autokap 1.6.1 → 1.6.3

package/dist/browser-pool.d.ts

@@ -19,6 +19,7 @@ declare class BrowserPool {
         lang?: string;
         colorScheme?: 'light' | 'dark';
         storageState?: BrowserStorageState;
+        extraHttpHeaders?: Record<string, string>;
     }): Promise<BrowserContext>;
     /**
      * Release a context back to the pool. Closes the context and unblocks

package/dist/browser-pool.js

@@ -67,12 +67,14 @@ class BrowserPool {
             await new Promise((resolve) => this.queue.push(resolve));
         }
         await this.ensureBrowser();
+        const extra = options?.extraHttpHeaders;
         const context = await this.browser.newContext({
             viewport,
             deviceScaleFactor: normalizeDeviceScaleFactor(deviceScaleFactor),
             locale: options?.lang ? options.lang : 'en-US',
             colorScheme: options?.colorScheme ?? 'light',
             storageState: options?.storageState,
+            ...(extra && Object.keys(extra).length > 0 ? { extraHTTPHeaders: extra } : {}),
         });
         this.activeContexts++;
         this.captureCount++;

package/dist/browser.js

@@ -911,6 +911,7 @@ export class Browser {
             lang: langToLocale(options.lang ?? 'en'),
             colorScheme: options.colorScheme ?? 'light',
             storageState: options.storageState,
+            extraHttpHeaders: options.extraHttpHeaders,
         });
         instance.page = await instance.context.newPage();
         instance.poolContext = true;
@@ -1030,6 +1031,9 @@ export class Browser {
             locale: langToLocale(options.lang ?? 'en'),
             colorScheme: options.colorScheme ?? 'light',
             storageState: options.storageState,
+            ...(options.extraHttpHeaders && Object.keys(options.extraHttpHeaders).length > 0
+                ? { extraHTTPHeaders: options.extraHttpHeaders }
+                : {}),
         };
         // Dedicated browser process for clip capture. Not pooled because clip
         // capture installs context-level init scripts (cursor overlay). Cloud Run
@@ -5368,7 +5372,13 @@ export class Browser {
     async setLanguage(lang) {
         const context = this.ensureContext();
         const page = this.ensurePage();
-        await context.setExtraHTTPHeaders({ 'Accept-Language': lang });
+        // `setExtraHTTPHeaders` REPLACES the header map — merge with the
+        // environment-level auth headers so a SET_LOCALE opcode doesn't strip
+        // them mid-run.
+        await context.setExtraHTTPHeaders({
+            ...(this.options.extraHttpHeaders ?? {}),
+            'Accept-Language': lang,
+        });
         await page.addInitScript((locale) => {
             Object.defineProperty(navigator, 'language', { get: () => locale, configurable: true });
             Object.defineProperty(navigator, 'languages', { get: () => [locale], configurable: true });
@@ -5485,12 +5495,14 @@ export class Browser {
         return this.context;
     }
     buildContextOptions() {
+        const extra = this.options.extraHttpHeaders;
         return {
             viewport: this.options.viewport,
             deviceScaleFactor: normalizeDeviceScaleFactor(this.options.deviceScaleFactor),
             locale: langToLocale(this.options.lang ?? 'en'),
             colorScheme: this.options.colorScheme ?? 'light',
             storageState: this.options.storageState,
+            ...(extra && Object.keys(extra).length > 0 ? { extraHTTPHeaders: extra } : {}),
         };
     }
 }

