browsentic 0.4.12 → 0.4.14

package/dist/cli.js

@@ -2276,7 +2276,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes3, createHash: createHash3 } = __require("crypto");
+    var { randomBytes: randomBytes4, createHash: createHash3 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -2814,7 +2814,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes3(16).toString("base64");
+      const key = randomBytes4(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -6658,7 +6658,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve.call(this, root, ref);
+      let _sch = resolve3.call(this, root, ref);
       if (_sch === void 0) {
         const schema = (_a3 = root.localRefs) === null || _a3 === void 0 ? void 0 : _a3[ref];
         const { schemaId } = this.opts;
@@ -6685,7 +6685,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve(root, ref) {
+    function resolve3(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -7316,55 +7316,55 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve(baseURI, relativeURI, options) {
+    function resolve3(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
-    function resolveComponent(base, relative2, options, skipNormalization) {
+    function resolveComponent(base, relative3, options, skipNormalization) {
       const target = {};
       if (!skipNormalization) {
         base = parse3(serialize(base, options), options);
-        relative2 = parse3(serialize(relative2, options), options);
+        relative3 = parse3(serialize(relative3, options), options);
       }
       options = options || {};
-      if (!options.tolerant && relative2.scheme) {
-        target.scheme = relative2.scheme;
-        target.userinfo = relative2.userinfo;
-        target.host = relative2.host;
-        target.port = relative2.port;
-        target.path = removeDotSegments(relative2.path || "");
-        target.query = relative2.query;
+      if (!options.tolerant && relative3.scheme) {
+        target.scheme = relative3.scheme;
+        target.userinfo = relative3.userinfo;
+        target.host = relative3.host;
+        target.port = relative3.port;
+        target.path = removeDotSegments(relative3.path || "");
+        target.query = relative3.query;
       } else {
-        if (relative2.userinfo !== void 0 || relative2.host !== void 0 || relative2.port !== void 0) {
-          target.userinfo = relative2.userinfo;
-          target.host = relative2.host;
-          target.port = relative2.port;
-          target.path = removeDotSegments(relative2.path || "");
-          target.query = relative2.query;
+        if (relative3.userinfo !== void 0 || relative3.host !== void 0 || relative3.port !== void 0) {
+          target.userinfo = relative3.userinfo;
+          target.host = relative3.host;
+          target.port = relative3.port;
+          target.path = removeDotSegments(relative3.path || "");
+          target.query = relative3.query;
         } else {
-          if (!relative2.path) {
+          if (!relative3.path) {
             target.path = base.path;
-            if (relative2.query !== void 0) {
-              target.query = relative2.query;
+            if (relative3.query !== void 0) {
+              target.query = relative3.query;
             } else {
               target.query = base.query;
             }
           } else {
-            if (relative2.path[0] === "/") {
-              target.path = removeDotSegments(relative2.path);
+            if (relative3.path[0] === "/") {
+              target.path = removeDotSegments(relative3.path);
             } else {
               if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) {
-                target.path = "/" + relative2.path;
+                target.path = "/" + relative3.path;
               } else if (!base.path) {
-                target.path = relative2.path;
+                target.path = relative3.path;
               } else {
-                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative2.path;
+                target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative3.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative2.query;
+            target.query = relative3.query;
           }
           target.userinfo = base.userinfo;
           target.host = base.host;
@@ -7372,7 +7372,7 @@ var require_fast_uri = __commonJS({
         }
         target.scheme = base.scheme;
       }
-      target.fragment = relative2.fragment;
+      target.fragment = relative3.fragment;
       return target;
     }
     function equal(uriA, uriB, options) {
@@ -7580,7 +7580,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve,
+      resolve: resolve3,
       resolveComponent,
       equal,
       serialize,
@@ -10570,7 +10570,8 @@ var require_dist = __commonJS({
 });
 
 // cli.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
+import { createInterface } from "readline/promises";
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process3 from "process";
@@ -26686,12 +26687,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve) => {
+    return new Promise((resolve3) => {
