@rudderhq/server 0.5.1 → 0.5.2-canary.0

package/resources/bundled-skills/browser/references/interaction-guide.md

@@ -0,0 +1,171 @@
+# Browser Interaction Guide
+
+Read this reference for workflows that require more than one simple Browser
+operation. It is intentionally task-oriented; exact schemas and limits live in
+`tool-contract.md`.
+
+## Snapshot Discipline
+
+Keep the latest relevant `rudder_browser_snapshot` result while it still
+describes the UI you are operating.
+
+- Re-snapshot after navigation when you need locator ground truth on the new
+  page.
+- Re-snapshot after a strict, stale, missing, hidden, covered, or timeout error.
+- Do not print or request full snapshots repeatedly when `count`, one attribute,
+  one state check, or a smaller max depth answers the question.
+- Do not discover a page by iterating through broad results and reading each
+  element separately. Take one bounded orientation snapshot, then narrow to the
+  relevant region with declarative locator reads.
+- Do not dump body text or embedded application-state JSON as exploratory
+  search. Use a focused page, container, or result.
+
+## Stable Locator Construction
+
+Choose a strategy from evidence in the latest snapshot:
+
+1. `testId` for an exact `data-testid`.
+2. `css` for a stable copied `data-*` attribute or other durable attribute.
+3. `href` for an exact visible destination, scoped if repeated.
+4. `role` plus a plain-string accessible `name`.
+5. `label` or `placeholder` for form controls.
+6. Scoped `text` for visible text without a more stable contract.
+7. Scoped CSS copied from actual page state.
+
+Generic labels such as Menu, Close, Search, Size, Color, Sort, and Submit are
+ambiguous by default. Scope them to the correct dialog, card, form, or section
+and count before acting.
+
+Use locator `scope` for a container, `filter.hasText` or `hasNotText` to narrow
+it, and `and` or `or` only when each side is supported by current page evidence.
+Use `frame` with outer-to-inner iframe CSS selectors for nested frames.
+
+## Forms And Controls
+
+- Locators are read-only and may only count, read bounded text/attributes/state,
+  or wait for attached, detached, visible, or hidden state.
+- For a simple input or clickable control, call `rudder_browser_read`, select
+  the exact opaque ref, and call `rudder_browser_type` or
+  `rudder_browser_click` once. Re-read before the next interaction because refs
+  are invalidated.
+- For select controls, checkboxes not represented by a safe high-level ref,
+  keypresses, hover, scroll, or drag, verify the target with a current snapshot,
+  screenshot, and `elementInfo`, then use explicit coordinate CUA.
+- File upload is unavailable until Rudder can provide run-owned staged handles;
+  do not attempt to operate a native picker or pass local paths.
+
+For multi-field forms, fill fields one at a time or in small logical groups and
+verify the narrow values that matter before submission. Submission is an
+external side effect when it sends data or creates state; confirm if the user's
+request did not already authorize that exact submission.
+
+## Navigation And State Changes
+
+Menus, filters, tabs, and accordions often do not navigate. Wait for their
+specific visible or selected state instead of load state.
+
+If you know an exact safe destination and click side effects do not matter,
+direct navigation is more reliable than clicking a brittle link. Never generate
+and probe a grid of guessed URL variants.
+
+## Frames
+
+Snapshot results include frame document metadata. Build the `frame` selector
+chain from outer frame to target frame, then use the same locator strategies as
+the main document. Re-snapshot if a frame navigates or its execution context is
+replaced.
+
+DOM-CUA is read-only. Its node ids are ephemeral snapshot evidence, not
+interaction handles. Use a fresh high-level ref or an explicit coordinate
+action to interact.
+
+## Visual And Coordinate Interaction
+
+Use a screenshot when canvas, rendered geometry, color, overlap, or pixel state
+is the source of truth. Coordinates are viewport-relative CSS pixels.
+
+Before a coordinate click or drag:
+
+1. Ensure the latest screenshot represents the current viewport and state.
+2. Use `elementInfo` at the point when DOM evidence can validate the target.
+3. Click the center of the proven target, not its edge.
+4. Verify one resulting visual or DOM signal.
+
+Use `move` for hover-only UI, `scroll` with a point inside the intended scroll
+container, and `drag` with a short bounded path. Coordinate input is a fallback,
+not a replacement for stable locators.
+
+## Dialogs
+
+A synchronous JavaScript dialog blocks the page action that opened it.