package/dist/cli-config.js

@@ -1,5 +1,18 @@
+// CLI-local config helpers.
+//
+// NOTE: this file currently duplicates the canonical implementation in
+// `@autokap/core/config`. The MCP server consumes the core package directly;
+// the bundled CLI binary still ships a self-contained copy because
+// `@autokap/core` is not yet published to npm. Once core@0.1.0 is on the
+// registry and the published CLI bumps to declare it as a runtime dep, this
+// file can become a thin re-export shim (just LOCAL_WS_URL + requireConfig).
+//
+// Hardening here must stay in lockstep with packages/core/src/config.ts:
+// atomic writes, scheme allowlist on URL inputs, env-var precedence, and
+// the "untrusted origin override" guard.
 import path from 'node:path';
 import os from 'node:os';
+import crypto from 'node:crypto';
 import fs from 'node:fs/promises';
 import { logger } from './logger.js';
 const DEFAULT_API_BASE_URL = 'https://autokap.app';
@@ -46,45 +59,76 @@ export async function readConfig() {
             wsUrl,
         };
     }
+    // Only swallow IO / parse failures. Origin-allowlist / schema errors must
+    // bubble up so the user sees what's wrong instead of "not authenticated".
+    let raw;
     try {
-        const raw = await fs.readFile(getConfigPath(), 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (!parsed.apiKey)
-            return null;
-        const envApiBaseUrl = normalizeUrl(process.env[API_BASE_URL_ENV_VAR]);
-        const envWsUrl = normalizeUrl(process.env[WS_URL_ENV_VAR]);
-        const storedApiBaseUrl = normalizeUrl(parsed.apiBaseUrl) ?? DEFAULT_API_BASE_URL;
-        const apiBaseUrl = envApiBaseUrl ?? storedApiBaseUrl;
-        const wsUrl = envWsUrl
-            ?? (envApiBaseUrl ? deriveWsUrl(apiBaseUrl) : normalizeUrl(parsed.wsUrl) ?? deriveWsUrl(apiBaseUrl));
-        assertAllowedApiOrigin(apiBaseUrl, storedApiBaseUrl, envApiBaseUrl ? API_BASE_URL_ENV_VAR : undefined);
-        if (envWsUrl) {
-            assertAllowedApiOrigin(wsUrl.replace(/^ws/, 'http'), deriveWsUrl(storedApiBaseUrl).replace(/^ws/, 'http'), WS_URL_ENV_VAR);
-        }
-        return {
-            apiKey: parsed.apiKey,
-            apiBaseUrl,
-            wsUrl,
-        };
+        raw = await fs.readFile(getConfigPath(), 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
     }
     catch {
         return null;
     }
+    if (!parsed || typeof parsed !== 'object')
+        return null;
+    const record = parsed;
+    if (typeof record.apiKey !== 'string' || record.apiKey.length === 0)
+        return null;
+    const storedApiBaseUrlRaw = typeof record.apiBaseUrl === 'string' ? record.apiBaseUrl : null;
+    const storedWsUrlRaw = typeof record.wsUrl === 'string' ? record.wsUrl : null;
+    const envApiBaseUrl = normalizeUrl(process.env[API_BASE_URL_ENV_VAR]);
+    const envWsUrl = normalizeUrl(process.env[WS_URL_ENV_VAR]);
+    const storedApiBaseUrl = normalizeUrl(storedApiBaseUrlRaw) ?? DEFAULT_API_BASE_URL;
+    const apiBaseUrl = envApiBaseUrl ?? storedApiBaseUrl;
+    const wsUrl = envWsUrl ??
+        (envApiBaseUrl
+            ? deriveWsUrl(apiBaseUrl)
+            : normalizeUrl(storedWsUrlRaw) ?? deriveWsUrl(apiBaseUrl));
+    assertAllowedApiOrigin(apiBaseUrl, storedApiBaseUrl, envApiBaseUrl ? API_BASE_URL_ENV_VAR : undefined);
+    if (envWsUrl) {
+        assertAllowedApiOrigin(wsUrl.replace(/^ws/, 'http'), deriveWsUrl(storedApiBaseUrl).replace(/^ws/, 'http'), WS_URL_ENV_VAR);
+    }
+    return {
+        apiKey: record.apiKey,
+        apiBaseUrl,
+        wsUrl,
+    };
 }
 export async function writeConfig(config) {
     const dir = getConfigDir();
     await fs.mkdir(dir, { recursive: true });
+    if (process.platform !== 'win32') {
+        try {
+            await fs.chmod(dir, 0o700);
+        }
+        catch {
+            // best-effort — the file's 0600 below is the real safety
+        }
+    }
     const configPath = getConfigPath();
     const normalizedConfig = {
         ...config,
         apiBaseUrl: normalizeUrl(config.apiBaseUrl) ?? DEFAULT_API_BASE_URL,
         wsUrl: normalizeUrl(config.wsUrl) ?? deriveWsUrl(config.apiBaseUrl),
     };
-    await fs.writeFile(configPath, JSON.stringify(normalizedConfig, null, 2), 'utf-8');
-    // Restrict file permissions on Unix (NTFS ignores POSIX modes)
-    if (process.platform !== 'win32') {
-        await fs.chmod(dir, 0o700);
-        await fs.chmod(configPath, 0o600);
+    // Atomic write — see packages/core/src/config.ts for the canonical impl.
+    const tmpPath = `${configPath}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+    try {
+        await fs.writeFile(tmpPath, JSON.stringify(normalizedConfig, null, 2), 'utf-8');
+        if (process.platform !== 'win32') {
+            await fs.chmod(tmpPath, 0o600);
+        }
+        await fs.rename(tmpPath, configPath);
+    }
+    catch (err) {
+        await fs.rm(tmpPath, { force: true }).catch(() => undefined);
+        throw err;
     }
 }
 export async function deleteConfig() {
@@ -105,7 +149,7 @@ export async function requireConfig() {
         process.exit(1);
     }
     if (!config) {
-        logger.error(`Not authenticated. Run \`npx autokap@latest init --cli-key <key>\` first, or set ${API_KEY_ENV_VAR} in CI.`);
+        logger.error(`Not authenticated. Authenticate via your IDE's MCP integration (autokap_authenticate) or run \`autokap login <key>\` for CI / Cloud Run. CI may also set ${API_KEY_ENV_VAR} directly.`);
         process.exit(1);
     }
     return config;

