@ulpi/browse 1.3.1 → 1.3.2

package/dist/browse.cjs

@@ -62,318 +62,631 @@ var init_constants = __esm({
   }
 });
 
-// src/chrome-discover.ts
-var chrome_discover_exports = {};
-__export(chrome_discover_exports, {
-  discoverChrome: () => discoverChrome,
-  fetchWsUrl: () => fetchWsUrl,
-  findChromeExecutable: () => findChromeExecutable,
-  getChromeUserDataDir: () => getChromeUserDataDir,
-  isChromeRunning: () => isChromeRunning,
-  launchChrome: () => launchChrome
+// src/cookie-import.ts
+var cookie_import_exports = {};
+__export(cookie_import_exports, {
+  CookieImportError: () => CookieImportError,
+  findInstalledBrowsers: () => findInstalledBrowsers,
+  importCookies: () => importCookies,
+  listDomains: () => listDomains
 });
-async function fetchWsUrl(port) {
+function findInstalledBrowsers() {
+  const appSupport = path2.join(os.homedir(), "Library", "Application Support");
+  return BROWSER_REGISTRY.filter((b) => {
+    const dbPath = path2.join(appSupport, b.dataDir, "Default", "Cookies");
+    try {
+      return fs2.existsSync(dbPath);
+    } catch {
+      return false;
+    }
+  });
+}
+function listDomains(browserName, profile = "Default") {
+  const browser2 = resolveBrowser(browserName);
+  const dbPath = getCookieDbPath(browser2, profile);
+  const db = openDb(dbPath, browser2.name);
   try {
-    const res = await fetch(`http://127.0.0.1:${port}/json/version`, {
-      signal: AbortSignal.timeout(2e3)
-    });
-    if (!res.ok) return null;
-    const data = await res.json();
-    return data.webSocketDebuggerUrl ?? null;
-  } catch {
-    return null;
+    const now = chromiumNow();
+    const rows = db.prepare(
+      `SELECT host_key AS domain, COUNT(*) AS count
+       FROM cookies
+       WHERE has_expires = 0 OR expires_utc > ?
+       GROUP BY host_key
+       ORDER BY count DESC`
+    ).all(now);
+    return { domains: rows, browser: browser2.name };
+  } finally {
+    db.close();
   }
 }
-function readDevToolsPort(filePath) {
+async function importCookies(browserName, domains, profile = "Default") {
+  if (domains.length === 0) return { cookies: [], count: 0, failed: 0, domainCounts: {} };
+  const browser2 = resolveBrowser(browserName);
+  const derivedKey = await getDerivedKey(browser2);
+  const dbPath = getCookieDbPath(browser2, profile);
+  const db = openDb(dbPath, browser2.name);
   try {
-    const content = fs2.readFileSync(filePath, "utf-8");
-    const port = parseInt(content.split("\n")[0], 10);
-    return Number.isFinite(port) && port > 0 ? port : null;
-  } catch {
-    return null;
+    const now = chromiumNow();
+    const placeholders = domains.map(() => "?").join(",");
+    const rows = db.prepare(
+      `SELECT host_key, name, value, encrypted_value, path, expires_utc,
+              is_secure, is_httponly, has_expires, samesite
+       FROM cookies
+       WHERE host_key IN (${placeholders})
+         AND (has_expires = 0 OR expires_utc > ?)
+       ORDER BY host_key, name`
+    ).all(...domains, now);
+    const cookies = [];
+    let failed = 0;
+    const domainCounts = {};
+    for (const row of rows) {
+      try {
+        const value = decryptCookieValue(row, derivedKey);
+        const cookie = toPlaywrightCookie(row, value);
+        cookies.push(cookie);
+        domainCounts[row.host_key] = (domainCounts[row.host_key] || 0) + 1;
+      } catch {
+        failed++;
+      }
+    }
+    return { cookies, count: cookies.length, failed, domainCounts };
+  } finally {
+    db.close();
   }
 }
-async function discoverChrome() {
-  const home = os.homedir();
-  for (const profile of PROFILE_PATHS) {
-    const filePath = process.platform === "darwin" ? path2.join(home, "Library", "Application Support", profile, "DevToolsActivePort") : path2.join(home, ".config", profile.toLowerCase().replace(/ /g, "-"), "DevToolsActivePort");
-    const port = readDevToolsPort(filePath);
-    if (port) {
-      const wsUrl = await fetchWsUrl(port);
-      if (wsUrl) return wsUrl;
-    }
+function resolveBrowser(nameOrAlias) {
+  const needle = nameOrAlias.toLowerCase().trim();
+  const found = BROWSER_REGISTRY.find(
+    (b) => b.aliases.includes(needle) || b.name.toLowerCase() === needle
+  );
+  if (!found) {
+    const supported = BROWSER_REGISTRY.flatMap((b) => b.aliases).join(", ");
+    throw new CookieImportError(
+      `Unknown browser '${nameOrAlias}'. Supported: ${supported}`,
+      "unknown_browser"
+    );
   }
-  for (const port of PROBE_PORTS) {
-    const wsUrl = await fetchWsUrl(port);
-    if (wsUrl) return wsUrl;
+  return found;
+}
+function validateProfile(profile) {
+  if (/[/\\]|\.\./.test(profile) || /[\x00-\x1f]/.test(profile)) {
+    throw new CookieImportError(
+      `Invalid profile name: '${profile}'`,
+      "bad_request"
+    );
   }
-  return null;
 }
-function findChromeExecutable() {
-  const envPath = process.env.BROWSE_CHROME_PATH;
-  if (envPath) {
-    if (fs2.existsSync(envPath)) return envPath;
-    return null;
+function getCookieDbPath(browser2, profile) {
+  validateProfile(profile);
+  const appSupport = path2.join(os.homedir(), "Library", "Application Support");
+  const dbPath = path2.join(appSupport, browser2.dataDir, profile, "Cookies");
+  if (!fs2.existsSync(dbPath)) {
+    throw new CookieImportError(
+      `${browser2.name} is not installed (no cookie database at ${dbPath})`,
+      "not_installed"
+    );
   }
-  if (process.platform === "darwin") {
-    const candidates = [
-      "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
-      "/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary"
-    ];
-    for (const c of candidates) {
-      if (fs2.existsSync(c)) return c;
+  return dbPath;
+}
+function openDb(dbPath, browserName) {
+  try {
+    return new import_better_sqlite3.default(dbPath, { readonly: true });
+  } catch (err) {
+    if (err.message?.includes("SQLITE_BUSY") || err.message?.includes("database is locked")) {
+      return openDbFromCopy(dbPath, browserName);
     }
-  } else if (process.platform === "linux") {
-    const names = ["google-chrome", "google-chrome-stable", "chromium-browser", "chromium"];
-    for (const name of names) {
-      try {
-        const result = (0, import_child_process.execSync)(`which ${name}`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-        if (result) return result;
-      } catch {
-      }
+    if (err.message?.includes("SQLITE_CORRUPT") || err.message?.includes("malformed")) {
+      throw new CookieImportError(
+        "Cookie database is corrupt",
+        "db_corrupt"
+      );
     }
+    throw err;
   }
-  return null;
 }
-function isChromeRunning() {
-  if (process.platform !== "darwin" && process.platform !== "linux") {
-    return { running: false, hasDebugPort: false };
-  }
+function openDbFromCopy(dbPath, browserName) {
+  const tmpPath = `/tmp/browse-cookies-${browserName.toLowerCase()}-${crypto.randomUUID()}.db`;
   try {
-    const pgrepPattern = process.platform === "darwin" ? "Google Chrome" : "google-chrome|chromium";
-    const pids = (0, import_child_process.execSync)(`pgrep -f "${pgrepPattern}"`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim().split("\n").filter(Boolean);
-    if (pids.length === 0) return { running: false, hasDebugPort: false };
-    for (const pid of pids) {
+    fs2.copyFileSync(dbPath, tmpPath);
+    const walPath = dbPath + "-wal";
+    const shmPath = dbPath + "-shm";
+    if (fs2.existsSync(walPath)) fs2.copyFileSync(walPath, tmpPath + "-wal");
+    if (fs2.existsSync(shmPath)) fs2.copyFileSync(shmPath, tmpPath + "-shm");
+    const db = new import_better_sqlite3.default(tmpPath, { readonly: true });
+    const origClose = db.close.bind(db);
+    db.close = (() => {
+      origClose();
       try {
-        const cmdline = (0, import_child_process.execSync)(`ps -p ${pid} -o command=`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-        const match = cmdline.match(/--remote-debugging-port=(\d+)/);
-        if (match) {
-          return { running: true, hasDebugPort: true, debugPort: parseInt(match[1], 10) };
-        }
+        fs2.unlinkSync(tmpPath);
       } catch {
       }
-    }
-    return { running: true, hasDebugPort: false };
-  } catch {
-    return { running: false, hasDebugPort: false };
-  }
-}
-function getChromeUserDataDir() {
-  const home = os.homedir();
-  if (process.platform === "darwin") {
-    const dir = path2.join(home, "Library", "Application Support", "Google", "Chrome");
-    if (fs2.existsSync(dir)) return dir;
-  } else if (process.platform === "linux") {
-    const dir = path2.join(home, ".config", "google-chrome");
-    if (fs2.existsSync(dir)) return dir;
-  }
-  return null;
-}
-function isPortFree(port) {
-  return new Promise((resolve4) => {
-    const srv = net.createServer();
-    srv.once("error", () => resolve4(false));
-    srv.once("listening", () => {
-      srv.close(() => resolve4(true));
-    });
-    srv.listen(port, "127.0.0.1");
-  });
-}
-async function pickDebugPort() {
-  if (await isPortFree(DEFAULTS.CHROME_DEBUG_PORT)) return DEFAULTS.CHROME_DEBUG_PORT;
-  for (let port = DEFAULTS.PORT_RANGE_START; port <= DEFAULTS.PORT_RANGE_END; port++) {
-    if (await isPortFree(port)) return port;
-  }
-  throw new Error("No available port for Chrome debug port");
-}
-function cleanStaleLock(dataDir) {
-  const lockFiles = ["SingletonLock", "lockfile"];
-  for (const name of lockFiles) {
-    const lockPath = path2.join(dataDir, name);
-    try {
-      const target = fs2.readlinkSync(lockPath);
-      const pidMatch = target.match(/-(\d+)$/);
-      if (pidMatch) {
-        const pid = parseInt(pidMatch[1], 10);
-        try {
-          process.kill(pid, 0);
-        } catch {
-          fs2.unlinkSync(lockPath);
-        }
+      try {
+        fs2.unlinkSync(tmpPath + "-wal");
+      } catch {
       }
-    } catch {
       try {
-        fs2.unlinkSync(lockPath);
+        fs2.unlinkSync(tmpPath + "-shm");
       } catch {
       }
+    });
+    return db;
+  } catch {
+    try {
+      fs2.unlinkSync(tmpPath);
+    } catch {
     }
-  }
-}
-async function launchChrome() {
-  const chromePath = findChromeExecutable();
-  if (!chromePath) {
-    throw new Error(
-      "Chrome not found. Install Google Chrome or set BROWSE_CHROME_PATH environment variable."
