browsertrack 0.2.1 → 0.2.3

package/dist/cli/index.js

@@ -2,8 +2,8 @@
 
 // packages/cli/src/index.ts
 import { Command } from "commander";
-import fs5 from "fs";
-import path6 from "path";
+import fs6 from "fs";
+import path7 from "path";
 
 // packages/daemon/src/config.ts
 import os from "os";
@@ -28,6 +28,218 @@ function getDaemonConfig(overrides = {}) {
 import Database from "better-sqlite3";
 import fs from "fs";
 import path2 from "path";
+
+// packages/core/src/fingerprint.ts
+function normalizeErrorMessage(message) {
+  if (!message) return "unknown_error";
+  return message.trim().replace(/0x[0-9a-fA-F]+/g, "0x<HEX>").replace(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/g, "<UUID>").replace(/\?[tv]=[\w.-]+/g, "").replace(/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z?/g, "<TIMESTAMP>").replace(/#\d+/g, "#<ID>").replace(/\s+/g, " ");
+}
+function normalizeSourceFile(filename) {
+  if (!filename) return "unknown_source";
+  let cleaned = filename.trim();
+  try {
+    if (cleaned.startsWith("http://") || cleaned.startsWith("https://")) {
+      const url = new URL(cleaned);
+      cleaned = url.pathname;
+    }
+  } catch {
+    cleaned = cleaned.replace(/^https?:\/\/[^/]+/, "");
+  }
+  cleaned = cleaned.split("?")[0].split("#")[0];
+  cleaned = cleaned.replace(/\\/g, "/");
+  return cleaned || "unknown_source";
+}
+function extractSourceFromStack(stack) {
+  if (!stack) return null;
+  const lines = stack.split("\n");
+  for (const line of lines) {
+    const match = line.match(/(?:at\s+(?:.*?\s+\()?)?(https?:\/\/[^\s)]+|file:\/\/[^\s)]+|\/[^\s)]+):(\d+):(\d+)\)?/);
+    if (match) {
+      return {
+        file: normalizeSourceFile(match[1]),
+        line: parseInt(match[2], 10),
+        column: parseInt(match[3], 10)
+      };
+    }
+  }
+  return null;
+}
+function djb2Hash(str) {
+  let hash = 5381;
+  for (let i = 0; i < str.length; i++) {
+    hash = hash * 33 ^ str.charCodeAt(i);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function computeFingerprint(input) {
+  const normType = (input.type || "Error").trim().toLowerCase();
+  const normMsg = normalizeErrorMessage(input.message);
+  let sourceFile = normalizeSourceFile(input.sourceFile);
+  let line = input.line || 0;
+  if ((sourceFile === "unknown_source" || line === 0) && input.stack) {
+    const extracted = extractSourceFromStack(input.stack);
+    if (extracted) {
+      sourceFile = extracted.file;
+      line = extracted.line;
+    }
+  }
+  const rawKey = `${normType}::${normMsg}::${sourceFile}::${line}`;
+  const hash = djb2Hash(rawKey);
+  return `fp_${hash}`;
+}
+
+// packages/core/src/redaction.ts
+import { redact as visulimaRedact, standardRules } from "@visulima/redact";
+var REDACTED_PLACEHOLDER = "[REDACTED]";
+var SENSITIVE_KEY_PATTERNS = [
+  /^authorization$/i,
+  /^cookie$/i,
+  /^set-cookie$/i,
+  /password/i,
+  /token/i,
+  /secret/i,
+  /api[-_]?key/i,
+  /access[-_]?token/i,
+  /refresh[-_]?token/i,
+  /credentials/i,
+  /private[-_]?key/i,
+  /ssn/i,
+  /credit[-_]?card/i,
+  /cvv/i
+];
+var SENSITIVE_QUERY_PARAMS = [
+  "token",
+  "auth",
+  "key",
+  "apikey",
+  "api_key",
+  "secret",
+  "password",
+  "access_token",
+  "refresh_token",
+  "code",
+  "signature"
+];
+var BROWSER_SECURITY_RULES = [
+  { deep: true, key: "password", replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "secret", replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "token", replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "authorization", replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "cookie", replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "set-cookie", replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "apikey", replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "api_key", replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "creditcard", pattern: /(?:\d[ -]*?){13,16}/, replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "cvv", replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "ssn", pattern: /\b\d{3}-\d{2}-\d{4}\b/, replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "awsid", pattern: /\bAKIA[0-9A-Z]{16}\b/, replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "awskey", pattern: /\b[0-9a-zA-Z/+]{40}\b/, replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "jwt", pattern: /\beyJ[0-9a-zA-Z_\-]*\.[0-9a-zA-Z_\-]*\.[0-9a-zA-Z_\-]*\b/, replacement: REDACTED_PLACEHOLDER },
+  { deep: true, key: "slack_token", pattern: /\bxox[baprs]-[0-9a-zA-Z]{10,48}\b/, replacement: REDACTED_PLACEHOLDER }
+];
+function isSensitiveKey(key) {
+  if (!key) return false;
+  const cleaned = key.replace(/[-_]/g, "");
+  return SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(key) || pattern.test(cleaned));
+}
+function redactUrl(rawUrl) {
+  if (!rawUrl) return rawUrl;
+  try {
+    const isRelative = !rawUrl.startsWith("http://") && !rawUrl.startsWith("https://") && !rawUrl.startsWith("ws://") && !rawUrl.startsWith("wss://");
+    const base = "http://localhost";
+    const parsed = new URL(rawUrl, base);
+    let changed = false;
+    for (const param of SENSITIVE_QUERY_PARAMS) {
+      if (parsed.searchParams.has(param)) {
+        parsed.searchParams.set(param, REDACTED_PLACEHOLDER);
+        changed = true;
+      }
+    }
+    for (const key of Array.from(parsed.searchParams.keys())) {
+      if (isSensitiveKey(key)) {
+        parsed.searchParams.set(key, REDACTED_PLACEHOLDER);
+        changed = true;
+      }
+    }
+    if (!changed) return rawUrl;
+    let result = isRelative ? parsed.pathname + parsed.search + parsed.hash : parsed.toString();
+    result = result.replace(/%5BREDACTED%5D/g, REDACTED_PLACEHOLDER);
+    return result;
+  } catch {
+    let safe = rawUrl;
+    for (const param of SENSITIVE_QUERY_PARAMS) {
+      const reg = new RegExp(`([?&]${param}=)[^&#]+`, "gi");
+      safe = safe.replace(reg, `$1${REDACTED_PLACEHOLDER}`);
+    }
+    return safe;
+  }
+}
+function redactSensitiveData(data, maxDepth = 6, currentDepth = 0) {
+  if (data === null || data === void 0) return data;
+  if (typeof data !== "object") return data;
+  if (currentDepth > maxDepth) return "[DEPTH_EXCEEDED]";
+  if (Array.isArray(data)) {
+    return data.map((item) => redactSensitiveData(item, maxDepth, currentDepth + 1));
+  }
+  const result = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (typeof value === "object" && value !== null) {
+      result[key] = redactSensitiveData(value, maxDepth, currentDepth + 1);
+    } else if (isSensitiveKey(key)) {
+      result[key] = REDACTED_PLACEHOLDER;
+    } else if (typeof value === "string") {
+      if (value.startsWith("http://") || value.startsWith("https://") || value.includes("?")) {
+        result[key] = redactUrl(value);
+      } else {
+        try {
+          result[key] = visulimaRedact(value, BROWSER_SECURITY_RULES);
+        } catch {
+          result[key] = value;
+        }
+      }
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+
+// packages/core/src/safety.ts
+function safeJsonParse(raw, fallback) {
+  if (raw === null || raw === void 0) return fallback;
+  if (typeof raw !== "string") return typeof raw === "object" ? raw : fallback;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return fallback;
+  }
+}
+function safeJsonStringify(val, fallback = "{}") {
+  if (val === void 0) return fallback;
+  try {
+    const seen = /* @__PURE__ */ new WeakSet();
+    return JSON.stringify(val, (key, value) => {
+      if (typeof value === "object" && value !== null) {
+        if (seen.has(value)) {
+          return "[Circular]";
+        }
+        seen.add(value);
+      }
+      if (typeof value === "bigint") {
+        return value.toString();
+      }
+      return value;
+    });
+  } catch {
+    try {
+      return JSON.stringify(String(val));
+    } catch {
+      return fallback;
+    }
+  }
+}
+
+// packages/daemon/src/storage/db.ts
 var StorageDB = class {
   db;
   constructor(dbPath) {
@@ -36,6 +248,7 @@ var StorageDB = class {
     this.db = new Database(dbPath);
     this.db.pragma("journal_mode = WAL");
     this.db.pragma("synchronous = NORMAL");
+    this.db.pragma("busy_timeout = 5000");
     this.initTables();
   }
   initTables() {
@@ -167,18 +380,36 @@ var StorageDB = class {
       CREATE INDEX IF NOT EXISTS idx_incidents_project ON incidents(project_id, status);
       CREATE INDEX IF NOT EXISTS idx_incidents_fp ON incidents(fingerprint);
       CREATE INDEX IF NOT EXISTS idx_notes_project ON notes(project_id, status);
-      CREATE INDEX IF NOT EXISTS idx_notes_scenario ON notes(scenario_id, step_number);
     `);
     try {
-      this.db.exec("ALTER TABLE notes ADD COLUMN scenario_id TEXT;");
-    } catch {
-    }
-    try {
-      this.db.exec("ALTER TABLE notes ADD COLUMN step_number INTEGER;");
+      const columns = this.db.prepare("PRAGMA table_info(notes)").all().map(
+        (c) => c.name
+      );
+      if (!columns.includes("scenario_id")) {
+        this.db.exec("ALTER TABLE notes ADD COLUMN scenario_id TEXT;");
+      }
+      if (!columns.includes("step_number")) {
+        this.db.exec("ALTER TABLE notes ADD COLUMN step_number INTEGER;");
+      }
+      if (!columns.includes("scenario_title")) {
+        this.db.exec("ALTER TABLE notes ADD COLUMN scenario_title TEXT;");
+      }
     } catch {
+      try {
+        this.db.exec("ALTER TABLE notes ADD COLUMN scenario_id TEXT;");
+      } catch {
+      }
+      try {