+
+- Open the dialog once through a high-level ref or verified explicit coordinate
+  action, then call `rudder_browser_dialog` to inspect and handle it.
+- JavaScript prompts can only be dismissed in the Electron runtime. An attempt
+  to accept one fails closed after dismissal; prompt text is never bridged
+  through page-visible state.
+- Use `rudder_browser_dialog` for a dialog opened independently by navigation,
+  a timer, or page code.
+- Do not retry the opening click after a dialog timeout without inspecting the
+  current dialog and page state; the first click may already have happened.
+
+## Downloads
+
+For explicit media or file links, use download mode `media` with a unique
+locator. This reads the media URL and downloads it without firing page events.
+Locator-triggered download clicks are unavailable because resolving a semantic
+locator and separately dispatching input cannot be made atomic. Use an
+authorized high-level ref or verified explicit coordinate action for a normal
+page interaction, and do not search the user's Downloads folder.
+
+Paths are opaque temporary artifacts and are removed on tab/run cleanup.
+
+## Page Assets
+
+1. Put the page into the relevant rendered state, including lazy-loaded content.
+2. Call assets `list` and keep its inventory id.
+3. Select explicit `assetIds` for narrow acquisition or explicit `kinds` for a
+   bounded broad acquisition.
+4. Call `bundle` once. Inspect failures rather than repeatedly downloading the
+   same asset.
+
+Inline SVG inventory entries contain only a stable inventory id, media type,
+inline origin, and bounded dimensions. Raw SVG/page markup, attributes, text,
+and embedded `foreignObject` content are never returned. File assets are
+streamed with per-asset, per-bundle, and per-run limits.
+
+## Content Export
+
+- Raw HTML export is unavailable because markup can contain credentials. Use
+  `text` for rendered readable text.
+- Use `pdf` for a page PDF.
+- On eligible Google Workspace URLs, use the requested `pdf`, `md`, `docx`,
+  `xlsx`, `csv`, or `pptx` format.
+- Returned files are temporary artifacts. Do not upload or transmit them unless
+  the task authorizes that destination.
+
+## Console And Clipboard
+
+Use logs with the narrowest useful levels, substring filter, and limit. Clear
+the buffer only when subsequent reads should exclude prior entries.
+
+The clipboard belongs to the signed run. `writeText` and `readText` are the
+simple path; structured items support bounded MIME text or Base64 data. The
+state remains outside the page world. CUA `ControlOrMeta+C`,
+`ControlOrMeta+X`, and `ControlOrMeta+V` explicitly transfer the focused
+selection without reading or mutating the operating-system clipboard. Never
+describe it as the system clipboard.
+
+## Recovery Without Duplicate Side Effects
+
+- On locator ambiguity or staleness, refresh the snapshot and rebuild once.
+- After two failures against the same target, switch to a stable copied
+  attribute or an explicitly verified coordinate action. Do not keep
+  increasing timeout or selector complexity.
+- On a Browser timeout, call `rudder_browser_tabs` before retrying. The active
+  tab may have been closed and the website action may already have occurred.
+- On navigation failure, inspect the tab URL/title before deciding to retry.
+- On result size errors, reduce depth/node count, scope the locator, crop the
+  screenshot, narrow log filters, or reduce asset selection.
+- On disable, unavailable Broker, unsupported runtime, or inactive run, stop.
+  Another browser or shell request would be a different surface and authority.

package/resources/bundled-skills/browser/references/tool-contract.md

@@ -1,73 +1,197 @@
 # Rudder Browser Tool Contract
 
-Browser tools are exposed by the first-party `rudder-tools` transport
-only when the deployment is `local_trusted`, the instance Browser capability is
-enabled, and the current adapter is `claude_local`, `codex_local`,
-`opencode_local`, or `pi_local`. Runtime fallback recomputes this gate and removes
-the Browser skill, capability flag, and tools together when the target runtime is
-not eligible.
-
-## Tools
-
-- `rudder_browser_tabs`: list tabs owned by the current run.
-- `rudder_browser_open`: open an HTTP(S) URL and return its `tabId`.
-- `rudder_browser_navigate`: navigate a run-owned `tabId` to an HTTP(S) URL.
-- `rudder_browser_read`: return the current URL, title, readable text, and
-  interactive elements with opaque `ref` values.