       const json2 = serializeMessage(message);
       if (this._stdout.write(json2)) {
-        resolve();
+        resolve3();
       } else {
-        this._stdout.once("drain", resolve);
+        this._stdout.once("drain", resolve3);
       }
     });
   }
@@ -27680,7 +27681,7 @@ function hoverSequence(el, at) {
 
 // ../lib/actions/page/drag-element.ts
 var FRAME_MS = 16;
-var settle = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var settle = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 function mouseInit(at, buttons) {
   return {
     clientX: at.x,
@@ -28392,8 +28393,8 @@ function renderDiagram(regions) {
   const walk2 = (nodes, indent) => {
     nodes.forEach((region, i) => {
       const last = i === nodes.length - 1;
-      const { bounds, contains } = region;
-      const counts = ["links", "buttons", "fields"].filter((kind) => contains[kind] > 0).map((kind) => ` \xB7 ${contains[kind]} ${kind}`).join("");
+      const { bounds, contains: contains2 } = region;
+      const counts = ["links", "buttons", "fields"].filter((kind) => contains2[kind] > 0).map((kind) => ` \xB7 ${contains2[kind]} ${kind}`).join("");
       lines.push(
         `${indent}${last ? "\u2514" : "\u251C"} ${regionName(region)} \xB7 ${bounds.width}\xD7${bounds.height} @ (${bounds.x},${bounds.y})${counts}`
       );
@@ -28698,7 +28699,7 @@ function pickWithLens({ hint, timeoutMs }) {
   const box = root.querySelector(".box");
   const chip = root.querySelector(".chip");
   let hovered = null;
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     const dismiss = () => settle2({ cancelled: true });
     dismissCurrent = dismiss;
     const timer = setTimeout(() => settle2({ timedOut: true }), timeoutMs);
@@ -28766,7 +28767,7 @@ function pickWithLens({ hint, timeoutMs }) {
       host.remove();
       cursor.remove();
       if (dismissCurrent === dismiss) dismissCurrent = null;
-      resolve(outcome);
+      resolve3(outcome);
     }
   });
 }
@@ -29201,12 +29202,12 @@ function callToolkit(fn, args, timeoutMs) {
     throw new ActionError("No toolkit is installed in this page.", TOOLKIT_MISSING);
   }
   const callId = crypto.randomUUID();
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve3, reject) => {
     const onResult = (event) => {
       const reply = parseReply(event.detail);
       if (reply?.id !== callId) return;
       stop2();
-      if (reply.ok) resolve(reply.value ?? null);
+      if (reply.ok) resolve3(reply.value ?? null);
       else reject(new ActionError(reply.error ?? "The function threw.", CODE_ERROR));
     };
     const timer = setTimeout(() => {
@@ -29330,11 +29331,11 @@ var scrollTo = defineAction({
   }
 });
 function scrollSettled() {
-  return new Promise((resolve) => {
+  return new Promise((resolve3) => {
     const done = () => {
       window.removeEventListener("scrollend", done);
       clearTimeout(timer);
-      resolve();
+      resolve3();
     };
     const timer = setTimeout(done, 1e3);
     window.addEventListener("scrollend", done);
@@ -29748,7 +29749,7 @@ var LINGER_AFTER = {
 var MAX_DURATION_MS = 12e4;
 var keyDelays = (text3, base) => [...text3].map((char) => base * (LINGER_AFTER[char] ?? 1));
 var budgetFor = (delays, jitter) => Math.round(delays.reduce((total, ms) => total + ms, 0) * (1 + jitter));
-var pause = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var pause = (ms) => new Promise((resolve3) => setTimeout(resolve3, ms));
 var typeText = defineAction({
   name: "page.typeText",
   description: "Stream text into a field one keystroke at a time, at a human pace \u2014 a real key event per character, pauses that vary, and longer breaths after punctuation. Use page.fillInput when you just need the value in the field; use this when the page should watch someone type.",
@@ -29898,12 +29899,12 @@ var waitForElement = defineAction({
     if (satisfied(element)) {
       return { state, elapsedMs: 0, element: element ? describeElement(element) : void 0 };
     }
-    await new Promise((resolve, reject) => {
+    await new Promise((resolve3, reject) => {
       const check2 = () => {
         element = find();
         if (satisfied(element)) {
           cleanup();
-          resolve();
+          resolve3();
         }
       };
       const observer = new MutationObserver(check2);
@@ -30078,7 +30079,7 @@ function assertToolNamesRoundTrip(actionNames) {
 }
 
 // cli.ts
-import { basename as basename2, join as join15 } from "path";
+import { basename as basename3, join as join18 } from "path";
 
 // agent/agent-skills.ts
 import { createHash } from "crypto";
@@ -31033,6 +31034,10 @@ var failure = (code, message) => ({
   error: { code, message }
 });
 
+// guardrails/scope.ts
+var PROBES = ["https://one.probe.invalid/", "https://two.probe.invalid/"];
+var PROBE_HOSTS = PROBES.map((base) => new URL(base).hostname);
+
 // ../lib/recordings/events.ts
 var MAX_RECORDING_MS = 15 * 6e4;
 var WARN_AT_MS = 13 * 6e4;
@@ -31291,6 +31296,18 @@ var DEFAULT_RULES = [
     title: "Non-http navigation",
     reason: "Only http(s) URLs can be opened."
