@web-auto/camo 0.1.15 → 0.1.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@web-auto/camo",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Camoufox Browser CLI - Cross-platform browser automation",
   "type": "module",
   "bin": {

package/src/autoscript/runtime.mjs

@@ -970,6 +970,7 @@ export class AutoscriptRunner {
         profileId: this.profileId,
         subscriptions: this.script.subscriptions,
         throttle: this.script.throttle,
+        filterMode: this.script?.defaults?.filterMode || 'strict',
         onEvent: async (event) => {
           this.log('autoscript:event', {
             type: event.type,

package/src/autoscript/schema.mjs

@@ -127,9 +127,14 @@ function normalizeSubscription(item, index, defaults) {
   const selector = toTrimmedString(item.selector);
   if (!selector) return null;
   const events = toArray(item.events).map((name) => toTrimmedString(name)).filter(Boolean);
+  const pageUrlIncludes = toArray(item.pageUrlIncludes).map((token) => toTrimmedString(token)).filter(Boolean);
+  const pageUrlExcludes = toArray(item.pageUrlExcludes).map((token) => toTrimmedString(token)).filter(Boolean);
   return {
     id,
     selector,
+    visible: item.visible !== false,
+    pageUrlIncludes,
+    pageUrlExcludes,
     events: events.length > 0 ? events : ['appear', 'exist', 'disappear', 'change'],
     dependsOn: toArray(item.dependsOn).map((x) => toTrimmedString(x)).filter(Boolean),
     retry: normalizeRetry(item.retry, defaults.retry),
@@ -243,6 +248,7 @@ export function normalizeAutoscript(raw, sourcePath = null) {
       retry: normalizeRetry(defaults.retry, {}),
       impact: toTrimmedString(defaults.impact || 'op') || 'op',
       onFailure: toTrimmedString(defaults.onFailure || 'chain_stop') || 'chain_stop',
+      filterMode: toTrimmedString(defaults.filterMode || 'strict') || 'strict',
       validationMode: toTrimmedString(defaults.validationMode || 'none') || 'none',
       recovery: normalizeRecovery(defaults.recovery, {}),
       pacing: normalizePacing(defaults.pacing, {}),

package/src/cli.mjs

@@ -160,7 +160,11 @@ async function handleConfigCommand(args) {
 }
 
 async function main() {
-  const args = process.argv.slice(2);
+  const rawArgs = process.argv.slice(2);
+  const jsEnabled = rawArgs.includes('--js');
+  if (jsEnabled) process.env.CAMO_ALLOW_JS = '1';
+  else delete process.env.CAMO_ALLOW_JS;
+  const args = rawArgs.filter((arg) => arg !== '--js');
   const cmd = args[0];
 
   if (!cmd) {

package/src/commands/autoscript.mjs

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { getDefaultProfile } from '../utils/config.mjs';
+import { getDefaultProfile, listProfiles } from '../utils/config.mjs';
 import { explainAutoscript, loadAndValidateAutoscript } from '../autoscript/schema.mjs';
 import { AutoscriptRunner } from '../autoscript/runtime.mjs';
 import { safeAppendProgressEvent } from '../events/progress-log.mjs';
@@ -30,6 +30,18 @@ function collectPositionals(args, startIndex = 2, valueFlags = new Set(['--profi
   return out;
 }
 
+function assertExistingProfile(profileId) {
+  const id = String(profileId || '').trim();
+  if (!id) {
+    throw new Error('profileId is required');
+  }
+  const known = new Set(listProfiles());
+  if (!known.has(id)) {
+    throw new Error(`profile not found: ${id}. create it first with "camo profile create ${id}"`);
+  }
+  return id;
+}
+
 function appendJsonLine(filePath, payload) {
   if (!filePath) return;
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -783,6 +795,7 @@ async function handleRun(args) {
   if (!profileId) {
     throw new Error('profileId is required. Set in script or pass --profile <id>');
   }
+  assertExistingProfile(profileId);
 
   await executeAutoscriptRuntime({
     commandName: 'autoscript.run',
@@ -896,6 +909,7 @@ async function handleResume(args) {
   if (!profileId) {
     throw new Error('profileId is required. Set in script or pass --profile <id>');
   }
+  assertExistingProfile(profileId);
   const resumeState = buildResumeStateFromSnapshot(script, snapshot, fromNode || null);
   await executeAutoscriptRuntime({
     commandName: 'autoscript.resume',

package/src/commands/browser.mjs

@@ -9,11 +9,10 @@ import {
 } from '../utils/config.mjs';
 import { callAPI, ensureCamoufox, ensureBrowserService, getSessionByProfile, checkBrowserService } from '../utils/browser-service.mjs';
 import { resolveProfileId, ensureUrlScheme, looksLikeUrlToken, getPositionals } from '../utils/args.mjs';
+import { ensureJsExecutionEnabled } from '../utils/js-policy.mjs';
 import { acquireLock, releaseLock, cleanupStaleLocks } from '../lifecycle/lock.mjs';
 import {
-  buildSelectorClickScript,
   buildScrollTargetScript,
-  buildSelectorTypeScript,
 } from '../container/runtime-core/operations/selector-scripts.mjs';
 import {
   registerSession,
@@ -31,11 +30,15 @@ import { startSessionWatchdog, stopAllSessionWatchdogs, stopSessionWatchdog } fr
 const START_WINDOW_MIN_WIDTH = 960;
 const START_WINDOW_MIN_HEIGHT = 700;
 const START_WINDOW_MAX_RESERVE = 240;
-const START_WINDOW_DEFAULT_RESERVE = 72;
+const START_WINDOW_DEFAULT_RESERVE = 0;
 const DEFAULT_HEADLESS_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
 const DEVTOOLS_SHORTCUTS = process.platform === 'darwin'
   ? ['Meta+Alt+I', 'F12']
   : ['F12', 'Control+Shift+I'];
+const INPUT_ACTION_TIMEOUT_MS = Math.max(
+  1000,
+  parseNumber(process.env.CAMO_INPUT_ACTION_TIMEOUT_MS, 30000),
+);
 
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -77,6 +80,167 @@ function parseDurationMs(raw, fallbackMs) {
   return Math.floor(value * factor);
 }
 
