agent-browser-stealth 0.17.0-fork.2 → 0.24.0-fork.2

package/scripts/postinstall.js

@@ -2,80 +2,56 @@
 
 /**
  * Postinstall script for agent-browser
- *
+ * 
  * Downloads the platform-specific native binary if not present.
  * On global installs, patches npm's bin entry to use the native binary directly:
  * - Windows: Overwrites .cmd/.ps1 shims
  * - Mac/Linux: Replaces symlink to point to native binary
  */
 
-import {
-  existsSync,
-  mkdirSync,
-  chmodSync,
-  createWriteStream,
-  unlinkSync,
-  writeFileSync,
-  symlinkSync,
-  lstatSync,
-  readFileSync,
-} from 'fs';
+import { existsSync, mkdirSync, chmodSync, createWriteStream, unlinkSync, writeFileSync, symlinkSync, lstatSync } from 'fs';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
 import { platform, arch } from 'os';
 import { get } from 'https';
-import { execFileSync, execSync } from 'child_process';
+import { execSync } from 'child_process';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const projectRoot = join(__dirname, '..');
 const binDir = join(projectRoot, 'bin');
 
+// Detect if the system uses musl libc (e.g. Alpine Linux)
+function isMusl() {
+  if (platform() !== 'linux') return false;
+  try {
+    const result = execSync('ldd --version 2>&1 || true', { encoding: 'utf8' });
+    return result.toLowerCase().includes('musl');
+  } catch {
+    return existsSync('/lib/ld-musl-x86_64.so.1') || existsSync('/lib/ld-musl-aarch64.so.1');
+  }
+}
+
 // Platform detection
-const platformKey = `${platform()}-${arch()}`;
+const osKey = platform() === 'linux' && isMusl() ? 'linux-musl' : platform();
+const platformKey = `${osKey}-${arch()}`;
 const ext = platform() === 'win32' ? '.exe' : '';
 const binaryName = `agent-browser-${platformKey}${ext}`;
 const binaryPath = join(binDir, binaryName);
 
 // Package info
-const packageJson = JSON.parse(readFileSync(join(projectRoot, 'package.json'), 'utf8'));
+const packageJson = JSON.parse(
+  (await import('fs')).readFileSync(join(projectRoot, 'package.json'), 'utf8')
+);
 const version = packageJson.version;
-const packageName = packageJson.name;
-const binCommands = getBinCommands(packageJson);
 
 // GitHub release URL
-const GITHUB_REPO = getGitHubRepoFromPackage(packageJson);
+const GITHUB_REPO = 'vercel-labs/agent-browser';
 const DOWNLOAD_URL = `https://github.com/${GITHUB_REPO}/releases/download/v${version}/${binaryName}`;
 
-function getGitHubRepoFromPackage(pkg) {
-  const repo = pkg?.repository;
-  const repoUrl = typeof repo === 'string' ? repo : repo?.url;
-
-  if (typeof repoUrl === 'string') {
-    const match = repoUrl.match(/github\.com[:/]([^/]+\/[^/.]+)(?:\.git)?$/i);
-    if (match?.[1]) {
-      return match[1];
-    }
-  }
-
-  // Fallback for legacy package metadata
-  return 'vercel-labs/agent-browser';
-}
-
-function getBinCommands(pkg) {
-  const bin = pkg?.bin;
-  if (typeof bin === 'string') {
-    return [pkg.name.replace(/^@[^/]+\//, '')];
-  }
-  if (bin && typeof bin === 'object') {
-    return Object.keys(bin);
-  }
-  return ['agent-browser'];
-}
-
 async function downloadFile(url, dest) {
   return new Promise((resolve, reject) => {
     const file = createWriteStream(dest);
-
+    
     const request = (url) => {
       get(url, (response) => {
         // Handle redirects
@@ -83,12 +59,12 @@ async function downloadFile(url, dest) {
           request(response.headers.location);
           return;
         }
-
+        
         if (response.statusCode !== 200) {
           reject(new Error(`Failed to download: HTTP ${response.statusCode}`));
           return;
         }
-
+        
         response.pipe(file);
         file.on('finish', () => {
           file.close();
@@ -99,11 +75,36 @@ async function downloadFile(url, dest) {
         reject(err);
       });
     };
-
+    
     request(url);
   });
 }
 