+        this.db.exec("ALTER TABLE notes ADD COLUMN step_number INTEGER;");
+      } catch {
+      }
+      try {
+        this.db.exec("ALTER TABLE notes ADD COLUMN scenario_title TEXT;");
+      } catch {
+      }
     }
     try {
-      this.db.exec("ALTER TABLE notes ADD COLUMN scenario_title TEXT;");
+      this.db.exec("CREATE INDEX IF NOT EXISTS idx_notes_scenario ON notes(scenario_id, step_number);");
     } catch {
     }
   }
@@ -343,7 +574,7 @@ var StorageDB = class {
       id: r.id,
       sessionId: r.session_id,
       eventType: r.event_type,
-      payload: JSON.parse(r.payload),
+      payload: safeJsonParse(r.payload, {}),
       timestamp: r.timestamp,
       route: r.route,
       url: r.url
@@ -404,9 +635,9 @@ var StorageDB = class {
       incident.occurrences,
       incident.status,
       incident.stack || null,
-      JSON.stringify(incident.breadcrumbs || []),
-      JSON.stringify(incident.networkFailures || []),
-      incident.lastElement ? JSON.stringify(incident.lastElement) : null,
+      safeJsonStringify(incident.breadcrumbs || []),
+      safeJsonStringify(incident.networkFailures || []),
+      incident.lastElement ? safeJsonStringify(incident.lastElement) : null,
       incident.screenshots?.error || null
     );
   }
@@ -420,8 +651,8 @@ var StorageDB = class {
       update.lastSeen,
       update.occurrences,
       update.route,
-      JSON.stringify(update.breadcrumbs || []),
-      update.lastElement ? JSON.stringify(update.lastElement) : null,
+      safeJsonStringify(update.breadcrumbs || []),
+      update.lastElement ? safeJsonStringify(update.lastElement) : null,
       update.stack || null,
       incidentId
     );
@@ -441,8 +672,8 @@ var StorageDB = class {
       occurrence.route,
       occurrence.url,
       occurrence.stack || null,
-      JSON.stringify(occurrence.breadcrumbs || []),
-      occurrence.lastElement ? JSON.stringify(occurrence.lastElement) : null
+      safeJsonStringify(occurrence.breadcrumbs || []),
+      occurrence.lastElement ? safeJsonStringify(occurrence.lastElement) : null
     );
   }
   // --- VERIFICATIONS ---
@@ -454,7 +685,7 @@ var StorageDB = class {
       v.id,
       v.incidentId,
       v.status,
-      JSON.stringify(v.checks),
+      safeJsonStringify(v.checks),
       v.beforeScreenshot || null,
       v.afterScreenshot || null,
       v.message || null,
@@ -467,7 +698,7 @@ var StorageDB = class {
     return {
       incidentId: row.incident_id,
       status: row.status,
-      checks: JSON.parse(row.checks || "[]"),
+      checks: safeJsonParse(row.checks, []),
       screenshots: {
         before: row.before_screenshot || void 0,
         after: row.after_screenshot || void 0
@@ -492,11 +723,11 @@ var StorageDB = class {
       note.message,
       note.route,
       note.url,
-      JSON.stringify(note.viewport),
-      JSON.stringify(note.scroll),
-      note.target ? JSON.stringify(note.target) : null,
-      note.elementContext ? JSON.stringify(note.elementContext) : null,
-      note.region ? JSON.stringify(note.region) : null,
+      safeJsonStringify(note.viewport),
+      safeJsonStringify(note.scroll),
+      note.target ? safeJsonStringify(note.target) : null,
+      note.elementContext ? safeJsonStringify(note.elementContext) : null,
+      note.region ? safeJsonStringify(note.region) : null,
       note.screenshots?.original || null,
       note.incidentId || null,
       note.scenarioId || null,
@@ -637,8 +868,8 @@ var StorageDB = class {
       `nver_${Date.now()}_${Math.random().toString(36).slice(2, 6)}`,
       v.noteId,
       v.status,
-      JSON.stringify(v.checks),
-      v.geometryDiff ? JSON.stringify(v.geometryDiff) : null,
+      safeJsonStringify(v.checks),
+      v.geometryDiff ? safeJsonStringify(v.geometryDiff) : null,
       v.screenshots?.before || null,
       v.screenshots?.after || null,
       v.message || null,
@@ -651,8 +882,8 @@ var StorageDB = class {
     return {
       noteId: row.note_id,
       status: row.status,
-      checks: JSON.parse(row.checks || "[]"),
-      geometryDiff: row.geometry_diff ? JSON.parse(row.geometry_diff) : void 0,
+      checks: safeJsonParse(row.checks, []),
+      geometryDiff: safeJsonParse(row.geometry_diff, void 0),
       screenshots: {
         before: row.before_screenshot || void 0,
         after: row.after_screenshot || void 0
@@ -693,9 +924,9 @@ var StorageDB = class {
       occurrences: row.occurrences,
       status: row.status,
       stack: row.stack || void 0,
-      breadcrumbs: JSON.parse(row.breadcrumbs || "[]"),
-      networkFailures: JSON.parse(row.network_failures || "[]"),
-      lastElement: row.last_element ? JSON.parse(row.last_element) : void 0,
+      breadcrumbs: safeJsonParse(row.breadcrumbs, []),
+      networkFailures: safeJsonParse(row.network_failures, []),
+      lastElement: safeJsonParse(row.last_element, void 0),
       screenshots: row.screenshot_path ? {
         error: row.screenshot_path
       } : void 0
@@ -710,11 +941,11 @@ var StorageDB = class {
       message: row.message,
       route: row.route,
       url: row.url,
-      viewport: JSON.parse(row.viewport_json || "{}"),
-      scroll: JSON.parse(row.scroll_json || "{}"),
-      target: row.target_json ? JSON.parse(row.target_json) : void 0,
-      elementContext: row.element_context_json ? JSON.parse(row.element_context_json) : void 0,
-      region: row.region_json ? JSON.parse(row.region_json) : void 0,
+      viewport: safeJsonParse(row.viewport_json, { width: 0, height: 0, devicePixelRatio: 1 }),
+      scroll: safeJsonParse(row.scroll_json, { scrollX: 0, scrollY: 0 }),
+      target: safeJsonParse(row.target_json, void 0),
+      elementContext: safeJsonParse(row.element_context_json, void 0),
+      region: safeJsonParse(row.region_json, void 0),
       status: row.status,
       incidentId: row.incident_id || void 0,
       scenarioId: row.scenario_id || void 0,
@@ -893,183 +1124,6 @@ var SessionManager = class {
 
 // packages/daemon/src/incidents/engine.ts
 import crypto from "crypto";
-
-// packages/core/src/fingerprint.ts
-function normalizeErrorMessage(message) {
-  if (!message) return "unknown_error";
-  return message.trim().replace(/0x[0-9a-fA-F]+/g, "0x<HEX>").replace(/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}/g, "<UUID>").replace(/\?[tv]=[\w.-]+/g, "").replace(/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?Z?/g, "<TIMESTAMP>").replace(/#\d+/g, "#<ID>").replace(/\s+/g, " ");
-}
-function normalizeSourceFile(filename) {
-  if (!filename) return "unknown_source";
-  let cleaned = filename.trim();
-  try {
-    if (cleaned.startsWith("http://") || cleaned.startsWith("https://")) {
-      const url = new URL(cleaned);
-      cleaned = url.pathname;
-    }
-  } catch {
-    cleaned = cleaned.replace(/^https?:\/\/[^/]+/, "");
-  }
-  cleaned = cleaned.split("?")[0].split("#")[0];
-  cleaned = cleaned.replace(/\\/g, "/");
-  return cleaned || "unknown_source";
-}
-function extractSourceFromStack(stack) {
-  if (!stack) return null;
-  const lines = stack.split("\n");
-  for (const line of lines) {
-    const match = line.match(/(?:at\s+(?:.*?\s+\()?)?(https?:\/\/[^\s)]+|file:\/\/[^\s)]+|\/[^\s)]+):(\d+):(\d+)\)?/);
-    if (match) {
-      return {
-        file: normalizeSourceFile(match[1]),
-        line: parseInt(match[2], 10),
-        column: parseInt(match[3], 10)
-      };
-    }
-  }
-  return null;
-}
-function djb2Hash(str) {
-  let hash = 5381;
-  for (let i = 0; i < str.length; i++) {
-    hash = hash * 33 ^ str.charCodeAt(i);
-  }
-  return (hash >>> 0).toString(16).padStart(8, "0");
-}
-function computeFingerprint(input) {
-  const normType = (input.type || "Error").trim().toLowerCase();
-  const normMsg = normalizeErrorMessage(input.message);
-  let sourceFile = normalizeSourceFile(input.sourceFile);
-  let line = input.line || 0;
-  if ((sourceFile === "unknown_source" || line === 0) && input.stack) {
-    const extracted = extractSourceFromStack(input.stack);
-    if (extracted) {
-      sourceFile = extracted.file;
-      line = extracted.line;
-    }
-  }
-  const rawKey = `${normType}::${normMsg}::${sourceFile}::${line}`;
-  const hash = djb2Hash(rawKey);
-  return `fp_${hash}`;
-}
-
-// packages/core/src/redaction.ts
-import { redact as visulimaRedact, standardRules } from "@visulima/redact";
-var REDACTED_PLACEHOLDER = "[REDACTED]";
-var SENSITIVE_KEY_PATTERNS = [
-  /^authorization$/i,
-  /^cookie$/i,
-  /^set-cookie$/i,
-  /password/i,
-  /token/i,
-  /secret/i,
-  /api[-_]?key/i,
-  /access[-_]?token/i,
-  /refresh[-_]?token/i,
-  /credentials/i,
-  /private[-_]?key/i,
-  /ssn/i,
-  /credit[-_]?card/i,
-  /cvv/i
-];
-var SENSITIVE_QUERY_PARAMS = [
-  "token",
-  "auth",
-  "key",
-  "apikey",
-  "api_key",
-  "secret",
-  "password",
-  "access_token",
-  "refresh_token",
-  "code",
-  "signature"
-];
-var BROWSER_SECURITY_RULES = [
-  { deep: true, key: "password", replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "secret", replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "token", replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "authorization", replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "cookie", replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "set-cookie", replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "apikey", replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "api_key", replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "creditcard", pattern: /(?:\d[ -]*?){13,16}/, replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "cvv", replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "ssn", pattern: /\b\d{3}-\d{2}-\d{4}\b/, replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "awsid", pattern: /\bAKIA[0-9A-Z]{16}\b/, replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "awskey", pattern: /\b[0-9a-zA-Z/+]{40}\b/, replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "jwt", pattern: /\beyJ[0-9a-zA-Z_\-]*\.[0-9a-zA-Z_\-]*\.[0-9a-zA-Z_\-]*\b/, replacement: REDACTED_PLACEHOLDER },