package/dist/cli-contract.d.ts

@@ -4,15 +4,29 @@ export interface CliPublicCommandDescriptor {
     summary: string;
     docsDescriptionKey?: string;
 }
-export declare const CLI_KEY_TERM = "CLI key";
+export declare const API_KEY_TERM = "API key";
+/**
+ * Back-compat alias for internal callers that still import `CLI_KEY_TERM`.
+ * Points at the same string as `API_KEY_TERM`.
+ */
+export declare const CLI_KEY_TERM = "API key";
+/** HTTP header sent by the bundled CLI binary on every request. */
 export declare const CLI_VERSION_HEADER = "x-autokap-cli-version";
 export declare const MIN_CLI_VERSION_FOR_SIGNED_PROGRAMS = "1.0.9";
 export declare const MIN_CLI_VERSION_FOR_DIRECT_ARTIFACT_UPLOADS = "1.5.0";
-export declare const CLI_DEFAULT_INSTALL_COMMAND = "npm install -g autokap";
-export declare const CLI_DEFAULT_INSTALLED_SETUP_COMMAND = "autokap init --cli-key <your-cli-key>";
-export declare const CLI_DEFAULT_SETUP_COMMAND = "npx autokap@latest init --cli-key <your-cli-key>";
-export declare const CLI_ADVANCED_SKILL_COMMAND = "autokap skill --agent <agent>";
+export declare const CLI_DEFAULT_INSTALL_COMMAND = "npx -y autokap@latest";
+export declare const CLI_DEFAULT_INSTALLED_SETUP_COMMAND = "autokap login <your-api-key>";
+export declare const CLI_DEFAULT_SETUP_COMMAND = "npx -y autokap@latest login <your-api-key>";
 export declare const CLI_FALLBACK_PROGRAM_COMMAND = "autokap run <preset-id> --program <file>";
+/** Bare MCP runner. Used by generic clients and as the npx command. */
+export declare const MCP_INSTALL_COMMAND = "npx -y @autokap/mcp";
+/** One-shot install command for Claude Code (CLI flag `claude mcp add`). */
+export declare const MCP_CLAUDE_CODE_COMMAND = "claude mcp add autokap -- npx -y @autokap/mcp";
+/**
+ * JSON snippet to merge into the IDE-specific MCP config file (Cursor, Codex,
+ * Windsurf, Cline...). Format follows the shared `mcpServers` schema.
+ */
+export declare const MCP_CONFIG_SNIPPET_JSON: string;
 export declare function buildCliRunCommand(presetId: string, options?: {
     local?: boolean;
     env?: string;
@@ -114,6 +128,12 @@ export interface ArtifactUploadMetadata {
     mimeType: string;
     captureType: "fullpage" | "element";
     captureUrl: string;
+    /**
+     * Document title captured from the page at screenshot time (Playwright's
+     * `page.title()`). Server uses it as the tab title in browser mockups; falls
+     * back to `parsed.hostname` when absent (older CLIs do not send it).
+     */
+    pageTitle?: string | null;
     lang: string;
     theme: "light" | "dark";
     deviceFrame?: string | null;

