@kritchoff/agent-browser 0.9.2

package/scripts/postinstall.js

@@ -0,0 +1,235 @@
+#!/usr/bin/env node
+
+/**
+ * Postinstall script for agent-browser
+ * 
+ * Downloads the platform-specific native binary if not present.
+ * On global installs, patches npm's bin entry to use the native binary directly:
+ * - Windows: Overwrites .cmd/.ps1 shims
+ * - Mac/Linux: Replaces symlink to point to native binary
+ */
+
+import { existsSync, mkdirSync, chmodSync, createWriteStream, unlinkSync, writeFileSync, symlinkSync, lstatSync } from 'fs';
+import { dirname, join } from 'path';
+import { fileURLToPath } from 'url';
+import { platform, arch } from 'os';
+import { get } from 'https';
+import { execSync } from 'child_process';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const projectRoot = join(__dirname, '..');
+const binDir = join(projectRoot, 'bin');
+
+// Platform detection
+const platformKey = `${platform()}-${arch()}`;
+const ext = platform() === 'win32' ? '.exe' : '';
+const binaryName = `agent-browser-${platformKey}${ext}`;
+const binaryPath = join(binDir, binaryName);
+
+// Package info
+const packageJson = JSON.parse(
+  (await import('fs')).readFileSync(join(projectRoot, 'package.json'), 'utf8')
+);
+const version = packageJson.version;
+
+// GitHub release URL
+const GITHUB_REPO = 'vercel-labs/agent-browser';
+const DOWNLOAD_URL = `https://github.com/${GITHUB_REPO}/releases/download/v${version}/${binaryName}`;
+
+async function downloadFile(url, dest) {
+  return new Promise((resolve, reject) => {
+    const file = createWriteStream(dest);
+    
+    const request = (url) => {
+      get(url, (response) => {
+        // Handle redirects
+        if (response.statusCode === 301 || response.statusCode === 302) {
+          request(response.headers.location);
+          return;
+        }
+        
+        if (response.statusCode !== 200) {
+          reject(new Error(`Failed to download: HTTP ${response.statusCode}`));
+          return;
+        }
+        
+        response.pipe(file);
+        file.on('finish', () => {
+          file.close();
+          resolve();
+        });
+      }).on('error', (err) => {
+        unlinkSync(dest);
+        reject(err);
+      });
+    };
+    
+    request(url);
+  });
+}
+
+async function main() {
+  // Check if binary already exists
+  if (existsSync(binaryPath)) {
+    // Ensure binary is executable (npm doesn't preserve execute bit)
+    if (platform() !== 'win32') {
+      chmodSync(binaryPath, 0o755);
+    }
+    console.log(`✓ Native binary ready: ${binaryName}`);
+    
+    // On global installs, fix npm's bin entry to use native binary directly
+    await fixGlobalInstallBin();
+    
+    showPlaywrightReminder();
+    return;
+  }
+
+  // Ensure bin directory exists
+  if (!existsSync(binDir)) {
+    mkdirSync(binDir, { recursive: true });
+  }
+
+  console.log(`Downloading native binary for ${platformKey}...`);
+  console.log(`URL: ${DOWNLOAD_URL}`);
+
+  try {
+    await downloadFile(DOWNLOAD_URL, binaryPath);
+    
+    // Make executable on Unix
+    if (platform() !== 'win32') {
+      chmodSync(binaryPath, 0o755);
+    }
+    
+    console.log(`✓ Downloaded native binary: ${binaryName}`);
+  } catch (err) {
+    console.log(`⚠ Could not download native binary: ${err.message}`);
+    console.log(`  The CLI will use Node.js fallback (slightly slower startup)`);
+    console.log('');
+    console.log('To build the native binary locally:');
+    console.log('  1. Install Rust: https://rustup.rs');
+    console.log('  2. Run: npm run build:native');
+  }
+
+  // On global installs, fix npm's bin entry to use native binary directly
+  // This avoids the /bin/sh error on Windows and provides zero-overhead execution
+  await fixGlobalInstallBin();
+
+  showPlaywrightReminder();
+}
+
+function showPlaywrightReminder() {
+  console.log('');
+  console.log('╔═══════════════════════════════════════════════════════════════════════════╗');
+  console.log('║ To download browser binaries, run:                                        ║');
+  console.log('║                                                                           ║');
+  console.log('║     npx playwright install chromium                                       ║');
+  console.log('║                                                                           ║');
+  console.log('║ On Linux, include system dependencies with:                               ║');
+  console.log('║                                                                           ║');
+  console.log('║     npx playwright install --with-deps chromium                           ║');
+  console.log('║                                                                           ║');
+  console.log('╚═══════════════════════════════════════════════════════════════════════════╝');
+}
+
+/**
+ * Fix npm's bin entry on global installs to use the native binary directly.