-  { deep: true, key: "slack_token", pattern: /\bxox[baprs]-[0-9a-zA-Z]{10,48}\b/, replacement: REDACTED_PLACEHOLDER }
-];
-function isSensitiveKey(key) {
-  if (!key) return false;
-  const cleaned = key.replace(/[-_]/g, "");
-  return SENSITIVE_KEY_PATTERNS.some((pattern) => pattern.test(key) || pattern.test(cleaned));
-}
-function redactUrl(rawUrl) {
-  if (!rawUrl) return rawUrl;
-  try {
-    const isRelative = !rawUrl.startsWith("http://") && !rawUrl.startsWith("https://") && !rawUrl.startsWith("ws://") && !rawUrl.startsWith("wss://");
-    const base = "http://localhost";
-    const parsed = new URL(rawUrl, base);
-    let changed = false;
-    for (const param of SENSITIVE_QUERY_PARAMS) {
-      if (parsed.searchParams.has(param)) {
-        parsed.searchParams.set(param, REDACTED_PLACEHOLDER);
-        changed = true;
-      }
-    }
-    for (const key of Array.from(parsed.searchParams.keys())) {
-      if (isSensitiveKey(key)) {
-        parsed.searchParams.set(key, REDACTED_PLACEHOLDER);
-        changed = true;
-      }
-    }
-    if (!changed) return rawUrl;
-    let result = isRelative ? parsed.pathname + parsed.search + parsed.hash : parsed.toString();
-    result = result.replace(/%5BREDACTED%5D/g, REDACTED_PLACEHOLDER);
-    return result;
-  } catch {
-    let safe = rawUrl;
-    for (const param of SENSITIVE_QUERY_PARAMS) {
-      const reg = new RegExp(`([?&]${param}=)[^&#]+`, "gi");
-      safe = safe.replace(reg, `$1${REDACTED_PLACEHOLDER}`);
-    }
-    return safe;
-  }
-}
-function redactSensitiveData(data, maxDepth = 6, currentDepth = 0) {
-  if (data === null || data === void 0) return data;
-  if (typeof data !== "object") return data;
-  if (currentDepth > maxDepth) return "[DEPTH_EXCEEDED]";
-  if (Array.isArray(data)) {
-    return data.map((item) => redactSensitiveData(item, maxDepth, currentDepth + 1));
-  }
-  const result = {};
-  for (const [key, value] of Object.entries(data)) {
-    if (typeof value === "object" && value !== null) {
-      result[key] = redactSensitiveData(value, maxDepth, currentDepth + 1);
-    } else if (isSensitiveKey(key)) {
-      result[key] = REDACTED_PLACEHOLDER;
-    } else if (typeof value === "string") {
-      if (value.startsWith("http://") || value.startsWith("https://") || value.includes("?")) {
-        result[key] = redactUrl(value);
-      } else {
-        try {
-          result[key] = visulimaRedact(value, BROWSER_SECURITY_RULES);
-        } catch {
-          result[key] = value;
-        }
-      }
-    } else {
-      result[key] = value;
-    }
-  }
-  return result;
-}
-
-// packages/daemon/src/incidents/engine.ts
 var IncidentEngine = class {
   db;
   screenshotStore;
@@ -1657,141 +1711,254 @@ var VerificationEngine = class {
 import fs4 from "fs";
 import path5 from "path";
 import { fileURLToPath } from "url";
-function createHttpHandler(db, sessionManager, baseScreenshotsDir) {
-  return (req, res) => {
-    const parsedUrl = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
-    const pathname = parsedUrl.pathname;
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
-    if (req.method === "OPTIONS") {
-      res.writeHead(204);
-      res.end();
-      return;
-    }
-    if (pathname === "/health" || pathname === "/") {
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(
-        JSON.stringify({
-          status: "ok",
-          name: "browsertrack",
-          version: "0.1.0",
-          activeSessions: sessionManager.getActiveCount(),
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        })
-      );
-      return;
-    }
-    if (pathname === "/client.js" || pathname === "/browserdiag.js") {
-      let scriptContent = "";
+function readJsonBody(req, res, maxSizeBytes = 10 * 1024 * 1024) {
+  return new Promise((resolve, reject) => {
+    let body = "";
+    let isTooLarge = false;
+    req.on("data", (chunk) => {
+      if (isTooLarge) return;
+      body += chunk;
+      if (body.length > maxSizeBytes) {
+        isTooLarge = true;
+        if (!res.headersSent) {
+          res.writeHead(413, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Payload too large" }));
+        }
+        req.destroy();
+        reject(new Error("Payload too large"));
+      }
+    });
+    req.on("end", () => {
+      if (isTooLarge) return;
       try {
-        const __filename = fileURLToPath(import.meta.url);
-        const __dirname = path5.dirname(__filename);
-        const candidatePaths = [
-          path5.resolve(__dirname, "../client.iife.js"),
-          path5.resolve(__dirname, "../../dist/client.iife.js"),
-          path5.resolve(__dirname, "../../../dist/client.iife.js")
-        ];
-        for (const p of candidatePaths) {
-          if (fs4.existsSync(p)) {
-            scriptContent = fs4.readFileSync(p, "utf-8");
-            break;
+        const parsed = body ? JSON.parse(body) : {};
+        resolve(parsed);
+      } catch (err) {
+        if (!res.headersSent) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Malformed JSON payload" }));
+        }
+        reject(err);
+      }
+    });
+    req.on("error", (err) => {
+      reject(err);
+    });
+  });
+}
+function createHttpHandler(db, sessionManager, baseScreenshotsDir, verificationEngine, noteVerificationEngine) {
+  return async (req, res) => {
+    try {
+      const parsedUrl = new URL(req.url || "/", `http://${req.headers.host || "127.0.0.1"}`);
+      const pathname = parsedUrl.pathname;
+      res.setHeader("Access-Control-Allow-Origin", "*");
+      res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+      if (req.method === "OPTIONS") {
+        res.writeHead(204);
+        res.end();
+        return;
+      }
+      if (pathname === "/health" || pathname === "/") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify({
+            status: "ok",
+            name: "browsertrack",
+            version: "0.1.0",
+            activeSessions: sessionManager.getActiveCount(),
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          })
+        );
+        return;
+      }
+      if (pathname === "/client.js" || pathname === "/browserdiag.js") {
+        let scriptContent = "";
+        try {
+          const __filename = fileURLToPath(import.meta.url);
+          const __dirname = path5.dirname(__filename);
+          const candidatePaths = [
+            path5.resolve(__dirname, "../client.iife.js"),
+            path5.resolve(__dirname, "../../dist/client.iife.js"),
+            path5.resolve(__dirname, "../../../dist/client.iife.js")
+          ];
+          for (const p of candidatePaths) {
+            if (fs4.existsSync(p)) {
+              scriptContent = fs4.readFileSync(p, "utf-8");
+              break;
+            }
           }
+        } catch {
         }
-      } catch {
+        if (!scriptContent) {
+          scriptContent = `console.warn("[BrowserTrack] Standalone client bundle not built yet. Run 'npm run build'.");`;
+        }
+        res.writeHead(200, {
+          "Content-Type": "application/javascript; charset=utf-8",
+          "Cache-Control": "no-cache"
+        });
+        res.end(scriptContent);
+        return;
       }
-      if (!scriptContent) {
-        scriptContent = `console.warn("[BrowserTrack] Standalone client bundle not built yet. Run 'npm run build'.");`;
+      if (pathname === "/api/projects") {
+        const projects = db.listProjects();
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: true, projects }));
+        return;
       }
-      res.writeHead(200, {
-        "Content-Type": "application/javascript; charset=utf-8",
-        "Cache-Control": "no-cache"
-      });
-      res.end(scriptContent);
-      return;
-    }
-    if (pathname === "/api/projects") {
-      const projects = db.listProjects();
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: true, projects }));
-      return;
-    }
-    if (pathname === "/api/sessions") {
-      const projectId = parsedUrl.searchParams.get("project") || void 0;
-      const activeOnly = parsedUrl.searchParams.get("active") === "true";
-      const sessions = db.listSessions(projectId, activeOnly);
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: true, sessions }));
-      return;
-    }
-    if (pathname === "/api/incidents") {
-      const projectId = parsedUrl.searchParams.get("project") || void 0;
-      const status = parsedUrl.searchParams.get("status") || void 0;
-      const limit = parseInt(parsedUrl.searchParams.get("limit") || "50", 10);
-      const incidents = db.listIncidents({ projectId, status, limit });
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: true, incidents }));
-      return;
-    }
-    if (pathname.startsWith("/api/incidents/")) {
-      const incidentId = pathname.replace("/api/incidents/", "");
-      const incident = db.getIncident(incidentId);
-      if (!incident) {
-        res.writeHead(404, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: false, error: "Incident not found" }));