   },
+  {
+    // A URL is a destination or it is nothing, and this is the rule that makes that true.
+    // `//evil.com/x` used to arrive here as a null every url condition skipped, while the
+    // page it was typed on resolved it and left the site. Classifying fixed that spelling;
+    // refusing what still will not classify is what stops the next one, without anybody
+    // having to think of it first.
+    id: "unreadable-navigation",
+    when: "unreadableNavigation",
+    effect: "deny",
+    title: "URL with no readable destination",
+    reason: "That URL does not resolve to a destination Browsentic can check. Pass an absolute https:// URL."
+  },
   {
     id: "off-scope-navigation",
     when: "navigatesOffScope",
@@ -31655,6 +31672,38 @@ async function probeExisting() {
   }
   return null;
 }
+async function runningDaemons() {
+  const found = /* @__PURE__ */ new Map();
+  for (const port of DAEMON_PORTS) {
+    const pid = await healthyPid(port);
+    if (pid !== null && !found.has(pid)) found.set(pid, port);
+  }
+  return [...found].map(([pid, port]) => ({ pid, port }));
+}
+async function stopDaemons(graceMs = 5e3) {
+  const daemons = await runningDaemons();
+  for (const { pid } of daemons) kill(pid, "SIGTERM");
+  const remaining = await waitForExit(daemons, graceMs);
+  for (const { pid } of remaining) kill(pid, "SIGKILL");
+  const stubborn = await waitForExit(remaining, 2e3);
+  clearLockfile();
+  return { stopped: daemons.filter((daemon) => !stubborn.includes(daemon)), stubborn };
+}
+function kill(pid, signal) {
+  try {
+    process.kill(pid, signal);
+  } catch {
+  }
+}
+async function waitForExit(daemons, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  let alive = daemons.filter((daemon) => isRunning(daemon.pid));
+  while (alive.length && Date.now() < deadline) {
+    await delay(POLL_INTERVAL_MS);
+    alive = alive.filter((daemon) => isRunning(daemon.pid));
+  }
+  return alive;
+}
 async function healthyPid(port) {
   try {
     const response = await fetch(`http://127.0.0.1:${port}/health`, {
@@ -31668,7 +31717,7 @@ async function healthyPid(port) {
   }
 }
 function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 
 // install.ts
@@ -31781,6 +31830,71 @@ function install(dir, force = false) {
   return { dir, version: version2, source: packaged.source, files: sources.length, changed, alreadyCurrent: false };
 }
 
+// npx.ts
+import { existsSync as existsSync5, readFileSync as readFileSync9, readdirSync as readdirSync5, realpathSync } from "fs";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname6, join as join15, resolve, sep as sep2 } from "path";
+import { fileURLToPath as fileURLToPath5 } from "url";
+var packageRoot = resolve(dirname6(fileURLToPath5(import.meta.url)), "..");
+var inNpxCache = (path) => path.split(sep2).includes("_npx");
+function installKind() {
+  if (inNpxCache(packageRoot)) return "npx";
+  if (existsSync5(join15(packageRoot, "tsup.config.ts"))) return "repo";
+  return "global";
+}
+function real(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+    return path;
+  }
+}
+function cacheRoots() {
+  const roots = [
+    process.env.npm_config_cache,
+    process.platform === "win32" ? join15(process.env.LOCALAPPDATA ?? homedir7(), "npm-cache") : null,
+    join15(homedir7(), ".npm")
+  ].filter((root) => !!root);
+  return [...new Set(roots.map((root) => join15(root, "_npx")))];
+}
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync9(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function npxEntries() {
+  const own = inNpxCache(packageRoot) ? real(resolve(packageRoot, "..", "..")) : null;
+  const scanned = cacheRoots().flatMap((root) => {
+    try {
+      return readdirSync5(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => real(join15(root, entry.name)));
+    } catch {
+      return [];
+    }
+  });
+  const entries = /* @__PURE__ */ new Map();