+/**
+ * Detect which package manager ran this postinstall and write a marker file
+ * next to the binary so `agent-browser upgrade` can use the correct one
+ * without fragile path heuristics or slow subprocess probing.
+ *
+ * npm_config_user_agent is set by npm/pnpm/yarn/bun during lifecycle scripts,
+ * e.g. "pnpm/8.10.0 node/v20.10.0 linux x64"
+ */
+function writeInstallMethod() {
+  const ua = process.env.npm_config_user_agent || '';
+  let method = '';
+  if (ua.startsWith('pnpm/')) method = 'pnpm';
+  else if (ua.startsWith('yarn/')) method = 'yarn';
+  else if (ua.startsWith('bun/')) method = 'bun';
+  else if (ua.startsWith('npm/')) method = 'npm';
+
+  if (method) {
+    try {
+      writeFileSync(join(binDir, '.install-method'), method);
+    } catch {
+      // Non-critical — upgrade will fall back to heuristics
+    }
+  }
+}
+
 async function main() {
   // Check if binary already exists
   if (existsSync(binaryPath)) {
@@ -111,21 +112,15 @@ async function main() {
     if (platform() !== 'win32') {
       chmodSync(binaryPath, 0o755);
     }
-    const installedVersion = readBinaryVersion(binaryPath);
-    if (installedVersion.includes(version)) {
-      console.log(`✓ Native binary ready: ${binaryName}`);
+    console.log(`✓ Native binary ready: ${binaryName}`);
 
-      // On global installs, fix npm's bin entry to use native binary directly
-      await fixGlobalInstallBin();
+    writeInstallMethod();
 
-      showPlaywrightReminder();
-      return;
-    }
+    // On global installs, fix npm's bin entry to use native binary directly
+    await fixGlobalInstallBin();
 
-    console.log(
-      `⚠ Binary version mismatch detected: expected ${version}, got "${installedVersion || 'unknown'}"`
-    );
-    console.log(`  Re-downloading ${binaryName} from release assets...`);
+    showInstallReminder();
+    return;
   }
 
   // Ensure bin directory exists
@@ -144,72 +139,86 @@ async function main() {
       chmodSync(binaryPath, 0o755);
     }
 
-    const downloadedVersion = readBinaryVersion(binaryPath);
-    if (!downloadedVersion.includes(version)) {
-      throw new Error(
-        `downloaded binary version mismatch: expected ${version}, got "${downloadedVersion || 'unknown'}"`
-      );
-    }
-
     console.log(`✓ Downloaded native binary: ${binaryName}`);
   } catch (err) {
-    console.log(`⚠ Could not download native binary: ${err.message}`);
-    console.log(`  The CLI will use Node.js fallback (slightly slower startup)`);
+    console.log(`Could not download native binary: ${err.message}`);
     console.log('');
     console.log('To build the native binary locally:');
     console.log('  1. Install Rust: https://rustup.rs');
-    console.log('  2. Run: pnpm run build:native');
+    console.log('  2. Run: npm run build:native');
   }
 
+  writeInstallMethod();
+
   // On global installs, fix npm's bin entry to use native binary directly
   // This avoids the /bin/sh error on Windows and provides zero-overhead execution
   await fixGlobalInstallBin();
 