+      if (pathname === "/api/sessions") {
+        const projectId = parsedUrl.searchParams.get("project") || void 0;
+        const activeOnly = parsedUrl.searchParams.get("active") === "true";
+        const sessions = db.listSessions(projectId, activeOnly);
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: true, sessions }));
         return;
       }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: true, incident }));
-      return;
-    }
-    if (pathname === "/api/notes") {
-      const projectId = parsedUrl.searchParams.get("project") || void 0;
-      const status = parsedUrl.searchParams.get("status") || void 0;
-      const limit = parseInt(parsedUrl.searchParams.get("limit") || "50", 10);
-      const notes = db.listNotes({ projectId, status, limit });
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: true, notes }));
-      return;
-    }
-    if (pathname.startsWith("/api/notes/")) {
-      const noteId = pathname.replace("/api/notes/", "");
-      const note = db.getNote(noteId);
-      if (!note) {
+      if (pathname === "/api/incidents") {
+        const projectId = parsedUrl.searchParams.get("project") || void 0;
+        const status = parsedUrl.searchParams.get("status") || void 0;
+        const limit = parseInt(parsedUrl.searchParams.get("limit") || "50", 10);
+        const incidents = db.listIncidents({ projectId, status, limit });
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: true, incidents }));
+        return;
+      }
+      if (pathname.startsWith("/api/incidents/")) {
+        const incidentId = pathname.replace("/api/incidents/", "");
+        const incident = db.getIncident(incidentId);
+        if (!incident) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Incident not found" }));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: true, incident }));
+        return;
+      }
+      if (pathname === "/api/notes") {
+        const projectId = parsedUrl.searchParams.get("project") || void 0;
+        const status = parsedUrl.searchParams.get("status") || void 0;
+        const limit = parseInt(parsedUrl.searchParams.get("limit") || "50", 10);
+        const notes = db.listNotes({ projectId, status, limit });
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: true, notes }));
+        return;
+      }
+      if (pathname.startsWith("/api/notes/")) {
+        const noteId = pathname.replace("/api/notes/", "");
+        const note = db.getNote(noteId);
+        if (!note) {
+          res.writeHead(404, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: "Note not found" }));
+          return;
+        }
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: true, note }));
+        return;
+      }
+      if (pathname.startsWith("/screenshots/")) {
+        const relativePath = pathname.replace("/screenshots/", "");
+        const filePath = path5.join(baseScreenshotsDir, relativePath);
+        if (fs4.existsSync(filePath) && fs4.statSync(filePath).isFile()) {
+          const ext = path5.extname(filePath).toLowerCase();
+          const mimeTypes = {
+            ".webp": "image/webp",
+            ".png": "image/png",
+            ".jpg": "image/jpeg",
+            ".jpeg": "image/jpeg"
+          };
+          res.writeHead(200, { "Content-Type": mimeTypes[ext] || "application/octet-stream" });
+          fs4.createReadStream(filePath).pipe(res);
+          return;
+        }
         res.writeHead(404, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ ok: false, error: "Note not found" }));
+        res.end(JSON.stringify({ ok: false, error: "Screenshot not found" }));
         return;
       }
-      res.writeHead(200, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: true, note }));
-      return;
-    }
-    if (pathname.startsWith("/screenshots/")) {
-      const relativePath = pathname.replace("/screenshots/", "");
-      const filePath = path5.join(baseScreenshotsDir, relativePath);
-      if (fs4.existsSync(filePath) && fs4.statSync(filePath).isFile()) {
-        const ext = path5.extname(filePath).toLowerCase();
-        const mimeTypes = {
-          ".webp": "image/webp",
-          ".png": "image/png",
-          ".jpg": "image/jpeg",
-          ".jpeg": "image/jpeg"
-        };
-        res.writeHead(200, { "Content-Type": mimeTypes[ext] || "application/octet-stream" });
-        fs4.createReadStream(filePath).pipe(res);
+      if (pathname === "/api/command" && req.method === "POST") {
+        try {
+          const data = await readJsonBody(req, res);
+          const sessionId = data.sessionId || sessionManager.getAnyActiveSession()?.id;
+          if (!sessionId) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "No active browser session connected" }));
+            return;
+          }
+          const cmdRes = await sessionManager.sendCommand(sessionId, data.command, data.timeoutMs || 5e3);
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify(cmdRes));
+        } catch (err) {
+          if (!res.headersSent) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: err?.message || String(err) }));
+          }
+        }
+        return;
+      }
+      if (pathname === "/api/verify/incident" && req.method === "POST") {
+        try {
+          if (!verificationEngine) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Verification engine not attached to daemon" }));
+            return;
+          }
+          const data = await readJsonBody(req, res);
+          const result = await verificationEngine.verifyIncident(data.incidentId, data.options);
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, result }));
+        } catch (err) {
+          if (!res.headersSent) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: err?.message || String(err) }));
+          }
+        }
+        return;
+      }
+      if (pathname === "/api/verify/note" && req.method === "POST") {
+        try {
+          if (!noteVerificationEngine) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: "Note verification engine not attached to daemon" }));
+            return;
+          }
+          const data = await readJsonBody(req, res);
+          const result = await noteVerificationEngine.verifyNote(data.noteId, data.options);
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: true, result }));
+        } catch (err) {
+          if (!res.headersSent) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: err?.message || String(err) }));
+          }
+        }
         return;
       }
       res.writeHead(404, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: false, error: "Screenshot not found" }));
-      return;
+      res.end(JSON.stringify({ ok: false, error: "Not found" }));
+    } catch (err) {
+      if (!res.headersSent) {
+        try {
+          res.writeHead(500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: err?.message || "Internal Server Error" }));
+        } catch {
+        }
+      }
     }
-    res.writeHead(404, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ ok: false, error: "Not found" }));
   };
 }
 
 // packages/daemon/src/server/ws.ts
 import crypto5 from "crypto";
+function safeWsSend(ws, payload) {
+  if (ws.readyState !== 1) return false;
+  try {
+    const raw = typeof payload === "string" ? payload : safeJsonStringify(payload);
+    ws.send(raw);
+    return true;
+  } catch {
+    return false;
+  }
+}
 function setupWebSocketServer(wss, db, sessionManager, incidentEngine, notesEngine, maxEventsPerSession = 1e3, verbose = false) {
   wss.on("connection", (ws) => {
     let currentSessionId = null;
@@ -1834,21 +2001,17 @@ function setupWebSocketServer(wss, db, sessionManager, incidentEngine, notesEngi
             active: true
           });
           sessionManager.registerSocket(sessionId, ws, hello.origin || "", project.id);
-          ws.send(
-            JSON.stringify({
-              type: "hello_ack",
-              sessionId,
-              projectId: project.id,
-              projectName: project.name
-            })
-          );
+          safeWsSend(ws, {
+            type: "hello_ack",
+            sessionId,
+            projectId: project.id,
+            projectName: project.name
+          });
           const existingNotes = db.listNotes({ projectId: project.id, limit: 100 });
-          ws.send(
-            JSON.stringify({
-              type: "notes_sync",
-              notes: existingNotes
-            })
-          );
+          safeWsSend(ws, {
+            type: "notes_sync",
+            notes: existingNotes
+          });
           if (verbose) {
             console.log(`[BrowserTrack] New session connected: ${sessionId} (${project.name} @ ${hello.origin})`);
           }
@@ -1900,15 +2063,13 @@ function setupWebSocketServer(wss, db, sessionManager, incidentEngine, notesEngi
               `[BrowserTrack] Visual note created: ${note.id} on ${note.route} ("${note.message}")${note.scenarioId ? ` [Scenario: ${note.scenarioTitle || note.scenarioId} Step ${note.stepNumber}]` : ""}`
             );
           }
-          ws.send(
-            JSON.stringify({
-              type: "note_created_ack",
-              noteId: note.id,
-              status: note.status,
-              scenarioId: note.scenarioId,
-              stepNumber: note.stepNumber
-            })
-          );
+          safeWsSend(ws, {
+            type: "note_created_ack",
+            noteId: note.id,
+            status: note.status,