+    throw new CookieImportError(
+      `Cookie database is locked (${browserName} may be running). Try closing ${browserName} first.`,
+      "db_locked",
+      "retry"
     );
   }
-  const status = isChromeRunning();
-  if (status.running && status.hasDebugPort && status.debugPort) {
-    const wsUrl2 = await fetchWsUrl(status.debugPort);
-    if (wsUrl2) {
-      const pw2 = await import("playwright");
-      const browser3 = await pw2.chromium.connectOverCDP(wsUrl2);
-      return { browser: browser3, child: null, close: async () => {
-      } };
-    }
-  }
-  const port = await pickDebugPort();
-  const localDir = process.env.BROWSE_LOCAL_DIR || ".browse";
-  const dataDir = path2.join(localDir, "chrome-data");
-  const realDataDir = getChromeUserDataDir();
-  if (realDataDir && !fs2.existsSync(path2.join(dataDir, "Default", "Preferences"))) {
-    console.log("[browse] Copying Chrome profile (first-time setup)...");
-    fs2.mkdirSync(dataDir, { recursive: true });
-    (0, import_child_process.execSync)(`cp -a "${realDataDir}/Default" "${dataDir}/Default"`, { stdio: "pipe", timeout: 3e4 });
-    for (const f of ["Local State", "First Run"]) {
-      const src = path2.join(realDataDir, f);
-      if (fs2.existsSync(src)) fs2.copyFileSync(src, path2.join(dataDir, f));
-    }
-    console.log("[browse] Profile copied.");
-  } else {
-    fs2.mkdirSync(dataDir, { recursive: true });
-  }
-  cleanStaleLock(dataDir);
-  const chromeArgs = [
-    `--remote-debugging-port=${port}`,
-    "--no-first-run",
-    "--no-default-browser-check",
-    `--user-data-dir=${dataDir}`
-  ];
-  const child = (0, import_child_process.spawn)(chromePath, chromeArgs, {
-    stdio: ["ignore", "pipe", "pipe"],
-    detached: false
-  });
-  let stderrData = "";
-  if (child.stderr) {
-    child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (chunk) => {
-      stderrData += chunk;
-    });
-  }
-  const deadline = Date.now() + DEFAULTS.CHROME_CDP_TIMEOUT_MS;
-  let wsUrl;
-  while (Date.now() < deadline) {
-    if (child.exitCode !== null) {
-      throw new Error(
-        `Chrome exited before CDP became ready (exit code: ${child.exitCode})` + (stderrData ? `
-stderr: ${stderrData.slice(0, 2e3)}` : "")
+}
+async function getDerivedKey(browser2) {
+  const cached = keyCache.get(browser2.keychainService);
+  if (cached) return cached;
+  const password = await getKeychainPassword(browser2.keychainService);
+  const derived = crypto.pbkdf2Sync(password, "saltysalt", 1003, 16, "sha1");
+  keyCache.set(browser2.keychainService, derived);
+  return derived;
+}
+async function getKeychainPassword(service) {
+  const proc = (0, import_child_process.spawn)("security", ["find-generic-password", "-s", service, "-w"], {
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  let stdout = "";
+  let stderr = "";
+  proc.stdout.setEncoding("utf8");
+  proc.stderr.setEncoding("utf8");
+  proc.stdout.on("data", (chunk) => {
+    stdout += chunk;
+  });
+  proc.stderr.on("data", (chunk) => {
+    stderr += chunk;
+  });
+  const exitPromise = new Promise(
+    (resolve4) => proc.on("close", (code) => resolve4(code))
+  );
+  const timeout = new Promise(
+    (_, reject) => setTimeout(() => {
+      proc.kill();
+      reject(new CookieImportError(
+        `macOS is waiting for Keychain permission. Look for a dialog asking to allow access to "${service}".`,
+        "keychain_timeout",
+        "retry"
+      ));
+    }, 1e4)
+  );
+  try {
+    const exitCode = await Promise.race([exitPromise, timeout]);
+    if (exitCode !== 0) {
+      const errText = stderr.trim().toLowerCase();
+      if (errText.includes("user canceled") || errText.includes("denied") || errText.includes("interaction not allowed")) {
+        throw new CookieImportError(
+          `Keychain access denied. Click Allow in the macOS dialog for "${service}".`,
+          "keychain_denied",
+          "retry"
+        );
+      }
+      if (errText.includes("could not be found") || errText.includes("not found")) {
+        throw new CookieImportError(
+          `No Keychain entry for "${service}".`,
+          "keychain_not_found"
+        );
+      }
+      throw new CookieImportError(
+        `Could not read Keychain: ${stderr.trim()}`,
+        "keychain_error",
+        "retry"
       );
     }
-    const url = await fetchWsUrl(port);
-    if (url) {
-      wsUrl = url;
-      break;
-    }
-    await new Promise((r) => setTimeout(r, 200));
+    return stdout.trim();
+  } catch (err) {
+    if (err instanceof CookieImportError) throw err;
+    throw new CookieImportError(
+      `Could not read Keychain: ${err.message}`,
+      "keychain_error",
+      "retry"
+    );
   }
-  if (!wsUrl) {
-    child.kill();
-    throw new Error(`Chrome failed to start on port ${port} within ${DEFAULTS.CHROME_CDP_TIMEOUT_MS / 1e3} seconds`);
+}
+function decryptCookieValue(row, key) {
+  if (row.value && row.value.length > 0) return row.value;
+  const ev = Buffer.from(row.encrypted_value);
+  if (ev.length === 0) return "";
+  const prefix = ev.slice(0, 3).toString("utf-8");
+  if (prefix !== "v10") {
+    throw new Error(`Unknown encryption prefix: ${prefix}`);
   }
-  const pw = await import("playwright");
-  const browser2 = await pw.chromium.connectOverCDP(wsUrl);
+  const ciphertext = ev.slice(3);
+  const iv = Buffer.alloc(16, 32);
+  const decipher = crypto.createDecipheriv("aes-128-cbc", key, iv);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  if (plaintext.length <= 32) return "";
+  return plaintext.slice(32).toString("utf-8");
+}
+function toPlaywrightCookie(row, value) {
   return {
-    browser: browser2,
-    child,
-    close: async () => {
-      await browser2.close().catch(() => {
-      });
-      child.kill("SIGTERM");
-    }
+    name: row.name,
+    value,
+    domain: row.host_key,
+    path: row.path || "/",
+    expires: chromiumEpochToUnix(row.expires_utc, row.has_expires),
+    secure: row.is_secure === 1,
+    httpOnly: row.is_httponly === 1,
+    sameSite: mapSameSite(row.samesite)
   };
 }
-var os, fs2, path2, net, import_child_process, PROFILE_PATHS, PROBE_PORTS;
-var init_chrome_discover = __esm({
-  "src/chrome-discover.ts"() {
+function chromiumNow() {
+  return BigInt(Date.now()) * 1000n + CHROMIUM_EPOCH_OFFSET;
+}
+function chromiumEpochToUnix(epoch, hasExpires) {
+  if (hasExpires === 0 || epoch === 0 || epoch === 0n) return -1;
+  const epochBig = BigInt(epoch);
+  const unixMicro = epochBig - CHROMIUM_EPOCH_OFFSET;
+  return Number(unixMicro / 1000000n);
+}
+function mapSameSite(value) {
+  switch (value) {
+    case 0:
+      return "None";
+    case 1:
+      return "Lax";
+    case 2:
+      return "Strict";
+    default:
+      return "Lax";
+  }
+}
+var import_better_sqlite3, import_child_process, crypto, fs2, path2, os, CookieImportError, BROWSER_REGISTRY, keyCache, CHROMIUM_EPOCH_OFFSET;
+var init_cookie_import = __esm({
+  "src/cookie-import.ts"() {
     "use strict";
-    os = __toESM(require("os"), 1);
+    import_better_sqlite3 = __toESM(require("better-sqlite3"), 1);
+    import_child_process = require("child_process");
+    crypto = __toESM(require("crypto"), 1);
     fs2 = __toESM(require("fs"), 1);
     path2 = __toESM(require("path"), 1);
-    net = __toESM(require("net"), 1);
-    import_child_process = require("child_process");
-    init_constants();
-    PROFILE_PATHS = [
-      "Google/Chrome",
-      "Arc/User Data",
-      "BraveSoftware/Brave-Browser",
-      "Microsoft Edge"
+    os = __toESM(require("os"), 1);
+    CookieImportError = class extends Error {
+      constructor(message, code, action) {
+        super(message);
+        this.code = code;
+        this.action = action;
+        this.name = "CookieImportError";
+      }
+    };
+    BROWSER_REGISTRY = [
+      { name: "Chrome", dataDir: "Google/Chrome/", keychainService: "Chrome Safe Storage", aliases: ["chrome", "google-chrome"] },
+      { name: "Arc", dataDir: "Arc/User Data/", keychainService: "Arc Safe Storage", aliases: ["arc"] },
+      { name: "Brave", dataDir: "BraveSoftware/Brave-Browser/", keychainService: "Brave Safe Storage", aliases: ["brave"] },
+      { name: "Edge", dataDir: "Microsoft Edge/", keychainService: "Microsoft Edge Safe Storage", aliases: ["edge"] }
     ];
-    PROBE_PORTS = [9222, 9229];
+    keyCache = /* @__PURE__ */ new Map();
+    CHROMIUM_EPOCH_OFFSET = 11644473600000000n;
   }
 });
 
-// src/encryption.ts
-function resolveEncryptionKey(localDir) {
-  const envKey = process.env.BROWSE_ENCRYPTION_KEY;
-  if (envKey) {
-    if (envKey.length !== 64) {
-      throw new Error("BROWSE_ENCRYPTION_KEY must be 64 hex characters (32 bytes)");
-    }
-    return Buffer.from(envKey, "hex");
-  }
-  const keyPath = path3.join(localDir, ".encryption-key");
-  if (fs3.existsSync(keyPath)) {
-    const hex = fs3.readFileSync(keyPath, "utf-8").trim();
-    return Buffer.from(hex, "hex");
+// src/chrome-discover.ts
+var chrome_discover_exports = {};
+__export(chrome_discover_exports, {
+  discoverChrome: () => discoverChrome,
+  fetchWsUrl: () => fetchWsUrl,
+  findChromeExecutable: () => findChromeExecutable,
+  getChromeUserDataDir: () => getChromeUserDataDir,
+  isChromeRunning: () => isChromeRunning,
+  launchChrome: () => launchChrome
+});
+async function fetchWsUrl(port) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/json/version`, {
+      signal: AbortSignal.timeout(2e3)
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.webSocketDebuggerUrl ?? null;
+  } catch {
+    return null;
   }
-  const key = crypto.randomBytes(32);
-  fs3.writeFileSync(keyPath, key.toString("hex") + "\n", { mode: 384 });
-  return key;
-}
-function encrypt(plaintext, key) {
-  const iv = crypto.randomBytes(12);
-  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-  return {