+ * This provides zero-overhead CLI execution for global installs.
+ */
+async function fixGlobalInstallBin() {
+  if (platform() === 'win32') {
+    await fixWindowsShims();
+  } else {
+    await fixUnixSymlink();
+  }
+}
+
+/**
+ * Fix npm symlink on Mac/Linux global installs.
+ * Replace the symlink to the JS wrapper with a symlink to the native binary.
+ */
+async function fixUnixSymlink() {
+  // Get npm's global bin directory (npm prefix -g + /bin)
+  let npmBinDir;
+  try {
+    const prefix = execSync('npm prefix -g', { encoding: 'utf8' }).trim();
+    npmBinDir = join(prefix, 'bin');
+  } catch {
+    return; // npm not available
+  }
+
+  const symlinkPath = join(npmBinDir, 'agent-browser');
+
+  // Check if symlink exists (indicates global install)
+  try {
+    const stat = lstatSync(symlinkPath);
+    if (!stat.isSymbolicLink()) {
+      return; // Not a symlink, don't touch it
+    }
+  } catch {
+    return; // Symlink doesn't exist, not a global install
+  }
+
+  // Replace symlink to point directly to native binary
+  try {
+    unlinkSync(symlinkPath);
+    symlinkSync(binaryPath, symlinkPath);
+    console.log('✓ Optimized: symlink points to native binary (zero overhead)');
+  } catch (err) {
+    // Permission error or other issue - not critical, JS wrapper still works
+    console.log(`⚠ Could not optimize symlink: ${err.message}`);
+    console.log('  CLI will work via Node.js wrapper (slightly slower startup)');
+  }
+}
+
+/**
+ * Fix npm-generated shims on Windows global installs.
+ * npm generates shims that try to run /bin/sh, which doesn't exist on Windows.
+ * We overwrite them to invoke the native .exe directly.
+ */
+async function fixWindowsShims() {
+  // Check if this is a global install by looking for npm's global prefix
+  let npmBinDir;
+  try {
+    npmBinDir = execSync('npm prefix -g', { encoding: 'utf8' }).trim();
+  } catch {
+    return; // Not a global install or npm not available
+  }
+
+  // The shims are in the npm prefix directory (not prefix/bin on Windows)
+  const cmdShim = join(npmBinDir, 'agent-browser.cmd');
+  const ps1Shim = join(npmBinDir, 'agent-browser.ps1');
+
+  // Only fix if shims exist (indicates global install)
+  if (!existsSync(cmdShim)) {
+    return;
+  }
+
+  // Path to native binary relative to npm prefix
+  const relativeBinaryPath = 'node_modules\\agent-browser\\bin\\agent-browser-win32-x64.exe';
+
+  try {
+    // Overwrite .cmd shim
+    const cmdContent = `@ECHO off\r\n"%~dp0${relativeBinaryPath}" %*\r\n`;
+    writeFileSync(cmdShim, cmdContent);
+
+    // Overwrite .ps1 shim
+    const ps1Content = `#!/usr/bin/env pwsh
+$basedir = Split-Path $MyInvocation.MyCommand.Definition -Parent
+$exe = ""
+if ($PSVersionTable.PSVersion -lt "6.0" -or $IsWindows) {
+  $exe = ".exe"
+}
+& "$basedir/${relativeBinaryPath.replace(/\\/g, '/')}" $args
+exit $LASTEXITCODE
+`;
+    writeFileSync(ps1Shim, ps1Content);
+
+    console.log('✓ Optimized: shims point to native binary (zero overhead)');
+  } catch (err) {
+    // Permission error or other issue - not critical, JS wrapper still works
+    console.log(`⚠ Could not optimize shims: ${err.message}`);
+    console.log('  CLI will work via Node.js wrapper (slightly slower startup)');
+  }
+}
+
+main().catch(console.error);

package/scripts/publish_images.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+# Script to build and push WootzApp Agent Browser images to Docker Hub.