+            scenarioId: note.scenarioId,
+            stepNumber: note.stepNumber
+          });
           const allNotes = db.listNotes({ projectId: note.projectId, limit: 100 });
           sessionManager.broadcastToProject(note.projectId, {
             type: "notes_sync",
@@ -1969,12 +2130,10 @@ function setupWebSocketServer(wss, db, sessionManager, incidentEngine, notesEngi
           const projectId = data.projectId || session?.projectId;
           if (projectId) {
             const allNotes = db.listNotes({ projectId, limit: 100 });
-            ws.send(
-              JSON.stringify({
-                type: "notes_sync",
-                notes: allNotes
-              })
-            );
+            safeWsSend(ws, {
+              type: "notes_sync",
+              notes: allNotes
+            });
           }
           return;
         }
@@ -2035,7 +2194,13 @@ var BrowserTrackDaemon = class {
   }
   async start() {
     if (this.isRunning) return;
-    const httpHandler = createHttpHandler(this.db, this.sessionManager, this.config.screenshotsDir);
+    const httpHandler = createHttpHandler(
+      this.db,
+      this.sessionManager,
+      this.config.screenshotsDir,
+      this.verificationEngine,
+      this.noteVerificationEngine
+    );
     this.httpServer = http.createServer(httpHandler);
     this.wss = new WebSocketServer({ server: this.httpServer });
     setupWebSocketServer(
@@ -2106,11 +2271,117 @@ function createDaemon(config = {}) {
 }
 
 // packages/mcp/src/server.ts
+import fs5 from "fs";
+import path6 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+import { spawn } from "child_process";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 
 // packages/mcp/src/handlers.ts
+async function sendSessionCommand(ctx, sessionId, command, timeoutMs = 5e3) {
+  if (ctx.daemonInitPromise) {
+    try {
+      await Promise.race([ctx.daemonInitPromise, new Promise((r) => setTimeout(r, 2e3))]);
+    } catch {
+    }
+  }
+  if (ctx.sessionManager && ctx.sessionManager.getActiveCount() > 0) {
+    const targetSession = sessionId ? ctx.db.getSession(sessionId) : ctx.sessionManager.getAnyActiveSession();
+    if (targetSession) {
+      const res = await ctx.sessionManager.sendCommand(targetSession.id, command, timeoutMs);
+      if (!res.ok) {
+        throw new Error(res.error || res.reason || `Command ${command.type} failed`);
+      }
+      return res;
+    }
+  }
+  if (ctx.daemonUrl) {
+    try {
+      const resp = await fetch(`${ctx.daemonUrl}/api/command`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ sessionId, command, timeoutMs }),
+        signal: AbortSignal.timeout(timeoutMs + 2e3)
+      });
+      if (resp.ok) {
+        const res = await resp.json();
+        if (!res.ok) {
+          throw new Error(res.error || res.reason || `Command ${command.type} failed`);
+        }
+        return res;
+      }
+      const errJson = await resp.json().catch(() => ({}));
+      if (errJson.error) {
+        throw new Error(errJson.error);
+      }
+    } catch (err) {
+      if (err.message && !err.message.includes("fetch failed") && !err.message.includes("ECONNREFUSED")) {
+        throw err;
+      }
+    }
+  }
+  throw new Error(
+    'No active browser session connected. Please ensure the BrowserTrack daemon is running ("browsertrack start") and your application tab is open in the browser.'
+  );
+}
+async function runVerifyIncident(ctx, incidentId, options) {
+  if (ctx.verificationEngine && ctx.sessionManager && ctx.sessionManager.getActiveCount() > 0) {
+    return await ctx.verificationEngine.verifyIncident(incidentId, options);
+  }
+  if (ctx.daemonUrl) {
+    try {
+      const timeoutMs = (options?.observationWindowMs || 3e3) + 7e3;
+      const resp = await fetch(`${ctx.daemonUrl}/api/verify/incident`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ incidentId, options }),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (resp.ok) {
+        const data = await resp.json();
+        if (data.ok) return data.result;
+        throw new Error(data.error);
+      }
+    } catch (err) {
+      if (err.message && !err.message.includes("fetch failed") && !err.message.includes("ECONNREFUSED")) {
+        throw err;
+      }
+    }
+  }
+  throw new Error(
+    'Verification failed: No active browser session connected. Please ensure the BrowserTrack daemon is running ("browsertrack start") and your application tab is open in the browser.'
+  );
+}
+async function runVerifyNote(ctx, noteId, options) {
+  if (ctx.noteVerificationEngine && ctx.sessionManager && ctx.sessionManager.getActiveCount() > 0) {
+    return await ctx.noteVerificationEngine.verifyNote(noteId, options);
+  }
+  if (ctx.daemonUrl) {
+    try {
+      const timeoutMs = (options?.observationWindowMs || 3e3) + 7e3;
+      const resp = await fetch(`${ctx.daemonUrl}/api/verify/note`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ noteId, options }),
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (resp.ok) {
+        const data = await resp.json();
+        if (data.ok) return data.result;
+        throw new Error(data.error);
+      }
+    } catch (err) {
+      if (err.message && !err.message.includes("fetch failed") && !err.message.includes("ECONNREFUSED")) {
+        throw err;
+      }
+    }
+  }
+  throw new Error(
+    'Verification failed: No active browser session connected. Please ensure the BrowserTrack daemon is running ("browsertrack start") and your application tab is open in the browser.'
+  );
+}
 async function handleToolCall(name, args, ctx) {
   const { db, sessionManager, verificationEngine, noteVerificationEngine } = ctx;
   switch (name) {
@@ -2260,38 +2531,18 @@ async function handleToolCall(name, args, ctx) {
       };
     }
     case "get_page_state": {
-      if (!sessionManager) {
-        throw new Error("Live browser connection not available: Daemon session manager not attached.");
-      }
-      let session = args.sessionId ? db.getSession(args.sessionId) : sessionManager.getAnyActiveSession();
-      if (!session) {
-        throw new Error("No active browser session connected.");
-      }
-      const cmdRes = await sessionManager.sendCommand(session.id, {
+      const cmdRes = await sendSessionCommand(ctx, args.sessionId, {
         id: `cmd_mcp_${Date.now()}`,
         type: "get_page_state"
       });
-      if (!cmdRes.ok) {
-        throw new Error(cmdRes.error || "Failed to retrieve page state from browser.");
-      }
       return cmdRes.result;
     }
     case "capture_element": {
-      if (!sessionManager) {
-        throw new Error("Live browser connection not available: Daemon session manager not attached.");
-      }
-      let session = args.sessionId ? db.getSession(args.sessionId) : sessionManager.getAnyActiveSession();
-      if (!session) {
-        throw new Error("No active browser session connected.");
-      }
-      const cmdRes = await sessionManager.sendCommand(session.id, {
+      const cmdRes = await sendSessionCommand(ctx, args.sessionId, {
         id: `cmd_mcp_${Date.now()}`,
         type: "capture_element",
         params: { selector: args.selector }
       });
-      if (!cmdRes.ok) {
-        throw new Error(cmdRes.error || cmdRes.reason || "Failed to capture element screenshot.");
-      }
       return {
         ok: true,
         format: cmdRes.result?.format || "webp",
@@ -2301,10 +2552,7 @@ async function handleToolCall(name, args, ctx) {
       };
     }
     case "verify_incident": {
-      if (!verificationEngine) {
-        throw new Error("Verification engine not available: Daemon session manager not attached.");
-      }
-      const res = await verificationEngine.verifyIncident(args.incidentId, {
+      const res = await runVerifyIncident(ctx, args.incidentId, {
         route: args.route,
         targetSelector: args.targetSelector,
         expect: args.expect,
@@ -2455,10 +2703,7 @@ async function handleToolCall(name, args, ctx) {
       };
     }
     case "verify_note": {
-      if (!noteVerificationEngine) {
-        throw new Error("Note verification engine not available: Daemon session manager not attached.");
-      }
-      const res = await noteVerificationEngine.verifyNote(args.noteId, {
+      const res = await runVerifyNote(ctx, args.noteId, {
         observationWindowMs: args.observationWindowMs
       });
       return res;
@@ -2471,24 +2716,17 @@ async function handleToolCall(name, args, ctx) {
       return v;
     }
     case "capture_note_context": {
-      if (!sessionManager) {
-        throw new Error("Live browser connection not available: Daemon session manager not attached.");
-      }
-      let session = args.sessionId ? db.getSession(args.sessionId) : sessionManager.getAnyActiveSession();
-      if (!session) {
-        throw new Error("No active browser session connected.");
-      }
-      const queryCmd = await sessionManager.sendCommand(session.id, {
+      const queryCmd = await sendSessionCommand(ctx, args.sessionId, {
         id: `cmd_ctx_${Date.now()}`,
         type: "query_element",
         params: { selector: args.selector }
       });
-      const overflowCmd = await sessionManager.sendCommand(session.id, {
+      const overflowCmd = await sendSessionCommand(ctx, args.sessionId, {
         id: `cmd_ovf_${Date.now()}`,
         type: "check_overflow",
         params: { selector: args.selector }
       });
-      const styleCmd = await sessionManager.sendCommand(session.id, {