-    ciphertext: encrypted.toString("base64"),
-    iv: iv.toString("base64"),
-    authTag: cipher.getAuthTag().toString("base64")
-  };
 }
-function decrypt(ciphertext, iv, authTag, key) {
-  const decipher = crypto.createDecipheriv(
-    "aes-256-gcm",
-    key,
-    Buffer.from(iv, "base64")
-  );
-  decipher.setAuthTag(Buffer.from(authTag, "base64"));
-  const decrypted = Buffer.concat([
-    decipher.update(Buffer.from(ciphertext, "base64")),
-    decipher.final()
-  ]);
-  return decrypted.toString("utf-8");
+function readDevToolsPort(filePath) {
+  try {
+    const content = fs3.readFileSync(filePath, "utf-8");
+    const port = parseInt(content.split("\n")[0], 10);
+    return Number.isFinite(port) && port > 0 ? port : null;
+  } catch {
+    return null;
+  }
 }
-var crypto, fs3, path3;
-var init_encryption = __esm({
-  "src/encryption.ts"() {
-    "use strict";
-    crypto = __toESM(require("crypto"), 1);
-    fs3 = __toESM(require("fs"), 1);
-    path3 = __toESM(require("path"), 1);
+async function discoverChrome() {
+  const home = os2.homedir();
+  for (const profile of PROFILE_PATHS) {
+    const filePath = process.platform === "darwin" ? path3.join(home, "Library", "Application Support", profile, "DevToolsActivePort") : path3.join(home, ".config", profile.toLowerCase().replace(/ /g, "-"), "DevToolsActivePort");
+    const port = readDevToolsPort(filePath);
+    if (port) {
+      const wsUrl = await fetchWsUrl(port);
+      if (wsUrl) return wsUrl;
+    }
   }
-});
-
-// src/sanitize.ts
-function sanitizeName(name) {
-  const sanitized = name.replace(/[\/\\]/g, "_").replace(/\.\./g, "_");
-  if (!sanitized || /^[._]+$/.test(sanitized)) {
-    throw new Error(`Invalid name: "${name}"`);
+  for (const port of PROBE_PORTS) {
+    const wsUrl = await fetchWsUrl(port);
+    if (wsUrl) return wsUrl;
   }
-  return sanitized;
+  return null;
 }
-var init_sanitize = __esm({
-  "src/sanitize.ts"() {
-    "use strict";
+function findChromeExecutable() {
+  const envPath = process.env.BROWSE_CHROME_PATH;
+  if (envPath) {
+    if (fs3.existsSync(envPath)) return envPath;
+    return null;
+  }
+  if (process.platform === "darwin") {
+    const candidates = [
+      "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+      "/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary"
+    ];
+    for (const c of candidates) {
+      if (fs3.existsSync(c)) return c;
+    }
+  } else if (process.platform === "linux") {
+    const names = ["google-chrome", "google-chrome-stable", "chromium-browser", "chromium"];
+    for (const name of names) {
+      try {
+        const result = (0, import_child_process2.execSync)(`which ${name}`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+        if (result) return result;
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function isChromeRunning() {
+  if (process.platform !== "darwin" && process.platform !== "linux") {
+    return { running: false, hasDebugPort: false };
+  }
+  try {
+    const pgrepPattern = process.platform === "darwin" ? "Google Chrome" : "google-chrome|chromium";
+    const pids = (0, import_child_process2.execSync)(`pgrep -f "${pgrepPattern}"`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim().split("\n").filter(Boolean);
+    if (pids.length === 0) return { running: false, hasDebugPort: false };
+    for (const pid of pids) {
+      try {
+        const cmdline = (0, import_child_process2.execSync)(`ps -p ${pid} -o command=`, { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+        const match = cmdline.match(/--remote-debugging-port=(\d+)/);
+        if (match) {
+          return { running: true, hasDebugPort: true, debugPort: parseInt(match[1], 10) };
+        }
+      } catch {
+      }
+    }
+    return { running: true, hasDebugPort: false };
+  } catch {
+    return { running: false, hasDebugPort: false };
+  }
+}
+function getChromeUserDataDir() {
+  const home = os2.homedir();
+  if (process.platform === "darwin") {
+    const dir = path3.join(home, "Library", "Application Support", "Google", "Chrome");
+    if (fs3.existsSync(dir)) return dir;
+  } else if (process.platform === "linux") {
+    const dir = path3.join(home, ".config", "google-chrome");
+    if (fs3.existsSync(dir)) return dir;
+  }
+  return null;
+}
+function isPortFree(port) {
+  return new Promise((resolve4) => {
+    const srv = net.createServer();
+    srv.once("error", () => resolve4(false));
+    srv.once("listening", () => {
+      srv.close(() => resolve4(true));
+    });
+    srv.listen(port, "127.0.0.1");
+  });
+}
+async function pickDebugPort() {
+  if (await isPortFree(DEFAULTS.CHROME_DEBUG_PORT)) return DEFAULTS.CHROME_DEBUG_PORT;
+  for (let port = DEFAULTS.PORT_RANGE_START; port <= DEFAULTS.PORT_RANGE_END; port++) {
+    if (await isPortFree(port)) return port;
+  }
+  throw new Error("No available port for Chrome debug port");
+}
+function cleanStaleLock(dataDir) {
+  const lockFiles = ["SingletonLock", "lockfile"];
+  for (const name of lockFiles) {
+    const lockPath = path3.join(dataDir, name);
+    try {
+      const target = fs3.readlinkSync(lockPath);
+      const pidMatch = target.match(/-(\d+)$/);
+      if (pidMatch) {
+        const pid = parseInt(pidMatch[1], 10);
+        try {
+          process.kill(pid, 0);
+        } catch {
+          fs3.unlinkSync(lockPath);
+        }
+      }
+    } catch {
+      try {
+        fs3.unlinkSync(lockPath);
+      } catch {
+      }
+    }
+  }
+}
+async function launchChrome() {
+  const chromePath = findChromeExecutable();
+  if (!chromePath) {
+    throw new Error(
+      "Chrome not found. Install Google Chrome or set BROWSE_CHROME_PATH environment variable."
+    );
+  }
+  const status = isChromeRunning();
+  if (status.running && status.hasDebugPort && status.debugPort) {
+    const wsUrl2 = await fetchWsUrl(status.debugPort);
+    if (wsUrl2) {
+      const pw2 = await import("playwright");
+      const browser3 = await pw2.chromium.connectOverCDP(wsUrl2);
+      return { browser: browser3, child: null, close: async () => {
+      } };
+    }
+  }
+  const port = await pickDebugPort();
+  const localDir = process.env.BROWSE_LOCAL_DIR || ".browse";
+  const dataDir = path3.join(localDir, "chrome-data");
+  const realDataDir = getChromeUserDataDir();
+  fs3.mkdirSync(dataDir, { recursive: true });
+  cleanStaleLock(dataDir);
+  const chromeArgs = [
+    `--remote-debugging-port=${port}`,
+    "--no-first-run",
+    "--no-default-browser-check",
+    `--user-data-dir=${dataDir}`
+  ];
+  const child = (0, import_child_process2.spawn)(chromePath, chromeArgs, {
+    stdio: ["ignore", "pipe", "pipe"],
+    detached: false
+  });
+  let stderrData = "";
+  if (child.stderr) {
+    child.stderr.setEncoding("utf8");
+    child.stderr.on("data", (chunk) => {
+      stderrData += chunk;
+    });
+  }
+  const deadline = Date.now() + DEFAULTS.CHROME_CDP_TIMEOUT_MS;
+  let wsUrl;
+  while (Date.now() < deadline) {
+    if (child.exitCode !== null) {
+      throw new Error(
+        `Chrome exited before CDP became ready (exit code: ${child.exitCode})` + (stderrData ? `
+stderr: ${stderrData.slice(0, 2e3)}` : "")
+      );
+    }
+    const url = await fetchWsUrl(port);
+    if (url) {
+      wsUrl = url;
+      break;
+    }
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  if (!wsUrl) {
+    child.kill();
+    throw new Error(`Chrome failed to start on port ${port} within ${DEFAULTS.CHROME_CDP_TIMEOUT_MS / 1e3} seconds`);
+  }
+  const pw = await import("playwright");
+  const browser2 = await pw.chromium.connectOverCDP(wsUrl);
+  if (realDataDir) {
+    try {
+      const { importCookies: importCookies2, listDomains: listDomains2 } = await Promise.resolve().then(() => (init_cookie_import(), cookie_import_exports));
+      const { domains } = listDomains2("chrome");
+      if (domains.length > 0) {
+        const allDomains = domains.map((d) => d.domain);
+        const result = await importCookies2("chrome", allDomains);
+        if (result.cookies.length > 0) {
+          const context = browser2.contexts()[0];
+          if (context) {
+            await context.addCookies(result.cookies);
+            console.log(`[browse] Imported ${result.cookies.length} cookies from Chrome.`);
+          }
+        }
+      }
+    } catch (err) {
+      console.log(`[browse] Cookie import skipped: ${err.message}`);
+    }
+  }
+  return {
+    browser: browser2,
+    child,
+    close: async () => {
+      await browser2.close().catch(() => {
+      });
+      child.kill("SIGTERM");
+    }
+  };
+}
+var os2, fs3, path3, net, import_child_process2, PROFILE_PATHS, PROBE_PORTS;
+var init_chrome_discover = __esm({
+  "src/chrome-discover.ts"() {
+    "use strict";
+    os2 = __toESM(require("os"), 1);
+    fs3 = __toESM(require("fs"), 1);
+    path3 = __toESM(require("path"), 1);
+    net = __toESM(require("net"), 1);
+    import_child_process2 = require("child_process");
+    init_constants();
+    PROFILE_PATHS = [
+      "Google/Chrome",
+      "Arc/User Data",
+      "BraveSoftware/Brave-Browser",
+      "Microsoft Edge"
+    ];
+    PROBE_PORTS = [9222, 9229];
+  }
+});
+
+// src/encryption.ts
+function resolveEncryptionKey(localDir) {
+  const envKey = process.env.BROWSE_ENCRYPTION_KEY;
+  if (envKey) {
+    if (envKey.length !== 64) {
+      throw new Error("BROWSE_ENCRYPTION_KEY must be 64 hex characters (32 bytes)");
+    }
+    return Buffer.from(envKey, "hex");
+  }
+  const keyPath = path4.join(localDir, ".encryption-key");
+  if (fs4.existsSync(keyPath)) {
+    const hex = fs4.readFileSync(keyPath, "utf-8").trim();
+    return Buffer.from(hex, "hex");
+  }
+  const key = crypto2.randomBytes(32);
+  fs4.writeFileSync(keyPath, key.toString("hex") + "\n", { mode: 384 });
+  return key;
