@weavetab/skills 2.5.0 → 2.5.1

package/README.md

@@ -1,108 +1,108 @@
-# Weavetab MCP Skills (`@weavetab/skills`)
-
-[![npm version](https://img.shields.io/npm/v/@weavetab/skills.svg)](https://www.npmjs.com/package/@weavetab/skills)
-[![GitHub stars](https://img.shields.io/github/stars/Weavetab/skills.svg?style=social)](https://github.com/Weavetab/skills)
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
-
-Enterprise domain-driven agent intelligence for `@weavetab/mcp` (v2.5.0). Drop-in operational guides, failure recovery heuristics, and protocol rules for **Antigravity**, **Cursor**, **Cline**, **Windsurf**, and **OpenClaw**.
-
-- **Website:** [weavetab.dev](https://weavetab.dev)
-- **Core MCP Server:** [`@weavetab/mcp`](https://www.npmjs.com/package/@weavetab/mcp)
-- **Plugin SDK:** [`@weavetab/sdk`](https://www.npmjs.com/package/@weavetab/sdk)
-
----
-
-## 1. Architectural Philosophy: The Step-0 Router
-
-Rather than forcing LLMs to read dozens of flat files or guess between vague difficulty tiers, `@weavetab/skills` provides a deterministic Step-0 decision engine via [`ROUTER.md`](ROUTER.md). 
-
-Agents classify their immediate intent in one turn and jump directly to the target domain guide:
-
-```
-@weavetab/skills/
-├── ROUTER.md                   # Universal Intent Decision Matrix (Step-0)
-├── browser/                    # Web & Chromium DOM Navigation Engine
-├── desktop/                    # Native Desktop & Electron Application Automation
-├── memory/                     # Cross-Session Adaptive Selector Learning & History
-├── resilience/                 # Time-Travel Checkpoints, Stale Refs, Loops & Captchas
-├── security/                   # Zero-Leak Secret Containment & RBAC Guardrails
-├── plugins/                    # Dynamic Extension Loading, Hooks & Custom Tools
-├── network-and-perf/           # TLS Forensics, Interception, Core Web Vitals & Emulation
-├── documents/                  # Word, Excel, CSV, PDF & Canvas Ingestion
-├── developer/                  # GitHub Local Clone & API Repository Forensics
-├── evals/                      # Executable Agent Evaluation & Benchmark Harness
-├── dist/                       # Compiled targets (granular + bundled domain profiles)
-├── bin/cli.js                  # Interactive Multi-Agent Installer
-└── src/api.js                  # Programmatic Framework Generator & Adapter Engine
-```
-
----
-
-## 2. The 9 Operational Domains & 44-Tool Matrix
-
-Every single one of the **44 official tools** in `@weavetab/mcp` is documented with verified parameters and runtime patterns:
-
-| Domain | Primary Tools | Operational Capabilities |
-| :--- | :--- | :--- |
-| **`browser/`** | `browser_map`, `browser_find`, `browser_click`, `browser_type`, `browser_fill`, `browser_key`, `browser_pointer`, `browser_upload`, `browser_tabs`, `browser_scroll`, `browser_dialog`, `browser_burst`, `browser_highlight`, `browser_clipboard` | Token-conserving DOM walks (`lite: true`), volatile `w:NN` handles, atomic multi-field inputs, OS file upload bypass. |
-| **`desktop/`** | `browser_detect`, any tool with `app` argument | Zero-terminal scanning for Slack, Discord, VS Code, Notion, Obsidian; routing actions directly to native Electron windows. |
-| **`memory/`** | `browser_pattern_learn`, `browser_thoughts`, `browser_automation`, `browser_recording` | Cross-session origin selector decay, compiling manual interaction trails into deterministic macros via `browser_burst`. |
-| **`resilience/`**| `browser_checkpoint`, `browser_cookies`, `browser_storage`, `browser_captcha` | Time-travel state snapshots (`save`, `restore`) for instant rollbacks, 4-tier SPA stale ref healing, loop breaker (`browser_map`, `browser_wait`). |