+      const styleCmd = await sendSessionCommand(ctx, args.sessionId, {
         id: `cmd_sty_${Date.now()}`,
         type: "get_element_style",
         params: { selector: args.selector }
@@ -2770,8 +3008,76 @@ var TOOLS = [
 ];
 
 // packages/mcp/src/server.ts
+async function isDaemonRunning(host, port) {
+  try {
+    const res = await fetch(`http://${host}:${port}/health`, {
+      signal: AbortSignal.timeout(600)
+    });
+    if (res.ok) {
+      const data = await res.json().catch(() => ({}));
+      return data?.name === "browsertrack";
+    }
+  } catch {
+  }
+  return false;
+}
+function resolveCliPath() {
+  if (process.argv[1]) {
+    const candidate = process.argv[1];
+    if (candidate.endsWith("cli/index.js") || candidate.endsWith("browsertrack") || candidate.endsWith("bin/browsertrack.js") || candidate.endsWith("dist/cli/index.js")) {
+      if (fs5.existsSync(candidate)) return candidate;
+    }
+  }
+  try {
+    const currentDir = path6.dirname(fileURLToPath2(import.meta.url));
+    const paths = [
+      path6.resolve(currentDir, "../cli/index.js"),
+      path6.resolve(currentDir, "../../cli/index.js"),
+      path6.resolve(currentDir, "../../dist/cli/index.js")
+    ];
+    for (const p of paths) {
+      if (fs5.existsSync(p)) return p;
+    }
+  } catch {
+  }
+  return null;
+}
+function acquireBootLock(lockFile) {
+  try {
+    fs5.mkdirSync(path6.dirname(lockFile), { recursive: true });
+    const fd = fs5.openSync(lockFile, "wx");
+    fs5.writeSync(fd, String(process.pid));
+    fs5.closeSync(fd);
+    return true;
+  } catch {
+    try {
+      const stats = fs5.statSync(lockFile);
+      if (Date.now() - stats.mtimeMs > 5e3) {
+        fs5.unlinkSync(lockFile);
+        const fd = fs5.openSync(lockFile, "wx");
+        fs5.writeSync(fd, String(process.pid));
+        fs5.closeSync(fd);
+        return true;
+      }
+    } catch {
+    }
+    return false;
+  }
+}
+function releaseBootLock(lockFile) {
+  try {
+    if (fs5.existsSync(lockFile)) {
+      fs5.unlinkSync(lockFile);
+    }
+  } catch {
+  }
+}
 function createMcpServer(options = {}) {
-  const config = getDaemonConfig({ dbPath: options.dbPath });
+  const config = getDaemonConfig({
+    dbPath: options.dbPath,
+    port: options.port,
+    host: options.host
+  });
   const db = options.context?.db || new StorageDB(config.dbPath);
   const screenshotStore = new ScreenshotStore(config.screenshotsDir);
   const sessionManager = options.context?.sessionManager || new SessionManager(db);
@@ -2786,6 +3092,103 @@ function createMcpServer(options = {}) {
     daemonUrl: `http://${config.host}:${config.port}`,
     ...options.context
   };
+  let embeddedDaemon = null;
+  async function ensureDaemon() {
+    if (options.autoStartDaemon === false || options.context?.sessionManager) {
+      return;
+    }
+    if (await isDaemonRunning(config.host, config.port)) {
+      console.error(`[BrowserTrack MCP] Connected to active singleton daemon at http://${config.host}:${config.port}`);
+      return;
+    }
+    const lockFile = path6.join(config.dataDir, "daemon_boot.lock");
+    const hasLock = acquireBootLock(lockFile);
+    if (!hasLock) {
+      for (let i = 0; i < 30; i++) {
+        await new Promise((r) => setTimeout(r, 100));
+        if (await isDaemonRunning(config.host, config.port)) {
+          console.error(`[BrowserTrack MCP] Connected to shared singleton daemon at http://${config.host}:${config.port}`);
+          return;
+        }
+      }
+    }
+    try {
+      if (await isDaemonRunning(config.host, config.port)) {
+        console.error(`[BrowserTrack MCP] Connected to shared singleton daemon at http://${config.host}:${config.port}`);
+        return;
+      }
+      if (options.detached !== false) {
+        const cliPath = resolveCliPath();
+        if (cliPath && fs5.existsSync(cliPath)) {
+          try {
+            const nodePaths = [
+              "/usr/local/bin",
+              "/opt/homebrew/bin",
+              process.env.HOME ? `${process.env.HOME}/.nvm/versions/node/v20.19.5/bin` : "",
+              process.env.HOME ? `${process.env.HOME}/.nvm/versions/node/v23.1.0/bin` : ""
+            ].filter(Boolean);
+            const extendedPath = `${process.env.PATH || ""}:${nodePaths.join(":")}`;
+            const child = spawn(
+              process.execPath,
+              [cliPath, "start", "--port", String(config.port), "--host", config.host],
+              {
+                detached: true,
+                stdio: "ignore",
+                env: { ...process.env, PATH: extendedPath, BROWSERTRACK_DAEMON_DETACHED: "1" }
+              }
+            );
+            child.unref();
+            for (let i = 0; i < 30; i++) {
+              await new Promise((r) => setTimeout(r, 100));
+              if (await isDaemonRunning(config.host, config.port)) {
+                console.error(
+                  `[BrowserTrack MCP] Started singleton background daemon on http://${config.host}:${config.port}`
+                );
+                return;
+              }
+            }
+          } catch (spawnErr) {
+            console.error(
+              `[BrowserTrack MCP] Detached daemon spawn failed (${spawnErr?.message}), falling back to in-process daemon.`
+            );
+          }
+        }
+      }
+      embeddedDaemon = createDaemon({
+        host: config.host,
+        port: config.port,
+        dbPath: config.dbPath,
+        screenshotsDir: config.screenshotsDir,
+        verbose: false
+      });
+      await embeddedDaemon.start();
+      console.error(`[BrowserTrack MCP] Started singleton daemon on http://${config.host}:${config.port}`);
+      ctx.db = embeddedDaemon.db;
+      ctx.sessionManager = embeddedDaemon.sessionManager;
+      ctx.verificationEngine = embeddedDaemon.verificationEngine;
+      ctx.noteVerificationEngine = embeddedDaemon.noteVerificationEngine;
+      const cleanup = () => {
+        if (embeddedDaemon) {
+          try {
+            embeddedDaemon.stop();
+          } catch {
+          }
+          embeddedDaemon = null;
+        }
+      };
+      process.on("exit", cleanup);
+      process.on("SIGINT", cleanup);
+      process.on("SIGTERM", cleanup);
+    } catch (err) {
+      console.error(
+        `[BrowserTrack MCP] Note: Daemon startup skipped (${err?.message}). Running MCP in standalone database mode.`
+      );
+    } finally {
+      if (hasLock) {
+        releaseBootLock(lockFile);
+      }
+    }
+  }
   const server = new Server(
     {
       name: "browsertrack-mcp",
@@ -2803,7 +3206,10 @@ function createMcpServer(options = {}) {
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
     try {
-      const result = await handleToolCall(name, args || {}, ctx);
+      const timeoutPromise = new Promise(
+        (_, reject) => setTimeout(() => reject(new Error(`Tool execution timed out after 20s: ${name}`)), 2e4)
+      );
+      const result = await Promise.race([handleToolCall(name, args || {}, ctx), timeoutPromise]);
       return {
         content: [
           {
@@ -2826,30 +3232,48 @@ function createMcpServer(options = {}) {
   });
   return {
     server,
+    ctx,
+    ensureDaemon,
+    async stopDaemon() {
+      if (embeddedDaemon) {
+        await embeddedDaemon.stop();
+        embeddedDaemon = null;
+      }
+    },
     async startStdio() {
       const transport = new StdioServerTransport();
       await server.connect(transport);
+      const daemonInitPromise = ensureDaemon().catch((err) => {
+        console.error(`[BrowserTrack MCP] Daemon background init note: ${err?.message || err}`);
+      });
+      ctx.daemonInitPromise = daemonInitPromise;
     }
   };
 }
 
 // packages/cli/src/index.ts
+process.on("uncaughtException", (err) => {
+  console.error("[BrowserTrack] Uncaught Exception:", err?.message || err);
+});
+process.on("unhandledRejection", (reason) => {
+  console.error("[BrowserTrack] Unhandled Rejection:", reason?.message || reason);
+});
 var program = new Command();
 program.name("browsertrack").description("Local browser diagnostics + MCP bridge for coding agents").version("0.1.0");
 function getPidFilePath() {
   const config = getDaemonConfig();
-  return path6.join(config.dataDir, "daemon.pid");
+  return path7.join(config.dataDir, "daemon.pid");
 }
 function savePid(pid) {
   const pidFile = getPidFilePath();
-  fs5.mkdirSync(path6.dirname(pidFile), { recursive: true });
-  fs5.writeFileSync(pidFile, String(pid), "utf-8");
+  fs6.mkdirSync(path7.dirname(pidFile), { recursive: true });
+  fs6.writeFileSync(pidFile, String(pid), "utf-8");
 }
 function readPid() {
   try {
     const pidFile = getPidFilePath();
-    if (fs5.existsSync(pidFile)) {
-      const pidStr = fs5.readFileSync(pidFile, "utf-8").trim();
+    if (fs6.existsSync(pidFile)) {
+      const pidStr = fs6.readFileSync(pidFile, "utf-8").trim();
       const pid = parseInt(pidStr, 10);
       if (!isNaN(pid)) return pid;
     }
@@ -2860,8 +3284,8 @@ function readPid() {
 function removePid() {
   try {
     const pidFile = getPidFilePath();
-    if (fs5.existsSync(pidFile)) {
-      fs5.unlinkSync(pidFile);
+    if (fs6.existsSync(pidFile)) {
+      fs6.unlinkSync(pidFile);
     }
   } catch {
   }
@@ -2881,6 +3305,11 @@ program.command("start").description("Start the local BrowserTrack daemon and HT
     return;
   }
   const port = parseInt(options.port, 10);
+  const isRunningHttp = await isDaemonRunning(options.host, port);
