+ * We test the generated JS string for expected content and structure.
+ * Evaluating in Node is fragile because stealth patches target browser
+ * globals (navigator, Performance, HTMLIFrameElement) that don't exist
+ * or behave differently in Node. Instead we verify the code string
+ * contains the right patches and is syntactically valid.
+ */
+
+describe('generateStealthJs', () => {
+  it('returns a non-empty string', () => {
+    const code = generateStealthJs();
+    expect(typeof code).toBe('string');
+    expect(code.length).toBeGreaterThan(0);
+  });
+
+  it('is a valid self-contained IIFE', () => {
+    const code = generateStealthJs();
+    // Should start/end as an IIFE
+    expect(code.trim()).toMatch(/^\(\(\) => \{/);
+    expect(code.trim()).toMatch(/\}\)\(\)$/);
+  });
+
+  it('patches navigator.webdriver', () => {
+    const code = generateStealthJs();
+    expect(code).toContain("navigator, 'webdriver'");
+    expect(code).toContain('() => false');
+  });
+
+  it('stubs window.chrome', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('window.chrome');
+    expect(code).toContain('runtime');
+    expect(code).toContain('loadTimes');
+    expect(code).toContain('csi');
+  });
+
+  it('fakes navigator.plugins if empty', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('navigator.plugins');
+    expect(code).toContain('PDF Viewer');
+    expect(code).toContain('Chrome PDF Viewer');
+  });
+
+  it('ensures navigator.languages is non-empty', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('navigator.languages');
+    expect(code).toContain("'en-US'");
+  });
+
+  it('normalizes Permissions.query for notifications', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('Permissions');
+    expect(code).toContain('notifications');
+  });
+
+  it('cleans automation artifacts', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('__playwright');
+    expect(code).toContain('__puppeteer');
+    expect(code).toContain("'cdc_'");
+    expect(code).toContain("'__cdc_'");
+  });
+
+  it('filters CDP patterns from Error.stack', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('puppeteer_evaluation_script');
+    expect(code).toContain("'pptr:'");
+    expect(code).toContain("'debugger://'");
+  });
+
+  it('neutralizes debugger statement traps', () => {
+    const code = generateStealthJs();
+    // Should patch Function constructor with new.target / Reflect.construct
+    expect(code).toContain('_OrigFunction');
+    expect(code).toContain('_PatchedFunction');
+    expect(code).toContain('new.target');
+    expect(code).toContain('Reflect.construct');
+    // Should patch eval
+    expect(code).toContain('_origEval');
+    expect(code).toContain('_patchedEval');
+    // Regex to strip debugger (lookbehind for statement boundaries)
+    expect(code).toContain('_debuggerRe');
+  });
+
+  it('uses shared toString disguise via WeakMap', () => {
+    const code = generateStealthJs();
+    // Shared infrastructure at the top of the IIFE
+    expect(code).toContain('_origToString');
+    expect(code).toContain('WeakMap');
+    expect(code).toContain('_disguised');
+    expect(code).toContain('_disguise');
+    // Should NOT have per-instance toString overrides on Function/eval
+    // (they go through _disguise instead)
+  });
+
+  it('defends console method fingerprinting', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('_consoleMethods');
+    expect(code).toContain("'log'");
+    expect(code).toContain("'warn'");
+    expect(code).toContain("'error'");
+    expect(code).toContain('[native code]');
+    // Uses saved _origToString reference
+    expect(code).toContain('_origToString.call');
+  });
+
+  it('defends window dimension detection', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('outerWidth');
+    expect(code).toContain('outerHeight');
+    expect(code).toContain('innerWidth');
+    expect(code).toContain('innerHeight');
+  });
+
+  it('filters Performance API entries', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('getEntries');
+    expect(code).toContain('getEntriesByType');
+    expect(code).toContain('getEntriesByName');
+    expect(code).toContain('_suspiciousPatterns');
+  });
+
+  it('cleans document $cdc_ properties', () => {
+    const code = generateStealthJs();
+    expect(code).toContain("'$cdc_'");
+    expect(code).toContain("'$chrome_'");
+  });
+
+  it('patches iframe contentWindow.chrome consistency', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('contentWindow');
+    expect(code).toContain('HTMLIFrameElement');
+  });
+
+  it('uses non-enumerable guard flag on EventTarget.prototype', () => {
+    const code = generateStealthJs();
+    expect(code).toContain('EventTarget.prototype');
+    expect(code).toContain("'__lsn'");
+    expect(code).toContain('enumerable: false');
+  });
+
+  it('generates syntactically valid JavaScript', () => {
+    const code = generateStealthJs();
+    // new Function() parses the code without executing it in a real
+    // browser context, catching syntax errors from template literal issues.
+    expect(() => new Function(code)).not.toThrow();
+  });
+});