+function assertExistingProfile(profileId, profileSet = null) {
+  const id = String(profileId || '').trim();
+  if (!id) throw new Error('profileId is required');
+  const known = profileSet || new Set(listProfiles());
+  if (!known.has(id)) {
+    throw new Error(`profile not found: ${id}. create it first with "camo profile create ${id}"`);
+  }
+  return id;
+}
+
+async function resolveVisibleTargetPoint(profileId, selector, options = {}) {
+  const selectorLiteral = JSON.stringify(String(selector || '').trim());
+  const highlight = options.highlight === true;
+  const payload = await callAPI('evaluate', {
+    profileId,
+    script: `(() => {
+      const selector = ${selectorLiteral};
+      const highlight = ${highlight ? 'true' : 'false'};
+      const nodes = Array.from(document.querySelectorAll(selector));
+      const isVisible = (node) => {
+        if (!(node instanceof Element)) return false;
+        const rect = node.getBoundingClientRect?.();
+        if (!rect || rect.width <= 0 || rect.height <= 0) return false;
+        try {
+          const style = window.getComputedStyle(node);
+          if (!style) return false;
+          if (style.display === 'none') return false;
+          if (style.visibility === 'hidden' || style.visibility === 'collapse') return false;
+          const opacity = Number.parseFloat(String(style.opacity || '1'));
+          if (Number.isFinite(opacity) && opacity <= 0.01) return false;
+        } catch {
+          return false;
+        }
+        return true;
+      };
+      const hitVisible = (node) => {
+        if (!(node instanceof Element)) return false;
+        const rect = node.getBoundingClientRect?.();
+        if (!rect) return false;
+        const x = Math.max(0, Math.min((window.innerWidth || 1) - 1, Math.round(rect.left + rect.width / 2)));
+        const y = Math.max(0, Math.min((window.innerHeight || 1) - 1, Math.round(rect.top + rect.height / 2)));
+        const top = document.elementFromPoint(x, y);
+        if (!top) return false;
+        return top === node || node.contains(top) || top.contains(node);
+      };
+      const target = nodes.find((item) => isVisible(item) && hitVisible(item))
+        || nodes.find((item) => isVisible(item))
+        || nodes[0]
+        || null;
+      if (!target) {
+        return { ok: false, error: 'selector_not_found', selector };
+      }
+      const rect = target.getBoundingClientRect?.() || { left: 0, top: 0, width: 1, height: 1 };
+      const center = {
+        x: Math.max(1, Math.min((window.innerWidth || 1) - 1, Math.round(rect.left + Math.max(1, rect.width / 2)))),
+        y: Math.max(1, Math.min((window.innerHeight || 1) - 1, Math.round(rect.top + Math.max(1, rect.height / 2)))),
+      };
+      if (highlight) {
+        try {
+          const id = 'webauto-action-highlight-overlay';
+          const old = document.getElementById(id);
+          if (old) old.remove();
+          const overlay = document.createElement('div');
+          overlay.id = id;
+          overlay.style.position = 'fixed';
+          overlay.style.left = rect.left + 'px';
+          overlay.style.top = rect.top + 'px';
+          overlay.style.width = rect.width + 'px';
+          overlay.style.height = rect.height + 'px';
+          overlay.style.border = '2px solid #00A8FF';
+          overlay.style.borderRadius = '8px';
+          overlay.style.background = 'rgba(0,168,255,0.12)';
+          overlay.style.pointerEvents = 'none';
+          overlay.style.zIndex = '2147483647';
+          overlay.style.transition = 'opacity 120ms ease';
+          overlay.style.opacity = '1';
+          document.documentElement.appendChild(overlay);
+          setTimeout(() => {
+            overlay.style.opacity = '0';
+            setTimeout(() => overlay.remove(), 180);
+          }, 260);
+        } catch {}
+      }
+      return {
+        ok: true,
+        selector,
+        center,
+        rect: {
+          left: rect.left,
+          top: rect.top,
+          width: rect.width,
+          height: rect.height,
+        },
+        viewport: {
+          width: Number(window.innerWidth || 0),
+          height: Number(window.innerHeight || 0),
+        },
+      };
+    })()`,
+  }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
+  const result = payload?.result || payload?.data?.result || payload?.data || payload || null;
+  if (!result || result.ok !== true || !result.center) {
+    throw new Error(`Element not found: ${selector}`);
+  }
+  return result;
+}
+
+function isTargetFullyInViewport(target, margin = 6) {
+  const rect = target?.rect && typeof target.rect === 'object' ? target.rect : null;
+  const viewport = target?.viewport && typeof target.viewport === 'object' ? target.viewport : null;
+  if (!rect || !viewport) return true;
+  const vw = Number(viewport.width || 0);
+  const vh = Number(viewport.height || 0);
+  if (!Number.isFinite(vw) || !Number.isFinite(vh) || vw <= 0 || vh <= 0) return true;
+  const left = Number(rect.left || 0);
+  const top = Number(rect.top || 0);
+  const width = Math.max(0, Number(rect.width || 0));
+  const height = Math.max(0, Number(rect.height || 0));
+  const right = left + width;
+  const bottom = top + height;
+  const m = Math.max(0, Number(margin) || 0);
+  return left >= m && top >= m && right <= (vw - m) && bottom <= (vh - m);
+}
+
+async function ensureClickTargetInViewport(profileId, selector, initialTarget, options = {}) {
+  let target = initialTarget;
+  const maxSteps = Math.max(0, Number(options.maxAutoScrollSteps ?? 8) || 8);
+  const settleMs = Math.max(0, Number(options.autoScrollSettleMs ?? 140) || 140);
+  let autoScrolled = 0;
+
+  while (autoScrolled < maxSteps && !isTargetFullyInViewport(target)) {
+    const rect = target?.rect && typeof target.rect === 'object' ? target.rect : {};
+    const viewport = target?.viewport && typeof target.viewport === 'object' ? target.viewport : {};
+    const vw = Math.max(1, Number(viewport.width || 1));
+    const vh = Math.max(1, Number(viewport.height || 1));
+    const rawCenterY = Number(rect.top || 0) + Math.max(1, Number(rect.height || 0)) / 2;
+    const desiredCenterY = clamp(Math.round(vh * 0.45), 80, Math.max(80, vh - 80));
+    let deltaY = Math.round(rawCenterY - desiredCenterY);
+    deltaY = clamp(deltaY, -900, 900);
+    if (Math.abs(deltaY) < 100) {
+      deltaY = deltaY >= 0 ? 120 : -120;
+    }
+    const anchorX = clamp(Math.round(vw / 2), 1, Math.max(1, vw - 1));
+    const anchorY = clamp(Math.round(vh / 2), 1, Math.max(1, vh - 1));
+
+    await callAPI('mouse:move', { profileId, x: anchorX, y: anchorY, steps: 1 }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
+    await callAPI('mouse:wheel', { profileId, deltaX: 0, deltaY }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
+    autoScrolled += 1;
+    if (settleMs > 0) {
+      await sleep(settleMs);
+    }
+    target = await resolveVisibleTargetPoint(profileId, selector, { highlight: false });
+  }
+
+  return {
+    target,
+    autoScrolled,
+    targetFullyVisible: isTargetFullyInViewport(target),
+  };
+}
+
 function validateAlias(alias) {
   const text = String(alias || '').trim();
   if (!text) return null;
@@ -378,6 +542,7 @@ export async function handleStartCommand(args) {
       throw new Error('No default profile set. Run: camo profile default <profileId>');
     }
   }
+  assertExistingProfile(profileId, profileSet);
   if (alias && isSessionAliasTaken(alias, profileId)) {
     throw new Error(`Alias is already in use: ${alias}`);
   }
@@ -497,17 +662,28 @@ export async function handleStartCommand(args) {
           source: 'explicit',
         };
       } else {
+        const display = await callAPI('system:display', {}).catch(() => null);
+        const displayTarget = computeStartWindowSize(display);
         const rememberedWindow = getProfileWindowSize(profileId);
         if (rememberedWindow) {
-          windowTarget = {
+          const rememberedTarget = {
             width: rememberedWindow.width,
             height: rememberedWindow.height,
             source: 'profile',
             updatedAt: rememberedWindow.updatedAt,
           };
+          const canTrustDisplayTarget = displayTarget?.source && displayTarget.source !== 'fallback';
+          const refreshFromDisplay = canTrustDisplayTarget
+            && (
+              rememberedTarget.height < Math.floor(displayTarget.height * 0.92)
+              || rememberedTarget.width < Math.floor(displayTarget.width * 0.92)
+            );
+          windowTarget = refreshFromDisplay ? {
+            ...displayTarget,
+            source: 'display',
+          } : rememberedTarget;
         } else {
-          const display = await callAPI('system:display', {}).catch(() => null);
-          windowTarget = computeStartWindowSize(display);
+          windowTarget = displayTarget;
         }
       }
 