package/dist/cli-contract.js

@@ -1,12 +1,54 @@
-export const CLI_KEY_TERM = "CLI key";
+export const API_KEY_TERM = "API key";
+/**
+ * Back-compat alias for internal callers that still import `CLI_KEY_TERM`.
+ * Points at the same string as `API_KEY_TERM`.
+ */
+export const CLI_KEY_TERM = API_KEY_TERM;
+/** HTTP header sent by the bundled CLI binary on every request. */
 export const CLI_VERSION_HEADER = "x-autokap-cli-version";
 export const MIN_CLI_VERSION_FOR_SIGNED_PROGRAMS = "1.0.9";
 export const MIN_CLI_VERSION_FOR_DIRECT_ARTIFACT_UPLOADS = "1.5.0";
-export const CLI_DEFAULT_INSTALL_COMMAND = "npm install -g autokap";
-export const CLI_DEFAULT_INSTALLED_SETUP_COMMAND = "autokap init --cli-key <your-cli-key>";
-export const CLI_DEFAULT_SETUP_COMMAND = "npx autokap@latest init --cli-key <your-cli-key>";
-export const CLI_ADVANCED_SKILL_COMMAND = "autokap skill --agent <agent>";
+// MCP-first install. The bundled CLI binary ships only for CI / Cloud Run;
+// recommend `npx -y autokap@latest` over a global install to keep version
+// drift contained and avoid the npm supply-chain anxiety the migration was
+// designed to remove. The `CLI_DEFAULT_INSTALL_COMMAND` alias is retained for
+// legacy doc surfaces that still want a single shell snippet.
+export const CLI_DEFAULT_INSTALL_COMMAND = "npx -y autokap@latest";
+// `autokap init` was removed in v2. The setup command now uses the surviving
+// `autokap login` for the same purpose (store the API key in ~/.autokap/config.json).
+// MCP-first workflows should use `autokap_authenticate` from the IDE instead.
+export const CLI_DEFAULT_INSTALLED_SETUP_COMMAND = "autokap login <your-api-key>";
+export const CLI_DEFAULT_SETUP_COMMAND = "npx -y autokap@latest login <your-api-key>";
+// `autokap skill --agent` was removed in v2. The skill ships as the MCP resource
+// `autokap://skill/preset-spec` (or `autokap_get_skill` tool fallback). The
+// legacy `CLI_ADVANCED_SKILL_COMMAND` constant that pointed at the removed
+// command was dropped entirely — it had no consumers and any future doc page
+// surfacing it would mislead users into typing a non-existent command.
 export const CLI_FALLBACK_PROGRAM_COMMAND = "autokap run <preset-id> --program <file>";
+// ── MCP-first install contract ──────────────────────────────────────
+//
+// AutoKap is primarily exposed as a Model Context Protocol server via the
+// `@autokap/mcp` package. Every supported IDE installs the server by adding a
+// single stdio entry that runs `npx -y @autokap/mcp` — the constants below
+// are the canonical shell forms used across onboarding surfaces (wizard,
+// modal, banner, docs). For per-IDE payloads (config paths, snippets, notes),
+// use `getMcpInstallEntries()` from `web/lib/site-discovery.ts`.
+/** Bare MCP runner. Used by generic clients and as the npx command. */
+export const MCP_INSTALL_COMMAND = "npx -y @autokap/mcp";
+/** One-shot install command for Claude Code (CLI flag `claude mcp add`). */
+export const MCP_CLAUDE_CODE_COMMAND = "claude mcp add autokap -- npx -y @autokap/mcp";
+/**
+ * JSON snippet to merge into the IDE-specific MCP config file (Cursor, Codex,
+ * Windsurf, Cline...). Format follows the shared `mcpServers` schema.
+ */
+export const MCP_CONFIG_SNIPPET_JSON = JSON.stringify({
+    mcpServers: {
+        autokap: {
+            command: "npx",
+            args: ["-y", "@autokap/mcp"],
+        },
+    },
+}, null, 2);
 export function buildCliRunCommand(presetId, options = {}) {