package/src/browser/stealth.ts

@@ -150,6 +150,204 @@ export function generateStealthJs(): string {
         }
       } catch {}
 
+      // ── Shared toString disguise infrastructure ──
+      // Save the pristine Function.prototype.toString BEFORE any patches,
+      // so all subsequent disguises use the real native reference.
+      // Anti-bot scripts detect per-instance toString overrides via:
+      //   Function.hasOwnProperty('toString')          → true if patched
+      //   Function.prototype.toString.call(fn) !== fn.toString()
+      // Instead we patch Function.prototype.toString once with a WeakMap
+      // lookup, making disguised functions indistinguishable from native.
+      const _origToString = Function.prototype.toString;
+      const _disguised = new WeakMap();
+      try {
+        Object.defineProperty(Function.prototype, 'toString', {
+          value: function() {
+            const override = _disguised.get(this);
+            return override !== undefined ? override : _origToString.call(this);
+          },
+          writable: true, configurable: true,
+        });
+      } catch {}
+      const _disguise = (fn, name) => {
+        _disguised.set(fn, 'function ' + name + '() { [native code] }');
+        try { Object.defineProperty(fn, 'name', { value: name, configurable: true }); } catch {}
+        return fn;
+      };
+
+      // 8. Anti-debugger statement trap
+      //    Sites inject debugger statements to detect DevTools/CDP.
+      //    When a CDP debugger is attached, the statement pauses execution
+      //    and the site measures the time gap to confirm automation.
+      //    We neutralize this by overriding the Function constructor and
+      //    eval to strip debugger statements from dynamically created code.
+      //    Note: this does NOT affect static debugger statements in parsed
+      //    scripts — those require CDP Debugger.setBreakpointsActive(false)
+      //    which we handle at the extension level.
+      //    Caveat: the regex targets standalone debugger statements (preceded
+      //    by a statement boundary) to minimise false positives inside string
+      //    literals, but cannot perfectly distinguish all cases without a
+      //    full parser. This is an acceptable trade-off for stealth code.
+      try {
+        const _OrigFunction = Function;
+        // Match standalone debugger statements preceded by a statement
+        // boundary (start of string, semicolon, brace, or newline).
+        // This avoids most false positives inside string literals like
+        // "use debugger mode" while still catching the anti-bot patterns.
+        const _debuggerRe = /(?:^|(?<=[;{}\\n\\r]))\\s*debugger\\s*;?/g;
+        const _cleanDebugger = (src) => typeof src === 'string' ? src.replace(_debuggerRe, '') : src;
+        // Patch Function constructor to strip debugger from dynamic code.
+        // Support both Function('code') and new Function('code') via
+        // new.target / Reflect.construct.
+        const _PatchedFunction = function(...args) {
+          if (args.length > 0) {
+            args[args.length - 1] = _cleanDebugger(args[args.length - 1]);
+          }
+          if (new.target) {
+            return Reflect.construct(_OrigFunction, args, new.target);
+          }
+          return _OrigFunction.apply(this, args);
+        };
+        _PatchedFunction.prototype = _OrigFunction.prototype;
+        Object.setPrototypeOf(_PatchedFunction, _OrigFunction);
+        _disguise(_PatchedFunction, 'Function');
+        try { window.Function = _PatchedFunction; } catch {}
+
+        // Patch eval to strip debugger
+        const _origEval = window.eval;
+        const _patchedEval = function(code) {
+          return _origEval.call(this, _cleanDebugger(code));
+        };
+        _disguise(_patchedEval, 'eval');
+        try { window.eval = _patchedEval; } catch {}
+      } catch {}
+
+      // 9. Console method fingerprinting defense
+      //    When CDP Runtime.enable is called, Chrome replaces console.log etc.
+      //    with CDP-bound versions. These bound functions have a different
+      //    toString() output: "function log() { [native code] }" becomes
+      //    something like "function () { [native code] }" (no name) or the
+      //    bound function signature leaks. Anti-bot scripts check:
+      //      console.log.toString().includes('[native code]')
+      //      console.log.name === 'log'
+      //    We re-wrap console methods and register them via the shared
+      //    _disguise infrastructure so Function.prototype.toString.call()
+      //    also returns the correct native string.
+      try {
+        const _consoleMethods = ['log', 'warn', 'error', 'info', 'debug', 'table', 'trace', 'dir', 'group', 'groupEnd', 'groupCollapsed', 'clear', 'count', 'assert', 'profile', 'profileEnd', 'time', 'timeEnd', 'timeStamp'];
+        for (const _m of _consoleMethods) {
+          if (typeof console[_m] !== 'function') continue;
+          const _origMethod = console[_m];
+          const _nativeStr = 'function ' + _m + '() { [native code] }';
+          // Only patch if toString is wrong (i.e. CDP has replaced it)