-  showPlaywrightReminder();
+  showInstallReminder();
 }
 
-function readBinaryVersion(path) {
-  try {
-    return execFileSync(path, ['--version'], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe'],
-    }).trim();
-  } catch {
-    return '';
+function findSystemChrome() {
+  const os = platform();
+  if (os === 'darwin') {
+    const candidates = [
+      '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+      '/Applications/Google Chrome Canary.app/Contents/MacOS/Google Chrome Canary',
+      '/Applications/Chromium.app/Contents/MacOS/Chromium',
+    ];
+    return candidates.find(p => existsSync(p)) || null;
+  }
+  if (os === 'linux') {
+    const names = ['google-chrome', 'google-chrome-stable', 'chromium-browser', 'chromium'];
+    for (const name of names) {
+      try {
+        const result = execSync(`which ${name} 2>/dev/null`, { encoding: 'utf8' }).trim();
+        if (result) return result;
+      } catch {}
+    }
+    return null;
   }
+  if (os === 'win32') {
+    const candidates = [
+      `${process.env.LOCALAPPDATA}\\Google\\Chrome\\Application\\chrome.exe`,
+      'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+      'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
+    ];
+    return candidates.find(p => p && existsSync(p)) || null;
+  }
+  return null;
 }
 
-function showPlaywrightReminder() {
+function showInstallReminder() {
+  const systemChrome = findSystemChrome();
+  if (systemChrome) {
+    console.log('');
+    console.log(`  ✓ System Chrome found: ${systemChrome}`);
+    console.log('    agent-browser will use it automatically.');
+    console.log('');
+    return;
+  }
+
+  console.log('');
+  console.log('  ⚠ No Chrome installation detected.');
+  console.log('  If you plan to use a local browser, run:');
+  console.log('');
+  console.log('    agent-browser install');
+  if (platform() === 'linux') {
+    console.log('');
+    console.log('  On Linux, include system dependencies with:');
+    console.log('');
+    console.log('    agent-browser install --with-deps');
+  }
+  console.log('');
+  console.log('  You can skip this if you use --cdp, --provider, --engine, or --executable-path.');
   console.log('');
-  console.log('╔═══════════════════════════════════════════════════════════════════════════╗');
-  console.log('║ To download browser binaries, run:                                        ║');
-  console.log('║                                                                           ║');
-  console.log('║     npx playwright install chromium                                       ║');
-  console.log('║                                                                           ║');
-  console.log('║ On Linux, include system dependencies with:                               ║');
-  console.log('║                                                                           ║');
-  console.log('║     npx playwright install --with-deps chromium                           ║');
-  console.log('║                                                                           ║');
-  console.log('╚═══════════════════════════════════════════════════════════════════════════╝');
 }
 
 /**
  * Fix npm's bin entry on global installs to use the native binary directly.
  * This provides zero-overhead CLI execution for global installs.
  */
-function isPnpmGlobalInstall() {
-  const ua = process.env.npm_config_user_agent || '';
-  return ua.includes('pnpm/');
-}
-
 async function fixGlobalInstallBin() {
-  // pnpm already manages global shims in its own bin dir.
-  // Rewriting links via `npm prefix -g` can create stale links in unrelated paths
-  // (e.g. /opt/homebrew/bin), which then shadow pnpm's up-to-date shims.
-  if (isPnpmGlobalInstall()) {
-    return;
-  }
-
   if (platform() === 'win32') {
     await fixWindowsShims();
   } else {
@@ -231,34 +240,27 @@ async function fixUnixSymlink() {
     return; // npm not available
   }
 
-  let optimized = false;
-  for (const commandName of binCommands) {
-    const symlinkPath = join(npmBinDir, commandName);
-
-    // Check if symlink exists (indicates global install)
-    try {
-      const stat = lstatSync(symlinkPath);
-      if (!stat.isSymbolicLink()) {
-        continue; // Not a symlink, don't touch it
-      }
-    } catch {
-      continue; // Symlink doesn't exist, not a global install
-    }
+  const symlinkPath = join(npmBinDir, 'agent-browser');
 