@@ -704,6 +880,7 @@ export async function handleStatusCommand(args) {
 export async function handleGotoCommand(args) {
   await ensureBrowserService();
   const positionals = getPositionals(args);
+  const profileSet = new Set(listProfiles());
 
   let profileId;
   let url;
@@ -718,6 +895,13 @@ export async function handleGotoCommand(args) {
 
   if (!profileId) throw new Error('Usage: camo goto [profileId] <url> (or set default profile first)');
   if (!url) throw new Error('Usage: camo goto [profileId] <url>');
+  assertExistingProfile(profileId, profileSet);
+  const active = await getSessionByProfile(profileId);
+  if (!active) {
+    throw new Error(
+      `No active session for profile: ${profileId}. Start via "camo start ${profileId}" (or UI CLI startup) before goto.`,
+    );
+  }
   
   const result = await callAPI('goto', { profileId, url: ensureUrlScheme(url) });
   updateSession(profileId, { url: ensureUrlScheme(url), lastSeen: Date.now() });
@@ -768,7 +952,8 @@ export async function handleScrollCommand(args) {
   const isFlag = (arg) => arg?.startsWith('--');
   const selectorIdx = args.indexOf('--selector');
   const selector = selectorIdx >= 0 ? String(args[selectorIdx + 1] || '').trim() : null;
-  const highlight = resolveHighlightEnabled(args);
+  const highlightRequested = resolveHighlightEnabled(args);
+  const highlight = highlightRequested;
 
   let profileId = null;
   for (let i = 1; i < args.length; i++) {
@@ -794,16 +979,15 @@ export async function handleScrollCommand(args) {
   const target = await callAPI('evaluate', {
     profileId,
     script: buildScrollTargetScript({ selector, highlight }),
-  });
+  }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
   const centerX = Number(target?.result?.center?.x);
   const centerY = Number(target?.result?.center?.y);
   if (Number.isFinite(centerX) && Number.isFinite(centerY)) {
-    await callAPI('mouse:move', { profileId, x: centerX, y: centerY, steps: 2 });
+    await callAPI('mouse:move', { profileId, x: centerX, y: centerY, steps: 2 }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
   }
-
   const deltaX = direction === 'left' ? -amount : direction === 'right' ? amount : 0;
   const deltaY = direction === 'up' ? -amount : direction === 'down' ? amount : 0;
-  const result = await callAPI('mouse:wheel', { profileId, deltaX, deltaY });
+  const result = await callAPI('mouse:wheel', { profileId, deltaX, deltaY }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
   console.log(JSON.stringify({
     ...result,
     scrollTarget: target?.result || null,
@@ -829,11 +1013,33 @@ export async function handleClickCommand(args) {
   if (!profileId) throw new Error('Usage: camo click [profileId] <selector> [--highlight|--no-highlight]');
   if (!selector) throw new Error('Usage: camo click [profileId] <selector> [--highlight|--no-highlight]');
 
-  const result = await callAPI('evaluate', {
-    profileId,
-    script: buildSelectorClickScript({ selector, highlight }),
+  let target = await resolveVisibleTargetPoint(profileId, selector, { highlight });
+  const ensured = await ensureClickTargetInViewport(profileId, selector, target, {
+    maxAutoScrollSteps: 3,
   });
-  console.log(JSON.stringify(result, null, 2));
+  if (!ensured.targetFullyVisible) {
+    throw new Error(`Click target not fully visible after ${ensured.autoScrolled} auto-scroll attempts: ${selector}`);
+  }
+  target = ensured.target;
+  if (highlight) {
+    target = await resolveVisibleTargetPoint(profileId, selector, { highlight: true });
+  }
+  await callAPI('mouse:move', { profileId, x: target.center.x, y: target.center.y, steps: 2 }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
+  const result = await callAPI('mouse:click', {
+    profileId,
+    x: target.center.x,
+    y: target.center.y,
+    button: 'left',
+    clicks: 1,
+  }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
+  console.log(JSON.stringify({
+    ...result,
+    selector,
+    highlight,
+    autoScrolled: ensured.autoScrolled,
+    targetFullyVisible: ensured.targetFullyVisible,
+    target,
+  }, null, 2));
 }
 
 export async function handleTypeCommand(args) {
@@ -857,15 +1063,36 @@ export async function handleTypeCommand(args) {
   if (!profileId) throw new Error('Usage: camo type [profileId] <selector> <text> [--highlight|--no-highlight]');
   if (!selector || text === undefined) throw new Error('Usage: camo type [profileId] <selector> <text> [--highlight|--no-highlight]');
 