+          try {
+            const _currentStr = _origToString.call(_origMethod);
+            if (_currentStr === _nativeStr) continue; // already looks native
+          } catch {}
+          const _wrapper = function() { return _origMethod.apply(console, arguments); };
+          Object.defineProperty(_wrapper, 'length', { value: _origMethod.length || 0, configurable: true });
+          _disguise(_wrapper, _m);
+          try { console[_m] = _wrapper; } catch {}
+        }
+      } catch {}
+
+      // 10. window.outerWidth/outerHeight defense
+      //     When DevTools or CDP debugger is attached, Chrome may alter the
+      //     window dimensions. Anti-bot scripts compare outerWidth/innerWidth
+      //     and outerHeight/innerHeight — a significant difference indicates
+      //     DevTools is open. We freeze the relationship so the delta stays
+      //     consistent with a normal browser window.
+      //     Thresholds: width delta > 100px or height delta > 200px indicates
+      //     a docked DevTools panel. When triggered, we report outerWidth
+      //     equal to innerWidth (normal for maximised windows) and
+      //     outerHeight as innerHeight + the captured "normal" delta (capped
+      //     to a reasonable range), so the result is plausible across OSes.
+      try {
+        const _normalWidthDelta = window.outerWidth - window.innerWidth;
+        const _normalHeightDelta = window.outerHeight - window.innerHeight;
+        // Only patch if the delta looks suspicious (e.g. DevTools docked)
+        if (_normalWidthDelta > 100 || _normalHeightDelta > 200) {
+          Object.defineProperty(window, 'outerWidth', {
+            get: () => window.innerWidth,
+            configurable: true,
+          });
+          // Use a clamped height offset (40-120px covers macOS ~78px,
+          // Windows ~40px, and Linux ~37-50px title bar heights).
+          const _heightOffset = Math.max(40, Math.min(120, _normalHeightDelta));
+          Object.defineProperty(window, 'outerHeight', {
+            get: () => window.innerHeight + _heightOffset,
+            configurable: true,
+          });
+        }
+      } catch {}
+
+      // 11. Performance API cleanup
+      //     CDP injects internal resources and timing entries that don't exist
+      //     in normal browsing. Filter entries with debugger/devtools URLs.
+      try {
+        const _origGetEntries = Performance.prototype.getEntries;
+        const _origGetByType = Performance.prototype.getEntriesByType;
+        const _origGetByName = Performance.prototype.getEntriesByName;
+        const _suspiciousPatterns = ['debugger', 'devtools', '__puppeteer', '__playwright', 'pptr:'];
+        const _filterEntries = (entries) => {
+          if (!Array.isArray(entries)) return entries;
+          return entries.filter(e => {
+            const name = e.name || '';
+            return !_suspiciousPatterns.some(p => name.includes(p));
+          });
+        };
+        Performance.prototype.getEntries = function() {
+          return _filterEntries(_origGetEntries.call(this));
+        };
+        Performance.prototype.getEntriesByType = function(type) {
+          return _filterEntries(_origGetByType.call(this, type));
+        };
+        Performance.prototype.getEntriesByName = function(name, type) {
+          return _filterEntries(_origGetByName.call(this, name, type));
+        };
+      } catch {}
+
+      // 12. WebDriver-related property defense
+      //     Some anti-bot systems check additional navigator properties
+      //     and document properties that may indicate automation.
+      try {
+        // document.$cdc_ properties (ChromeDriver specific, backup for #6)
+        for (const _prop of Object.getOwnPropertyNames(document)) {
+          if (_prop.startsWith('$cdc_') || _prop.startsWith('$chrome_')) {
+            try { delete document[_prop]; } catch {}
+          }
+        }
+      } catch {}
+
+      // 13. Iframe contentWindow.chrome consistency
+      //     Anti-bot scripts create iframes and check if
+      //     iframe.contentWindow.chrome exists and matches the parent.
+      //     CDP-controlled pages may have inconsistent iframe contexts.
+      try {
+        const _origHTMLIFrame = HTMLIFrameElement.prototype;
+        const _origContentWindow = Object.getOwnPropertyDescriptor(_origHTMLIFrame, 'contentWindow');
+        if (_origContentWindow && _origContentWindow.get) {
+          Object.defineProperty(_origHTMLIFrame, 'contentWindow', {
+            get: function() {
+              const _w = _origContentWindow.get.call(this);
+              if (_w) {
+                try {
+                  if (!_w.chrome) {
+                    Object.defineProperty(_w, 'chrome', {
+                      value: window.chrome,
+                      writable: true,
+                      configurable: true,
+                    });
+                  }
+                } catch {}
+              }
+              return _w;
+            },
+            configurable: true,
+          });
+        }
+      } catch {}
+
       return 'applied';
     })()
   `;