+}
+function encrypt(plaintext, key) {
+  const iv = crypto2.randomBytes(12);
+  const cipher = crypto2.createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+  return {
+    ciphertext: encrypted.toString("base64"),
+    iv: iv.toString("base64"),
+    authTag: cipher.getAuthTag().toString("base64")
+  };
+}
+function decrypt(ciphertext, iv, authTag, key) {
+  const decipher = crypto2.createDecipheriv(
+    "aes-256-gcm",
+    key,
+    Buffer.from(iv, "base64")
+  );
+  decipher.setAuthTag(Buffer.from(authTag, "base64"));
+  const decrypted = Buffer.concat([
+    decipher.update(Buffer.from(ciphertext, "base64")),
+    decipher.final()
+  ]);
+  return decrypted.toString("utf-8");
+}
+var crypto2, fs4, path4;
+var init_encryption = __esm({
+  "src/encryption.ts"() {
+    "use strict";
+    crypto2 = __toESM(require("crypto"), 1);
+    fs4 = __toESM(require("fs"), 1);
+    path4 = __toESM(require("path"), 1);
+  }
+});
+
+// src/sanitize.ts
+function sanitizeName(name) {
+  const sanitized = name.replace(/[\/\\]/g, "_").replace(/\.\./g, "_");
+  if (!sanitized || /^[._]+$/.test(sanitized)) {
+    throw new Error(`Invalid name: "${name}"`);
+  }
+  return sanitized;
+}
+var init_sanitize = __esm({
+  "src/sanitize.ts"() {
+    "use strict";
   }
 });
 
@@ -411,12 +724,12 @@ async function cleanupProvider(providerName, apiKey, sessionId) {
     await provider.cleanup(apiKey, sessionId);
   }
 }
-var fs4, path4, providers, ProviderVault;
+var fs5, path5, providers, ProviderVault;
 var init_cloud_providers = __esm({
   "src/cloud-providers.ts"() {
     "use strict";
-    fs4 = __toESM(require("fs"), 1);
-    path4 = __toESM(require("path"), 1);
+    fs5 = __toESM(require("fs"), 1);
+    path5 = __toESM(require("path"), 1);
     init_encryption();
     init_sanitize();
     providers = {
@@ -462,12 +775,12 @@ var init_cloud_providers = __esm({
       dir;
       encryptionKey;
       constructor(localDir) {
-        this.dir = path4.join(localDir, "providers");
+        this.dir = path5.join(localDir, "providers");
         this.encryptionKey = resolveEncryptionKey(localDir);
       }
       save(name, apiKey) {
         getProvider(name);
-        fs4.mkdirSync(this.dir, { recursive: true });
+        fs5.mkdirSync(this.dir, { recursive: true });
         const { ciphertext, iv, authTag } = encrypt(apiKey, this.encryptionKey);
         const stored = {
           name,
@@ -477,34 +790,34 @@ var init_cloud_providers = __esm({
           data: ciphertext,
           createdAt: (/* @__PURE__ */ new Date()).toISOString()
         };
-        const filePath = path4.join(this.dir, `${sanitizeName(name)}.json`);
-        fs4.writeFileSync(filePath, JSON.stringify(stored, null, 2), { mode: 384 });
+        const filePath = path5.join(this.dir, `${sanitizeName(name)}.json`);
+        fs5.writeFileSync(filePath, JSON.stringify(stored, null, 2), { mode: 384 });
       }
       load(name) {
-        const filePath = path4.join(this.dir, `${sanitizeName(name)}.json`);
-        if (!fs4.existsSync(filePath)) {
+        const filePath = path5.join(this.dir, `${sanitizeName(name)}.json`);
+        if (!fs5.existsSync(filePath)) {
           throw new Error(
             `No API key saved for "${name}". Run: browse provider save ${name} <api-key>`
           );
         }
-        const stored = JSON.parse(fs4.readFileSync(filePath, "utf-8"));
+        const stored = JSON.parse(fs5.readFileSync(filePath, "utf-8"));
         return decrypt(stored.data, stored.iv, stored.authTag, this.encryptionKey);
       }
       list() {
-        if (!fs4.existsSync(this.dir)) return [];
-        return fs4.readdirSync(this.dir).filter((f) => f.endsWith(".json")).map((f) => {
+        if (!fs5.existsSync(this.dir)) return [];
+        return fs5.readdirSync(this.dir).filter((f) => f.endsWith(".json")).map((f) => {
           const stored = JSON.parse(
-            fs4.readFileSync(path4.join(this.dir, f), "utf-8")
+            fs5.readFileSync(path5.join(this.dir, f), "utf-8")
           );
           return { name: stored.name, createdAt: stored.createdAt };
         });
       }
       delete(name) {
-        const filePath = path4.join(this.dir, `${sanitizeName(name)}.json`);
-        if (!fs4.existsSync(filePath)) {
+        const filePath = path5.join(this.dir, `${sanitizeName(name)}.json`);
+        if (!fs5.existsSync(filePath)) {
           throw new Error(`No saved key for "${name}"`);
         }
-        fs4.unlinkSync(filePath);
+        fs5.unlinkSync(filePath);
       }
     };
   }
@@ -515,7 +828,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@ulpi/browse",
-      version: "1.3.0",
+      version: "1.3.2",
       repository: {
         type: "git",
         url: "https://github.com/ulpi-io/browse"
@@ -591,45 +904,45 @@ __export(install_skill_exports, {
 });
 function installSkill(targetDir) {
   const dir = targetDir || process.cwd();
-  const hasGit = fs5.existsSync(path5.join(dir, ".git"));
-  const hasClaude = fs5.existsSync(path5.join(dir, ".claude"));
+  const hasGit = fs6.existsSync(path6.join(dir, ".git"));
+  const hasClaude = fs6.existsSync(path6.join(dir, ".claude"));
   if (!hasGit && !hasClaude) {
     console.error(`Not a project root: ${dir}`);
     console.error("Run from a directory with .git or .claude, or pass the path as an argument.");
     process.exit(1);
   }
-  const skillDir = path5.join(dir, ".claude", "skills", "browse");
-  fs5.mkdirSync(skillDir, { recursive: true });
-  const skillSourceDir = path5.resolve(path5.dirname((0, import_url.fileURLToPath)(__import_meta_url)), "..", "skill");
-  if (!fs5.existsSync(skillSourceDir)) {
+  const skillDir = path6.join(dir, ".claude", "skills", "browse");
+  fs6.mkdirSync(skillDir, { recursive: true });
+  const skillSourceDir = path6.resolve(path6.dirname((0, import_url.fileURLToPath)(__import_meta_url)), "..", "skill");
+  if (!fs6.existsSync(skillSourceDir)) {
     console.error(`Skill directory not found at ${skillSourceDir}`);
     console.error("Is @ulpi/browse installed correctly?");
     process.exit(1);
   }
-  const mdFiles = fs5.readdirSync(skillSourceDir).filter((f) => f.endsWith(".md"));
+  const mdFiles = fs6.readdirSync(skillSourceDir).filter((f) => f.endsWith(".md"));
   if (mdFiles.length === 0) {
     console.error(`No .md files found in ${skillSourceDir}`);
     process.exit(1);
   }
   for (const file of mdFiles) {
-    fs5.copyFileSync(path5.join(skillSourceDir, file), path5.join(skillDir, file));
-    console.log(`Skill installed: ${path5.relative(dir, path5.join(skillDir, file))}`);
-  }
-  const refsSourceDir = path5.join(skillSourceDir, "references");
-  if (fs5.existsSync(refsSourceDir)) {
-    const refsDestDir = path5.join(skillDir, "references");
-    fs5.mkdirSync(refsDestDir, { recursive: true });
-    const refFiles = fs5.readdirSync(refsSourceDir).filter((f) => f.endsWith(".md"));
+    fs6.copyFileSync(path6.join(skillSourceDir, file), path6.join(skillDir, file));
+    console.log(`Skill installed: ${path6.relative(dir, path6.join(skillDir, file))}`);
+  }
+  const refsSourceDir = path6.join(skillSourceDir, "references");
+  if (fs6.existsSync(refsSourceDir)) {
+    const refsDestDir = path6.join(skillDir, "references");
+    fs6.mkdirSync(refsDestDir, { recursive: true });
+    const refFiles = fs6.readdirSync(refsSourceDir).filter((f) => f.endsWith(".md"));
     for (const file of refFiles) {
-      fs5.copyFileSync(path5.join(refsSourceDir, file), path5.join(refsDestDir, file));
-      console.log(`Skill installed: ${path5.relative(dir, path5.join(refsDestDir, file))}`);
+      fs6.copyFileSync(path6.join(refsSourceDir, file), path6.join(refsDestDir, file));
+      console.log(`Skill installed: ${path6.relative(dir, path6.join(refsDestDir, file))}`);
     }
   }
-  const settingsPath = path5.join(dir, ".claude", "settings.json");
+  const settingsPath = path6.join(dir, ".claude", "settings.json");
   let settings = {};
-  if (fs5.existsSync(settingsPath)) {
+  if (fs6.existsSync(settingsPath)) {
     try {
-      settings = JSON.parse(fs5.readFileSync(settingsPath, "utf-8"));
+      settings = JSON.parse(fs6.readFileSync(settingsPath, "utf-8"));
     } catch {
       console.error(`Warning: could not parse ${settingsPath}, creating fresh`);
       settings = {};
@@ -645,20 +958,20 @@ function installSkill(targetDir) {
       added++;
     }
   }
-  fs5.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+  fs6.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   if (added > 0) {
-    console.log(`Permissions: ${added} rules added to ${path5.relative(dir, settingsPath)}`);
+    console.log(`Permissions: ${added} rules added to ${path6.relative(dir, settingsPath)}`);
   } else {
     console.log(`Permissions: already configured`);
   }
   console.log("\nDone. Claude Code will now use browse for web tasks automatically.");
 }
-var fs5, path5, import_url, PERMISSIONS;
+var fs6, path6, import_url, PERMISSIONS;
 var init_install_skill = __esm({
   "src/install-skill.ts"() {
     "use strict";
-    fs5 = __toESM(require("fs"), 1);
-    path5 = __toESM(require("path"), 1);
+    fs6 = __toESM(require("fs"), 1);
+    path6 = __toESM(require("path"), 1);
     import_url = require("url");
     PERMISSIONS = [
       "Bash(browse:*)",
@@ -820,21 +1133,21 @@ function listDevices() {
 function getProfileDir(localDir, name) {
   const sanitized = sanitizeName(name);
   if (!sanitized) throw new Error("Invalid profile name");
-  return path6.join(localDir, "profiles", sanitized);
+  return path7.join(localDir, "profiles", sanitized);
 }
 function listProfiles(localDir) {
-  const profilesDir = path6.join(localDir, "profiles");
-  if (!fs6.existsSync(profilesDir)) return [];
-  return fs6.readdirSync(profilesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