-    // Replace symlink to point directly to native binary
-    try {
-      unlinkSync(symlinkPath);
-      symlinkSync(binaryPath, symlinkPath);
-      optimized = true;
-    } catch (err) {
-      // Permission error or other issue - not critical, JS wrapper still works
-      console.log(`⚠ Could not optimize symlink (${commandName}): ${err.message}`);
-      console.log('  CLI will work via Node.js wrapper (slightly slower startup)');
+  // Check if symlink exists (indicates global install)
+  try {
+    const stat = lstatSync(symlinkPath);
+    if (!stat.isSymbolicLink()) {
+      return; // Not a symlink, don't touch it
     }
+  } catch {
+    return; // Symlink doesn't exist, not a global install
   }
 
-  if (optimized) {
+  // Replace symlink to point directly to native binary
+  try {
+    unlinkSync(symlinkPath);
+    symlinkSync(binaryPath, symlinkPath);
     console.log('✓ Optimized: symlink points to native binary (zero overhead)');
+  } catch (err) {
+    // Permission error or other issue - not critical, JS wrapper still works
+    console.log(`⚠ Could not optimize symlink: ${err.message}`);
+    console.log('  CLI will work via Node.js wrapper (slightly slower startup)');
   }
 }
 
@@ -275,55 +277,37 @@ async function fixWindowsShims() {
     return;
   }
 
-  // Path to native binary relative to npm prefix
-  const packagePath = packageName.replace(/\//g, '\\');
-  const relativeBinaryPath = `node_modules\\${packagePath}\\bin\\${binaryName}`;
-  const absoluteBinaryPath = join(npmBinDir, relativeBinaryPath);
+  const cmdShim = join(npmBinDir, 'agent-browser.cmd');
+  const ps1Shim = join(npmBinDir, 'agent-browser.ps1');
 
-  // npm may create shims after lifecycle scripts, and binary may be absent
-  // when running with JS fallback; skip rewriting in those cases.
-  if (!existsSync(absoluteBinaryPath)) {
+  // Shims may not exist yet during postinstall (npm creates them after
+  // lifecycle scripts). If missing, fall back: the JS wrapper at
+  // bin/agent-browser.js handles Windows correctly via child_process.spawn.
+  if (!existsSync(cmdShim)) {
     return;
   }
 
-  let optimized = false;
+  // Detect architecture so ARM64 Windows is handled correctly
+  const cpuArch = arch() === 'arm64' ? 'arm64' : 'x64';
+  const relativeBinaryPath = `node_modules\\agent-browser\\bin\\agent-browser-win32-${cpuArch}.exe`;
+  const absoluteBinaryPath = join(npmBinDir, relativeBinaryPath);
 
-  for (const commandName of binCommands) {
-    // The shims are in the npm prefix directory (not prefix/bin on Windows)
-    const cmdShim = join(npmBinDir, `${commandName}.cmd`);
-    const ps1Shim = join(npmBinDir, `${commandName}.ps1`);
+  // Only rewrite shims if the native binary actually exists
+  if (!existsSync(absoluteBinaryPath)) {
+    return;
+  }
 
-    // Only fix if shims exist (indicates global install)
-    if (!existsSync(cmdShim)) {
-      continue;
-    }
+  try {
+    const cmdContent = `@ECHO off\r\n"%~dp0${relativeBinaryPath}" %*\r\n`;
+    writeFileSync(cmdShim, cmdContent);
 