-- `rudder_browser_click`: click one `ref` from the latest page snapshot.
-- `rudder_browser_type`: replace the value at one `ref`; optional `submit`
-  submits the owning form after input events are dispatched.
-- `rudder_browser_screenshot`: return a PNG capture for the current tab.
-- `rudder_browser_close`: close one run-owned tab.
-
-All tools derive `orgId`, `agentId`, and `runId` from Rudder runtime context.
-Those values are never valid model arguments. Browser authorization requires a
-run-scoped Agent JWT; the JWT's signed run is authoritative and any transport
-run header is only a matching assertion.
+This reference describes the separate first-party `rudder-browser` transport.
+It is available only when deployment is `local_trusted`, the instance Browser
+setting is enabled, and the runtime is `claude_local`, `codex_local`,
+`opencode_local`, or `pi_local`. Runtime fallback removes the Browser skill,
+capability flag, and server or native bridge together. `rudder-tools`
+never exposes Browser tools.
+
+The transport polls a Broker-free, run-authenticated liveness endpoint. Live
+disable or run termination aborts active Browser HTTP work, suppresses queued
+stdio responses, revokes Browser state, and permanently exits that process.
+Re-enable requires a fresh Browser server.
+
+## Codex In-App Browser Parity
+
+The baseline is the complete dynamic documentation returned by the Codex
+In-app Browser bundle `26.707.91948` on 2026-07-17. That IAB advertises only the
+Browser `visibility` and `viewport` capabilities plus the Tab `pageAssets`
+capability. Rudder uses typed MCP tools instead of the JavaScript object API and
+targets the mapped core task outcomes below.
+
+| Codex In-app Browser API | Rudder Browser MCP |
+| --- | --- |
+| `browser.user.openTabs()` | `rudder_browser_user_tabs` (coarse origin discovery only) |
+| `browser.tabs.list()`, `selected()`, `get()` | `rudder_browser_tabs` |
+| `browser.tabs.new()`, `tab.goto()` | `rudder_browser_open`, `rudder_browser_navigate` |
+| `tab.back()`, `forward()`, `reload()`, `close()` | matching navigation tools and `rudder_browser_close` |
+| `tab.title()`, `tab.url()` | tab results, locator reads, and `rudder_browser_read` |
+| `tab.playwright.domSnapshot()` | `rudder_browser_snapshot` |
+| Playwright locator builders, filters, reads, and waits | read-only `rudder_browser_locator` |
+| `frameLocator(...)` | locator `frame` chain |
+| `playwright.evaluate(...)`, `locator.evaluate(...)` | intentionally unavailable; use bounded declarative reads |
+| URL/load waits | `rudder_browser_wait` |
+| `tab.cua.*` | `rudder_browser_cua` |
+| `tab.dom_cua.*` | `rudder_browser_dom_cua` |
+| `tab.getJsDialog()` and dialog methods | `rudder_browser_dialog` |
+| `tab.screenshot(...)` | `rudder_browser_screenshot` |
+| `tab.clipboard.*` | `rudder_browser_clipboard` |
+| `tab.dev.logs(...)` | `rudder_browser_logs` |
+| Browser `visibility` capability | `rudder_browser_visibility` |
+| Browser `viewport` capability | `rudder_browser_viewport` |
+| Tab `pageAssets` capability | `rudder_browser_assets` |
+
+`browser.nameSession()` has no separate MCP action because every Rudder Browser
+session is already identified by its signed organization, Agent, and run. User
+tab ids are read-only context. Unlike Codex, Rudder returns only hostname and
+origin summaries for operator tabs because the Desktop profile can serve more
+than one organization. Titles, paths, queries, fragments, and credentials are
+never exposed to an Agent. This is shape/discovery parity, not exact user-tab
+inspection parity. The current IAB does not advertise extension-only tab
+claiming, history, finalize/handoff, browser authentication, raw CDP, bot-
+detection, or secure credential handoff, so those are not IAB parity blockers.
+Rudder also intentionally rejects arbitrary `file:` navigation; both the
+origin-only user-tab view and local-file boundary require an explicit product
+permission decision before literal parity would be safe.
+
+Rudder additionally provides read-only explicit-media download, text/PDF and
+Google Workspace export, element-at-coordinate inspection,
+and a compact legacy ref flow.