-    const dir = path6.join(profilesDir, d.name);
-    const stat = fs6.statSync(dir);
+  const profilesDir = path7.join(localDir, "profiles");
+  if (!fs7.existsSync(profilesDir)) return [];
+  return fs7.readdirSync(profilesDir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => {
+    const dir = path7.join(profilesDir, d.name);
+    const stat = fs7.statSync(dir);
     let totalSize = 0;
     try {
-      const files = fs6.readdirSync(dir, { recursive: true, withFileTypes: true });
+      const files = fs7.readdirSync(dir, { recursive: true, withFileTypes: true });
       for (const f of files) {
         if (f.isFile()) {
           try {
-            totalSize += fs6.statSync(path6.join(f.parentPath || f.path || dir, f.name)).size;
+            totalSize += fs7.statSync(path7.join(f.parentPath || f.path || dir, f.name)).size;
           } catch {
           }
         }
@@ -851,15 +1164,15 @@ function listProfiles(localDir) {
 }
 function deleteProfile(localDir, name) {
   const dir = getProfileDir(localDir, name);
-  if (!fs6.existsSync(dir)) throw new Error(`Profile "${name}" not found`);
-  fs6.rmSync(dir, { recursive: true, force: true });
+  if (!fs7.existsSync(dir)) throw new Error(`Profile "${name}" not found`);
+  fs7.rmSync(dir, { recursive: true, force: true });
 }
-var path6, fs6, import_playwright, DEVICE_ALIASES, CUSTOM_DEVICES, BrowserManager;
+var path7, fs7, import_playwright, DEVICE_ALIASES, CUSTOM_DEVICES, BrowserManager;
 var init_browser_manager = __esm({
   "src/browser-manager.ts"() {
     "use strict";
-    path6 = __toESM(require("path"), 1);
-    fs6 = __toESM(require("fs"), 1);
+    path7 = __toESM(require("path"), 1);
+    fs7 = __toESM(require("fs"), 1);
     import_playwright = require("playwright");
     init_buffers();
     init_sanitize();
@@ -2229,8 +2542,8 @@ async function handleReadCommand(command, args, bm, buffers) {
     case "eval": {
       const filePath = args[0];
       if (!filePath) throw new Error("Usage: browse eval <js-file>");
-      if (!fs7.existsSync(filePath)) throw new Error(`File not found: ${filePath}`);
-      const code = fs7.readFileSync(filePath, "utf-8");
+      if (!fs8.existsSync(filePath)) throw new Error(`File not found: ${filePath}`);
+      const code = fs8.readFileSync(filePath, "utf-8");
       const result = await evalCtx.evaluate(code);
       return typeof result === "object" ? JSON.stringify(result, null, 2) : String(result ?? "");
     }
@@ -2468,13 +2781,13 @@ async function handleReadCommand(command, args, bm, buffers) {
       throw new Error(`Unknown read command: ${command}`);
   }
 }
-var fs7;
+var fs8;
 var init_read = __esm({
   "src/commands/read.ts"() {
     "use strict";
     init_browser_manager();
     init_constants();
-    fs7 = __toESM(require("fs"), 1);
+    fs8 = __toESM(require("fs"), 1);
   }
 });
 
@@ -2701,14 +3014,14 @@ async function handleWriteCommand(command, args, bm, domainFilter) {
         const file = args[1];
         if (!file) throw new Error("Usage: browse cookie export <file>");
         const cookies = await page.context().cookies();
-        fs8.writeFileSync(file, JSON.stringify(cookies, null, 2));
+        fs9.writeFileSync(file, JSON.stringify(cookies, null, 2));
         return `Exported ${cookies.length} cookie(s) to ${file}`;
       }
       if (cookieStr === "import") {
         const file = args[1];
         if (!file) throw new Error("Usage: browse cookie import <file>");
-        if (!fs8.existsSync(file)) throw new Error(`File not found: ${file}`);
-        const cookies = JSON.parse(fs8.readFileSync(file, "utf-8"));
+        if (!fs9.existsSync(file)) throw new Error(`File not found: ${file}`);
+        const cookies = JSON.parse(fs9.readFileSync(file, "utf-8"));
         if (!Array.isArray(cookies)) throw new Error("Cookie file must contain a JSON array of cookie objects");
         await page.context().addCookies(cookies);
         return `Imported ${cookies.length} cookie(s) from ${file}`;
@@ -2775,7 +3088,7 @@ Note: Cookies and tab URLs preserved. localStorage/sessionStorage were reset (Pl
       const [selector, ...filePaths] = args;
       if (!selector || filePaths.length === 0) throw new Error("Usage: browse upload <selector> <file1> [file2] ...");
       for (const fp of filePaths) {
-        if (!fs8.existsSync(fp)) throw new Error(`File not found: ${fp}`);
+        if (!fs9.existsSync(fp)) throw new Error(`File not found: ${fp}`);
       }
       const resolved = bm.resolveRef(selector);
       if ("locator" in resolved) {
@@ -3111,13 +3424,13 @@ Note: Cookies and tab URLs preserved. localStorage/sessionStorage were reset (Pl
       throw new Error(`Unknown write command: ${command}`);
   }
 }
-var fs8;
+var fs9;
 var init_write = __esm({
   "src/commands/write.ts"() {
     "use strict";
     init_browser_manager();
     init_constants();
-    fs8 = __toESM(require("fs"), 1);
+    fs9 = __toESM(require("fs"), 1);
   }
 });
 
@@ -3921,7 +4234,7 @@ var init_lib = __esm({
       tokenize: function tokenize(value) {
         return Array.from(value);
       },
-      join: function join7(chars) {
+      join: function join8(chars) {
         return chars.join("");
       },
       postProcess: function postProcess(changeObjects) {
@@ -4100,20 +4413,20 @@ async function saveSessionState(sessionDir, context, encryptionKey) {
     } else {
       content = json;
     }
-    fs9.mkdirSync(sessionDir, { recursive: true });
-    fs9.writeFileSync(path7.join(sessionDir, STATE_FILENAME), content, { mode: 384 });
+    fs10.mkdirSync(sessionDir, { recursive: true });
+    fs10.writeFileSync(path8.join(sessionDir, STATE_FILENAME), content, { mode: 384 });
   } catch (err) {
     console.log(`[session-persist] Warning: failed to save state: ${err.message}`);
   }
 }
 async function loadSessionState(sessionDir, context, encryptionKey) {
-  const statePath = path7.join(sessionDir, STATE_FILENAME);
-  if (!fs9.existsSync(statePath)) {
+  const statePath = path8.join(sessionDir, STATE_FILENAME);
+  if (!fs10.existsSync(statePath)) {
     return false;
   }
   let stateData;
   try {
-    const raw = fs9.readFileSync(statePath, "utf-8");
+    const raw = fs10.readFileSync(statePath, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.encrypted) {
       if (!encryptionKey) {
@@ -4169,24 +4482,24 @@ async function loadSessionState(sessionDir, context, encryptionKey) {
   }
 }
 function hasPersistedState(sessionDir) {
-  return fs9.existsSync(path7.join(sessionDir, STATE_FILENAME));
+  return fs10.existsSync(path8.join(sessionDir, STATE_FILENAME));
 }
 function cleanOldStates(localDir, maxAgeDays) {
   const maxAgeMs = maxAgeDays * 24 * 60 * 60 * 1e3;
   const now = Date.now();
   let deleted = 0;
-  const statesDir = path7.join(localDir, "states");
-  if (fs9.existsSync(statesDir)) {
+  const statesDir = path8.join(localDir, "states");
+  if (fs10.existsSync(statesDir)) {
     try {
-      const entries = fs9.readdirSync(statesDir);
+      const entries = fs10.readdirSync(statesDir);
       for (const entry of entries) {
         if (!entry.endsWith(".json")) continue;
-        const filePath = path7.join(statesDir, entry);
+        const filePath = path8.join(statesDir, entry);
         try {
-          const stat = fs9.statSync(filePath);
+          const stat = fs10.statSync(filePath);
           if (!stat.isFile()) continue;
           if (now - stat.mtimeMs > maxAgeMs) {
-            fs9.unlinkSync(filePath);
+            fs10.unlinkSync(filePath);
             deleted++;
           }
         } catch (_) {
@@ -4195,23 +4508,23 @@ function cleanOldStates(localDir, maxAgeDays) {
     } catch (_) {
     }
   }
-  const sessionsDir = path7.join(localDir, "sessions");
-  if (fs9.existsSync(sessionsDir)) {
+  const sessionsDir = path8.join(localDir, "sessions");
+  if (fs10.existsSync(sessionsDir)) {
     try {
-      const sessionDirs = fs9.readdirSync(sessionsDir);
+      const sessionDirs = fs10.readdirSync(sessionsDir);
       for (const dir of sessionDirs) {
-        const dirPath = path7.join(sessionsDir, dir);
+        const dirPath = path8.join(sessionsDir, dir);
         try {
-          const dirStat = fs9.statSync(dirPath);
+          const dirStat = fs10.statSync(dirPath);
           if (!dirStat.isDirectory()) continue;
         } catch (_) {
           continue;
         }
-        const statePath = path7.join(dirPath, STATE_FILENAME);
+        const statePath = path8.join(dirPath, STATE_FILENAME);
         try {
-          const stat = fs9.statSync(statePath);
+          const stat = fs10.statSync(statePath);
           if (now - stat.mtimeMs > maxAgeMs) {
-            fs9.unlinkSync(statePath);
+            fs10.unlinkSync(statePath);
             deleted++;
           }
         } catch (_) {
@@ -4222,13 +4535,13 @@ function cleanOldStates(localDir, maxAgeDays) {
   }
   return { deleted };
 }
-var fs9, path7, STATE_FILENAME;
+var fs10, path8, STATE_FILENAME;
 var init_session_persist = __esm({
   "src/session-persist.ts"() {
     "use strict";
-    fs9 = __toESM(require("fs"), 1);
-    path7 = __toESM(require("path"), 1);
-    init_encryption();
+    fs10 = __toESM(require("fs"), 1);
+    path8 = __toESM(require("path"), 1);
+    init_encryption();
     STATE_FILENAME = "state.json";
   }
 });
@@ -4241,20 +4554,20 @@ __export(policy_exports, {
 function findFileUpward(filename) {
   let dir = process.cwd();
   for (let i = 0; i < 20; i++) {
-    const candidate = path8.join(dir, filename);
-    if (fs10.existsSync(candidate)) return candidate;
-    const parent = path8.dirname(dir);
+    const candidate = path9.join(dir, filename);
+    if (fs11.existsSync(candidate)) return candidate;
+    const parent = path9.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return null;