package/src/browser.test.ts

@@ -140,7 +140,7 @@ describe('BrowserBridge state', () => {
 
     const mcp = new BrowserBridge();
 
-    await expect(mcp.connect()).rejects.toThrow('Browser Extension is not connected');
+    await expect(mcp.connect({ timeout: 0.1 })).rejects.toThrow('Browser Extension is not connected');
   });
 });
 

package/src/build-manifest.test.ts

@@ -84,6 +84,7 @@ describe('manifest helper rules', () => {
         description: 'dynamic command',
         strategy: Strategy.PUBLIC,
         browser: false,
+        aliases: ['metadata'],
         args: [
           {
             name: 'model',
@@ -109,6 +110,7 @@ describe('manifest helper rules', () => {
         domain: 'localhost',
         strategy: 'public',
         browser: false,
+        aliases: ['metadata'],
         args: [
           {
             name: 'model',

package/src/build-manifest.ts

@@ -23,6 +23,7 @@ const OUTPUT = path.resolve(__dirname, '..', 'dist', 'cli-manifest.json');
 export interface ManifestEntry {
   site: string;
   name: string;
+  aliases?: string[];
   description: string;
   domain?: string;
   strategy: string;
@@ -84,6 +85,7 @@ function toManifestEntry(cmd: CliCommand, modulePath: string): ManifestEntry {
   return {
     site: cmd.site,
     name: cmd.name,
+    aliases: cmd.aliases,
     description: cmd.description ?? '',
     domain: cmd.domain,
     strategy: (cmd.strategy ?? 'public').toString().toLowerCase(),
@@ -119,6 +121,9 @@ function scanYaml(filePath: string, site: string): ManifestEntry | null {
       domain: cliDef.domain,
       strategy: strategy.toLowerCase(),
       browser,
+      aliases: isRecord(cliDef) && Array.isArray((cliDef as Record<string, unknown>).aliases)
+        ? ((cliDef as Record<string, unknown>).aliases as unknown[]).filter((value): value is string => typeof value === 'string')
+        : undefined,
       args,
       columns: cliDef.columns,
       pipeline: cliDef.pipeline,
@@ -230,7 +235,7 @@ export async function buildManifest(): Promise<ManifestEntry[]> {
     }
   }
 