+#
+# Usage:
+#   ./scripts/publish_images.sh [version]
+#
+# If no version is provided, it defaults to 'latest'.
+
+set -e
+
+VERSION="${1:-latest}"
+ORG="kritchoff"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+
+cd "$PROJECT_DIR"
+
+# Colors
+GREEN='\033[0;32m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+echo -e "${BLUE}Building and Pushing WootzApp Agent Browser images (version: $VERSION)...${NC}"
+
+# 1. Build Android Image
+echo -e "
+${BLUE}Building Android Image...${NC}"
+docker build -t "$ORG/agent-android:$VERSION" ./android_world
+
+# 2. Build Daemon Image
+echo -e "
+${BLUE}Building Daemon Image...${NC}"
+docker build -t "$ORG/agent-daemon:$VERSION" -f docker/Dockerfile.agent-prod .
+
+# 3. Push to Docker Hub
+echo -e "
+${BLUE}Pushing to Docker Hub...${NC}"
+echo "Note: You must be logged in to Docker Hub with 'docker login'"
+
+docker push "$ORG/agent-android:$VERSION"
+docker push "$ORG/agent-daemon:$VERSION"
+
+# Also tag as latest if a specific version was provided
+if [ "$VERSION" != "latest" ]; then
+    echo -e "
+${BLUE}Tagging and Pushing latest...${NC}"
+    docker tag "$ORG/agent-android:$VERSION" "$ORG/agent-android:latest"
+    docker tag "$ORG/agent-daemon:$VERSION" "$ORG/agent-daemon:latest"
+    docker push "$ORG/agent-android:latest"
+    docker push "$ORG/agent-daemon:latest"
+fi
+
+echo -e "
+${GREEN}Successfully published images to $ORG repository!${NC}"

package/scripts/snapshot_manager.sh

@@ -0,0 +1,293 @@
+#!/bin/bash
+# Emulator snapshot import/export utility
+#
+# Manages Android emulator snapshots for agent-browser.
+# Snapshots are stored in the emulator's AVD directory and can be
+# exported as compressed tar.gz files for sharing or backup.
+#
+# Usage:
+#   ./scripts/snapshot_manager.sh export <name> <output.tar.gz>
+#   ./scripts/snapshot_manager.sh import <input.tar.gz> [name]
+#   ./scripts/snapshot_manager.sh list
+#   ./scripts/snapshot_manager.sh validate <name>
+#
+# Examples:
+#   # Export current snapshot for sharing
+#   ./scripts/snapshot_manager.sh export w8rl_clean ./my_snapshot.tar.gz
+#
+#   # Import a snapshot from a file
+#   ./scripts/snapshot_manager.sh import ./my_snapshot.tar.gz
+#
+#   # Import with a different name
+#   ./scripts/snapshot_manager.sh import ./my_snapshot.tar.gz imported_snapshot
+#
+#   # List all available snapshots
+#   ./scripts/snapshot_manager.sh list
+#
+#   # Validate a snapshot is not corrupt
+#   ./scripts/snapshot_manager.sh validate w8rl_clean
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+
+cd "$PROJECT_DIR"
+
+# Respect COMPOSE_FILE from environment
+COMPOSE_FILE="${COMPOSE_FILE:-docker-compose.prod.yml}"
+
+# Detect container name using docker compose
+CONTAINER=$(docker compose -f "$COMPOSE_FILE" ps -q android-service)
+if [ -z "$CONTAINER" ]; then
+    echo "Error: android-service container not running."