-  const result = await callAPI('evaluate', {
+  const target = await resolveVisibleTargetPoint(profileId, selector, { highlight });
+  await callAPI('mouse:move', { profileId, x: target.center.x, y: target.center.y, steps: 2 }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
+  await callAPI('mouse:click', {
     profileId,
-    script: buildSelectorTypeScript({ selector, highlight, text }),
-  });
-  console.log(JSON.stringify(result, null, 2));
+    x: target.center.x,
+    y: target.center.y,
+    button: 'left',
+    clicks: 1,
+  }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
+  await callAPI('keyboard:press', {
+    profileId,
+    key: process.platform === 'darwin' ? 'Meta+A' : 'Control+A',
+  }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
+  await callAPI('keyboard:press', { profileId, key: 'Backspace' }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
+  const result = await callAPI('keyboard:type', {
+    profileId,
+    text: String(text),
+  }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
+  console.log(JSON.stringify({
+    ...result,
+    selector,
+    typed: String(text).length,
+    highlight,
+    target,
+  }, null, 2));
 }
 
 export async function handleHighlightCommand(args) {
   await ensureBrowserService();
+  ensureJsExecutionEnabled('highlight command');
   const positionals = getPositionals(args);
   let profileId;
   let selector;
@@ -898,6 +1125,7 @@ export async function handleHighlightCommand(args) {
 
 export async function handleClearHighlightCommand(args) {
   await ensureBrowserService();
+  ensureJsExecutionEnabled('clear-highlight command');
   const profileId = resolveProfileId(args, 1, getDefaultProfile);
   if (!profileId) throw new Error('Usage: camo clear-highlight [profileId]');
 

package/src/commands/mouse.mjs

@@ -2,6 +2,12 @@ import { getDefaultProfile } from '../utils/config.mjs';
 import { callAPI, ensureBrowserService } from '../utils/browser-service.mjs';
 import { getPositionals } from '../utils/args.mjs';
 
+const INPUT_ACTION_TIMEOUT_MS = (() => {
+  const parsed = Number(process.env.CAMO_INPUT_ACTION_TIMEOUT_MS);
+  if (!Number.isFinite(parsed) || parsed <= 0) return 30000;
+  return Math.max(1000, Math.floor(parsed));
+})();
+
 export async function handleMouseCommand(args) {
   await ensureBrowserService();
 
@@ -17,7 +23,7 @@ export async function handleMouseCommand(args) {
     const x = parseInt(args[xIdx + 1]);
     const y = parseInt(args[yIdx + 1]);
     const steps = stepsIdx >= 0 ? parseInt(args[stepsIdx + 1]) : undefined;
-    const result = await callAPI('mouse:move', { profileId, x, y, steps });
+    const result = await callAPI('mouse:move', { profileId, x, y, steps }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
     console.log(JSON.stringify(result, null, 2));
   } else if (sub === 'click') {
     // Use existing click command? We already have click command for element clicking.
@@ -33,7 +39,7 @@ export async function handleMouseCommand(args) {
     const button = buttonIdx >= 0 ? args[buttonIdx + 1] : 'left';
     const clicks = clicksIdx >= 0 ? parseInt(args[clicksIdx + 1]) : 1;
     const delay = delayIdx >= 0 ? parseInt(args[delayIdx + 1]) : undefined;
-    const result = await callAPI('mouse:click', { profileId, x, y, button, clicks, delay });
+    const result = await callAPI('mouse:click', { profileId, x, y, button, clicks, delay }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
     console.log(JSON.stringify(result, null, 2));
   } else if (sub === 'wheel') {
     const deltaXIdx = args.indexOf('--deltax');
@@ -41,7 +47,7 @@ export async function handleMouseCommand(args) {
     if (deltaXIdx === -1 && deltaYIdx === -1) throw new Error('Usage: camo mouse wheel [profileId] [--deltax <px>] [--deltay <px>]');
     const deltaX = deltaXIdx >= 0 ? parseInt(args[deltaXIdx + 1]) : 0;
     const deltaY = deltaYIdx >= 0 ? parseInt(args[deltaYIdx + 1]) : 0;
-    const result = await callAPI('mouse:wheel', { profileId, deltaX, deltaY });
+    const result = await callAPI('mouse:wheel', { profileId, deltaX, deltaY }, { timeoutMs: INPUT_ACTION_TIMEOUT_MS });
     console.log(JSON.stringify(result, null, 2));
   } else {
     throw new Error('Usage: camo mouse <move|click|wheel> [profileId] [options]');

package/src/container/runtime-core/operations/index.mjs

@@ -1,10 +1,6 @@
 import { callAPI, getDomSnapshotByProfile } from '../../../utils/browser-service.mjs';
+import { isJsExecutionEnabled } from '../../../utils/js-policy.mjs';
 import { executeTabPoolOperation } from './tab-pool.mjs';
-import {
-  buildSelectorClickScript,
-  buildSelectorScrollIntoViewScript,
-  buildSelectorTypeScript,
-} from './selector-scripts.mjs';
 import { executeViewportOperation } from './viewport.mjs';
 import {
   asErrorPayload,
@@ -27,6 +23,23 @@ const VIEWPORT_ACTIONS = new Set([
   'get_current_url',
 ]);
 
+const DEFAULT_MODAL_SELECTORS = [
+  '[aria-modal="true"]',
+  '[role="dialog"]',
+  '.modal',
+  '.dialog',
+  '.note-detail-mask',
+  '.note-detail-page',
+  '.note-detail-dialog',
+];
+
+function resolveFilterMode(input) {
+  const text = String(input || process.env.CAMO_FILTER_MODE || 'strict').trim().toLowerCase();
+  if (!text) return 'strict';
+  if (text === 'legacy') return 'legacy';
+  return 'strict';
+}
+
 async function executeExternalOperationIfAny({
   profileId,
   action,
@@ -54,6 +67,7 @@ async function executeExternalOperationIfAny({
 }
 
 async function flashOperationViewport(profileId, params = {}) {
+  if (!isJsExecutionEnabled()) return;
   if (params.highlight === false) return;
   try {
     await callAPI('evaluate', {
@@ -77,7 +91,272 @@ async function flashOperationViewport(profileId, params = {}) {
   }
 }
 