-| **`security/`** | `browser_type_secret`, RBAC tiers | Hardware-grade zero-bleed guarantee (passwords masked in HUD, CDP logs, and conversation transcripts). |
-| **`plugins/`**  | `list_plugins`, `load_plugin` | Runtime discovery and dynamic loading of verified npm community plugins into the active MCP session. |
-| **`network-and-perf/`** | `browser_network_intercept`, `browser_performance`, `browser_wait`, `browser_emulate` | API mocking, TLS certificate chain audits, Core Web Vitals (LCP/CLS), device presets & 3G throttling. |
-| **`documents/`**| `browser_office`, `browser_pdf`, `browser_canvas`, `browser_screenshot`, `browser_viewport`, `browser_extract_design` | Ingesting Excel spreadsheets, Word `.docx`, and CSVs into structured JSON; full-page screenshots and canvas inspection. |
-| **`developer/`**| `browser_github` | Sub-millisecond local repo inspection, PR diffs, and issue triage without burning browser turns. |
-
----
-
-## 3. Interactive Installation
-
-Inject formatted skills and rules directly into your AI agent environment:
-
-```bash
-npx @weavetab/skills
-```
-
-The interactive installer prompts you for:
-1. **Domain Scope**: Full Enterprise Suite (All 9 Domains), Web Core, Desktop, Resilience, or Forensics.
-2. **Target Agent Framework**:
-   - **Antigravity**: Generates `.agent/skills/weavetab-<domain>/SKILL.md` with standard YAML frontmatter.
-   - **Cursor**: Generates `.cursor/rules/weavetab-<domain>.mdc` with MDC frontmatter.
-   - **Cline**: Appends formatted sections to `.clinerules`.
-   - **Windsurf**: Generates `.windsurf/rules/weavetab-<domain>.md`.
-   - **OpenClaw & RooCode**: Generates respective agent rules.
-   - **Raw Markdown**: Generates portable `weavetab-skills/`.
-
----
-
-## 4. Programmatic API
-
-Install skills programmatically from setup scripts or custom CLIs:
-
-```javascript
-const { installSkills, getSkills, getSkill, getRouterMatrix } = require('@weavetab/skills');
-
-// Install targeted domains into Cursor
-await installSkills({
-  targetFramework: '.cursor',
-  domains: ['browser', 'resilience', 'security']
-});
-
-// Query skills catalog
-const webSkills = getSkillsByDomain('browser');
-```
-
----
-
-## 5. Automated Benchmark & Evaluation Suite (`evals/`)
-
-Run the automated evaluation harness to verify that all 48 tools are covered and that skill guidance strictly passes test scenarios without legacy hallucinations:
-
-```bash
-npm test
-```
-
----
-
-*Built with precision for the Weavetab Ecosystem.*
+# Weavetab Skills (`@weavetab/skills`)
+
+[![npm version](https://img.shields.io/npm/v/@weavetab/skills.svg)](https://www.npmjs.com/package/@weavetab/skills)
+[![GitHub stars](https://img.shields.io/github/stars/Weavetab/skills.svg?style=social)](https://github.com/Weavetab/skills)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+
+Enterprise domain-driven agent intelligence for `@weavetab/mcp` (v2.5.1). Drop-in operational guides, failure recovery heuristics, and protocol rules for **Antigravity**, **Cursor**, **Cline**, **Windsurf**, and **OpenClaw**.
+
+- **Website:** [weavetab.dev](https://weavetab.dev)
+- **Core MCP Server:** [`@weavetab/mcp`](https://www.npmjs.com/package/@weavetab/mcp)
+- **Plugin SDK:** [`@weavetab/sdk`](https://www.npmjs.com/package/@weavetab/sdk)
+
+---
+
+## 1. Architectural Philosophy: The Step-0 Router
+
+Rather than forcing LLMs to read dozens of flat files or guess between vague difficulty tiers, `@weavetab/skills` provides a deterministic Step-0 decision engine via [`ROUTER.md`](ROUTER.md). 
