cdpilot 0.8.0 → 0.9.0

package/src/cdpilot.py

@@ -14,7 +14,7 @@ Environment:
   CDPILOT_PROFILE      Isolated browser profile directory
 """
 
-__version__ = "0.8.0"
+__version__ = "0.9.0"
 
 import asyncio
 import atexit
@@ -236,7 +236,80 @@ window.__cdpilot_waitFor = function(selector, timeout) {
 #   - Idempotent: guarded by window.__cdpilot_stealth flag.
 #   - Fails silently per-patch; one failure cannot break the page.
 #   - Opt-in via `cdpilot stealth on`. Default OFF for backward compatibility.
-STEALTH_JS = r"""
+#
+# THREE-TIER MODEL (crawl4ai-style regular -> stealth -> undetected):
+#   - regular     : NO fingerprint patch injected at all. Cleanest, fastest,
+#                   relies only on --disable-blink-features=AutomationControlled
+#                   set at launch. Lowest entropy -> fewest leaks. Default tier.
+#   - stealth     : STEALTH_JS_LIGHT - webdriver + chrome.runtime + permissions
+#                   reconcile ONLY. Deliberately OMITS the plugin-array spoof,
+#                   which Stealth Bench V1 proved is itself a leak source
+#                   (bot.sannysoft.com surfaced garbage plugin filenames like
+#                   "rCJMteXy" from the synthetic PluginArray). Light tier is a
+#                   strict subset of FULL.
+#   - undetected  : STEALTH_JS_FULL - the full body (light subset + plugins +
+#                   Worker patch + WebGL vendor + hardwareConcurrency). Highest
+#                   plausibility on naive checks but highest entropy; pair with
+#                   behavioral entropy/humanize for the hardest targets.
+#
+# STEALTH_JS retains the FULL body for backward compatibility - every existing
+# reference (`cdpilot stealth on`, adaptive escalation) maps to undetected.
+
+# Light tier: the SAFE subset. webdriver + chrome.runtime + permissions only.
+# No plugin spoofing (bench leak), no WebGL vendor override, no Worker wrap.
+STEALTH_JS_LIGHT = r"""
+(function() {
+  'use strict';
+  if (window.__cdpilot_stealth) return;
+  try { Object.defineProperty(window, '__cdpilot_stealth', {value: true, writable: false, configurable: false}); } catch(e) {}
+
+  // 1) navigator.webdriver - only patch if it's actually `true`.
+  try {
+    var wdValue;
+    try { wdValue = navigator.webdriver; } catch (_) {}
+    if (wdValue === true) {
+      Object.defineProperty(Navigator.prototype, 'webdriver', {
+        get: function() { return false; },
+        configurable: true
+      });
+    }
+  } catch (e) {}
+
+  // 2) window.chrome - real Chrome exposes chrome.runtime even without extensions
+  try {
+    if (!window.chrome) {
+      window.chrome = {};
+    }
+    if (!window.chrome.runtime) {
+      window.chrome.runtime = {
+        OnInstalledReason: {}, OnRestartRequiredReason: {}, PlatformArch: {},
+        PlatformNackArch: {}, PlatformOs: {}, RequestUpdateCheckStatus: {}
+      };
+    }
+    if (typeof window.chrome.app === 'undefined') {
+      window.chrome.app = { isInstalled: false, InstallState: {}, RunningState: {} };
+    }
+  } catch (e) {}
+
+  // 3) Permissions.query - reconcile with Notification.permission (classic tell)
+  try {
+    if (navigator.permissions && navigator.permissions.query) {
+      var origQuery = navigator.permissions.query.bind(navigator.permissions);
+      navigator.permissions.query = function(p) {
+        if (p && p.name === 'notifications') {
+          return Promise.resolve({ state: Notification.permission, onchange: null });
+        }
+        return origQuery(p);
+      };
+    }
+  } catch (e) {}
+})();
+"""
+
+# Full tier (a.k.a. "undetected"): the complete body. Light subset + plugin
+# array + Worker patch + WebGL vendor + hardwareConcurrency. STEALTH_JS is kept
+# as an alias of FULL so every legacy reference still resolves.
+STEALTH_JS_FULL = r"""
 (function() {
   'use strict';
   if (window.__cdpilot_stealth) return;
@@ -404,6 +477,11 @@ STEALTH_JS = r"""
 })();
 """
 
+# Backward-compat alias: STEALTH_JS == the FULL (undetected) body. Every legacy
+# reference (`cdpilot stealth on`, adaptive escalation, navigate inject) keeps
+# resolving to the full patch set, exactly as before the three-tier split.
+STEALTH_JS = STEALTH_JS_FULL
+
 # ─── CAPTCHA Detection ────────────────────────────────────────────────────────
 # Read-only DOM probe. Detects common CAPTCHA/challenge providers post-navigation.
 # Returns JSON string: {"detected": bool, "types": [...], "details": [...]}
@@ -461,6 +539,14 @@ CAPTCHA_DETECT_JS = r"""
       add('geetest', 'GeeTest');
     }
 