-async function executeSelectorOperation({ profileId, action, operation, params }) {
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function clamp(value, min, max) {
+  return Math.min(Math.max(value, min), max);
+}
+
+function isTargetFullyInViewport(target, margin = 6) {
+  const rect = target?.rect && typeof target.rect === 'object' ? target.rect : null;
+  const viewport = target?.viewport && typeof target.viewport === 'object' ? target.viewport : null;
+  if (!rect || !viewport) return true;
+  const vw = Number(viewport.width || 0);
+  const vh = Number(viewport.height || 0);
+  if (!Number.isFinite(vw) || !Number.isFinite(vh) || vw <= 0 || vh <= 0) return true;
+  const left = Number(rect.left || 0);
+  const top = Number(rect.top || 0);
+  const width = Math.max(0, Number(rect.width || 0));
+  const height = Math.max(0, Number(rect.height || 0));
+  const right = left + width;
+  const bottom = top + height;
+  const m = Math.max(0, Number(margin) || 0);
+  return left >= m && top >= m && right <= (vw - m) && bottom <= (vh - m);
+}
+
+function resolveViewportScrollDelta(target, margin = 6) {
+  const rect = target?.rect && typeof target.rect === 'object' ? target.rect : null;
+  const viewport = target?.viewport && typeof target.viewport === 'object' ? target.viewport : null;
+  if (!rect || !viewport) return { deltaX: 0, deltaY: 0 };
+  const vw = Number(viewport.width || 0);
+  const vh = Number(viewport.height || 0);
+  if (!Number.isFinite(vw) || !Number.isFinite(vh) || vw <= 0 || vh <= 0) return { deltaX: 0, deltaY: 0 };
+  const left = Number(rect.left || 0);
+  const top = Number(rect.top || 0);
+  const width = Math.max(0, Number(rect.width || 0));
+  const height = Math.max(0, Number(rect.height || 0));
+  const right = left + width;
+  const bottom = top + height;
+  const m = Math.max(0, Number(margin) || 0);
+
+  let deltaX = 0;
+  let deltaY = 0;
+
+  if (left < m) {
+    deltaX = Math.round(left - m);
+  } else if (right > (vw - m)) {
+    deltaX = Math.round(right - (vw - m));
+  }
+
+  if (top < m) {
+    deltaY = Math.round(top - m);
+  } else if (bottom > (vh - m)) {
+    deltaY = Math.round(bottom - (vh - m));
+  }
+
+  if (Math.abs(deltaY) < 80 && !isTargetFullyInViewport(target, m)) {
+    deltaY = deltaY >= 0 ? 120 : -120;
+  }
+  if (Math.abs(deltaX) < 40 && (left < m || right > (vw - m))) {
+    deltaX = deltaX >= 0 ? 60 : -60;
+  }
+
+  return {
+    deltaX: clamp(deltaX, -900, 900),
+    deltaY: clamp(deltaY, -900, 900),
+  };
+}
+
+function normalizeRect(node) {
+  const rect = node?.rect && typeof node.rect === 'object' ? node.rect : null;
+  if (!rect) return null;
+  const left = Number(rect.left ?? rect.x ?? 0);
+  const top = Number(rect.top ?? rect.y ?? 0);
+  const width = Number(rect.width ?? 0);
+  const height = Number(rect.height ?? 0);
+  if (!Number.isFinite(left) || !Number.isFinite(top) || !Number.isFinite(width) || !Number.isFinite(height)) {
+    return null;
+  }
+  if (width <= 0 || height <= 0) return null;
+  return { left, top, width, height };
+}
+
+function nodeArea(node) {
+  const rect = normalizeRect(node);
+  if (!rect) return 0;
+  return Number(rect.width || 0) * Number(rect.height || 0);
+}
+
+function nodeCenter(node, viewport = null) {
+  const rect = normalizeRect(node);
+  const vw = Number(viewport?.width || 0);
+  const vh = Number(viewport?.height || 0);
+  if (!rect) return null;
+  const rawX = rect.left + Math.max(1, rect.width / 2);
+  const rawY = rect.top + Math.max(1, rect.height / 2);
+  const centerX = vw > 1
+    ? clamp(Math.round(rawX), 1, Math.max(1, vw - 1))
+    : Math.max(1, Math.round(rawX));
+  const centerY = vh > 1
+    ? clamp(Math.round(rawY), 1, Math.max(1, vh - 1))
+    : Math.max(1, Math.round(rawY));
+  return {
+    center: { x: centerX, y: centerY },
+    rawCenter: { x: rawX, y: rawY },
+    rect,
+  };
+}
+
+function getSnapshotViewport(snapshot) {
+  const width = Number(snapshot?.__viewport?.width || 0);
+  const height = Number(snapshot?.__viewport?.height || 0);
+  return { width, height };
+}
+
+function isPathWithin(path, parentPath) {
+  const child = String(path || '').trim();
+  const parent = String(parentPath || '').trim();
+  if (!child || !parent) return false;
+  return child === parent || child.startsWith(`${parent}/`);
+}
+
+function resolveActiveModal(snapshot) {
+  if (!snapshot) return null;
+  const rows = [];
+  for (const selector of DEFAULT_MODAL_SELECTORS) {
+    const matches = buildSelectorCheck(snapshot, { css: selector, visible: true });
+    for (const node of matches) {
+      if (nodeArea(node) <= 1) continue;
+      rows.push({
+        selector,
+        path: String(node.path || ''),
+        node,
+        area: nodeArea(node),
+      });
+    }
+  }
+  rows.sort((a, b) => b.area - a.area);
+  return rows[0] || null;
+}
+
+async function resolveSelectorTarget(profileId, selector, options = {}) {
+  const filterMode = resolveFilterMode(options.filterMode);
+  const strictFilter = filterMode !== 'legacy';
+  const normalizedSelector = String(selector || '').trim();
+  const snapshot = await getDomSnapshotByProfile(profileId);
+  const viewport = getSnapshotViewport(snapshot);
+  const modal = strictFilter ? resolveActiveModal(snapshot) : null;
+  const visibleMatches = buildSelectorCheck(snapshot, { css: normalizedSelector, visible: true });
+  const allMatches = strictFilter
+    ? visibleMatches
+    : buildSelectorCheck(snapshot, { css: normalizedSelector, visible: false });
+  const scopedVisible = modal
+    ? visibleMatches.filter((item) => isPathWithin(item.path, modal.path))
+    : visibleMatches;
+  const scopedAll = modal
+    ? allMatches.filter((item) => isPathWithin(item.path, modal.path))
+    : allMatches;
+  const candidate = strictFilter
+    ? (scopedVisible[0] || null)
+    : (scopedVisible[0] || scopedAll[0] || null);
+  if (!candidate) {
+    if (modal) {
+      throw new Error(`Modal focus locked for selector: ${normalizedSelector}`);
+    }
+    throw new Error(`Element not found: ${normalizedSelector}`);
+  }
+  const center = nodeCenter(candidate, viewport);
+  if (!center) {
+    throw new Error(`Element not found: ${normalizedSelector}`);
+  }
+  return {
+    ok: true,
+    selector: normalizedSelector,
+    matchedIndex: Math.max(0, scopedAll.indexOf(candidate)),
+    center: center.center,
+    rawCenter: center.rawCenter,
+    rect: center.rect,
+    viewport,
+    modalLocked: Boolean(modal),
+  };
+}
+
+async function scrollTargetIntoViewport(profileId, selector, initialTarget, params = {}, options = {}) {
+  let target = initialTarget;
+  const maxSteps = Math.max(0, Math.min(24, Number(params.maxScrollSteps ?? 8) || 8));
+  const settleMs = Math.max(0, Number(params.scrollSettleMs ?? 140) || 140);
+  const visibilityMargin = Math.max(0, Number(params.visibilityMargin ?? params.viewportMargin ?? 6) || 6);
+  for (let i = 0; i < maxSteps; i += 1) {
+    if (isTargetFullyInViewport(target, visibilityMargin)) break;
+    const delta = resolveViewportScrollDelta(target, visibilityMargin);
+    if (Math.abs(delta.deltaX) < 1 && Math.abs(delta.deltaY) < 1) break;
+    const anchorX = clamp(Math.round(Number(target?.center?.x || 0) || 1), 1, Math.max(1, Number(target?.viewport?.width || 1) - 1));
+    const anchorY = clamp(Math.round(Number(target?.center?.y || 0) || 1), 1, Math.max(1, Number(target?.viewport?.height || 1) - 1));
+    await callAPI('mouse:move', { profileId, x: anchorX, y: anchorY, steps: 1 });
+    await callAPI('mouse:wheel', { profileId, deltaX: delta.deltaX, deltaY: delta.deltaY });
+    if (settleMs > 0) await sleep(settleMs);
+    target = await resolveSelectorTarget(profileId, selector, options);
+  }
+  return target;
+}
+
+async function resolveScrollAnchor(profileId, options = {}) {
+  const filterMode = resolveFilterMode(options.filterMode);
+  const strictFilter = filterMode !== 'legacy';
+  const selector = String(options.selector || '').trim();
+  const snapshot = await getDomSnapshotByProfile(profileId);
+  const viewport = getSnapshotViewport(snapshot);
+  const modal = strictFilter ? resolveActiveModal(snapshot) : null;
+
+  if (selector) {
+    const visibleMatches = buildSelectorCheck(snapshot, { css: selector, visible: true });
+    const target = visibleMatches[0] || null;
+    if (target) {
+      if (modal && !isPathWithin(target.path, modal.path)) {
+        const modalCenter = nodeCenter(modal.node, viewport);
+        if (modalCenter) {
+          return {
+            ok: true,
+            source: 'modal',
+            center: modalCenter.center,
+            modalLocked: true,
+            modalSelector: modal.selector,
+            selectorRejectedByModalLock: true,
+          };
+        }
+      } else {
+        const targetCenter = nodeCenter(target, viewport);
+        if (targetCenter) {
+          return {
+            ok: true,
+            source: 'selector',
+            center: targetCenter.center,
+            modalLocked: Boolean(modal),
+          };
+        }
+      }
+    }
+  }
+
+  if (modal) {
+    const modalCenter = nodeCenter(modal.node, viewport);
+    if (modalCenter) {
+      return {
+        ok: true,
+        source: 'modal',
+        center: modalCenter.center,
+        modalLocked: true,
+        modalSelector: modal.selector,
+      };
+    }
+  }
+
+  const width = Number(viewport.width || 0);
+  const height = Number(viewport.height || 0);
+  return {
+    ok: true,
+    source: 'document',
+    center: {
+      x: width > 1 ? Math.round(width / 2) : 1,
+      y: height > 1 ? Math.round(height / 2) : 1,
+    },
+    modalLocked: false,
+  };
+}
+
+async function executeSelectorOperation({ profileId, action, operation, params, filterMode }) {
   const selector = maybeSelector({
     profileId,
     containerId: params.containerId || operation?.containerId || null,
@@ -85,22 +364,75 @@ async function executeSelectorOperation({ profileId, action, operation, params }
   });
   if (!selector) return asErrorPayload('CONTAINER_NOT_FOUND', `${action} requires selector/containerId`);
 