+  for (const dir of [...scanned, ...own ? [own] : []]) {
+    if (entries.has(dir)) continue;
+    const manifest = readJson(join15(dir, "node_modules", "browsentic", "package.json"));
+    if (!manifest) continue;
+    const requested = readJson(join15(dir, "package.json"))?._npx;
+    entries.set(dir, {
+      dir,
+      version: typeof manifest.version === "string" ? manifest.version : null,
+      packages: Array.isArray(requested?.packages) ? requested.packages : [],
+      running: dir === own
+    });
+  }
+  return [...entries.values()];
+}
+function pinnedVersion() {
+  const own = npxEntries().find((entry) => entry.running);
+  const spec = own?.packages.find((name) => name === "browsentic" || name.startsWith("browsentic@"));
+  const requested = spec?.slice("browsentic@".length);
+  return requested && /^\d+\.\d+\.\d+/.test(requested) ? requested : null;
+}
+
 // remote-bridge.ts
 import { randomUUID as randomUUID5 } from "crypto";
 
@@ -31807,11 +31921,11 @@ var RemoteBridge = class _RemoteBridge {
   pending = /* @__PURE__ */ new Map();
   manifestListeners = /* @__PURE__ */ new Set();
   static connect(port, token, runId) {
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       const socket = new import_websocket.default(`ws://127.0.0.1:${port}/control`, {
         headers: { authorization: `Bearer ${token}` }
       });
-      socket.once("open", () => resolve(new _RemoteBridge(socket, runId)));
+      socket.once("open", () => resolve3(new _RemoteBridge(socket, runId)));
       socket.once("error", reject);
     });
   }
@@ -31858,14 +31972,14 @@ var RemoteBridge = class _RemoteBridge {
   }
   request(request, timeoutMs = REQUEST_TIMEOUT_MS) {
     if (this.socket.readyState !== import_websocket.default.OPEN) return Promise.resolve(null);
-    return new Promise((resolve) => {
+    return new Promise((resolve3) => {
       const timer = setTimeout(() => {
         this.pending.delete(request.id);
-        resolve(null);
+        resolve3(null);
       }, timeoutMs);
       this.pending.set(request.id, (message) => {
         clearTimeout(timer);
-        resolve(message);
+        resolve3(message);
       });
       this.socket.send(JSON.stringify(request));
     });
@@ -31896,6 +32010,83 @@ function invokeTimeoutFor(action, input2) {
   return REQUEST_TIMEOUT_MS;
 }
 
+// self-update.ts
+import { spawnSync } from "child_process";
+import { rmSync as rmSync5 } from "fs";
+var REGISTRY = process.env.BROWSENTIC_REGISTRY ?? "https://registry.npmjs.org";
+async function publishedVersion(timeoutMs = 4e3) {
+  try {
+    const response = await fetch(`${REGISTRY}/browsentic/latest`, {
+      headers: { accept: "application/vnd.npm.install-v1+json" },
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    if (!response.ok) return null;
+    const manifest = await response.json();
+    return typeof manifest.version === "string" ? manifest.version : null;
+  } catch {
+    return null;
+  }
+}
+function isNewer(candidate, current) {
+  const release = (version2) => version2.split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const [a, b] = [release(candidate), release(current)];
+  for (let i = 0; i < 3; i++) if ((a[i] ?? 0) !== (b[i] ?? 0)) return (a[i] ?? 0) > (b[i] ?? 0);
+  const [pre, currentPre] = [candidate.split("-")[1], current.split("-")[1]];
+  if (pre === currentPre) return false;
+  if (!pre) return true;
+  if (!currentPre) return false;
+  return pre > currentPre;
+}
+async function upgradeCli(current, forward) {
+  const pinned = pinnedVersion();
+  if (pinned) return null;
+  const latest = await publishedVersion();
+  if (!latest || !isNewer(latest, current)) return null;
+  const kind = installKind();
+  if (kind === "repo") {
+    console.error(`
+  ! browsentic ${latest} is published; this is ${current}, from a source checkout.`);
+    console.error(`    Update it with "git pull && yarn setup".