+
+Agents classify their immediate intent in one turn and jump directly to the target domain guide:
+
+```
+@weavetab/skills/
+|-- ROUTER.md                   # Universal Intent Decision Matrix (Step-0)
+|-- browser/                    # Web & Chromium DOM Navigation Engine
+|-- desktop/                    # Native Desktop & Electron Application Automation
+|-- memory/                     # Cross-Session Adaptive Selector Learning & History
+|-- resilience/                 # Time-Travel Checkpoints, Stale Refs, Loops & Captchas
+|-- security/                   # Zero-Leak Secret Containment & RBAC Guardrails
+|-- plugins/                    # Dynamic Extension Loading, Hooks & Custom Tools
+|-- network-and-perf/           # TLS Telemetry, Interception, Core Web Vitals & Emulation
+|-- documents/                  # Word, Excel, CSV, PDF & Canvas Ingestion
+|-- developer/                  # GitHub API Repository Forensics
+|-- evals/                      # Executable Agent Evaluation & Benchmark Harness
+|-- dist/                       # Compiled targets (granular + bundled domain profiles)
+|-- bin/cli.js                  # Interactive Multi-Agent Installer
+`-- src/api.js                  # Programmatic Framework Generator & Adapter Engine
+```
+
+---
+
+## 2. The 9 Operational Domains & 41-Tool Matrix
+
+Every single one of the **41 official tools** in `@weavetab/mcp` is documented with verified parameters and runtime patterns:
+
+| Domain | Primary Tools | Operational Capabilities |
+| :--- | :--- | :--- |
+| **`browser/`** | `browser_map`, `browser_find`, `browser_click`, `browser_type`, `browser_fill`, `browser_key`, `browser_pointer`, `browser_upload`, `browser_tabs`, `browser_scroll`, `browser_dialog`, `browser_burst`, `browser_highlight`, `browser_clipboard` | Token-conserving DOM walks (`lite: true`), volatile `w:NN` handles, atomic multi-field inputs, OS file upload bypass. |
+| **`desktop/`** | `browser_detect`, any tool with `app` argument | Zero-terminal scanning for Slack, Discord, VS Code, Notion, Obsidian; routing actions directly to native Electron windows. |
+| **`memory/`** | `browser_pattern_learn`, `browser_thoughts`, `browser_automation`, `browser_recording` | Cross-session origin selector decay, compiling manual interaction trails into deterministic macros via `browser_burst`. |
+| **`resilience/`**| `browser_checkpoint`, `browser_cookies`, `browser_storage`, `browser_captcha` | Time-travel state snapshots (`save`, `restore`) for instant rollbacks, 4-tier SPA stale ref healing, loop breaker (`browser_map`, `browser_wait`). |
+| **`security/`** | `browser_type_secret`, RBAC tiers | Hardware-grade zero-bleed guarantee (passwords masked in HUD, CDP logs, and conversation transcripts). |
+| **`plugins/`**  | CLI plugin management (`weavetab plugins`) | Runtime discovery and dynamic loading of verified npm community plugins via the CLI. Plugin lifecycle is not an MCP tool surface. |
+| **`network-and-perf/`** | `browser_network_intercept`, `browser_performance`, `browser_wait`, `browser_emulate` | API mocking, TLS/SSL certificate metadata & timing telemetry, Core Web Vitals (LCP/CLS), device presets & 3G throttling. |
+| **`documents/`**| `browser_office`, `browser_pdf`, `browser_canvas`, `browser_screenshot`, `browser_viewport`, `browser_extract_design` | Ingesting Excel spreadsheets, Word `.docx`, and CSVs into structured JSON; full-page screenshots and canvas inspection. |
+| **`developer/`**| *(plugin: `github`)* | GitHub REST/raw API inspection, PR diffs, and issue triage via `@weavetab/plugin-github` — no browser turns burned. |
+
+---
+
+## 3. Interactive Installation
+
+Inject formatted skills and rules directly into your AI agent environment:
+
+```bash
+npx @weavetab/skills
+```
+
+The interactive installer prompts you for:
+1. **Domain Scope**: Full Enterprise Suite (All 9 Domains), Web Core, Desktop, Resilience, or Forensics.