+  if (isRunningHttp) {
+    console.log(`[BrowserTrack] Daemon is already running on http://${options.host}:${port} (active via MCP Server).`);
+    return;
+  }
   const daemon = createDaemon({
     port,
     host: options.host,
@@ -2924,6 +3353,13 @@ program.command("start").description("Start the local BrowserTrack daemon and HT
 program.command("stop").description("Stop the running BrowserTrack daemon").action(async () => {
   const pid = readPid();
   if (!pid || !isProcessRunning(pid)) {
+    const config = getDaemonConfig();
+    const isRunningHttp = await isDaemonRunning(config.host, config.port);
+    if (isRunningHttp) {
+      console.log("[BrowserTrack] Daemon is actively maintained by an MCP Server process in your IDE and will shut down when your editor session ends.");
+      removePid();
+      return;
+    }
     console.log("[BrowserTrack] Daemon is not currently running.");
     removePid();
     return;
@@ -2938,13 +3374,21 @@ program.command("stop").description("Stop the running BrowserTrack daemon").acti
 });
 program.command("status").description("Check if the BrowserTrack daemon is running and view active sessions").action(async () => {
   const pid = readPid();
-  const isRunning = pid ? isProcessRunning(pid) : false;
   const config = getDaemonConfig();
+  let isRunning = pid ? isProcessRunning(pid) : false;
+  let detail = isRunning ? ` (PID: ${pid})` : "";
+  if (!isRunning) {
+    const isRunningHttp = await isDaemonRunning(config.host, config.port);
+    if (isRunningHttp) {
+      isRunning = true;
+      detail = " (Active via MCP Server)";
+    }
+  }
   console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
-  console.log(`  Status:       ${isRunning ? "\u{1F7E2} RUNNING" : "\u26AA STOPPED"}${isRunning ? ` (PID: ${pid})` : ""}`);
+  console.log(`  Status:       ${isRunning ? "\u{1F7E2} RUNNING" : "\u26AA STOPPED"}${detail}`);
   console.log(`  Endpoint:     http://${config.host}:${config.port}`);
   console.log(`  Database:     ${config.dbPath}`);
-  if (fs5.existsSync(config.dbPath)) {
+  if (fs6.existsSync(config.dbPath)) {
     try {
       const db = new StorageDB(config.dbPath);
       const projects = db.listProjects();
@@ -2962,172 +3406,240 @@ program.command("status").description("Check if the BrowserTrack daemon is runni
 });
 var projectCommand = program.command("project").description("Manage tracked project mappings");
 projectCommand.command("add <name>").description("Register a project with origin and filesystem path").requiredOption("-o, --origin <origin>", "Project origin (e.g. http://localhost:5173)").option("-p, --path <path>", "Filesystem path (e.g. /path/to/project)").action((name, options) => {
-  const config = getDaemonConfig();
-  const db = new StorageDB(config.dbPath);
-  const resolvedPath = options.path ? path6.resolve(options.path) : void 0;
-  const proj = db.upsertProject({
-    id: `proj_${name}`,
-    name,
-    origin: options.origin,
-    path: resolvedPath
-  });
-  console.log(`[BrowserTrack] Registered project '${proj.name}':`);
-  console.log(`  ID:     ${proj.id}`);
-  console.log(`  Origin: ${proj.origin}`);
-  console.log(`  Path:   ${proj.path || "(none)"}`);
-  db.close();
+  try {
+    const config = getDaemonConfig();
+    const db = new StorageDB(config.dbPath);
+    try {
+      const resolvedPath = options.path ? path7.resolve(options.path) : void 0;
+      const proj = db.upsertProject({
+        id: `proj_${name}`,
+        name,
+        origin: options.origin,
+        path: resolvedPath
+      });
+      console.log(`[BrowserTrack] Registered project '${proj.name}':`);
+      console.log(`  ID:     ${proj.id}`);
+      console.log(`  Origin: ${proj.origin}`);
+      console.log(`  Path:   ${proj.path || "(none)"}`);
+    } finally {
+      db.close();
+    }
+  } catch (err) {
+    console.error("[BrowserTrack] Failed to register project:", err?.message || err);
+  }
 });
 program.command("projects").description("List all tracked projects").action(() => {
-  const config = getDaemonConfig();
-  const db = new StorageDB(config.dbPath);
-  const projects = db.listProjects();
-  if (projects.length === 0) {
-    console.log("[BrowserTrack] No projects registered yet. Projects will be auto-detected upon browser connection.");
-  } else {
-    console.log("\nTracked Projects:");
-    for (const p of projects) {
-      console.log(`  \u2022 ${p.name.padEnd(16)} | ${p.origin.padEnd(26)} | ${p.path || "(auto-detected)"}`);
-    }
-    console.log("");
-  }
-  db.close();
+  try {
+    const config = getDaemonConfig();
+    const db = new StorageDB(config.dbPath);
+    try {
+      const projects = db.listProjects();
+      if (projects.length === 0) {
+        console.log("[BrowserTrack] No projects registered yet. Projects will be auto-detected upon browser connection.");
+      } else {
+        console.log("\nTracked Projects:");
+        for (const p of projects) {
+          console.log(`  \u2022 ${p.name.padEnd(16)} | ${p.origin.padEnd(26)} | ${p.path || "(auto-detected)"}`);
+        }
+        console.log("");
+      }
+    } finally {
+      db.close();
+    }
+  } catch (err) {
+    console.error("[BrowserTrack] Failed to list projects:", err?.message || err);
+  }
 });
 program.command("errors").description("List recorded runtime errors and incidents").option("-p, --project <project>", "Filter by project name or ID").option("-s, --status <status>", "Filter by status (OPEN, VERIFIED, FAILED, etc.)").option("-l, --limit <number>", "Limit result count", "20").action((options) => {
-  const config = getDaemonConfig();
-  const db = new StorageDB(config.dbPath);
-  const limit = parseInt(options.limit, 10);
-  const incidents = db.listIncidents({
-    projectId: options.project,
-    status: options.status,
-    limit
-  });
-  if (incidents.length === 0) {
-    console.log("[BrowserTrack] No incidents found matching the filter.");
-  } else {
-    console.log(`
+  try {
+    const config = getDaemonConfig();
+    const db = new StorageDB(config.dbPath);
+    try {
+      const limit = parseInt(options.limit, 10);
+      const incidents = db.listIncidents({
+        projectId: options.project,
+        status: options.status,
+        limit
+      });
+      if (incidents.length === 0) {
+        console.log("[BrowserTrack] No incidents found matching the filter.");
+      } else {
+        console.log(`
 Incidents (${incidents.length}):`);
-    for (const inc of incidents) {
-      const statusBadge = inc.status === "OPEN" ? "\u{1F534} OPEN" : inc.status === "VERIFIED" ? "\u{1F7E2} VERIFIED" : inc.status === "FAILED" ? "\u274C FAILED" : `\u26AA ${inc.status}`;
-      console.log(`  ${inc.id.padEnd(12)} [${statusBadge}] (${inc.occurrences}x) ${inc.type}: ${inc.message}`);
-      console.log(`    Source: ${inc.source.file}:${inc.source.line} | Route: ${inc.route}`);
+        for (const inc of incidents) {
+          const statusBadge = inc.status === "OPEN" ? "\u{1F534} OPEN" : inc.status === "VERIFIED" ? "\u{1F7E2} VERIFIED" : inc.status === "FAILED" ? "\u274C FAILED" : `\u26AA ${inc.status}`;
+          console.log(`  ${inc.id.padEnd(12)} [${statusBadge}] (${inc.occurrences}x) ${inc.type}: ${inc.message}`);
+          console.log(`    Source: ${inc.source.file}:${inc.source.line} | Route: ${inc.route}`);
+        }
+        console.log("");
+      }
+    } finally {
+      db.close();
     }
-    console.log("");
+  } catch (err) {
+    console.error("[BrowserTrack] Failed to list incidents:", err?.message || err);
   }
-  db.close();
 });
 var noteCmd = program.command("note").description("Inspect or manage visual development notes");
 noteCmd.command("show <noteId>").description("Show full context for a specific visual note").action((noteId) => {
-  const config = getDaemonConfig();
-  const db = new StorageDB(config.dbPath);
-  const note = db.getNote(noteId);
-  if (!note) {
-    console.log(`[BrowserTrack] Note '${noteId}' not found.`);
-  } else {
-    console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
-    console.log(`  \u{1F4DD} Visual Note: ${note.id} [${note.status}]`);
-    console.log(`  \u{1F4CD} Route:       ${note.route} (${note.url})`);
-    console.log(`  \u{1F4D0} Viewport:    ${note.viewport.width} \xD7 ${note.viewport.height} (dpr: ${note.viewport.devicePixelRatio})`);
-    if (note.target) {
-      console.log(`  \u{1F3AF} Target:      ${note.target.selector}`);
-      console.log(`     Bounds:      x:${note.target.boundingRect.x}, y:${note.target.boundingRect.y}, ${note.target.boundingRect.width}\xD7${note.target.boundingRect.height}`);
-    }
-    console.log(`  \u{1F4AC} Note:        "${note.message}"`);
-    if (note.screenshots?.original) {
-      console.log(`  \u{1F5BC}\uFE0F  Screenshot:  ${note.screenshots.original}`);
-    }
-    console.log(`  \u{1F552} Created:     ${note.createdAt}`);
-    console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+  try {
+    const config = getDaemonConfig();
+    const db = new StorageDB(config.dbPath);
+    try {
+      const note = db.getNote(noteId);
+      if (!note) {
+        console.log(`[BrowserTrack] Note '${noteId}' not found.`);
+      } else {
+        console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+        console.log(`  \u{1F4DD} Visual Note: ${note.id} [${note.status}]`);
+        console.log(`  \u{1F4CD} Route:       ${note.route} (${note.url})`);
+        console.log(`  \u{1F4D0} Viewport:    ${note.viewport.width} \xD7 ${note.viewport.height} (dpr: ${note.viewport.devicePixelRatio})`);