-  const highlight = params.highlight !== false;
+  let target = await resolveSelectorTarget(profileId, selector, { filterMode });
+  target = await scrollTargetIntoViewport(profileId, selector, target, params, { filterMode });
+  const visibilityMargin = Math.max(0, Number(params.visibilityMargin ?? params.viewportMargin ?? 6) || 6);
+  const targetFullyVisible = isTargetFullyInViewport(target, visibilityMargin);
+  if (action === 'click' && !targetFullyVisible) {
+    return asErrorPayload('TARGET_NOT_FULLY_VISIBLE', 'click target is not fully visible after auto scroll', {
+      selector,
+      target,
+      visibilityMargin,
+    });
+  }
+
+  await callAPI('mouse:move', { profileId, x: target.center.x, y: target.center.y, steps: 2 });
+
   if (action === 'scroll_into_view') {
-    const script = buildSelectorScrollIntoViewScript({ selector, highlight });
-    const result = await callAPI('evaluate', {
+    return {
+      ok: true,
+      code: 'OPERATION_DONE',
+      message: 'scroll_into_view done',
+      data: { selector, target, targetFullyVisible, visibilityMargin },
+    };
+  }
+
+  if (action === 'click') {
+    const button = String(params.button || 'left').trim() || 'left';
+    const clicks = Math.max(1, Number(params.clicks ?? 1) || 1);
+    const delay = Number(params.delay);
+    const result = await callAPI('mouse:click', {
       profileId,
-      script,
+      x: target.center.x,
+      y: target.center.y,
+      button,
+      clicks,
+      ...(Number.isFinite(delay) && delay >= 0 ? { delay } : {}),
     });
-    return { ok: true, code: 'OPERATION_DONE', message: 'scroll_into_view done', data: result };
+    return { ok: true, code: 'OPERATION_DONE', message: 'click done', data: { selector, target, result, targetFullyVisible, visibilityMargin } };
   }
 
-  const typeText = String(params.text ?? params.value ?? '');
-  const script = action === 'click'
-    ? buildSelectorClickScript({ selector, highlight })
-    : buildSelectorTypeScript({ selector, highlight, text: typeText });
-  const result = await callAPI('evaluate', { profileId, script });
-  return { ok: true, code: 'OPERATION_DONE', message: `${action} done`, data: result };
+  const text = String(params.text ?? params.value ?? '');
+  await callAPI('mouse:click', {
+    profileId,
+    x: target.center.x,
+    y: target.center.y,
+    button: 'left',
+    clicks: 1,
+  });
+  const clearBeforeType = params.clear !== false;
+  if (clearBeforeType) {
+    await callAPI('keyboard:press', {
+      profileId,
+      key: process.platform === 'darwin' ? 'Meta+A' : 'Control+A',
+    });
+    await callAPI('keyboard:press', { profileId, key: 'Backspace' });
+  }
+  const delay = Number(params.keyDelayMs ?? params.delay);
+  await callAPI('keyboard:type', {
+    profileId,
+    text,
+    ...(Number.isFinite(delay) && delay >= 0 ? { delay } : {}),
+  });
+  if (params.pressEnter === true) {
+    await callAPI('keyboard:press', { profileId, key: 'Enter' });
+  }
+  return {
+    ok: true,
+    code: 'OPERATION_DONE',
+    message: 'type done',
+    data: { selector, target, length: text.length },
+  };
 }
 