+`);
+    return null;
+  }
+  console.error(`
+  \u21BB Updating the command itself, ${current} \u2192 ${latest}
+`);
+  const rerun = [...forward, "--no-self-update"];
+  if (kind === "npx") {
+    for (const entry of npxEntries()) rmSync5(entry.dir, { recursive: true, force: true });
+    const code = run("npx", ["-y", `browsentic@${latest}`, ...rerun]);
+    if (code !== 0) {
+      console.error(`
+  That did not run, but nothing is broken: the cache is cleared, so a plain`);
+      console.error(`  \`npx browsentic ${forward[0] ?? "setup"}\` fetches ${latest} fresh next time.
+`);
+    }
+    return code;
+  }
+  const installed = run("npm", ["install", "-g", `browsentic@${latest}`]);
+  if (installed !== 0) {
+    console.error(`
+  Could not replace the global install. Run this yourself, then try again:
+`);
+    console.error(`      npm install -g browsentic@${latest}
+`);
+    return installed;
+  }
+  return run("browsentic", rerun);
+}
+function run(command2, args) {
+  const result = spawnSync(command2, args, { stdio: "inherit", shell: process.platform === "win32" });
+  if (result.error) {
+    console.error(`
+  Could not run \`${command2}\`: ${result.error.message}
+`);
+    return 1;
+  }
+  return result.status ?? 1;
+}
+
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
@@ -32488,7 +32679,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+        await new Promise((resolve3) => setTimeout(resolve3, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error51) {
@@ -32505,7 +32696,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       const earlyReject = (error51) => {
         reject(error51);
       };
@@ -32583,7 +32774,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve(parseResult.data);
+            resolve3(parseResult.data);
           }
         } catch (error51) {
           reject(error51);
@@ -32844,12 +33035,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve3, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve, interval);
+      const timeoutId = setTimeout(resolve3, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -33902,10 +34093,98 @@ function text2(uri, mimeType, body) {
   return { contents: [{ uri, mimeType, text: body }] };
 }
 
+// uninstall.ts
+import { existsSync as existsSync6, readdirSync as readdirSync6, rmSync as rmSync6 } from "fs";
+import { isAbsolute as isAbsolute4, join as join17, relative as relative2 } from "path";
+
+// screenshots.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { chmodSync as chmodSync5, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7 } from "fs";
+import { homedir as homedir8 } from "os";
+import { basename as basename2, isAbsolute as isAbsolute3, join as join16, resolve as resolve2, sep as sep3 } from "path";
+function screenshotDir() {
+  const configured = readAgentConfig().screenshotDir;
+  if (typeof configured === "string" && configured.trim()) return expandHome3(configured.trim());
+  return join16(homedir8(), "browsentic", "screenshot");
+}
+function expandHome3(p) {
+  if (p === "~") return homedir8();
+  if (p.startsWith("~/")) return join16(homedir8(), p.slice(2));
+  return isAbsolute3(p) ? p : join16(homedir8(), p);
+}
+
+// uninstall.ts
+function contains(root, path) {
+  const inside = relative2(root, path);
+  return !inside.startsWith("..") && !isAbsolute4(inside);
+}
+function planUninstall(options = {}) {
+  const config2 = readAgentConfig();
+  const extension2 = extensionDir(config2.extensionDir);
+  const roots = [stateDir, userDir];
+  const removals = [];
+  if (!roots.some((root) => contains(root, extension2)) && existsSync6(extension2)) {
+    removals.push({ label: "extension", path: extension2, holds: "the unpacked build Chrome loads" });
+  }
+  removals.push({
+    label: "state",
+    path: stateDir,
+    holds: "pairing keys, config, approvals, logs",
+    keep: options.keepSkills ? ["skills"] : void 0
+  });
+  removals.push({
+    label: "files",