+        if (note.target) {
+          console.log(`  \u{1F3AF} Target:      ${note.target.selector}`);
+          console.log(`     Bounds:      x:${note.target.boundingRect.x}, y:${note.target.boundingRect.y}, ${note.target.boundingRect.width}\xD7${note.target.boundingRect.height}`);
+        }
+        console.log(`  \u{1F4AC} Note:        "${note.message}"`);
+        if (note.screenshots?.original) {
+          console.log(`  \u{1F5BC}\uFE0F  Screenshot:  ${note.screenshots.original}`);
+        }
+        console.log(`  \u{1F552} Created:     ${note.createdAt}`);
+        console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+      }
+    } finally {
+      db.close();
+    }
+  } catch (err) {
+    console.error("[BrowserTrack] Failed to retrieve note:", err?.message || err);
   }
-  db.close();
 });
 noteCmd.command("resolve <noteId>").description("Mark a visual note as resolved").action((noteId) => {
-  const config = getDaemonConfig();
-  const db = new StorageDB(config.dbPath);
-  const note = db.getNote(noteId);
-  if (!note) {
-    console.log(`[BrowserTrack] Note '${noteId}' not found.`);
-  } else {
-    db.updateNoteStatus(noteId, "RESOLVED");
-    console.log(`[BrowserTrack] Marked note '${noteId}' as RESOLVED.`);
-  }
-  db.close();
+  try {
+    const config = getDaemonConfig();
+    const db = new StorageDB(config.dbPath);
+    try {
+      const note = db.getNote(noteId);
+      if (!note) {
+        console.log(`[BrowserTrack] Note '${noteId}' not found.`);
+      } else {
+        db.updateNoteStatus(noteId, "RESOLVED");
+        console.log(`[BrowserTrack] Marked note '${noteId}' as RESOLVED.`);
+      }
+    } finally {
+      db.close();
+    }
+  } catch (err) {
+    console.error("[BrowserTrack] Failed to resolve note:", err?.message || err);
+  }
 });
 noteCmd.command("reopen <noteId>").description("Reopen a visual note").action((noteId) => {
-  const config = getDaemonConfig();
-  const db = new StorageDB(config.dbPath);
-  const note = db.getNote(noteId);
-  if (!note) {
-    console.log(`[BrowserTrack] Note '${noteId}' not found.`);
-  } else {
-    db.updateNoteStatus(noteId, "OPEN");
-    console.log(`[BrowserTrack] Reopened note '${noteId}' (status: OPEN).`);
-  }
-  db.close();
+  try {
+    const config = getDaemonConfig();
+    const db = new StorageDB(config.dbPath);
+    try {
+      const note = db.getNote(noteId);
+      if (!note) {
+        console.log(`[BrowserTrack] Note '${noteId}' not found.`);
+      } else {
+        db.updateNoteStatus(noteId, "OPEN");
+        console.log(`[BrowserTrack] Reopened note '${noteId}' (status: OPEN).`);
+      }
+    } finally {
+      db.close();
+    }
+  } catch (err) {
+    console.error("[BrowserTrack] Failed to reopen note:", err?.message || err);
+  }
 });
 program.command("notes").description("List visual development notes").option("-p, --project <project>", "Filter by project name or ID").option("-s, --status <status>", "Filter by status (OPEN, RESOLVED, etc.)").option("-l, --limit <number>", "Limit result count", "20").action((options) => {
-  const config = getDaemonConfig();
-  const db = new StorageDB(config.dbPath);
-  const limit = parseInt(options.limit, 10);
-  const notes = db.listNotes({
-    projectId: options.project,
-    status: options.status,
-    limit
-  });
-  if (notes.length === 0) {
-    console.log("[BrowserTrack] No visual notes found.");
-  } else {
-    console.log(`
+  try {
+    const config = getDaemonConfig();
+    const db = new StorageDB(config.dbPath);
+    try {
+      const limit = parseInt(options.limit, 10);
+      const notes = db.listNotes({
+        projectId: options.project,
+        status: options.status,
+        limit
+      });
+      if (notes.length === 0) {
+        console.log("[BrowserTrack] No visual notes found.");
+      } else {
+        console.log(`
 Visual Notes (${notes.length}):`);
-    for (const n of notes) {
-      const badge = n.status === "OPEN" ? "\u{1F7E1} OPEN" : n.status === "RESOLVED" ? "\u{1F7E2} RESOLVED" : `\u26AA ${n.status}`;
-      console.log(`  ${n.id.padEnd(12)} [${badge}] Route: ${n.route.padEnd(16)} | Target: ${n.target?.selector || n.type}`);
-      console.log(`    Note: "${n.message}" (${n.viewport.width}\xD7${n.viewport.height})`);
+        for (const n of notes) {
+          const badge = n.status === "OPEN" ? "\u{1F7E1} OPEN" : n.status === "RESOLVED" ? "\u{1F7E2} RESOLVED" : `\u26AA ${n.status}`;
+          console.log(`  ${n.id.padEnd(12)} [${badge}] Route: ${n.route.padEnd(16)} | Target: ${n.target?.selector || n.type}`);
+          console.log(`    Note: "${n.message}" (${n.viewport.width}\xD7${n.viewport.height})`);
+        }
+        console.log("");
+      }
+    } finally {
+      db.close();
     }
-    console.log("");
+  } catch (err) {
+    console.error("[BrowserTrack] Failed to list visual notes:", err?.message || err);
   }
-  db.close();
 });
 program.command("inbox").description("View combined developer inbox with active runtime errors and visual notes").option("-p, --project <project>", "Filter by project name or ID").action((options) => {
-  const config = getDaemonConfig();
-  const db = new StorageDB(config.dbPath);
-  const incidents = db.listIncidents({ projectId: options.project, status: "OPEN", limit: 20 });
-  const notes = db.listNotes({ projectId: options.project, status: "OPEN", limit: 20 });
-  console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
-  console.log(`  \u{1F4E5} Browser Development Inbox ${options.project ? `(${options.project})` : ""}`);
-  console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
-  if (incidents.length === 0 && notes.length === 0) {
-    console.log("  \u2728 All clear! No open errors or visual notes.");
-  } else {
-    if (incidents.length > 0) {
-      console.log(`
+  try {
+    const config = getDaemonConfig();
+    const db = new StorageDB(config.dbPath);
+    try {
+      const incidents = db.listIncidents({ projectId: options.project, status: "OPEN", limit: 20 });
+      const notes = db.listNotes({ projectId: options.project, status: "OPEN", limit: 20 });
+      console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+      console.log(`  \u{1F4E5} Browser Development Inbox ${options.project ? `(${options.project})` : ""}`);
+      console.log("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+      if (incidents.length === 0 && notes.length === 0) {
+        console.log("  \u2728 All clear! No open errors or visual notes.");
+      } else {
+        if (incidents.length > 0) {
+          console.log(`
   \u{1F6A8} Runtime Errors (${incidents.length}):`);
-      for (const inc of incidents) {
-        console.log(`    \u2022 ${inc.id} (${inc.occurrences}x) ${inc.type}: ${inc.message}`);
-        console.log(`      Route: ${inc.route} | Source: ${inc.source.file}:${inc.source.line}`);
-      }
-    }
-    if (notes.length > 0) {
-      console.log(`
+          for (const inc of incidents) {
+            console.log(`    \u2022 ${inc.id} (${inc.occurrences}x) ${inc.type}: ${inc.message}`);
+            console.log(`      Route: ${inc.route} | Source: ${inc.source.file}:${inc.source.line}`);
+          }
+        }
+        if (notes.length > 0) {
+          console.log(`
   \u{1F4DD} Visual Notes (${notes.length}):`);
-      for (const n of notes) {
-        console.log(`    \u2022 ${n.id} on ${n.route} (${n.viewport.width}\xD7${n.viewport.height})`);
-        console.log(`      Target: ${n.target?.selector || n.type} | Note: "${n.message}"`);
+          for (const n of notes) {
+            console.log(`    \u2022 ${n.id} on ${n.route} (${n.viewport.width}\xD7${n.viewport.height})`);
+            console.log(`      Target: ${n.target?.selector || n.type} | Note: "${n.message}"`);
+          }
+        }
       }
+      console.log("\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
+    } finally {
+      db.close();
     }
+  } catch (err) {
+    console.error("[BrowserTrack] Failed to display inbox:", err?.message || err);
   }
-  console.log("\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501");
-  db.close();
 });
 program.command("clear").description("Clear all stored incidents, events, and sessions from the database").action(() => {
-  const config = getDaemonConfig();
-  const db = new StorageDB(config.dbPath);
-  db.clearAll();
-  console.log("[BrowserTrack] Database cleared.");
-  db.close();
+  try {
+    const config = getDaemonConfig();
+    const db = new StorageDB(config.dbPath);
+    try {
+      db.clearAll();
+      console.log("[BrowserTrack] Database cleared.");
+    } finally {
+      db.close();
+    }
+  } catch (err) {
+    console.error("[BrowserTrack] Failed to clear database:", err?.message || err);
+  }
 });
-program.command("mcp").description("Launch the Model Context Protocol (MCP) server over stdio").action(async () => {
+program.command("mcp").description("Launch the Model Context Protocol (MCP) server over stdio").option("--no-daemon", "Do not auto-start background daemon if offline").action(async (options) => {
   try {
-    const server = createMcpServer();
+    console.log = (...args) => {
+      console.error(...args);
+    };
+    const server = createMcpServer({
+      autoStartDaemon: options.daemon !== false
+    });
     await server.startStdio();
   } catch (err) {
     console.error("[BrowserTrack] MCP Server error:", err?.message);