@oya-ai/browser 1.0.77 → 1.0.79

package/README.md

@@ -44,14 +44,17 @@ const answer = await browser.ask("What are the top 3 stories and their points?")
 console.log(answer);
 ```
 
-### Data pass-through: the model never sees your values
+### Data and secrets
 
 ```ts
-await browser.ask("Search for order {{orderNumber}} and download its invoice", {
-  data: { orderNumber: "1042" }, // typed into the page; the LLM only reads {{orderNumber}}
+await browser.ask("Log in as {{user}} with {{password}}, then book {{patient}} born {{dob}}", {
+  data: { patient: "John Smith", dob: "Jan 5, 1970" }, // the agent reads these
+  secrets: { user: "ops", password: process.env.PORTAL_PASSWORD! }, // the agent never sees these
 });
 ```
 
+The agent types every value as a placeholder, transforming it with filters when a form needs a piece or another format: `{{patient|first}}`, `{{patient|last}}`, `{{dob|date:MM/DD/YYYY}}`, `{{dob|date:YYYY}}`, `{{phone|digits}}`. A playbook saved from the run stores the placeholders, never the values.
+
 ### Playbooks: ask once, replay without the LLM
 
 ```ts

package/dist/index.cjs

@@ -187,18 +187,19 @@ var Browser = class {
     return result;
   }
   /**
-   * Natural-language control, using this key's configured model. Refer to `data`
-   * as `{{name}}` in the prompt: the agent types the placeholder, the page gets the
-   * value, and the model never sees it.
+   * Natural-language control, using this key's configured model. Refer to values as
+   * `{{name}}` in the prompt. `data` the agent can read, so it can split a name or pick
+   * the matching option; `secrets` it never sees. It types both through placeholders,
+   * with filters like `{{name|first}}`, so a playbook saved from the run stores no values.
    */
-  async ask(prompt, { data } = {}) {
+  async ask(prompt, { data, secrets } = {}) {
     const res = await this.http.request(
       "POST",
       `/api/browsers/${this.id}/chat`,
-      { messages: [{ role: "user", content: prompt }], data },
+      { messages: [{ role: "user", content: prompt }], data, secrets },
       6e5
     );
-    if (res.error) throw new OyaError(res.error, 500, res);
+    if (res.error) throw new OyaError(res.error, res.status ?? 500, res);
     return res.text;
   }
   /**
@@ -223,7 +224,7 @@ var Browser = class {
       { variables: data, autoHeal },
       6e5
     );
-    if (res.error) throw new OyaError(res.error, 500, res);
+    if (res.error) throw new OyaError(res.error, res.status ?? 500, res);
     return res;
   }
   /**
@@ -366,7 +367,7 @@ var Run = class {
         return result;
       }
       if (run.status === "failed") {
-        const failure = new OyaError(run.error || "Run failed", 500, run);
+        const failure = new OyaError(run.error || "Run failed", run.errorStatus ?? 500, run);
         await call(() => cb.onFailure?.(failure));
         throw failure;
       }

package/dist/index.d.cts

@@ -83,7 +83,11 @@ interface PlaybookSummary extends Playbook {
         healedFrom: number;
     }) | null;
 }
-/** Values passed through to the page as `{{name}}` placeholders; the model never sees them. */
+/**
+ * Task values, referred to as `{{name}}` in prompts. As `data` the agent can read them
+ * (to split a name or pick the right option); as `secrets` it never sees them. Either
+ * way they are typed through placeholders, so playbooks store no values.
+ */
 type RunData = Record<string, string | number>;
 interface AttentionRequest {
     id: string;
@@ -105,10 +109,14 @@ interface RunInfo {
     attention: AttentionRequest | null;
     result?: RunResult;
     error?: string;
+    /** HTTP-style status of a failure: 429 when a quota stopped the run. */
+    errorStatus?: number;
 }
 interface SubmitOptions {
-    /** Passed through as `{{name}}` placeholders; for a playbook, its variables. */
+    /** Task values the agent can read; for a playbook, its variables (secret ones included). */
     data?: RunData;
+    /** Prompts only: values the agent never sees, like passwords. A playbook already knows which of its variables are secret. */
+    secrets?: RunData;
     /** Playbooks only: let the agent finish a broken replay and save its fix as a draft. Default true. */
     autoHeal?: boolean;
     onSuccess?: (result: RunResult) => unknown;
@@ -426,12 +434,14 @@ declare class Browser {
      */
     completeMfa(): Promise<MfaResult>;
     /**
-     * Natural-language control, using this key's configured model. Refer to `data`
-     * as `{{name}}` in the prompt: the agent types the placeholder, the page gets the
-     * value, and the model never sees it.
+     * Natural-language control, using this key's configured model. Refer to values as
+     * `{{name}}` in the prompt. `data` the agent can read, so it can split a name or pick
+     * the matching option; `secrets` it never sees. It types both through placeholders,
+     * with filters like `{{name|first}}`, so a playbook saved from the run stores no values.
      */
-    ask(prompt: string, { data }?: {
+    ask(prompt: string, { data, secrets }?: {
         data?: RunData;
+        secrets?: RunData;
     }): Promise<string>;
     /**
      * Save the last `ask()` on this browser as a named playbook. Values that came