 }
-var fs10, path8, PolicyChecker;
+var fs11, path9, PolicyChecker;
 var init_policy = __esm({
   "src/policy.ts"() {
     "use strict";
-    fs10 = __toESM(require("fs"), 1);
-    path8 = __toESM(require("path"), 1);
+    fs11 = __toESM(require("fs"), 1);
+    path9 = __toESM(require("path"), 1);
     PolicyChecker = class {
       filePath = null;
       lastMtime = 0;
@@ -4273,10 +4586,10 @@ var init_policy = __esm({
       reload() {
         if (!this.filePath) return;
         try {
-          const stat = fs10.statSync(this.filePath);
+          const stat = fs11.statSync(this.filePath);
           if (stat.mtimeMs === this.lastMtime) return;
           this.lastMtime = stat.mtimeMs;
-          const raw = fs10.readFileSync(this.filePath, "utf-8");
+          const raw = fs11.readFileSync(this.filePath, "utf-8");
           this.policy = JSON.parse(raw);
         } catch {
         }
@@ -4424,516 +4737,211 @@ function generateDiffImage(base, curr, colorThreshold) {
         diffData[di + 1] = 0;
         diffData[di + 2] = 0;
         diffData[di + 3] = 255;
-        continue;
-      }
-      const bi = (y * base.width + x) * 4;
-      const ci = (y * curr.width + x) * 4;
-      const dr = base.data[bi] - curr.data[ci];
-      const dg = base.data[bi + 1] - curr.data[ci + 1];
-      const db = base.data[bi + 2] - curr.data[ci + 2];
-      const distSq = dr * dr + dg * dg + db * db;
-      const isDiff = colorThreshold === 0 ? distSq > 0 : distSq > colorThreshSq;
-      if (isDiff) {
-        diffData[di] = 255;
-        diffData[di + 1] = curr.data[ci + 1] / 3 | 0;
-        diffData[di + 2] = curr.data[ci + 2] / 3 | 0;
-        diffData[di + 3] = 255;
-      } else {
-        diffData[di] = curr.data[ci] / 3 | 0;
-        diffData[di + 1] = curr.data[ci + 1] / 3 | 0;
-        diffData[di + 2] = curr.data[ci + 2] / 3 | 0;
-        diffData[di + 3] = 128;
-      }
-    }
-  }
-  return encodePNG({ width: w, height: h, data: diffData });
-}
-function compareScreenshots(baselineBuf, currentBuf, thresholdPct = 0.1, colorThreshold = 30) {
-  const base = decodePNG(baselineBuf);
-  const curr = decodePNG(currentBuf);
-  const w = Math.max(base.width, curr.width);
-  const h = Math.max(base.height, curr.height);
-  const totalPixels = w * h;
-  let diffPixels = 0;
-  const colorThreshSq = colorThreshold * colorThreshold * 3;
-  for (let y = 0; y < h; y++) {
-    for (let x = 0; x < w; x++) {
-      const inBase = x < base.width && y < base.height;
-      const inCurr = x < curr.width && y < curr.height;
-      if (!inBase || !inCurr) {
-        diffPixels++;
-        continue;
-      }
-      const bi = (y * base.width + x) * 4;
-      const ci = (y * curr.width + x) * 4;
-      const dr = base.data[bi] - curr.data[ci];
-      const dg = base.data[bi + 1] - curr.data[ci + 1];
-      const db = base.data[bi + 2] - curr.data[ci + 2];
-      const distSq = dr * dr + dg * dg + db * db;
-      if (colorThreshold === 0 ? distSq > 0 : distSq > colorThreshSq) diffPixels++;
-    }
-  }
-  const mismatchPct = totalPixels > 0 ? diffPixels / totalPixels * 100 : 0;
-  const passed = mismatchPct <= thresholdPct;
-  const result = { totalPixels, diffPixels, mismatchPct, passed };
-  if (!passed) {
-    result.diffImage = generateDiffImage(base, curr, colorThreshold);
-  }
-  return result;
-}
-var zlib, PNG_MAGIC;
-var init_png_compare = __esm({
-  "src/png-compare.ts"() {
-    "use strict";
-    zlib = __toESM(require("zlib"), 1);
-    PNG_MAGIC = [137, 80, 78, 71, 13, 10, 26, 10];
-  }
-});
-
-// src/auth-vault.ts
-var auth_vault_exports = {};
-__export(auth_vault_exports, {
-  AuthVault: () => AuthVault
-});
-async function autoDetectSelector(page, field) {
-  if (field === "username") {
-    const candidates2 = [
-      'input[type="email"]',
-      'input[name="email"]',
-      'input[name="username"]',
-      'input[name="user"]',
-      'input[name="login"]',
-      'input[autocomplete="username"]',
-      'input[autocomplete="email"]',
-      'input[type="text"]:first-of-type'
-    ];
-    for (const sel of candidates2) {
-      const count = await page.locator(sel).count();
-      if (count > 0) return sel;
-    }
-    throw new Error("Could not auto-detect username field. Save with explicit selectors: browse auth save <name> <url> <user> <pass> --user-sel <sel> --pass-sel <sel> --submit-sel <sel>");
-  }
-  if (field === "password") {
-    const candidates2 = [
-      'input[type="password"]',
-      'input[name="password"]',
-      'input[name="pass"]',
-      'input[autocomplete="current-password"]'
-    ];
-    for (const sel of candidates2) {
-      const count = await page.locator(sel).count();
-      if (count > 0) return sel;
-    }
-    throw new Error("Could not auto-detect password field.");
-  }
-  const candidates = [
-    'button[type="submit"]',
-    'input[type="submit"]',
-    "form button",
-    'button:has-text("Log in")',
-    'button:has-text("Sign in")',
-    'button:has-text("Login")',
-    'button:has-text("Submit")'
-  ];
-  for (const sel of candidates) {
-    const count = await page.locator(sel).count();
-    if (count > 0) return sel;
-  }
-  throw new Error("Could not auto-detect submit button.");
-}
-var fs11, path9, AuthVault;
-var init_auth_vault = __esm({
-  "src/auth-vault.ts"() {
-    "use strict";
-    fs11 = __toESM(require("fs"), 1);
-    path9 = __toESM(require("path"), 1);
-    init_constants();
-    init_encryption();
-    init_sanitize();
-    AuthVault = class {
-      authDir;
-      encryptionKey;
-      constructor(localDir) {
-        this.authDir = path9.join(localDir, "auth");
-        this.encryptionKey = resolveEncryptionKey(localDir);
-      }
-      save(name, url, username, password, selectors) {
-        fs11.mkdirSync(this.authDir, { recursive: true });
-        const { ciphertext, iv, authTag } = encrypt(password, this.encryptionKey);
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        const credential = {
-          name,
-          url,
-          username,
-          encrypted: true,
-          iv,
-          authTag,
-          data: ciphertext,
-          usernameSelector: selectors?.username,
-          passwordSelector: selectors?.password,
-          submitSelector: selectors?.submit,
-          createdAt: now,
-          updatedAt: now
-        };
-        const filePath = path9.join(this.authDir, `${sanitizeName(name)}.json`);
-        fs11.writeFileSync(filePath, JSON.stringify(credential, null, 2), { mode: 384 });
-      }
-      load(name) {
-        const filePath = path9.join(this.authDir, `${sanitizeName(name)}.json`);
-        if (!fs11.existsSync(filePath)) {
-          throw new Error(`Credential "${name}" not found. Run "browse auth list" to see saved credentials.`);
-        }
-        return JSON.parse(fs11.readFileSync(filePath, "utf-8"));
-      }
-      async login(name, bm) {
-        const cred = this.load(name);
-        const password = decrypt(cred.data, cred.iv, cred.authTag, this.encryptionKey);
-        const page = bm.getPage();
-        await page.goto(cred.url, {
-          waitUntil: "domcontentloaded",
-          timeout: DEFAULTS.COMMAND_TIMEOUT_MS
-        });
-        const userSel = cred.usernameSelector || await autoDetectSelector(page, "username");
-        const passSel = cred.passwordSelector || await autoDetectSelector(page, "password");
-        const submitSel = cred.submitSelector || await autoDetectSelector(page, "submit");
-        await page.fill(userSel, cred.username, { timeout: DEFAULTS.ACTION_TIMEOUT_MS });
-        await page.fill(passSel, password, { timeout: DEFAULTS.ACTION_TIMEOUT_MS });
-        await page.click(submitSel, { timeout: DEFAULTS.ACTION_TIMEOUT_MS });
-        await page.waitForLoadState("domcontentloaded").catch(() => {
-        });
-        return `Logged in as ${cred.username} at ${page.url()}`;
-      }
-      list() {
-        if (!fs11.existsSync(this.authDir)) return [];
-        const files = fs11.readdirSync(this.authDir).filter((f) => f.endsWith(".json"));
-        return files.map((f) => {
-          try {
-            const data = JSON.parse(fs11.readFileSync(path9.join(this.authDir, f), "utf-8"));
-            return {
-              name: data.name,
-              url: data.url,
-              username: data.username,
-              hasPassword: true,
-              createdAt: data.createdAt
-            };
-          } catch {
-            return null;
-          }
-        }).filter(Boolean);
-      }
-      delete(name) {
-        const filePath = path9.join(this.authDir, `${sanitizeName(name)}.json`);
-        if (!fs11.existsSync(filePath)) {
-          throw new Error(`Credential "${name}" not found.`);
-        }
-        fs11.unlinkSync(filePath);
-      }
-    };
-  }
-});
-
-// src/cookie-import.ts
-var cookie_import_exports = {};
-__export(cookie_import_exports, {
-  CookieImportError: () => CookieImportError,
-  findInstalledBrowsers: () => findInstalledBrowsers,
-  importCookies: () => importCookies,
-  listDomains: () => listDomains
-});
-function findInstalledBrowsers() {
-  const appSupport = path10.join(os2.homedir(), "Library", "Application Support");
-  return BROWSER_REGISTRY.filter((b) => {
-    const dbPath = path10.join(appSupport, b.dataDir, "Default", "Cookies");
-    try {
-      return fs12.existsSync(dbPath);
-    } catch {
-      return false;
-    }
-  });
-}
-function listDomains(browserName, profile = "Default") {
-  const browser2 = resolveBrowser(browserName);
-  const dbPath = getCookieDbPath(browser2, profile);
-  const db = openDb(dbPath, browser2.name);
-  try {
-    const now = chromiumNow();
-    const rows = db.prepare(
-      `SELECT host_key AS domain, COUNT(*) AS count
-       FROM cookies
-       WHERE has_expires = 0 OR expires_utc > ?