 async function executeVerifySubscriptions({ profileId, params }) {
@@ -200,6 +532,13 @@ export async function executeOperation({ profileId, operation, context = {} }) {
     const resolvedProfile = session.profileId || profileId;
     const action = String(operation?.action || '').trim();
     const params = operation?.params || operation?.config || {};
+    const filterMode = resolveFilterMode(
+      params.filterMode
+      || operation?.filterMode
+      || context?.filterMode
+      || context?.runtime?.filterMode
+      || null,
+    );
 
     if (!action) {
       return asErrorPayload('OPERATION_FAILED', 'operation.action is required');
@@ -279,38 +618,49 @@ export async function executeOperation({ profileId, operation, context = {} }) {
         deltaX = amount;
         deltaY = 0;
       }
+      const anchorSelector = maybeSelector({
+        profileId: resolvedProfile,
+        containerId: params.containerId || operation?.containerId || null,
+        selector: params.selector || operation?.selector || null,
+      });
+      const anchor = await resolveScrollAnchor(resolvedProfile, {
+        selector: anchorSelector,
+        filterMode,
+      });
+      if (anchor?.center?.x && anchor?.center?.y) {
+        await callAPI('mouse:move', {
+          profileId: resolvedProfile,
+          x: Math.max(1, Math.round(Number(anchor.center.x) || 1)),
+          y: Math.max(1, Math.round(Number(anchor.center.y) || 1)),
+          steps: 2,
+        });
+      }
       const result = await callAPI('mouse:wheel', { profileId: resolvedProfile, deltaX, deltaY });
       return {
         ok: true,
         code: 'OPERATION_DONE',
         message: 'scroll done',
-        data: { direction, amount, deltaX, deltaY, result },
+        data: {
+          direction,
+          amount,
+          deltaX,
+          deltaY,
+          filterMode,
+          anchorSource: String(anchor?.source || 'document'),
+          modalLocked: anchor?.modalLocked === true,
+          result,
+        },
       };
     }
 
     if (action === 'press_key') {
       const key = String(params.key || params.value || '').trim();
       if (!key) return asErrorPayload('OPERATION_FAILED', 'press_key requires params.key');
-      const result = await callAPI('evaluate', {
+      const delay = Number(params.delay);
+      const result = await callAPI('keyboard:press', {
         profileId: resolvedProfile,
-        script: `(async () => {
-          const target = document.activeElement || document.body || document.documentElement;
-          const key = ${JSON.stringify(key)};
-          const code = key.length === 1 ? 'Key' + key.toUpperCase() : key;
-          const opts = { key, code, bubbles: true, cancelable: true };
-          target.dispatchEvent(new KeyboardEvent('keydown', opts));
-          target.dispatchEvent(new KeyboardEvent('keypress', opts));
-          target.dispatchEvent(new KeyboardEvent('keyup', opts));
-          if (key === 'Escape') {
-            const closeButton = document.querySelector('.note-detail-mask .close-box, .note-detail-mask .close-circle');
-            if (closeButton instanceof HTMLElement) closeButton.click();
-          }
-          if (key === 'Enter' && target instanceof HTMLInputElement && target.form) {
-            if (typeof target.form.requestSubmit === 'function') target.form.requestSubmit();
-            else target.form.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }));
-          }
-          return { key, targetTag: target?.tagName || null };
-        })()`,
+        key,
+        ...(Number.isFinite(delay) && delay >= 0 ? { delay } : {}),
       });
       return { ok: true, code: 'OPERATION_DONE', message: 'press_key done', data: result };
     }
@@ -320,6 +670,9 @@ export async function executeOperation({ profileId, operation, context = {} }) {
     }
 
     if (action === 'evaluate') {
+      if (!isJsExecutionEnabled()) {
+        return asErrorPayload('JS_DISABLED', 'evaluate is disabled by default. Re-run camo command with --js.');
+      }
       const script = String(params.script || '').trim();
       if (!script) return asErrorPayload('OPERATION_FAILED', 'evaluate requires params.script');
       const result = await callAPI('evaluate', { profileId: resolvedProfile, script });
@@ -327,11 +680,12 @@ export async function executeOperation({ profileId, operation, context = {} }) {
     }
 
     if (action === 'click' || action === 'type' || action === 'scroll_into_view') {
-      return executeSelectorOperation({
+      return await executeSelectorOperation({
         profileId: resolvedProfile,
         action,
         operation,
         params,
+        filterMode,
       });
     }
 

package/src/container/runtime-core/subscription.mjs

@@ -1,17 +1,36 @@
 import { getDomSnapshotByProfile } from '../../utils/browser-service.mjs';
 import { ChangeNotifier } from '../change-notifier.mjs';
-import { ensureActiveSession, normalizeArray } from './utils.mjs';
+import { ensureActiveSession, getCurrentUrl, normalizeArray } from './utils.mjs';
+
+function resolveFilterMode(input) {
+  const text = String(input || process.env.CAMO_FILTER_MODE || 'strict').trim().toLowerCase();
+  if (!text) return 'strict';
+  if (text === 'legacy') return 'legacy';
+  return 'strict';
+}
+
+function urlMatchesFilter(url, item) {
+  const href = String(url || '').trim();
+  const includes = normalizeArray(item?.pageUrlIncludes).map((token) => String(token || '').trim()).filter(Boolean);
+  const excludes = normalizeArray(item?.pageUrlExcludes).map((token) => String(token || '').trim()).filter(Boolean);
+  if (includes.length > 0 && !includes.every((token) => href.includes(token))) return false;
+  if (excludes.length > 0 && excludes.some((token) => href.includes(token))) return false;
+  return true;
+}
 
 export async function watchSubscriptions({
   profileId,
   subscriptions,
   throttle = 500,
+  filterMode = 'strict',
   onEvent = () => {},
   onError = () => {},
 }) {
   const session = await ensureActiveSession(profileId);
   const resolvedProfile = session.profileId || profileId;
   const notifier = new ChangeNotifier();
+  const effectiveFilterMode = resolveFilterMode(filterMode);
+  const strictFilter = effectiveFilterMode === 'strict';
   const items = normalizeArray(subscriptions)
     .map((item, index) => {
       if (!item || typeof item !== 'object') return null;
@@ -19,7 +38,16 @@ export async function watchSubscriptions({
       const selector = String(item.selector || '').trim();
       if (!selector) return null;
       const events = normalizeArray(item.events).map((name) => String(name).trim()).filter(Boolean);
-      return { id, selector, events: events.length > 0 ? new Set(events) : null };
+      const pageUrlIncludes = normalizeArray(item.pageUrlIncludes).map((token) => String(token || '').trim()).filter(Boolean);
+      const pageUrlExcludes = normalizeArray(item.pageUrlExcludes).map((token) => String(token || '').trim()).filter(Boolean);
+      return {
+        id,
+        selector,
+        visible: strictFilter ? true : (item.visible !== false),
+        pageUrlIncludes,
+        pageUrlExcludes,
+        events: events.length > 0 ? new Set(events) : null,
+      };
     })
     .filter(Boolean);
 