+
+## Tool Inventory
+
+### Tabs And Navigation
+
+- `rudder_browser_user_tabs {}` lists live user-visible tabs in Rudder's
+  built-in Browser as hostname and origin-only summaries. Results use opaque
+  ids and are never controllable Agent tab ids. Ask for the exact URL when an
+  origin alone cannot identify the requested page.
+- `rudder_browser_tabs {}` lists tabs owned by the signed run and returns its
+  selected tab id.
+- `rudder_browser_open { url }` opens an HTTP(S) URL.
+- `rudder_browser_navigate { tabId, url }` replaces a run-owned tab's page.
+- `rudder_browser_back`, `rudder_browser_forward`, and
+  `rudder_browser_reload` accept `{ tabId }`.
+- `rudder_browser_close { tabId }` closes one run-owned tab.
+- `rudder_browser_visibility { visible? }` reads or changes whether the run's
+  selected tab is shown to the local operator.
+- `rudder_browser_viewport { action, width?, height? }` gets, sets, or resets a
+  run-wide viewport override. Set requires width 320-3840 and height 240-2160.
+
+V1 permits eight tabs per run and 32 Agent Browser tabs per Desktop process.
+User-visible tabs do not consume this Agent tab quota.
+
+### Page Understanding
+
+- `rudder_browser_snapshot { tabId, boxes?, depth?, maxNodes? }` returns a
+  bounded accessibility-oriented DOM tree, same-origin frame boundaries,
+  optional boxes, and ephemeral DOM-CUA node ids. Depth is at most 30 and node
+  count at most 3000; Chromium full-tree capture is never materialized.
+- `rudder_browser_locator` accepts a locator strategy of `css`, `testId`,
+  `href`, `role`, `label`, `placeholder`, or `text`. Locators may use a frame
+  chain, a scoped parent, filters, `and`, `or`, and an explicit index or
+  first/last position.
+- Locator read actions are `count`, `allTextContents`, `textContent`,
+  `innerText`, `attribute`, `visible`, `enabled`, `checked`, and
+  `selected`, plus `wait` for attached, detached, visible, or hidden state.
+- Locator operations are read-only. Mutating or event-generating actions such
+  as click, double-click, hover, fill, type, press, check, select, scroll, drag,
+  focus, and file assignment are rejected before Desktop dispatch.
+- Arbitrary page or locator JavaScript evaluation is intentionally unavailable
+  because side-effect checks do not prevent credential reads.
+- `rudder_browser_read { tabId }` returns bounded visible text and opaque refs
+  for the legacy compact flow.
+
+### Interaction
+
+- File upload is disabled until Rudder can bind a run-owned staged handle rather
+  than trusting a model-supplied filesystem path.
+- `rudder_browser_cua` supports coordinate `click`, `doubleClick`, `move`,
+  `scroll`, `drag`, `keypress`, `type`, and read-only `elementInfo`.
+- `rudder_browser_dom_cua` supports only the read-only `get` action. Node ids
+  cannot be used for click, scroll, keyboard, or text input; use a high-level
+  ref or explicit coordinate action instead.
+- `rudder_browser_click` and `rudder_browser_type` operate only on refs from
+  the latest `rudder_browser_read` result.
+
+### Dialogs, Evidence, And Artifacts
+
+- `rudder_browser_dialog { tabId, action, promptText? }` gets, accepts, or
+  dismisses an alert, confirm, or before-unload dialog. JavaScript prompts are
+  dismissal-only in Electron; acceptance fails closed after dismissal.
+- `rudder_browser_screenshot` supports viewport, full-page, explicit clip, or
+  unique-locator PNG/JPEG captures. Decoded image bytes are capped at 10 MB.
+  Full-page dimensions beyond Chromium's 16384-pixel limit fail explicitly
+  instead of returning a silently truncated image marked `fullPage`.
+- `rudder_browser_logs` reads at most 500 buffered log entries and can filter by
+  level or substring and clear the buffer.
+- `rudder_browser_clipboard` reads, writes, or clears a virtual run clipboard.
+  Text, binary Base64 entries, MIME types, and presentation style are bounded.
+  State remains in Desktop memory and is never installed on
+  `navigator.clipboard`. Explicit CUA copy, cut, and paste chords transfer only
+  the focused selection and never reach the native OS clipboard path.
+- `rudder_browser_download` downloads explicit locator media without firing a
+  page event. Locator-triggered click downloads are rejected. Each artifact is
+  capped at 25 MB.