-       GROUP BY host_key
-       ORDER BY count DESC`
-    ).all(now);
-    return { domains: rows, browser: browser2.name };
-  } finally {
-    db.close();
-  }
-}
-async function importCookies(browserName, domains, profile = "Default") {
-  if (domains.length === 0) return { cookies: [], count: 0, failed: 0, domainCounts: {} };
-  const browser2 = resolveBrowser(browserName);
-  const derivedKey = await getDerivedKey(browser2);
-  const dbPath = getCookieDbPath(browser2, profile);
-  const db = openDb(dbPath, browser2.name);
-  try {
-    const now = chromiumNow();
-    const placeholders = domains.map(() => "?").join(",");
-    const rows = db.prepare(
-      `SELECT host_key, name, value, encrypted_value, path, expires_utc,
-              is_secure, is_httponly, has_expires, samesite
-       FROM cookies
-       WHERE host_key IN (${placeholders})
-         AND (has_expires = 0 OR expires_utc > ?)
-       ORDER BY host_key, name`
-    ).all(...domains, now);
-    const cookies = [];
-    let failed = 0;
-    const domainCounts = {};
-    for (const row of rows) {
-      try {
-        const value = decryptCookieValue(row, derivedKey);
-        const cookie = toPlaywrightCookie(row, value);
-        cookies.push(cookie);
-        domainCounts[row.host_key] = (domainCounts[row.host_key] || 0) + 1;
-      } catch {
-        failed++;
-      }
-    }
-    return { cookies, count: cookies.length, failed, domainCounts };
-  } finally {
-    db.close();
-  }
-}
-function resolveBrowser(nameOrAlias) {
-  const needle = nameOrAlias.toLowerCase().trim();
-  const found = BROWSER_REGISTRY.find(
-    (b) => b.aliases.includes(needle) || b.name.toLowerCase() === needle
-  );
-  if (!found) {
-    const supported = BROWSER_REGISTRY.flatMap((b) => b.aliases).join(", ");
-    throw new CookieImportError(
-      `Unknown browser '${nameOrAlias}'. Supported: ${supported}`,
-      "unknown_browser"
-    );
-  }
-  return found;
-}
-function validateProfile(profile) {
-  if (/[/\\]|\.\./.test(profile) || /[\x00-\x1f]/.test(profile)) {
-    throw new CookieImportError(
-      `Invalid profile name: '${profile}'`,
-      "bad_request"
-    );
-  }
-}
-function getCookieDbPath(browser2, profile) {
-  validateProfile(profile);
-  const appSupport = path10.join(os2.homedir(), "Library", "Application Support");
-  const dbPath = path10.join(appSupport, browser2.dataDir, profile, "Cookies");
-  if (!fs12.existsSync(dbPath)) {
-    throw new CookieImportError(
-      `${browser2.name} is not installed (no cookie database at ${dbPath})`,
-      "not_installed"
-    );
-  }
-  return dbPath;
-}
-function openDb(dbPath, browserName) {
-  try {
-    return new import_better_sqlite3.default(dbPath, { readonly: true });
-  } catch (err) {
-    if (err.message?.includes("SQLITE_BUSY") || err.message?.includes("database is locked")) {
-      return openDbFromCopy(dbPath, browserName);
-    }
-    if (err.message?.includes("SQLITE_CORRUPT") || err.message?.includes("malformed")) {
-      throw new CookieImportError(
-        "Cookie database is corrupt",
-        "db_corrupt"
-      );
-    }
-    throw err;
-  }
-}
-function openDbFromCopy(dbPath, browserName) {
-  const tmpPath = `/tmp/browse-cookies-${browserName.toLowerCase()}-${crypto2.randomUUID()}.db`;
-  try {
-    fs12.copyFileSync(dbPath, tmpPath);
-    const walPath = dbPath + "-wal";
-    const shmPath = dbPath + "-shm";
-    if (fs12.existsSync(walPath)) fs12.copyFileSync(walPath, tmpPath + "-wal");
-    if (fs12.existsSync(shmPath)) fs12.copyFileSync(shmPath, tmpPath + "-shm");
-    const db = new import_better_sqlite3.default(tmpPath, { readonly: true });
-    const origClose = db.close.bind(db);
-    db.close = (() => {
-      origClose();
-      try {
-        fs12.unlinkSync(tmpPath);
-      } catch {
-      }
-      try {
-        fs12.unlinkSync(tmpPath + "-wal");
-      } catch {
-      }
-      try {
-        fs12.unlinkSync(tmpPath + "-shm");
-      } catch {
-      }
-    });
-    return db;
-  } catch {
-    try {
-      fs12.unlinkSync(tmpPath);
-    } catch {
-    }
-    throw new CookieImportError(
-      `Cookie database is locked (${browserName} may be running). Try closing ${browserName} first.`,
-      "db_locked",
-      "retry"
-    );
-  }
-}
-async function getDerivedKey(browser2) {
-  const cached = keyCache.get(browser2.keychainService);
-  if (cached) return cached;
-  const password = await getKeychainPassword(browser2.keychainService);
-  const derived = crypto2.pbkdf2Sync(password, "saltysalt", 1003, 16, "sha1");
-  keyCache.set(browser2.keychainService, derived);
-  return derived;
-}
-async function getKeychainPassword(service) {
-  const proc = (0, import_child_process2.spawn)("security", ["find-generic-password", "-s", service, "-w"], {
-    stdio: ["ignore", "pipe", "pipe"]
-  });
-  let stdout = "";
-  let stderr = "";
-  proc.stdout.setEncoding("utf8");
-  proc.stderr.setEncoding("utf8");
-  proc.stdout.on("data", (chunk) => {
-    stdout += chunk;
-  });
-  proc.stderr.on("data", (chunk) => {
-    stderr += chunk;
-  });
-  const exitPromise = new Promise(
-    (resolve4) => proc.on("close", (code) => resolve4(code))
-  );
-  const timeout = new Promise(
-    (_, reject) => setTimeout(() => {
-      proc.kill();
-      reject(new CookieImportError(
-        `macOS is waiting for Keychain permission. Look for a dialog asking to allow access to "${service}".`,
-        "keychain_timeout",
-        "retry"
-      ));
-    }, 1e4)
-  );
-  try {
-    const exitCode = await Promise.race([exitPromise, timeout]);
-    if (exitCode !== 0) {
-      const errText = stderr.trim().toLowerCase();
-      if (errText.includes("user canceled") || errText.includes("denied") || errText.includes("interaction not allowed")) {
-        throw new CookieImportError(
-          `Keychain access denied. Click Allow in the macOS dialog for "${service}".`,
-          "keychain_denied",
-          "retry"
-        );
-      }
-      if (errText.includes("could not be found") || errText.includes("not found")) {
-        throw new CookieImportError(
-          `No Keychain entry for "${service}".`,
-          "keychain_not_found"
-        );
+        continue;
+      }
+      const bi = (y * base.width + x) * 4;
+      const ci = (y * curr.width + x) * 4;
+      const dr = base.data[bi] - curr.data[ci];
+      const dg = base.data[bi + 1] - curr.data[ci + 1];
+      const db = base.data[bi + 2] - curr.data[ci + 2];
+      const distSq = dr * dr + dg * dg + db * db;
+      const isDiff = colorThreshold === 0 ? distSq > 0 : distSq > colorThreshSq;
+      if (isDiff) {
+        diffData[di] = 255;
+        diffData[di + 1] = curr.data[ci + 1] / 3 | 0;
+        diffData[di + 2] = curr.data[ci + 2] / 3 | 0;
+        diffData[di + 3] = 255;
+      } else {
+        diffData[di] = curr.data[ci] / 3 | 0;
+        diffData[di + 1] = curr.data[ci + 1] / 3 | 0;
+        diffData[di + 2] = curr.data[ci + 2] / 3 | 0;
+        diffData[di + 3] = 128;
       }
-      throw new CookieImportError(
-        `Could not read Keychain: ${stderr.trim()}`,
-        "keychain_error",
-        "retry"
-      );
     }
-    return stdout.trim();
-  } catch (err) {
-    if (err instanceof CookieImportError) throw err;
-    throw new CookieImportError(
-      `Could not read Keychain: ${err.message}`,
-      "keychain_error",
-      "retry"
-    );
   }
+  return encodePNG({ width: w, height: h, data: diffData });
 }
-function decryptCookieValue(row, key) {
-  if (row.value && row.value.length > 0) return row.value;
-  const ev = Buffer.from(row.encrypted_value);
-  if (ev.length === 0) return "";
-  const prefix = ev.slice(0, 3).toString("utf-8");
-  if (prefix !== "v10") {
-    throw new Error(`Unknown encryption prefix: ${prefix}`);
+function compareScreenshots(baselineBuf, currentBuf, thresholdPct = 0.1, colorThreshold = 30) {
+  const base = decodePNG(baselineBuf);
+  const curr = decodePNG(currentBuf);
+  const w = Math.max(base.width, curr.width);
+  const h = Math.max(base.height, curr.height);
+  const totalPixels = w * h;
+  let diffPixels = 0;
+  const colorThreshSq = colorThreshold * colorThreshold * 3;
+  for (let y = 0; y < h; y++) {
+    for (let x = 0; x < w; x++) {
+      const inBase = x < base.width && y < base.height;
+      const inCurr = x < curr.width && y < curr.height;
+      if (!inBase || !inCurr) {
+        diffPixels++;
+        continue;
+      }
+      const bi = (y * base.width + x) * 4;
+      const ci = (y * curr.width + x) * 4;
+      const dr = base.data[bi] - curr.data[ci];
+      const dg = base.data[bi + 1] - curr.data[ci + 1];