+    path: userDir,
+    holds: "the extension, skills, site maps, screenshots, captured downloads",
+    keep: options.keepSkills ? ["skills"] : void 0
+  });
+  const elsewhere = [];
+  const outside = (label2, path, holds) => {
+    if (!roots.some((root) => contains(root, path)) && existsSync6(path)) elsewhere.push({ label: label2, path, holds });
+  };
+  outside("skills", uploadedSkillsDir(), "site maps and uploaded skills");
+  outside("screenshots", screenshotDir(), "captures taken with save: true");
+  outside("downloads", downloadDir(), "files captured from pages");
+  return {
+    removals: removals.filter((removal) => existsSync6(removal.path)),
+    elsewhere,
+    npx: npxEntries()
+  };
+}
+function removeAll(removals) {
+  return removals.map((removal) => {
+    try {
+      const kept = removal.keep?.length ? keepingSome(removal.path, removal.keep) : [];
+      if (!kept.length) rmSync6(removal.path, { recursive: true, force: true });
+      return { removal, removed: true, kept };
+    } catch (error51) {
+      return { removal, removed: false, kept: [], error: error51.message };
+    }
+  });
+}
+function keepingSome(dir, keep) {
+  const kept = [];
+  for (const entry of readdirSync6(dir)) {
+    if (keep.includes(entry)) kept.push(entry);
+    else rmSync6(join17(dir, entry), { recursive: true, force: true });
+  }
+  return kept;
+}
+function purgeNpxCache(entries) {
+  return entries.map((entry) => {
+    try {
+      rmSync6(entry.dir, { recursive: true, force: true });
+      return { entry, removed: true };
+    } catch (error51) {
+      return { entry, removed: false, error: error51.message };
+    }
+  });
+}
+
 // package.json
 var package_default = {
   name: "browsentic",
-  version: "0.4.12",
+  version: "0.4.14",
   description: "Hand your real, logged-in browser to the AI agent you already run. Installs the browser extension, runs the local daemon, and speaks MCP.",
   type: "module",
   license: "MIT",
@@ -33962,7 +34241,8 @@ var package_default = {
 var USAGE = `browsentic ${package_default.version} \u2014 hand your real browser to the agent you already run
 
   browsentic setup            install the extension, start the daemon, print a pairing code
-  browsentic update           refresh the installed extension and restart the daemon
+  browsentic update           pull the newest build \u2014 the command itself, then the extension
+  browsentic uninstall        stop the daemon and remove everything Browsentic wrote
   browsentic pair             issue a one-time code to type into the extension
   browsentic status           daemon, extension and agent state
   browsentic sessions         list paired browsers
@@ -33990,7 +34270,7 @@ For MCP clients
   browsentic mcp              serve MCP over stdio \u2014 what a client runs, not what you type
       claude mcp add browsentic -- browsentic mcp
 `;
-var invokedAs = basename2(process.argv[1] ?? "").replace(/\.(?:js|cjs|mjs|exe|cmd|ps1)$/i, "");
+var invokedAs = basename3(process.argv[1] ?? "").replace(/\.(?:js|cjs|mjs|exe|cmd|ps1)$/i, "");
 var servesBare = invokedAs === "browsentic-mcp" || !!process.env.BROWSENTIC_AGENT_RUN;
 var [command] = process.argv.slice(2);
 switch (command) {
@@ -34007,6 +34287,9 @@ switch (command) {
   case "update":
     await setup(["--no-pair", "--restart", ...process.argv.slice(3)]);
     break;
+  case "uninstall":
+    await uninstall(process.argv.slice(3));
+    break;
   case "pair":
     await pair();
     break;
@@ -34026,7 +34309,7 @@ switch (command) {
     await showStatus();
     break;
   case "stop":
-    stop();
+    await stop();
     break;
   case "restart":
     await restart();
@@ -34102,7 +34385,7 @@ function printSkills() {
     ].filter(Boolean);
     console.log(`${skill.name}  (${tags.join(" \xB7 ")})`);
     if (skill.description) console.log(`  ${skill.description}`);
-    if (skill.provenance === "generated") console.log(`  ${join15(uploadedSkillsDir(), skill.name)}/`);