+- `rudder_browser_assets` first creates an inventory, then bundles an explicit
+  `assetIds` or `kinds` selection. Each asset is capped at 25 MB, each bundle at
+  100 MB, and each run at 250 MB. Response bodies are canceled while streaming
+  as soon as a byte limit is crossed; bundle admission is serialized per run.
+  Navigation makes an inventory stale and unknown requested ids are rejected;
+  callers must list the current page again. Inline SVGs are inventory metadata
+  only (`id`, media `type`, `origin`, `width`, and `height`); raw markup and page
+  attributes are never returned or bundled.
+- `rudder_browser_content` exports text or PDF, or an eligible Google
+  Doc, Sheet, or Slides page to `pdf`, `md`, `docx`, `xlsx`, `csv`, or `pptx`.
+  Content exports are capped at 25 MB.
+- `rudder_browser_wait` waits for a URL substring, text, text disappearance, or
+  bounded time. URL input is never treated as a regular expression.
+
+All returned paths are temporary run-owned artifacts. Explicit tab close,
+Browser disable, run cleanup, and Desktop shutdown await artifact deletion.
+
+## Identity And Logging
+
+Every tool derives `orgId`, `agentId`, and `runId` only from the signed runtime
+credential. Model arguments cannot select another identity, Broker, profile,
+API URL, or key. Browser authorization requires a run-scoped Agent JWT; a run
+header is only a matching assertion.
+
+Browser request bodies are marked sensitive before HTTP error logging. Values,
+clipboard data, prompt text, and Broker tokens
+are never written as durable request-body diagnostics. Activity records contain
+only action, status, safe origin, tab id, and stable error code.
 
 ## Stable Errors
 
-- `browser_disabled` (`409`): Browser is disabled in instance Settings. Do not
-  retry until the operator enables it.
-- `browser_unavailable` (`503`): no live Rudder Desktop Browser Broker is
-  accepting commands. Retry only after Desktop reconnects.
-- `browser_runtime_unsupported` (`403`): the current Agent runtime is not one of
-  the supported local Browser adapters. Do not retry through the same runtime.
-- `browser_run_required` (`400`): the runtime did not provide a run id.
-- `agent_run_context_mismatch` (`403`): a transport run header does not match
-  the run signed into the runtime credential. Do not retry with another run id.
-- `browser_run_credential_required` (`403`): the request used a credential that
-  is not bound to one run. Browser cannot be authorized with a long-lived Agent
-  API key plus a caller-supplied run id.
-- `browser_run_forbidden` (`403`): the run identity does not match the authenticated
-  organization and Agent. Do not retry with guessed identity.
-- `browser_run_inactive` (`409`): the run has already ended. Do not retry from
-  that run.
-- `browser_tab_not_found` (`404`): the tab no longer exists. List tabs and open
-  a replacement when needed.
-- `browser_tab_forbidden` (`403`): the tab belongs to another run. Never probe
-  or reuse it.
-- `browser_ref_not_found` (`404`): the element ref is stale, changed, hidden,
-  covered, disabled, or no longer belongs to the latest snapshot. Read again;
-  refs are intentionally invalidated after every click or type action.
-- `browser_unsafe_url` (`422`): the URL, protocol, or Rudder
-  origin is not allowed. Correct the URL instead of retrying it unchanged.
-- `browser_invalid_argument` (`400` or `422`): a tool argument is malformed or
-  outside its bound. Correct the request before retrying.
-- `browser_navigation_failed` (`502`): Chromium could not complete navigation.
-  Inspect or list the tab before deciding whether to retry.
-- `browser_tab_limit` (`429`): the run or Desktop tab limit was reached. Reuse
-  or close an owned tab before opening another. V1 permits eight tabs per run
-  and 32 Agent Browser tabs per Desktop process.
-- `browser_timeout` (`504`): the command expired in a queue or timed out during
-  execution. List tabs before retrying because an active timed-out tab is
-  closed to prevent late side effects.
-- `browser_result_too_large` (`413`): the screenshot exceeded the bounded
-  response size. Use `read` or another narrower evidence path.
-- `browser_broker_protocol_error` / `browser_broker_error` (`502`): Desktop
-  returned an invalid or internal Broker result. Do not blindly retry a
-  consequential action; inspect the tab or report the failure.
-
-The Browser profile may contain sessions shared by organizations in the same
-local Rudder instance. Tab ownership remains isolated by organization, Agent,
-and run. Shared login state never broadens the task's authorization boundary.