+      const db = base.data[bi + 2] - curr.data[ci + 2];
+      const distSq = dr * dr + dg * dg + db * db;
+      if (colorThreshold === 0 ? distSq > 0 : distSq > colorThreshSq) diffPixels++;
+    }
   }
-  const ciphertext = ev.slice(3);
-  const iv = Buffer.alloc(16, 32);
-  const decipher = crypto2.createDecipheriv("aes-128-cbc", key, iv);
-  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-  if (plaintext.length <= 32) return "";
-  return plaintext.slice(32).toString("utf-8");
-}
-function toPlaywrightCookie(row, value) {
-  return {
-    name: row.name,
-    value,
-    domain: row.host_key,
-    path: row.path || "/",
-    expires: chromiumEpochToUnix(row.expires_utc, row.has_expires),
-    secure: row.is_secure === 1,
-    httpOnly: row.is_httponly === 1,
-    sameSite: mapSameSite(row.samesite)
-  };
-}
-function chromiumNow() {
-  return BigInt(Date.now()) * 1000n + CHROMIUM_EPOCH_OFFSET;
-}
-function chromiumEpochToUnix(epoch, hasExpires) {
-  if (hasExpires === 0 || epoch === 0 || epoch === 0n) return -1;
-  const epochBig = BigInt(epoch);
-  const unixMicro = epochBig - CHROMIUM_EPOCH_OFFSET;
-  return Number(unixMicro / 1000000n);
+  const mismatchPct = totalPixels > 0 ? diffPixels / totalPixels * 100 : 0;
+  const passed = mismatchPct <= thresholdPct;
+  const result = { totalPixels, diffPixels, mismatchPct, passed };
+  if (!passed) {
+    result.diffImage = generateDiffImage(base, curr, colorThreshold);
+  }
+  return result;
 }
-function mapSameSite(value) {
-  switch (value) {
-    case 0:
-      return "None";
-    case 1:
-      return "Lax";
-    case 2:
-      return "Strict";
-    default:
-      return "Lax";
+var zlib, PNG_MAGIC;
+var init_png_compare = __esm({
+  "src/png-compare.ts"() {
+    "use strict";
+    zlib = __toESM(require("zlib"), 1);
+    PNG_MAGIC = [137, 80, 78, 71, 13, 10, 26, 10];
+  }
+});
+
+// src/auth-vault.ts
+var auth_vault_exports = {};
+__export(auth_vault_exports, {
+  AuthVault: () => AuthVault
+});
+async function autoDetectSelector(page, field) {
+  if (field === "username") {
+    const candidates2 = [
+      'input[type="email"]',
+      'input[name="email"]',
+      'input[name="username"]',
+      'input[name="user"]',
+      'input[name="login"]',
+      'input[autocomplete="username"]',
+      'input[autocomplete="email"]',
+      'input[type="text"]:first-of-type'
+    ];
+    for (const sel of candidates2) {
+      const count = await page.locator(sel).count();
+      if (count > 0) return sel;
+    }
+    throw new Error("Could not auto-detect username field. Save with explicit selectors: browse auth save <name> <url> <user> <pass> --user-sel <sel> --pass-sel <sel> --submit-sel <sel>");
+  }
+  if (field === "password") {
+    const candidates2 = [
+      'input[type="password"]',
+      'input[name="password"]',
+      'input[name="pass"]',
+      'input[autocomplete="current-password"]'
+    ];
+    for (const sel of candidates2) {
+      const count = await page.locator(sel).count();
+      if (count > 0) return sel;
+    }
+    throw new Error("Could not auto-detect password field.");
+  }
+  const candidates = [
+    'button[type="submit"]',
+    'input[type="submit"]',
+    "form button",
+    'button:has-text("Log in")',
+    'button:has-text("Sign in")',
+    'button:has-text("Login")',
+    'button:has-text("Submit")'
+  ];
+  for (const sel of candidates) {
+    const count = await page.locator(sel).count();
+    if (count > 0) return sel;
   }
+  throw new Error("Could not auto-detect submit button.");
 }
-var import_better_sqlite3, import_child_process2, crypto2, fs12, path10, os2, CookieImportError, BROWSER_REGISTRY, keyCache, CHROMIUM_EPOCH_OFFSET;
-var init_cookie_import = __esm({
-  "src/cookie-import.ts"() {
+var fs12, path10, AuthVault;
+var init_auth_vault = __esm({
+  "src/auth-vault.ts"() {
     "use strict";
-    import_better_sqlite3 = __toESM(require("better-sqlite3"), 1);
-    import_child_process2 = require("child_process");
-    crypto2 = __toESM(require("crypto"), 1);
     fs12 = __toESM(require("fs"), 1);
     path10 = __toESM(require("path"), 1);
-    os2 = __toESM(require("os"), 1);
-    CookieImportError = class extends Error {
-      constructor(message, code, action) {
-        super(message);
-        this.code = code;
-        this.action = action;
-        this.name = "CookieImportError";
+    init_constants();
+    init_encryption();
+    init_sanitize();
+    AuthVault = class {
+      authDir;
+      encryptionKey;
+      constructor(localDir) {
+        this.authDir = path10.join(localDir, "auth");
+        this.encryptionKey = resolveEncryptionKey(localDir);
+      }
+      save(name, url, username, password, selectors) {
+        fs12.mkdirSync(this.authDir, { recursive: true });
+        const { ciphertext, iv, authTag } = encrypt(password, this.encryptionKey);
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const credential = {
+          name,
+          url,
+          username,
+          encrypted: true,
+          iv,
+          authTag,
+          data: ciphertext,
+          usernameSelector: selectors?.username,
+          passwordSelector: selectors?.password,
+          submitSelector: selectors?.submit,
+          createdAt: now,
+          updatedAt: now
+        };
+        const filePath = path10.join(this.authDir, `${sanitizeName(name)}.json`);
+        fs12.writeFileSync(filePath, JSON.stringify(credential, null, 2), { mode: 384 });
+      }
+      load(name) {
+        const filePath = path10.join(this.authDir, `${sanitizeName(name)}.json`);
+        if (!fs12.existsSync(filePath)) {
+          throw new Error(`Credential "${name}" not found. Run "browse auth list" to see saved credentials.`);
+        }
+        return JSON.parse(fs12.readFileSync(filePath, "utf-8"));
+      }
+      async login(name, bm) {
+        const cred = this.load(name);
+        const password = decrypt(cred.data, cred.iv, cred.authTag, this.encryptionKey);
+        const page = bm.getPage();
+        await page.goto(cred.url, {
+          waitUntil: "domcontentloaded",
+          timeout: DEFAULTS.COMMAND_TIMEOUT_MS
+        });
+        const userSel = cred.usernameSelector || await autoDetectSelector(page, "username");
+        const passSel = cred.passwordSelector || await autoDetectSelector(page, "password");
+        const submitSel = cred.submitSelector || await autoDetectSelector(page, "submit");
+        await page.fill(userSel, cred.username, { timeout: DEFAULTS.ACTION_TIMEOUT_MS });
+        await page.fill(passSel, password, { timeout: DEFAULTS.ACTION_TIMEOUT_MS });
+        await page.click(submitSel, { timeout: DEFAULTS.ACTION_TIMEOUT_MS });
+        await page.waitForLoadState("domcontentloaded").catch(() => {
+        });
+        return `Logged in as ${cred.username} at ${page.url()}`;
+      }
+      list() {
+        if (!fs12.existsSync(this.authDir)) return [];
+        const files = fs12.readdirSync(this.authDir).filter((f) => f.endsWith(".json"));
+        return files.map((f) => {
+          try {
+            const data = JSON.parse(fs12.readFileSync(path10.join(this.authDir, f), "utf-8"));
+            return {
+              name: data.name,
+              url: data.url,
+              username: data.username,
+              hasPassword: true,
+              createdAt: data.createdAt
+            };
+          } catch {
+            return null;
+          }
+        }).filter(Boolean);
+      }
+      delete(name) {
+        const filePath = path10.join(this.authDir, `${sanitizeName(name)}.json`);
+        if (!fs12.existsSync(filePath)) {
+          throw new Error(`Credential "${name}" not found.`);
+        }
+        fs12.unlinkSync(filePath);
       }
     };
-    BROWSER_REGISTRY = [
-      { name: "Chrome", dataDir: "Google/Chrome/", keychainService: "Chrome Safe Storage", aliases: ["chrome", "google-chrome"] },
-      { name: "Arc", dataDir: "Arc/User Data/", keychainService: "Arc Safe Storage", aliases: ["arc"] },
-      { name: "Brave", dataDir: "BraveSoftware/Brave-Browser/", keychainService: "Brave Safe Storage", aliases: ["brave"] },
-      { name: "Edge", dataDir: "Microsoft Edge/", keychainService: "Microsoft Edge Safe Storage", aliases: ["edge"] }
-    ];
-    keyCache = /* @__PURE__ */ new Map();
-    CHROMIUM_EPOCH_OFFSET = 11644473600000000n;
   }
 });
 
@@ -9904,6 +9912,9 @@ async function main() {
     runtimeName = "chrome";
     headed = true;
   }
+  if (runtimeName === "chrome") {
+    headed = true;
+  }
   cliFlags.json = jsonMode;
   cliFlags.contentBoundaries = contentBoundaries;
   cliFlags.allowedDomains = allowedDomains || "";