+    exit 1
+fi
+
+AVD_NAME="${EMULATOR_NAME:-Pixel_6_API_34}"
+SNAPSHOT_BASE="/root/.android/avd/${AVD_NAME}.avd/snapshots"
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+log_info() {
+    echo -e "${BLUE}[INFO]${NC} $1"
+}
+
+log_success() {
+    echo -e "${GREEN}[OK]${NC} $1"
+}
+
+log_warn() {
+    echo -e "${YELLOW}[WARN]${NC} $1"
+}
+
+log_error() {
+    echo -e "${RED}[ERROR]${NC} $1"
+}
+
+# Check if container is running
+check_container() {
+    # Use docker inspect for reliable status check (avoids SIGPIPE with grep -q)
+    if [ "$(docker inspect -f '{{.State.Running}}' "$CONTAINER" 2>/dev/null)" != "true" ]; then
+        log_error "Container '${CONTAINER}' is not running"
+        log_info "Start it with: docker compose -f ${COMPOSE_FILE} up -d android-service"
+        exit 1
+    fi
+}
+
+# Validate a snapshot has all required files and is not corrupt
+validate_snapshot_internal() {
+    local name="$1"
+    local snapshot_dir="${SNAPSHOT_BASE}/${name}"
+    local valid=true
+
+    log_info "Validating snapshot '${name}'..."
+
+    for file in ram.bin snapshot.pb hardware.ini; do
+        if docker exec "$CONTAINER" test -f "${snapshot_dir}/${file}"; then
+            local size
+            size=$(docker exec "$CONTAINER" stat -c%s "${snapshot_dir}/${file}")
+            echo -e "  ${GREEN}✓${NC} ${file}: ${size} bytes"
+        else
+            echo -e "  ${RED}✗${NC} ${file}: MISSING"
+            valid=false
+        fi
+    done
+
+    # Check ram.bin size (must be >= 1MB)
+    if docker exec "$CONTAINER" test -f "${snapshot_dir}/ram.bin"; then
+        local ram_size
+        ram_size=$(docker exec "$CONTAINER" stat -c%s "${snapshot_dir}/ram.bin")
+        if [ "$ram_size" -lt 1000000 ]; then
+            echo -e "  ${RED}✗${NC} ram.bin too small (${ram_size} bytes, expected >= 1MB)"
+            valid=false
+        fi
+    fi
+
+    if [ "$valid" = true ]; then
+        log_success "Snapshot validation passed"
+        return 0
+    else
+        log_error "Snapshot validation failed"
+        return 1
+    fi
+}
+
+# Export a snapshot to a tar.gz file
+cmd_export() {
+    local name="${1:?Usage: $0 export <name> <output.tar.gz>}"
+    local output="${2:?Usage: $0 export <name> <output.tar.gz>}"
+
+    check_container
+
+    # Validate snapshot exists
+    if ! docker exec "$CONTAINER" test -d "${SNAPSHOT_BASE}/${name}"; then
+        log_error "Snapshot '${name}' does not exist"
+        exit 1
+    fi
+
+    log_info "Exporting snapshot '${name}' to ${output}..."
+
+    # Validate before export
+    if ! validate_snapshot_internal "$name"; then
+        log_error "Cannot export invalid snapshot"
+        exit 1
+    fi
+
+    # Create tar.gz from snapshot directory
+    docker exec "$CONTAINER" tar -czf - -C "$SNAPSHOT_BASE" "$name" > "$output"
+
+    local size
+    size=$(ls -lh "$output" | awk '{print $5}')
+    log_success "Exported: ${output} (${size})"
+}
+
+# Import a snapshot from a tar.gz file
+cmd_import() {
+    local input="${1:?Usage: $0 import <input.tar.gz> [name]}"
+
+    # Extract original name from tar
+    # Disable pipefail to avoid SIGPIPE from tar | head
+    set +o pipefail
+    local original_name
+    original_name=$(tar -tzf "$input" 2>/dev/null | head -1 | cut -d'/' -f1)
+    set -o pipefail
+
+    local name="${2:-$original_name}"
+
+    if [ -z "$name" ]; then
+        log_error "Could not determine snapshot name from archive"
+        exit 1
+    fi
+
+    check_container
+
+    log_info "Importing snapshot from ${input} as '${name}'..."
+
+    # Ensure snapshot directory exists
+    docker exec "$CONTAINER" mkdir -p "$SNAPSHOT_BASE"
+
+    # Remove existing snapshot if present
+    if docker exec "$CONTAINER" test -d "${SNAPSHOT_BASE}/${name}"; then
+        log_warn "Removing existing snapshot '${name}'..."
+        docker exec "$CONTAINER" rm -rf "${SNAPSHOT_BASE}/${name}"
+    fi
+
+    # Extract snapshot into container
+    # Use 'docker cp' to avoid stdin pipe issues
+    log_info "Copying archive to container..."