+    if (skill.provenance === "generated") console.log(`  ${join18(uploadedSkillsDir(), skill.name)}/`);
   }
   console.log(`
 Read in order: ${skillDirNames().join(" \u2192 ")} (a later one shadows an earlier one by name)`);
@@ -34148,34 +34431,27 @@ async function showStatus() {
   );
   if (!status2.pairedBrowsers) console.log('\nRun "browsentic setup" to install the extension, or "browsentic pair" if it is already loaded.');
 }
-function stop() {
-  const lock = readLockfile();
-  if (!lock) return console.log("No daemon lockfile; nothing to stop.");
-  try {
-    process.kill(lock.pid, "SIGTERM");
-    console.log(`Stopped daemon (pid ${lock.pid}).`);
-  } catch {
-    console.log(`Daemon (pid ${lock.pid}) was not running; clearing the lockfile.`);
-    clearLockfile();
+async function stop() {
+  const { stopped, stubborn } = await stopDaemons();
+  for (const daemon of stopped) console.log(`Stopped daemon (pid ${daemon.pid}) on 127.0.0.1:${daemon.port}.`);
+  for (const daemon of stubborn) {
+    console.error(`Daemon (pid ${daemon.pid}) on 127.0.0.1:${daemon.port} would not exit \u2014 kill it by hand.`);
   }
+  if (!stopped.length && !stubborn.length) console.log("No daemon is answering; nothing to stop.");
+  if (stubborn.length) process.exitCode = 1;
 }
 async function restart() {
-  const lock = readLockfile();
-  stop();
-  const deadline = Date.now() + 5e3;
-  while (lock && isRunning(lock.pid)) {
-    if (Date.now() > deadline) {
-      console.error(`Daemon (pid ${lock.pid}) is still exiting \u2014 try again in a moment.`);
-      process.exit(1);
-    }
-    await new Promise((resolve) => setTimeout(resolve, 150));
+  const { stubborn } = await stopDaemons();
+  if (stubborn.length) {
+    console.error(`Daemon (pid ${stubborn[0].pid}) is still exiting \u2014 try again in a moment.`);
+    process.exit(1);
   }
   const fresh = await ensureDaemon();
   console.log(`Daemon running on 127.0.0.1:${fresh.port} (pid ${fresh.pid}, v${fresh.daemonVersion}).`);
 }
 function showLogs() {
   try {
-    process.stdout.write(readFileSync9(logPath, "utf8"));
+    process.stdout.write(readFileSync10(logPath, "utf8"));
   } catch {
     console.log(`No log at ${logPath} yet.`);
   }
@@ -34206,6 +34482,10 @@ async function setup(argv) {
     const at = argv.indexOf(`--${name}`);
     return at === -1 ? void 0 : argv[at + 1];
   };
+  if (!flag("no-self-update")) {
+    const code2 = await upgradeCli(package_default.version, process.argv.slice(2));
+    if (code2 !== null) process.exit(code2);
+  }
   const browser = valueOf("browser") ?? "chrome";
   if (browser === "firefox") {
     console.log(`
@@ -34244,15 +34524,11 @@ async function setup(argv) {
   }
   if (flag("restart")) await restart();
   const lock = await ensureDaemon();
-  let code;
-  let alreadyPaired = false;
-  if (!flag("no-pair")) {
-    const bridge = await RemoteBridge.connect(lock.port, lock.token);
-    const sessions = await bridge.sessions();
-    alreadyPaired = sessions.some((session) => session.origin.startsWith("chrome-extension://"));
-    if (!alreadyPaired) code = (await bridge.pair()).code;
-    await bridge.close();
-  }
+  const bridge = await RemoteBridge.connect(lock.port, lock.token);
+  const sessions = await bridge.sessions();
+  const alreadyPaired = sessions.some((session) => session.origin.startsWith("chrome-extension://"));
+  const code = alreadyPaired || flag("no-pair") ? void 0 : (await bridge.pair()).code;
+  await bridge.close();
   if (json2) {
     console.log(
       JSON.stringify(
@@ -34292,11 +34568,91 @@ async function setup(argv) {
     console.log(`         ${groupCode(code)}
 `);
     console.log(`     Single use, expires in 10 minutes. Need another? "browsentic pair"
+`);
+  } else {
+    console.log(`  2. Run "browsentic pair" and paste the code into the Browsentic popup.
 `);
   }
   console.log(`  Then open the side panel and say what you want.