package/dist/index.d.ts

@@ -83,7 +83,11 @@ interface PlaybookSummary extends Playbook {
         healedFrom: number;
     }) | null;
 }
-/** Values passed through to the page as `{{name}}` placeholders; the model never sees them. */
+/**
+ * Task values, referred to as `{{name}}` in prompts. As `data` the agent can read them
+ * (to split a name or pick the right option); as `secrets` it never sees them. Either
+ * way they are typed through placeholders, so playbooks store no values.
+ */
 type RunData = Record<string, string | number>;
 interface AttentionRequest {
     id: string;
@@ -105,10 +109,14 @@ interface RunInfo {
     attention: AttentionRequest | null;
     result?: RunResult;
     error?: string;
+    /** HTTP-style status of a failure: 429 when a quota stopped the run. */
+    errorStatus?: number;
 }
 interface SubmitOptions {
-    /** Passed through as `{{name}}` placeholders; for a playbook, its variables. */
+    /** Task values the agent can read; for a playbook, its variables (secret ones included). */
     data?: RunData;
+    /** Prompts only: values the agent never sees, like passwords. A playbook already knows which of its variables are secret. */
+    secrets?: RunData;
     /** Playbooks only: let the agent finish a broken replay and save its fix as a draft. Default true. */
     autoHeal?: boolean;
     onSuccess?: (result: RunResult) => unknown;
@@ -426,12 +434,14 @@ declare class Browser {
      */
     completeMfa(): Promise<MfaResult>;
     /**
-     * Natural-language control, using this key's configured model. Refer to `data`
-     * as `{{name}}` in the prompt: the agent types the placeholder, the page gets the
-     * value, and the model never sees it.
+     * Natural-language control, using this key's configured model. Refer to values as
+     * `{{name}}` in the prompt. `data` the agent can read, so it can split a name or pick
+     * the matching option; `secrets` it never sees. It types both through placeholders,
+     * with filters like `{{name|first}}`, so a playbook saved from the run stores no values.
      */
-    ask(prompt: string, { data }?: {
+    ask(prompt: string, { data, secrets }?: {
         data?: RunData;
+        secrets?: RunData;
     }): Promise<string>;
     /**
      * Save the last `ask()` on this browser as a named playbook. Values that came

package/dist/index.js

@@ -157,18 +157,19 @@ var Browser = class {
     return result;
   }
   /**
-   * Natural-language control, using this key's configured model. Refer to `data`
-   * as `{{name}}` in the prompt: the agent types the placeholder, the page gets the
-   * value, and the model never sees it.
+   * Natural-language control, using this key's configured model. Refer to values as
+   * `{{name}}` in the prompt. `data` the agent can read, so it can split a name or pick
+   * the matching option; `secrets` it never sees. It types both through placeholders,
+   * with filters like `{{name|first}}`, so a playbook saved from the run stores no values.
    */
-  async ask(prompt, { data } = {}) {
+  async ask(prompt, { data, secrets } = {}) {
     const res = await this.http.request(
       "POST",
       `/api/browsers/${this.id}/chat`,
-      { messages: [{ role: "user", content: prompt }], data },
+      { messages: [{ role: "user", content: prompt }], data, secrets },
       6e5
     );
-    if (res.error) throw new OyaError(res.error, 500, res);
+    if (res.error) throw new OyaError(res.error, res.status ?? 500, res);
     return res.text;
   }
   /**
@@ -193,7 +194,7 @@ var Browser = class {
       { variables: data, autoHeal },
       6e5
     );
-    if (res.error) throw new OyaError(res.error, 500, res);
+    if (res.error) throw new OyaError(res.error, res.status ?? 500, res);
     return res;
   }
   /**
@@ -336,7 +337,7 @@ var Run = class {
         return result;
       }
       if (run.status === "failed") {
-        const failure = new OyaError(run.error || "Run failed", 500, run);
+        const failure = new OyaError(run.error || "Run failed", run.errorStatus ?? 500, run);
         await call(() => cb.onFailure?.(failure));
         throw failure;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oya-ai/browser",
-  "version": "1.0.77",
+  "version": "1.0.79",
   "description": "Rotate thousands of browsers behind one API — personas, proxies, stealth, CAPTCHA and MFA.",
   "license": "MIT",
   "homepage": "https://browser.getoya.ai",