+2. **Target Agent Framework**:
+   - **Antigravity**: Generates `.agent/skills/weavetab-<domain>/SKILL.md` with standard YAML frontmatter.
+   - **Cursor**: Generates `.cursor/rules/weavetab-<domain>.mdc` with MDC frontmatter.
+   - **Cline**: Appends formatted sections to `.clinerules`.
+   - **Windsurf**: Generates `.windsurf/rules/weavetab-<domain>.md`.
+   - **OpenClaw & RooCode**: Generates respective agent rules.
+   - **Raw Markdown**: Generates portable `weavetab-skills/`.
+
+---
+
+## 4. Programmatic API
+
+Install skills programmatically from setup scripts or custom CLIs:
+
+```javascript
+const { installSkills, getSkills, getSkill, getRouterMatrix } = require('@weavetab/skills');
+
+// Install targeted domains into Cursor
+await installSkills({
+  targetFramework: '.cursor',
+  domains: ['browser', 'resilience', 'security']
+});
+
+// Query skills catalog
+const webSkills = getSkillsByDomain('browser');
+```
+
+---
+
+## 5. Automated Benchmark & Evaluation Suite (`evals/`)
+
+Run the automated evaluation harness to verify that all 41 tools are covered and that skill guidance strictly passes test scenarios without legacy hallucinations:
+
+```bash
+npm test
+```
+
+---
+
+*Built with precision for the Weavetab Ecosystem.*

package/ROUTER.md

@@ -1,43 +1,43 @@
-# Weavetab Agent Intent Decision Matrix (Step-0 Router)
-
-Welcome to the **Weavetab MCP Skills Routing Engine**. 
-
-When executing browser or desktop automation via `@weavetab/mcp`, **do not read the entire skills directory**. Match your immediate intent against the matrix below and jump directly to the target domain guide.
-
----
-
-## Intent Routing Table
-
-| If your objective is... | Read Domain Guide | Primary MCP Tools |
-| :--- | :--- | :--- |
-| **Inspect DOM, extract text, locate elements, save tokens** | [`browser/dom-strategy.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/browser/dom-strategy.md) | `browser_map`, `browser_find`, `browser_scrape`, `browser_snapshot` |
-| **Click, type, press keys, pointer trajectories, file upload** | [`browser/interaction-pipeline.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/browser/interaction-pipeline.md) | `browser_click`, `browser_type`, `browser_key`, `browser_pointer`, `browser_upload` |
-| **Fill multi-field forms, select dropdowns, checkboxes** | [`browser/form-automation.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/browser/form-automation.md) | `browser_fill`, `browser_select` |
-| **Manage tabs, window creation, tab crash recovery** | [`browser/tab-and-window.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/browser/tab-and-window.md) | `browser_tabs` |
-| **Discover running Electron apps (Slack, Discord, VS Code)** | [`desktop/electron-discovery.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/desktop/electron-discovery.md) | `browser_detect` |
-| **Control native desktop applications with MCP tools** | [`desktop/desktop-targeting.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/desktop/desktop-targeting.md) | Any tool passing `app: "<name>"` |
-| **Bypass DOM walks using learned & cached selectors** | [`memory/selector-memory-system.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/memory/selector-memory-system.md) | Telemetry & selector history |
-| **Recall multi-step site workflows, quirks & fast-path replay** | [`memory/site-learning.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/memory/site-learning.md) | `browser_pattern_learn` |
-| **Compile manual action history into reusable macros** | [`memory/session-trail.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/memory/session-trail.md) | `browser_burst` (`compile_from_history`) |
-| **Handle React/Next/Vue detached elements & re-renders** | [`resilience/stale-ref-recovery.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/resilience/stale-ref-recovery.md) | 4-tier auto-recovery heuristic |