     const flags = [
         options.local ? " --local" : "",
@@ -17,170 +59,32 @@ export function buildCliRunCommand(presetId, options = {}) {
     return `autokap run${flags} ${presetId}`;
 }
 export function buildCliInstalledSetupCommand(cliKey) {
-    return `autokap init --cli-key ${cliKey}`;
+    return `autokap login ${cliKey}`;
 }
 export const CLI_PUBLIC_COMMANDS = [
-    {
-        id: "init",
-        command: "autokap init",
-        summary: "Authenticate and install the AI skill in one step",
-        docsDescriptionKey: "cliCmdInit",
-    },
     {
         id: "login",
         command: "autokap login <key>",
-        summary: "Authenticate with your CLI key",
+        summary: "Authenticate with your API key (used by Cloud Run + CI; from the IDE, call autokap_authenticate via MCP instead)",
         docsDescriptionKey: "cliCmdLogin",
     },
-    {
-        id: "logout",
-        command: "autokap logout",
-        summary: "Remove stored credentials",
-        docsDescriptionKey: "cliCmdLogout",
-    },
-    {
-        id: "whoami",
-        command: "autokap whoami",
-        summary: "Show the account linked to the current CLI key",
-        docsDescriptionKey: "cliCmdWhoami",
-    },
-    {
-        id: "ping",
-        command: "autokap ping",
-        summary: "Verify CLI connection and confirm the stored key is still valid",
-        docsDescriptionKey: "cliCmdPing",
-    },
     {
         id: "run",
         command: "autokap run <preset-id> --env local",
-        summary: "Run a preset capture using local Playwright",
+        summary: "Run a preset capture using local Playwright (also spawned by autokap_start_capture from the MCP server)",
         docsDescriptionKey: "cliCmdRun",
     },
     {
         id: "auto-recapture",
         command: "autokap auto-recapture --project <project-id> --env local",
-        summary: "Run every preset enabled for Recapture Cloud in a project",
+        summary: "Run every preset enabled for Recapture Cloud in a project (the canonical surface for Cloud Run + CI; MCP exposes autokap_start_auto_recapture for end users)",
         docsDescriptionKey: "cliCmdAutoRecapture",
     },
     {
-        id: "run-headed",
-        command: "autokap run <preset-id> --headed",
-        summary: "Show the browser window for debugging",
-        docsDescriptionKey: "cliCmdHeaded",
-    },
-    {
-        id: "run-dry",
-        command: "autokap run <preset-id> --dry",
-        summary: "Dry run: execute the opcode program without capturing or uploading (0 credits charged)",
-        docsDescriptionKey: "cliCmdRunDry",
-    },
-    {
-        id: "project-list",
-        command: "autokap project list",
-        summary: "List accessible projects as JSON",
-        docsDescriptionKey: "cliCmdProjectList",
-    },
-    {
-        id: "project-get",
-        command: "autokap project get <project-id>",
-        summary: "Get a single project as JSON",
-        docsDescriptionKey: "cliCmdProjectGet",
-    },
-    {
-        id: "project-create",
-        command: "autokap project create --name <name> --url <url>",
-        summary: "Create a project and print its ID",
-        docsDescriptionKey: "cliCmdProjectCreate",
-    },
-    {
-        id: "preset-info",
-        command: "autokap preset info <preset-id>",
-        summary: "Get structured JSON with endpoints, variants, and URL parameters",
-        docsDescriptionKey: "cliCmdPresetInfo",
-    },
-    {
-        id: "capture-list",