+    docker cp "$input" "$CONTAINER:/tmp/import_snapshot.tar.gz"
+
+    log_info "Extracting archive..."
+    if ! docker exec "$CONTAINER" tar -xzf /tmp/import_snapshot.tar.gz -C "$SNAPSHOT_BASE"; then
+        log_error "Failed to extract snapshot archive"
+        docker exec "$CONTAINER" rm -f /tmp/import_snapshot.tar.gz
+        exit 1
+    fi
+
+    # Clean up
+    docker exec "$CONTAINER" rm -f /tmp/import_snapshot.tar.gz
+
+    # If renaming, move the extracted directory
+    if [ "$name" != "$original_name" ]; then
+        docker exec "$CONTAINER" mv "${SNAPSHOT_BASE}/${original_name}" "${SNAPSHOT_BASE}/${name}"
+    fi
+
+    # Validate after import
+    if validate_snapshot_internal "$name"; then
+        log_success "Import completed successfully"
+        docker exec "$CONTAINER" ls -lh "${SNAPSHOT_BASE}/${name}/"
+    else
+        log_error "Import failed - snapshot validation failed"
+        exit 1
+    fi
+}
+
+# List all snapshots
+cmd_list() {
+    check_container
+
+    log_info "Available snapshots in ${CONTAINER}:"
+    echo ""
+
+    if docker exec "$CONTAINER" test -d "$SNAPSHOT_BASE"; then
+        docker exec "$CONTAINER" ls -la "$SNAPSHOT_BASE" 2>/dev/null | tail -n +2 || echo "  (none)"
+
+        echo ""
+        log_info "Snapshot details:"
+        for snapshot in $(docker exec "$CONTAINER" ls "$SNAPSHOT_BASE" 2>/dev/null); do
+            local snapshot_dir="${SNAPSHOT_BASE}/${snapshot}"
+            if docker exec "$CONTAINER" test -d "$snapshot_dir"; then
+                local ram_size
+                ram_size=$(docker exec "$CONTAINER" stat -c%s "${snapshot_dir}/ram.bin" 2>/dev/null || echo "0")
+                local ram_mb=$((ram_size / 1024 / 1024))
+                echo "  ${snapshot}: ${ram_mb}MB RAM"
+            fi
+        done
+    else
+        echo "  No snapshots found (snapshot directory does not exist)"
+    fi
+}
+
+# Validate a snapshot
+cmd_validate() {
+    local name="${1:?Usage: $0 validate <name>}"
+
+    check_container
+
+    if ! docker exec "$CONTAINER" test -d "${SNAPSHOT_BASE}/${name}"; then
+        log_error "Snapshot '${name}' does not exist"
+        exit 1
+    fi
+
+    validate_snapshot_internal "$name"
+}
+
+# Show usage
+usage() {
+    echo "Usage: $0 {export|import|list|validate} [args...]"
+    echo ""
+    echo "Commands:"
+    echo "  export <name> <output.tar.gz>  Export a snapshot to a file"
+    echo "  import <input.tar.gz> [name]   Import a snapshot from a file"
+    echo "  list                           List all available snapshots"
+    echo "  validate <name>                Validate a snapshot is not corrupt"
+    echo ""
+    echo "Examples:"
+    echo "  $0 export w8rl_clean ./my_snapshot.tar.gz"
+    echo "  $0 import ./my_snapshot.tar.gz"
+    echo "  $0 import ./my_snapshot.tar.gz custom_name"
+    echo "  $0 list"
+    echo "  $0 validate w8rl_clean"
+}
+
+# Main command dispatch
+case "${1:-}" in
+    export)
+        shift
+        cmd_export "$@"
+        ;;
+    import)
+        shift
+        cmd_import "$@"
+        ;;
+    list)
+        cmd_list
+        ;;
+    validate)
+        shift
+        cmd_validate "$@"
+        ;;
+    -h|--help|help)
+        usage
+        ;;
+    *)
+        usage
+        exit 1
+        ;;
+esac

package/scripts/start-android-agent.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+set -e
+
+export AGENT_BROWSER_SOCKET_DIR=/tmp/agent-browser
+mkdir -p $AGENT_BROWSER_SOCKET_DIR
+
+echo "[Agent] Starting Agent Browser Service"
+
+# Resolve IP of android-service to avoid Chrome Host header security block
+echo "[Agent] Resolving android-service IP..."