-| **Save/restore checkpoints & rollback failed workflows** | [`resilience/session-time-travel.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/resilience/session-time-travel.md) | `browser_checkpoint` |
-| **Break infinite interaction loops or handle CAPTCHAs** | [`resilience/loop-breaker.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/resilience/loop-breaker.md) | `browser_map`, `browser_captcha` |
-| **Enter passwords, API keys, or sensitive credentials** | [`security/secret-containment-protocol.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/security/secret-containment-protocol.md) | `browser_type_secret` |
-| **Enforce RBAC boundaries & sandbox viewer agents** | [`security/rbac-and-policies.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/security/rbac-and-policies.md) | RBAC security layer |
-| **Discover & dynamically load community plugins** | [`plugins/plugin-runtime.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/plugins/plugin-runtime.md) | `list_plugins`, `load_plugin` |
-| **Intercept tool execution pipelines via SDK hooks** | [`plugins/hooks-and-overrides.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/plugins/hooks-and-overrides.md) | SDK Plugin Hooks |
-| **Mock API endpoints, stub tracking, analyze TLS certs** | [`network-and-perf/network-intercept-and-mock.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/network-and-perf/network-intercept-and-mock.md) | `browser_network_intercept` |
-| **Measure Core Web Vitals (LCP, CLS) & wait conditions** | [`network-and-perf/performance-and-vitals.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/network-and-perf/performance-and-vitals.md) | `browser_performance`, `browser_wait` |
-| **Emulate mobile devices, CPU throttle, mock location** | [`network-and-perf/device-and-environment.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/network-and-perf/device-and-environment.md) | `browser_emulate` |
-| **Ingest Word (.docx), Excel (.xlsx), CSV files** | [`documents/office-document-ingestion.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/documents/office-document-ingestion.md) | `browser_office` |
-| **Capture screenshots, PDF exports, canvas pixels & visual marks** | [`documents/canvas-and-visual-capture.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/documents/canvas-and-visual-capture.md) | `browser_screenshot`, `browser_canvas`, `browser_pdf`, `browser_map` |
-| **Sub-ms local Git repo parsing & PR/issue triage** | [`developer/github-forensics.md`](file:///c:/Users/fy2ne/Music/Weavetab/skills/developer/github-forensics.md) | `browser_github` |
-
----
-
-## The 4 Golden Operational Rules for Weavetab Agents
-
-1. **Environment Handshake First**: Always call `browser_detect` at the start of a session to discover available browsers and configured desktop apps (Discord, Slack, etc.) and check their live connection status (`connected`, `running_no_debug`, `offline`).
-2. **Token Conservation**: NEVER call `browser_map` on large modern web apps without `lite: true` unless you strictly require full hierarchy data. For keyword navigation, always prefer `browser_find`.
-3. **Volatile Handle Discipline**: Always use the returned volatile ref IDs (`w:NN`) directly. Do NOT attempt to construct speculative CSS selectors from scratch.
-4. **Zero Secret Leakage**: Pass all authentication credentials, API keys, and sensitive tokens through `browser_type_secret`. Never use `browser_type` or `browser_fill` for credentials.
+# Weavetab Agent Intent Decision Matrix (Step-0 Router)
+
+Welcome to the **Weavetab MCP Skills Routing Engine**. 
+
+When executing browser or desktop automation via `@weavetab/mcp`, **do not read the entire skills directory**. Match your immediate intent against the matrix below and jump directly to the target domain guide.