-    try {
-      // Overwrite .cmd shim
-      const cmdContent = `@ECHO off\r\n"%~dp0${relativeBinaryPath}" %*\r\n`;
-      writeFileSync(cmdShim, cmdContent);
-
-      // Overwrite .ps1 shim
-      const ps1Content = `#!/usr/bin/env pwsh
-$basedir = Split-Path $MyInvocation.MyCommand.Definition -Parent
-$exe = ""
-if ($PSVersionTable.PSVersion -lt "6.0" -or $IsWindows) {
-  $exe = ".exe"
-}
-& "$basedir/${relativeBinaryPath.replace(/\\/g, '/')}" $args
-exit $LASTEXITCODE
-`;
-      writeFileSync(ps1Shim, ps1Content);
-      optimized = true;
-    } catch (err) {
-      // Permission error or other issue - not critical, JS wrapper still works
-      console.log(`⚠ Could not optimize shims (${commandName}): ${err.message}`);
-      console.log('  CLI will work via Node.js wrapper (slightly slower startup)');
-    }
-  }
+    const ps1Content = `#!/usr/bin/env pwsh\r\n$basedir = Split-Path $MyInvocation.MyCommand.Definition -Parent\r\n& "$basedir\\${relativeBinaryPath}" $args\r\nexit $LASTEXITCODE\r\n`;
+    writeFileSync(ps1Shim, ps1Content);
 
-  if (optimized) {
     console.log('✓ Optimized: shims point to native binary (zero overhead)');
+  } catch (err) {
+    console.log(`⚠ Could not optimize shims: ${err.message}`);
+    console.log('  CLI will work via Node.js wrapper (slightly slower startup)');
   }
 }
 