+- `browser_disabled` (409): Browser is disabled. Do not retry from the old MCP
+  process.
+- `browser_unavailable` (503): Desktop has no live Browser Broker.
+- `browser_runtime_unsupported` (403): the runtime adapter is not eligible.
+- `browser_run_required` (400): runtime context has no run id.
+- `agent_run_context_mismatch` (403): transport and signed run differ.
+- `browser_run_credential_required` (403): the credential is not run-scoped.
+- `browser_run_forbidden` (403): signed organization, Agent, and run ownership
+  do not match.
+- `browser_run_inactive` (409): the run has ended.
+- `browser_tab_not_found` (404): the run tab no longer exists.
+- `browser_tab_forbidden` (403): the tab belongs to another run.
+- `browser_ref_not_found` (404): the ref, node, or locator is stale, missing,
+  hidden, covered, disabled, or ambiguous.
+- `browser_unsafe_url` (422): protocol, URL, or Rudder app origin is
+  blocked.
+- `browser_invalid_argument` (400 or 422): arguments exceed schema bounds.
+- `browser_navigation_failed` (502): Chromium could not complete navigation.
+- `browser_tab_limit` (429): reuse or close an owned tab.
+- `browser_timeout` (504): the operation expired; active timed-out tabs close
+  to prevent late side effects.
+- `browser_result_too_large` (413): narrow the result or artifact selection.
+- `browser_action_failed` (502): the bounded Electron action failed.
+- `browser_broker_protocol_error` or `browser_broker_error` (502): Desktop
+  returned an invalid or internal Broker result.
+
+Website login state may be shared by organizations using the same local Rudder
+instance. Tab, clipboard, viewport, dialog, download, asset, and artifact state
+remain isolated by organization, Agent, and run. Shared login state never
+expands authorization.

package/resources/bundled-skills/rudder-docs/references/cli-reference.md

@@ -84,12 +84,29 @@ operating-practices guide for operating behavior:
 | `rudder_skill_scan_local` | `rudder skill scan-local --org-id <id> [--roots <csv>]` | Scan local roots for skill packages and import new ones. | yes | required | no | attached when available |
 | `rudder_skill_scan_projects` | `rudder skill scan-projects --org-id <id> [--project-ids <csv>] [--workspace-ids <csv>]` | Scan the org workspace and any legacy project workspace records for skill packages and import new ones. | yes | required | no | attached when available |
 | `rudder_browser_tabs` | `rudder browser tabs` | List Browser tabs owned by the current Rudder agent run. | no | required | required | required |
+| `rudder_browser_user_tabs` | `rudder browser user-tabs` | List user-visible tabs currently open in Rudder's built-in Browser without taking control of them. | no | required | required | required |
 | `rudder_browser_open` | `rudder browser open <url>` | Open a run-owned tab in the Rudder Browser. | yes | required | required | required |
 | `rudder_browser_navigate` | `rudder browser navigate <tab-id> <url>` | Navigate a run-owned Rudder Browser tab. | yes | required | required | required |
+| `rudder_browser_back` | `rudder browser back <tab-id>` | Navigate a run-owned Rudder Browser tab back in history. | yes | required | required | required |
+| `rudder_browser_forward` | `rudder browser forward <tab-id>` | Navigate a run-owned Rudder Browser tab forward in history. | yes | required | required | required |
+| `rudder_browser_reload` | `rudder browser reload <tab-id>` | Reload a run-owned Rudder Browser tab. | yes | required | required | required |
+| `rudder_browser_viewport` | `rudder browser viewport --action <get|set|reset> [--width <px> --height <px>]` | Inspect, set, or reset the responsive viewport for the current Rudder Browser run. | yes | required | required | required |
+| `rudder_browser_visibility` | `rudder browser visibility [--visible <true|false>]` | Inspect or change whether the current run's selected Rudder Browser tab is visible. | yes | required | required | required |
+| `rudder_browser_snapshot` | `rudder browser snapshot <tab-id> [--input <json>]` | Capture a bounded DOM and accessibility-oriented snapshot, including frame structure and ephemeral node ids. | no | required | required | required |
+| `rudder_browser_locator` | `rudder browser locator <tab-id> --input <json>` | Perform read-only bounded Browser locator text, attribute, state, count, or wait operations. | no | required | required | required |