@@ -39,10 +67,14 @@ export async function watchSubscriptions({
     if (stopped) return;
     try {
       const snapshot = await getDomSnapshotByProfile(resolvedProfile);
+      const currentUrl = await getCurrentUrl(resolvedProfile).catch(() => '');
       const ts = new Date().toISOString();
       for (const item of items) {
         const prev = state.get(item.id) || { exists: false, stateSig: '', appearCount: 0 };
-        const elements = notifier.findElements(snapshot, { css: item.selector });
+        const urlMatched = urlMatchesFilter(currentUrl, item);
+        const elements = urlMatched
+          ? notifier.findElements(snapshot, { css: item.selector, visible: item.visible })
+          : [];
         const exists = elements.length > 0;
         const stateSig = elements.map((node) => node.path).sort().join(',');
         const changed = stateSig !== prev.stateSig;
@@ -55,16 +87,56 @@ export async function watchSubscriptions({
 
         const shouldEmit = (type) => !item.events || item.events.has(type);
         if (exists && !prev.exists && shouldEmit('appear')) {
-          await emit({ type: 'appear', profileId: resolvedProfile, subscriptionId: item.id, selector: item.selector, count: elements.length, elements, timestamp: ts });
+          await emit({
+            type: 'appear',
+            profileId: resolvedProfile,
+            subscriptionId: item.id,
+            selector: item.selector,
+            count: elements.length,
+            elements,
+            pageUrl: currentUrl,
+            filterMode: effectiveFilterMode,
+            timestamp: ts,
+          });
         }
         if (!exists && prev.exists && shouldEmit('disappear')) {
-          await emit({ type: 'disappear', profileId: resolvedProfile, subscriptionId: item.id, selector: item.selector, count: 0, elements: [], timestamp: ts });
+          await emit({
+            type: 'disappear',
+            profileId: resolvedProfile,
+            subscriptionId: item.id,
+            selector: item.selector,
+            count: 0,
+            elements: [],
+            pageUrl: currentUrl,
+            filterMode: effectiveFilterMode,
+            timestamp: ts,
+          });
         }
         if (exists && shouldEmit('exist')) {
-          await emit({ type: 'exist', profileId: resolvedProfile, subscriptionId: item.id, selector: item.selector, count: elements.length, elements, timestamp: ts });
+          await emit({
+            type: 'exist',
+            profileId: resolvedProfile,
+            subscriptionId: item.id,
+            selector: item.selector,
+            count: elements.length,
+            elements,
+            pageUrl: currentUrl,
+            filterMode: effectiveFilterMode,
+            timestamp: ts,
+          });
         }
         if (changed && shouldEmit('change')) {
-          await emit({ type: 'change', profileId: resolvedProfile, subscriptionId: item.id, selector: item.selector, count: elements.length, elements, timestamp: ts });
+          await emit({
+            type: 'change',
+            profileId: resolvedProfile,
+            subscriptionId: item.id,
+            selector: item.selector,
+            count: elements.length,
+            elements,
+            pageUrl: currentUrl,
+            filterMode: effectiveFilterMode,
+            timestamp: ts,
+          });
         }
       }
       await emit({ type: 'tick', profileId: resolvedProfile, timestamp: ts });

package/src/utils/browser-service.mjs

@@ -9,6 +9,31 @@ import { BROWSER_SERVICE_URL, loadConfig, setRepoRoot } from './config.mjs';
 import { touchSessionActivity } from '../lifecycle/session-registry.mjs';
 
 const require = createRequire(import.meta.url);
+const DEFAULT_API_TIMEOUT_MS = 30000;
+
+function resolveApiTimeoutMs(options = {}) {
+  const optionValue = Number(options?.timeoutMs);
+  if (Number.isFinite(optionValue) && optionValue > 0) {
+    return Math.max(1000, Math.floor(optionValue));
+  }
+  const envValue = Number(process.env.CAMO_API_TIMEOUT_MS);
+  if (Number.isFinite(envValue) && envValue > 0) {
+    return Math.max(1000, Math.floor(envValue));
+  }
+  return DEFAULT_API_TIMEOUT_MS;
+}
+
+function isTimeoutError(error) {
+  const name = String(error?.name || '').toLowerCase();
+  const message = String(error?.message || '').toLowerCase();
+  return (
+    name.includes('timeout')
+    || name.includes('abort')
+    || message.includes('timeout')
+    || message.includes('timed out')
+    || message.includes('aborted')
+  );
+}
 
 function shouldTrackSessionActivity(action, payload) {
   const profileId = String(payload?.profileId || '').trim();
@@ -17,12 +42,22 @@ function shouldTrackSessionActivity(action, payload) {
   return true;
 }
 
-export async function callAPI(action, payload = {}) {
-  const r = await fetch(`${BROWSER_SERVICE_URL}/command`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ action, args: payload }),
-  });
+export async function callAPI(action, payload = {}, options = {}) {
+  const timeoutMs = resolveApiTimeoutMs(options);
+  let r;
+  try {
+    r = await fetch(`${BROWSER_SERVICE_URL}/command`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ action, args: payload }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (error) {
+    if (isTimeoutError(error)) {
+      throw new Error(`browser-service timeout after ${timeoutMs}ms: ${action}`);
+    }
+    throw error;
+  }
 
   let body;
   try {

package/src/utils/js-policy.mjs

@@ -0,0 +1,13 @@
+function isTruthy(value) {
+  const text = String(value || '').trim().toLowerCase();
+  return ['1', 'true', 'yes', 'on'].includes(text);
+}
+
+export function isJsExecutionEnabled() {
+  return isTruthy(process.env.CAMO_ALLOW_JS);
+}
+
+export function ensureJsExecutionEnabled(scope = 'JavaScript execution') {
+  if (isJsExecutionEnabled()) return;
+  throw new Error(`${scope} is disabled by default. Re-run with --js to enable.`);
+}