-  return [...manifest.values()];
+  return [...manifest.values()].sort((a, b) => a.site.localeCompare(b.site) || a.name.localeCompare(b.name));
 }
 
 async function main(): Promise<void> {

package/src/cli.ts

@@ -16,6 +16,7 @@ import { printCompletionScript } from './completion.js';
 import { loadExternalClis, executeExternalCli, installExternalCli, registerExternalCli, isBinaryInstalled } from './external.js';
 import { registerAllCommands } from './commanderAdapter.js';
 import { EXIT_CODES, getErrorMessage } from './errors.js';
+import { daemonStatus, daemonStop, daemonRestart } from './commands/daemon.js';
 
 export function runCli(BUILTIN_CLIS: string, USER_CLIS: string): void {
   const program = new Command();
@@ -36,7 +37,7 @@ export function runCli(BUILTIN_CLIS: string, USER_CLIS: string): void {
     .option('--json', 'JSON output (deprecated)')
     .action((opts) => {
       const registry = getRegistry();
-      const commands = [...registry.values()].sort((a, b) => fullName(a).localeCompare(fullName(b)));
+      const commands = [...new Set(registry.values())].sort((a, b) => fullName(a).localeCompare(fullName(b)));
       const fmt = opts.json && opts.format === 'table' ? 'json' : opts.format;
       const isStructured = fmt === 'json' || fmt === 'yaml';
 
@@ -47,6 +48,7 @@ export function runCli(BUILTIN_CLIS: string, USER_CLIS: string): void {
               command: fullName(c),
               site: c.site,
               name: c.name,
+              aliases: c.aliases?.join(', ') ?? '',
               description: c.description,
               strategy: strategyLabel(c),
               browser: !!c.browser,
@@ -54,7 +56,7 @@ export function runCli(BUILTIN_CLIS: string, USER_CLIS: string): void {
             }));
         renderOutput(rows, {
           fmt,
-          columns: ['command', 'site', 'name', 'description', 'strategy', 'browser', 'args',
+          columns: ['command', 'site', 'name', 'aliases', 'description', 'strategy', 'browser', 'args',
                      ...(isStructured ? ['columns', 'domain'] : [])],
           title: 'opencli/list',
           source: 'opencli list',
@@ -80,7 +82,8 @@ export function runCli(BUILTIN_CLIS: string, USER_CLIS: string): void {
           const tag = label === 'public'
             ? chalk.green('[public]')
             : chalk.yellow(`[${label}]`);
-          console.log(`    ${cmd.name} ${tag}${cmd.description ? chalk.dim(` — ${cmd.description}`) : ''}`);
+          const aliases = cmd.aliases?.length ? chalk.dim(` (aliases: ${cmd.aliases.join(', ')})`) : '';
+          console.log(`    ${cmd.name} ${tag}${aliases}${cmd.description ? chalk.dim(` — ${cmd.description}`) : ''}`);
         }
         console.log();
       }
@@ -442,6 +445,21 @@ export function runCli(BUILTIN_CLIS: string, USER_CLIS: string): void {
       }
     });
 
+  // ── Built-in: daemon ──────────────────────────────────────────────────────
+  const daemonCmd = program.command('daemon').description('Manage the opencli daemon');
+  daemonCmd
+    .command('status')
+    .description('Show daemon status')
+    .action(async () => { await daemonStatus(); });
+  daemonCmd
+    .command('stop')
+    .description('Stop the daemon')
+    .action(async () => { await daemonStop(); });
+  daemonCmd
+    .command('restart')
+    .description('Restart the daemon')
+    .action(async () => { await daemonRestart(); });
+
   // ── External CLIs ─────────────────────────────────────────────────────────
 
   const externalClis = loadExternalClis();