package/scripts/windows-debug/provision.sh

@@ -0,0 +1,220 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+INSTANCE_FILE="$SCRIPT_DIR/.instance"
+NAME_PREFIX="agent-browser-debug"
+INSTANCE_TYPE="${INSTANCE_TYPE:-t3.xlarge}"
+
+if [[ -f "$INSTANCE_FILE" ]]; then
+  echo "Error: Instance already provisioned. See $INSTANCE_FILE"
+  echo "Run ./scripts/windows-debug/start.sh to start it, or delete .instance to re-provision."
+  exit 1
+fi
+
+REGION=$(aws configure get region 2>/dev/null || echo "")
+if [[ -z "$REGION" ]]; then
+  echo "Error: No AWS region configured. Run: aws configure set region us-east-1"
+  exit 1
+fi
+
+echo "Provisioning Windows debug instance in $REGION..."
+
+# --- IAM Role for SSM ---
+ROLE_NAME="${IAM_ROLE_NAME:-$NAME_PREFIX-ssm-role}"
+PROFILE_NAME="${INSTANCE_PROFILE_NAME:-$NAME_PREFIX-instance-profile}"
+
+if aws iam get-instance-profile --instance-profile-name "$PROFILE_NAME" &>/dev/null; then
+  echo "Instance profile $PROFILE_NAME already exists, reusing."
+else
+  echo "Instance profile $PROFILE_NAME not found. Creating IAM resources..."
+
+  if ! aws iam get-role --role-name "$ROLE_NAME" &>/dev/null; then
+    echo "Creating IAM role: $ROLE_NAME"
+    if ! aws iam create-role \
+      --role-name "$ROLE_NAME" \
+      --assume-role-policy-document '{
+        "Version": "2012-10-17",
+        "Statement": [{
+          "Effect": "Allow",
+          "Principal": {"Service": "ec2.amazonaws.com"},
+          "Action": "sts:AssumeRole"
+        }]
+      }' \
+      --no-cli-pager; then
+
+      echo ""
+      echo "Error: Failed to create IAM role (see error above)."
+      echo ""
+      echo "Ask an IAM admin to create the following, then re-run with:"
+      echo "  INSTANCE_PROFILE_NAME=<name> ./scripts/windows-debug/provision.sh"
+      echo ""
+      echo "What the admin needs to create:"
+      echo "  1. IAM Role: $ROLE_NAME"
+      echo "     - Trusted entity: EC2 (ec2.amazonaws.com)"
+      echo "     - Attached policy: AmazonSSMManagedInstanceCore"
+      echo "  2. Instance Profile: $PROFILE_NAME"
+      echo "     - With the above role added to it"
+      echo ""
+      echo "Or run these commands with an account that has iam:CreateRole permission:"
+      echo ""
+      echo "  aws iam create-role --role-name $ROLE_NAME \\"
+      echo "    --assume-role-policy-document '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ec2.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}'"
+      echo ""
+      echo "  aws iam attach-role-policy --role-name $ROLE_NAME \\"
+      echo "    --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+      echo ""
+      echo "  aws iam create-instance-profile --instance-profile-name $PROFILE_NAME"
+      echo ""
+      echo "  aws iam add-role-to-instance-profile \\"
+      echo "    --instance-profile-name $PROFILE_NAME --role-name $ROLE_NAME"
+      exit 1
+    fi
+
+    aws iam attach-role-policy \
+      --role-name "$ROLE_NAME" \
+      --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
+  else
+    echo "IAM role $ROLE_NAME already exists."
+  fi
+
+  echo "Creating instance profile: $PROFILE_NAME"
+  aws iam create-instance-profile --instance-profile-name "$PROFILE_NAME" --no-cli-pager
+  aws iam add-role-to-instance-profile \
+    --instance-profile-name "$PROFILE_NAME" \
+    --role-name "$ROLE_NAME"
+  echo "Waiting for instance profile propagation..."
+  sleep 10
+fi
+
+# --- Security Group (no inbound rules) ---
+VPC_ID=$(aws ec2 describe-vpcs --filters "Name=isDefault,Values=true" --query "Vpcs[0].VpcId" --output text)
+if [[ "$VPC_ID" == "None" || -z "$VPC_ID" ]]; then
+  echo "Error: No default VPC found. Create one with: aws ec2 create-default-vpc"
+  exit 1
+fi
+
+SG_NAME="$NAME_PREFIX-sg"
+SG_ID=$(aws ec2 describe-security-groups \
+  --filters "Name=group-name,Values=$SG_NAME" "Name=vpc-id,Values=$VPC_ID" \
+  --query "SecurityGroups[0].GroupId" --output text 2>/dev/null || echo "None")
+
+if [[ "$SG_ID" == "None" || -z "$SG_ID" ]]; then
+  echo "Creating security group: $SG_NAME"
+  SG_ID=$(aws ec2 create-security-group \
+    --group-name "$SG_NAME" \
+    --description "agent-browser Windows debug instance (SSM only, no inbound)" \
+    --vpc-id "$VPC_ID" \
+    --query "GroupId" --output text)
+
+  # Revoke default egress isn't needed; SSM requires outbound HTTPS.