+
+---
+
+## Intent Routing Table
+
+| If your objective is... | Read Domain Guide | Primary MCP Tools |
+| :--- | :--- | :--- |
+| **Inspect DOM, extract text, locate elements, save tokens** | [`browser/dom-strategy.md`](browser/dom-strategy.md) | `browser_map`, `browser_find`, `browser_scrape`, `browser_snapshot` |
+| **Click, type, press keys, pointer trajectories, file upload** | [`browser/interaction-pipeline.md`](browser/interaction-pipeline.md) | `browser_click`, `browser_type`, `browser_key`, `browser_pointer`, `browser_upload` |
+| **Fill multi-field forms, select dropdowns, checkboxes** | [`browser/form-automation.md`](browser/form-automation.md) | `browser_fill`, `browser_select` |
+| **Manage tabs, window creation, tab crash recovery** | [`browser/tab-and-window.md`](browser/tab-and-window.md) | `browser_tabs` |
+| **Discover running Electron apps (Slack, Discord, VS Code)** | [`desktop/electron-discovery.md`](desktop/electron-discovery.md) | `browser_detect` |
+| **Control native desktop applications with MCP tools** | [`desktop/desktop-targeting.md`](desktop/desktop-targeting.md) | Any tool passing `app: "<name>"` |
+| **Bypass DOM walks using learned & cached selectors** | [`memory/selector-memory-system.md`](memory/selector-memory-system.md) | Telemetry & selector history |
+| **Recall multi-step site workflows, quirks & fast-path replay** | [`memory/site-learning.md`](memory/site-learning.md) | `browser_pattern_learn` |
+| **Compile manual action history into reusable macros** | [`memory/session-trail.md`](memory/session-trail.md) | `browser_burst` (`compile_from_history`) |
+| **Handle React/Next/Vue detached elements & re-renders** | [`resilience/stale-ref-recovery.md`](resilience/stale-ref-recovery.md) | 4-tier auto-recovery heuristic |
+| **Save/restore checkpoints & rollback failed workflows** | [`resilience/session-time-travel.md`](resilience/session-time-travel.md) | `browser_checkpoint` |
+| **Break infinite interaction loops or handle CAPTCHAs** | [`resilience/loop-breaker.md`](resilience/loop-breaker.md) | `browser_map`, `browser_captcha` |
+| **Enter passwords, API keys, or sensitive credentials** | [`security/secret-containment-protocol.md`](security/secret-containment-protocol.md) | `browser_type_secret` |
+| **Enforce RBAC boundaries & sandbox viewer agents** | [`security/rbac-and-policies.md`](security/rbac-and-policies.md) | RBAC security layer |
+| **Discover & dynamically load community plugins** | [`plugins/plugin-runtime.md`](plugins/plugin-runtime.md) | CLI plugin management (no MCP tool) |
+| **Intercept tool execution pipelines via SDK hooks** | [`plugins/hooks-and-overrides.md`](plugins/hooks-and-overrides.md) | SDK Plugin Hooks |
+| **Mock API endpoints, stub tracking, analyze TLS certs** | [`network-and-perf/network-intercept-and-mock.md`](network-and-perf/network-intercept-and-mock.md) | `browser_network_intercept` |
+| **Measure Core Web Vitals (LCP, CLS) & wait conditions** | [`network-and-perf/performance-and-vitals.md`](network-and-perf/performance-and-vitals.md) | `browser_performance`, `browser_wait` |
+| **Emulate mobile devices, CPU throttle, mock location** | [`network-and-perf/device-and-environment.md`](network-and-perf/device-and-environment.md) | `browser_emulate` |
+| **Ingest Word (.docx), Excel (.xlsx), CSV files** | [`documents/office-document-ingestion.md`](documents/office-document-ingestion.md) | `browser_office` |
+| **Capture screenshots, PDF exports, canvas pixels & visual marks** | [`documents/canvas-and-visual-capture.md`](documents/canvas-and-visual-capture.md) | `browser_screenshot`, `browser_canvas`, `browser_pdf`, `browser_map` |
+| **GitHub repository forensics, PR diffs & issue triage** | [`developer/github-forensics.md`](developer/github-forensics.md) | plugin: `github` |
+
+---
+
+## The 4 Golden Operational Rules for Weavetab Agents
+
+1. **Environment Handshake First**: Always call `browser_detect` at the start of a session to discover available browsers and configured desktop apps (Discord, Slack, etc.) and check their live connection status (`connected`, `running_no_debug`, `offline`).
+2. **Token Conservation**: NEVER call `browser_map` on large modern web apps without `lite: true` unless you strictly require full hierarchy data. For keyword navigation, always prefer `browser_find`.
+3. **Volatile Handle Discipline**: Always use the returned volatile ref IDs (`w:NN`) directly. Do NOT attempt to construct speculative CSS selectors from scratch.
+4. **Zero Secret Leakage**: Pass all authentication credentials, API keys, and sensitive tokens through `browser_type_secret`. Never use `browser_type` or `browser_fill` for credentials.