-        command: "autokap capture list",
-        summary: "List captures as JSON",
-        docsDescriptionKey: "cliCmdCaptureList",
-    },
-    {
-        id: "usage",
-        command: "autokap usage",
-        summary: "Show the current billing-period usage as JSON",
-        docsDescriptionKey: "cliCmdUsage",
-    },
-    {
-        id: "endpoints-list",
-        command: "autokap endpoints list --preset <id>",
-        summary: "List dev link endpoints as JSON or table",
-        docsDescriptionKey: "cliCmdEndpointsList",
-    },
-    {
-        id: "endpoints-get",
-        command: "autokap endpoints get <endpoint-id>",
-        summary: "Get a single dev link endpoint as JSON",
-        docsDescriptionKey: "cliCmdEndpointsGet",
-    },
-    {
-        id: "endpoints-export",
-        command: "autokap endpoints export --preset <id>",
-        summary: "Export dev link endpoints as JSON or CSV",
-        docsDescriptionKey: "cliCmdEndpointsExport",
-    },
-    {
-        id: "auth-capture",
-        command: "autokap auth capture <project-id>",
-        summary: "Capture a browser session for a session account",
-        docsDescriptionKey: "cliCmdAuthCapture",
-    },
-    {
-        id: "auth-account-list",
-        command: "autokap auth account list <project-id>",
-        summary: "List project credential accounts as JSON",
-        docsDescriptionKey: "cliCmdAuthAccountList",
-    },
-    {
-        id: "auth-account-create",
-        command: "autokap auth account create <project-id> --name <name>",
-        summary: "Create a project credential account and print its ID",
-        docsDescriptionKey: "cliCmdAuthAccountCreate",
-    },
-    {
-        id: "auth-account-update",
-        command: "autokap auth account update <project-id> --account <name-or-id>",
-        summary: "Update a project credential account",
-        docsDescriptionKey: "cliCmdAuthAccountUpdate",
-    },
-    {
-        id: "auth-account-delete",
-        command: "autokap auth account delete <project-id> --account <name-or-id>",
-        summary: "Delete an unused project credential account",
-        docsDescriptionKey: "cliCmdAuthAccountDelete",
-    },
-    {
-        id: "auth-session-clear",
-        command: "autokap auth session clear <project-id> --account <name-or-id>",
-        summary: "Clear the stored browser session for a session account",
-        docsDescriptionKey: "cliCmdAuthSessionClear",
-    },
-    {
-        id: "proxy-register",
-        command: "autokap proxy register --project <id> --proxy-url <url>",
-        summary: "Register a user-side proxy for dev links",
-        docsDescriptionKey: "cliCmdProxyRegister",
-    },
-    {
-        id: "proxy-verify",
-        command: "autokap proxy verify --project <id>",
-        summary: "Verify the configured proxy for a project",
-        docsDescriptionKey: "cliCmdProxyVerify",
-    },
-    {
-        id: "skill",
-        command: "autokap skill",
-        summary: "Export the AI agent skill bundle",
-        docsDescriptionKey: "cliCmdSkill",
+        id: "doctor",
+        command: "autokap doctor",
+        summary: "Run environment diagnostics (Node version, config, API key validity, Chromium cache, ffmpeg)",
+        docsDescriptionKey: "cliCmdDoctor",
     },
     {
         id: "version",

package/dist/cli-doctor.d.ts

@@ -1,4 +1,4 @@
 export declare function runDoctor(opts: {
     fix: boolean;
-    agent?: string;
+    json?: boolean;
 }, currentVersion: string): Promise<void>;