+  # No inbound rules -- SSM uses outbound connections only.
+else
+  echo "Security group $SG_NAME ($SG_ID) already exists, reusing."
+fi
+
+# --- AMI (latest Windows Server 2022) ---
+AMI_ID=$(aws ssm get-parameter \
+  --name "/aws/service/ami-windows-latest/Windows_Server-2022-English-Full-Base" \
+  --query "Parameter.Value" --output text)
+echo "Using AMI: $AMI_ID (Windows Server 2022)"
+
+# --- UserData bootstrap script ---
+USERDATA_FILE=$(mktemp)
+trap "rm -f $USERDATA_FILE" EXIT
+
+cat > "$USERDATA_FILE" <<'PWSH'
+<powershell>
+$ErrorActionPreference = "Continue"
+$logFile = "C:\bootstrap.log"
+
+function Log($msg) {
+    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
+    "$ts  $msg" | Tee-Object -FilePath $logFile -Append
+}
+
+Log "--- Bootstrap starting ---"
+
+# Install Git
+Log "Installing Git..."
+$gitInstaller = "$env:TEMP\git-installer.exe"
+Invoke-WebRequest -Uri "https://github.com/git-for-windows/git/releases/download/v2.47.1.windows.2/Git-2.47.1.2-64-bit.exe" -OutFile $gitInstaller
+Start-Process -FilePath $gitInstaller -ArgumentList "/VERYSILENT /NORESTART /NOCANCEL /SP- /CLOSEAPPLICATIONS /RESTARTAPPLICATIONS /COMPONENTS=`"icons,ext\reg\shellhere,assoc,assoc_sh`"" -Wait
+$env:PATH = "C:\Program Files\Git\cmd;$env:PATH"
+[Environment]::SetEnvironmentVariable("PATH", "C:\Program Files\Git\cmd;$([Environment]::GetEnvironmentVariable('PATH', 'Machine'))", "Machine")
+Log "Git installed: $(git --version)"
+
+# Install Rust
+Log "Installing Rust..."
+$rustupInit = "$env:TEMP\rustup-init.exe"
+Invoke-WebRequest -Uri "https://win.rustup.rs/x86_64" -OutFile $rustupInit
+Start-Process -FilePath $rustupInit -ArgumentList "-y --default-toolchain stable" -Wait
+$env:PATH = "$env:USERPROFILE\.cargo\bin;$env:PATH"
+[Environment]::SetEnvironmentVariable("PATH", "$env:USERPROFILE\.cargo\bin;$([Environment]::GetEnvironmentVariable('PATH', 'Machine'))", "Machine")
+Log "Rust installed: $(rustc --version)"
+
+# Install MSVC build tools (required for Rust on Windows)
+Log "Installing Visual Studio Build Tools..."
+$vsInstaller = "$env:TEMP\vs_buildtools.exe"
+Invoke-WebRequest -Uri "https://aka.ms/vs/17/release/vs_buildtools.exe" -OutFile $vsInstaller
+Start-Process -FilePath $vsInstaller -ArgumentList "--quiet --wait --norestart --nocache --add Microsoft.VisualStudio.Workload.VCTools --includeRecommended" -Wait
+Log "Build tools installed."
+
+# Clone repo
+Log "Cloning agent-browser..."
+git clone https://github.com/vercel-labs/agent-browser.git C:\agent-browser
+Set-Location C:\agent-browser
+Log "Repo cloned."
+
+# Build CLI
+Log "Building agent-browser CLI..."
+cargo build --release --manifest-path cli\Cargo.toml
+Log "Build complete."
+
+# Install Chrome
+Log "Installing Chrome via agent-browser..."
+.\cli\target\release\agent-browser.exe install
+Log "Chrome installed."
+
+Log "--- Bootstrap complete ---"
+</powershell>
+PWSH
+
+# --- Launch instance ---
+echo "Launching $INSTANCE_TYPE instance..."
+INSTANCE_ID=$(aws ec2 run-instances \
+  --image-id "$AMI_ID" \
+  --instance-type "$INSTANCE_TYPE" \
+  --iam-instance-profile "Name=$PROFILE_NAME" \
+  --security-group-ids "$SG_ID" \
+  --user-data "file://$USERDATA_FILE" \
+  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":80,"VolumeType":"gp3"}}]' \
+  --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=$NAME_PREFIX}]" \
+  --metadata-options "HttpTokens=required" \
+  --query "Instances[0].InstanceId" --output text)
+
+echo "Instance launched: $INSTANCE_ID"
+
+# Save instance config
+cat > "$INSTANCE_FILE" <<EOF
+INSTANCE_ID=$INSTANCE_ID
+REGION=$REGION
+EOF
+
+echo "Waiting for instance to enter running state..."
+aws ec2 wait instance-running --instance-ids "$INSTANCE_ID"
+echo "Instance is running."
+
+echo ""
+echo "Instance $INSTANCE_ID is booting and bootstrapping (Rust, Git, Chrome)."
+echo "Bootstrap takes ~15-20 minutes on first boot."
+echo ""
+echo "Check bootstrap progress:"
+echo "  ./scripts/windows-debug/run.sh \"Get-Content C:\\bootstrap.log\""
+echo ""
+echo "Once ready, sync your branch and start debugging:"
+echo "  ./scripts/windows-debug/sync.sh"
+echo "  ./scripts/windows-debug/run.sh \"cd C:\\agent-browser && cargo test\""
+echo ""
+echo "Stop when done to save costs:"
+echo "  ./scripts/windows-debug/stop.sh"