+ANDROID_IP=""
+until [ -n "$ANDROID_IP" ]; do
+  ANDROID_IP=$(getent hosts android-service | awk '{ print $1 }' | head -n 1)
+  if [ -z "$ANDROID_IP" ]; then
+    echo "[Agent] Waiting for DNS resolution..."
+    sleep 2
+  fi
+done
+echo "[Agent] Android IP: $ANDROID_IP"
+
+# Wait for CDP Bridge (Port 9224)
+echo "[Agent] Waiting for Android CDP at http://$ANDROID_IP:9224..."
+until curl -s http://$ANDROID_IP:9224/json/version > /dev/null; do
+  echo "[Agent] Waiting for CDP..."
+  sleep 5
+done
+echo "[Agent] CDP Bridge is ready!"
+
+# Start Daemon
+echo "[Agent] Starting Daemon..."
+export AGENT_BROWSER_CDP_URL=http://$ANDROID_IP:9224
+node dist/daemon.js &
+DAEMON_PID=$!
+
+# Start Socat Bridge for CLI
+SOCKET_FILE="$AGENT_BROWSER_SOCKET_DIR/default.sock"
+TCP_PORT=3000
+
+echo "[Agent] Waiting for socket..."
+while [ ! -S "$SOCKET_FILE" ]; do
+  if ! kill -0 $DAEMON_PID 2>/dev/null; then
+    echo "[Agent] Daemon crashed!"
+    exit 1
+  fi
+  sleep 0.5
+done
+
+echo "[Agent] Ready on port $TCP_PORT"
+exec socat TCP-LISTEN:$TCP_PORT,bind=0.0.0.0,reuseaddr,fork UNIX-CONNECT:$SOCKET_FILE

package/scripts/sync-version.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+
+/**
+ * Syncs the version from package.json to all other config files.
+ * Run this script before building or releasing.
+ */
+
+import { execSync } from "child_process";
+import { readFileSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const rootDir = join(__dirname, "..");
+const cliDir = join(rootDir, "cli");
+
+// Read version from package.json (single source of truth)
+const packageJson = JSON.parse(
+  readFileSync(join(rootDir, "package.json"), "utf-8")
+);
+const version = packageJson.version;
+
+console.log(`Syncing version ${version} to all config files...`);
+
+// Update Cargo.toml
+const cargoTomlPath = join(cliDir, "Cargo.toml");
+let cargoToml = readFileSync(cargoTomlPath, "utf-8");
+const cargoVersionRegex = /^version\s*=\s*"[^"]*"/m;
+const newCargoVersion = `version = "${version}"`;
+
+let cargoTomlUpdated = false;
+if (cargoVersionRegex.test(cargoToml)) {
+  const oldMatch = cargoToml.match(cargoVersionRegex)?.[0];
+  if (oldMatch !== newCargoVersion) {
+    cargoToml = cargoToml.replace(cargoVersionRegex, newCargoVersion);
+    writeFileSync(cargoTomlPath, cargoToml);
+    console.log(`  Updated cli/Cargo.toml: ${oldMatch} -> ${newCargoVersion}`);
+    cargoTomlUpdated = true;
+  } else {
+    console.log(`  cli/Cargo.toml already up to date`);
+  }
+} else {
+  console.error("  Could not find version field in cli/Cargo.toml");
+  process.exit(1);
+}
+
+// Update Cargo.lock to match Cargo.toml
+if (cargoTomlUpdated) {
+  try {
+    execSync("cargo update -p agent-browser --offline", {
+      cwd: cliDir,
+      stdio: "pipe",
+    });
+    console.log(`  Updated cli/Cargo.lock`);
+  } catch {
+    // --offline may fail if package not in cache, try without it
+    try {
+      execSync("cargo update -p agent-browser", {
+        cwd: cliDir,
+        stdio: "pipe",
+      });
+      console.log(`  Updated cli/Cargo.lock`);
+    } catch (e) {
+      console.error(`  Warning: Could not update Cargo.lock: ${e.message}`);
+    }
+  }
+}
+
+console.log("Version sync complete.");