 `);
 }
+async function uninstall(argv) {
+  const flag = (name) => argv.includes(`--${name}`);
+  const plan = planUninstall({ keepSkills: flag("keep-skills") });
+  const daemons = await runningDaemons();
+  const kind = installKind();
+  console.log(`
+  Browsentic ${package_default.version} \u2014 uninstall
+`);
+  if (!daemons.length && !plan.removals.length && !plan.npx.length) {
+    console.log("  Nothing to remove; this machine is already clean.\n");
+    return;
+  }
+  console.log("  This removes:\n");
+  for (const daemon of daemons) console.log(`    daemon      127.0.0.1:${daemon.port}, pid ${daemon.pid}`);
+  for (const removal of plan.removals) {
+    console.log(`    ${removal.label.padEnd(11)} ${removal.path}`);
+    console.log(`                ${removal.holds}${removal.keep ? " \u2014 keeping skills/" : ""}`);
+  }
+  for (const entry of plan.npx) {
+    const running = entry.running ? ", the copy running right now" : "";
+    console.log(`    npx cache   ${entry.dir}`);
+    console.log(`                browsentic ${entry.version ?? "unknown"}${running}`);
+  }
+  if (plan.elsewhere.length) {
+    console.log("\n  Left alone \u2014 configuration put these outside the two roots:\n");
+    for (const dir of plan.elsewhere) console.log(`    ${dir.label.padEnd(11)} ${dir.path}  (${dir.holds})`);
+  }
+  console.log("\n  You will have to remove these yourself:\n");
+  console.log("    the Browsentic card at chrome://extensions. Do that first \u2014 remove the");
+  console.log("    directory while the card is loaded and the browser is left holding a");
+  console.log("    broken one. It is also what clears recordings and held secrets, which");
+  console.log("    live in extension storage rather than on disk.");
+  if (kind === "global") console.log("\n    the command itself:  npm rm -g browsentic");
+  if (kind === "repo") console.log("\n    the global link:     yarn daemon:unlink");
+  console.log("\n    the entry in your MCP client, e.g.  claude mcp remove browsentic");
+  if (flag("dry-run")) {
+    console.log("\n  --dry-run: nothing was removed.\n");
+    return;
+  }
+  if (!flag("yes") && !argv.includes("-y")) {
+    if (!process.stdin.isTTY) {
+      console.error("\n  Nothing was removed \u2014 this is not a terminal, so there is nobody to ask.");
+      console.error("  Re-run it with --yes.\n");
+      process.exit(1);
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await rl.question("\n  Remove all of it? [y/N] ");
+    rl.close();
+    if (!/^y(es)?$/i.test(answer.trim())) return console.log("\n  Nothing was removed.\n");
+  }
+  console.log();
+  const lock = await probeExisting();
+  if (lock) {
+    try {
+      const bridge = await RemoteBridge.connect(lock.port, lock.token);
+      const revoked = await bridge.revoke();
+      await bridge.close();
+      if (revoked) console.log(`  \u2713 Unpaired   ${revoked} browser${revoked === 1 ? "" : "s"}`);
+    } catch {
+      console.log("  \xB7 Unpair     skipped, the daemon did not answer");
+    }
+  }
+  const { stopped, stubborn } = await stopDaemons();
+  if (stopped.length) console.log(`  \u2713 Daemon     stopped (pid ${stopped.map((daemon) => daemon.pid).join(", ")})`);
+  for (const daemon of stubborn) console.log(`  \u2717 Daemon     pid ${daemon.pid} would not exit \u2014 kill it by hand`);
+  for (const outcome of removeAll(plan.removals)) {
+    if (!outcome.removed) console.log(`  \u2717 ${outcome.removal.path} \u2014 ${outcome.error}`);
+    else if (outcome.kept.length) console.log(`  \u2713 Emptied    ${outcome.removal.path} \u2014 kept ${outcome.kept.join(", ")}/`);
+    else console.log(`  \u2713 Removed    ${outcome.removal.path}`);
+  }
+  for (const purge of purgeNpxCache(plan.npx)) {
+    if (purge.removed) console.log(`  \u2713 Cleared    ${purge.entry.dir}`);
+    else console.log(`  \u2717 ${purge.entry.dir} \u2014 ${purge.error}`);
+  }
+  console.log("\n  Done. Remove the card at chrome://extensions if you have not.\n");
+  if (stubborn.length) process.exitCode = 1;
+}
 async function showSessions() {
   const bridge = await connect();
   const sessions = await bridge.sessions();