+| `rudder_browser_cua` | `rudder browser cua <tab-id> --input <json>` | Perform trusted coordinate mouse, scroll, drag, keyboard, and text input in a run-owned Browser tab. | yes | required | required | required |
+| `rudder_browser_dom_cua` | `rudder browser dom-cua <tab-id> --input <json>` | Inspect a bounded read-only DOM snapshot with ephemeral node ids. | no | required | required | required |
+| `rudder_browser_dialog` | `rudder browser dialog <tab-id> --input <json>` | Inspect, accept, or dismiss the active JavaScript dialog in a run-owned Browser tab. | yes | required | required | required |
+| `rudder_browser_clipboard` | `rudder browser clipboard --input <json>` | Read or write the isolated virtual clipboard for the current Browser run without touching the OS clipboard. | yes | required | required | required |
+| `rudder_browser_logs` | `rudder browser logs <tab-id> [--input <json>]` | Read bounded console and runtime logs captured for a run-owned Browser tab. | yes | required | required | required |
+| `rudder_browser_download` | `rudder browser download <tab-id> --input <json>` | Download explicit locator media without dispatching page input into a bounded run-owned artifact. | yes | required | required | required |
+| `rudder_browser_assets` | `rudder browser assets <tab-id> --input <json>` | List page assets or bundle an explicit bounded selection into a run-owned temporary artifact. | yes | required | required | required |
+| `rudder_browser_content` | `rudder browser content <tab-id> --input <json>` | Export current page content or an eligible Google Workspace document into a bounded run-owned artifact. | yes | required | required | required |
+| `rudder_browser_wait` | `rudder browser wait <tab-id> --input <json>` | Wait for bounded URL, text, disappearance, or time conditions in a run-owned Browser tab. | no | required | required | required |
 | `rudder_browser_read` | `rudder browser read <tab-id>` | Read a structured snapshot from a run-owned Rudder Browser tab. | no | required | required | required |
 | `rudder_browser_click` | `rudder browser click <tab-id> <ref>` | Click an element reference returned by Rudder Browser read. | yes | required | required | required |
 | `rudder_browser_type` | `rudder browser type <tab-id> <ref> --text <text>` | Type into an element reference in a run-owned Rudder Browser tab. | yes | required | required | required |
-| `rudder_browser_screenshot` | `rudder browser screenshot <tab-id>` | Capture a screenshot of a run-owned Rudder Browser tab. | no | required | required | required |
+| `rudder_browser_screenshot` | `rudder browser screenshot <tab-id> [--input <json>]` | Capture a screenshot of a run-owned Rudder Browser tab. | no | required | required | required |
 | `rudder_browser_close` | `rudder browser close <tab-id>` | Close a run-owned Rudder Browser tab. | yes | required | required | required |
 | `rudder_automation_list` | `rudder automation list --org-id <id>` | List automations for an organization with compact local filters. | no | required | no | no |
 | `rudder_automation_get` | `rudder automation get <automation-id>` | Read one automation detail including triggers and recent runs. | no | no | no | no |

package/resources/bundled-skills/skill-creator/CHANGELOG.md

@@ -0,0 +1,26 @@
+# Changelog
+
+Notable changes to the `skill-creator` skill.
+
+## 2026-07-23
+
+- Made Rudder compatibility the default inside Rudder and limited host-specific
+  guides to explicitly requested provider-native or cross-host work.
+
+## 2026-07-22
+
+- Restored the complete self-contained skill creator package in Rudder.
+- Added Rudder-specific ownership, installation, enablement, permission, and
+  evaluation-workspace guidance while preserving the upstream workflow.
+
+## 2026-06-25
+
+- Added this changelog so future skill-maintenance work has a durable change history.
+
+## 2026-06-24
+
+- Split host compatibility guidance from a single `references/compatibility.md` file into host-specific guides under `references/compatibility/`.
+- Added `references/compatibility/claudecode.md` for Claude Code behavior, real trigger measurement, and baseline mechanics.
+- Added `references/compatibility/codex.md` for Codex/OpenAI behavior, judged trigger proxy expectations, and `agents/openai.yaml` metadata guidance.
+- Added `references/compatibility/other.md` for generic shell agents, chat-only hosts, and headless worker adaptations.
+- Updated `SKILL.md` to direct agents to read exactly one host-specific compatibility guide unless evaluating or packaging across multiple hosts.