+    // Amazon classic image CAPTCHA ("Type the characters you see in this image")
+    // Solvable locally with the optional amazoncaptcha library (image OCR).
+    var amzInput = document.querySelector('#captchacharacters');
+    var amzImg = document.querySelector('img[src*="opfcaptcha"], img[src*="captcha"][src*="images-na.ssl-images-amazon.com"], form[action*="/errors/validateCaptcha"] img');
+    if (amzInput && amzImg) {
+      add('amazon-classic', 'Amazon', { img_src: amzImg.src, input_id: amzInput.id || 'captchacharacters' });
+    }
+
     return JSON.stringify(result);
   } catch (e) {
     return JSON.stringify({ detected: false, error: String(e) });
@@ -468,9 +554,127 @@ CAPTCHA_DETECT_JS = r"""
 })()
 """
 
+# ─── Progressive-Resilience Escalation Ladder ───
+# Real sites stack defenses incrementally (sahibinden.com pattern: random
+# captcha -> rate-limit -> login-wall -> SMS/OTP). CAPTCHA_DETECT_JS only sees
+# the captcha rung. FRICTION_DETECT_JS detects the OTHER friction rungs purely
+# from the DOM (read-only) and reports the HIGHEST one present. Bilingual
+# (Turkish + English) keyword heuristics — TR sites are first-class.
+#
+# Ladder (low -> high):
+#   none          normal page
+#   rate_limited  HTTP 429 markers, "too many requests" / "çok fazla istek"
+#   soft_captcha  (handled by CAPTCHA_DETECT_JS, merged in _detect_friction)
+#   login_wall    login form gating the real content (sign in / giriş yap)
+#   otp_sms       verification-code / OTP / SMS input
+#   hard_block    access denied / banned / 403 forbidden, no content
+FRICTION_DETECT_JS = r"""
+(function() {
+  try {
+    var out = { level: 'none', signals: [], detail: '' };
+    var bodyText = (document.body ? (document.body.innerText || '') : '').toLowerCase();
+    var titleText = (document.title || '').toLowerCase();
+    var hay = titleText + ' \n ' + bodyText;
+    var sample = hay.slice(0, 6000);
+    var hasAny = function(words) {
+      for (var i = 0; i < words.length; i++) {
+        if (sample.indexOf(words[i]) >= 0) return words[i];
+      }
+      return null;
+    };
+
+    // ── hard_block (highest) ──
+    var blockWords = [
+      'access denied', 'access to this page has been denied', 'you have been blocked',
+      'permanently banned', 'ip has been banned', '403 forbidden', 'forbidden',
+      'erişim engellendi', 'erişiminiz engellendi', 'engellendiniz', 'yasaklandı',
+      'reddedildi', 'banlandı'
+    ];
+    var blockHit = hasAny(blockWords);
+    // Only treat as a hard block when the page has almost no real content
+    // (block pages are typically tiny). Avoids false positives on articles
+    // that merely mention these words.
+    var thinPage = bodyText.replace(/\s+/g, ' ').trim().length < 600;
+
+    // ── otp_sms ──
+    var otpWords = [
+      'verification code', 'one-time code', 'one time password', 'otp',
+      'sms code', 'code sent to your phone', 'enter the code',
+      'doğrulama kodu', 'onay kodu', 'tek kullanımlık', 'telefonunuza gönderilen',
+      'sms ile gönderilen', 'sms doğrulama', 'kodu girin'
+    ];
+    var otpInput = document.querySelector(
+      'input[autocomplete="one-time-code"], input[name*="otp" i], input[id*="otp" i], ' +
+      'input[name*="code" i][maxlength], input[name*="sms" i], input[name*="verification" i], ' +
+      'input[id*="verification" i], input[name*="dogrulama" i], input[id*="dogrulama" i]'
+    );
+    var otpWordHit = hasAny(otpWords);
+
+    // ── login_wall ──
+    var pwInput = document.querySelector('input[type="password"]');
+    var loginForm = document.querySelector(
+      'form[action*="login" i], form[action*="signin" i], form[action*="giris" i], form[id*="login" i]'
+    );
+    var loginWords = [
+      'sign in', 'log in', 'login to continue', 'please sign in', 'you must be logged in',
+      'create an account to continue', 'sign in to continue',
+      'giriş yap', 'oturum aç', 'giriş yapın', 'üye girişi', 'devam etmek için giriş',
+      'giriş yapmalısınız', 'lütfen giriş yapın', 'hesabınıza giriş'
+    ];
+    var loginWordHit = hasAny(loginWords);
+
+    // ── rate_limited ──
+    var rateWords = [
+      'too many requests', 'rate limit', 'rate limited', 'slow down',
+      'you are being rate limited', 'request limit', 'try again later',
+      'çok fazla istek', 'çok sık istek', 'lütfen yavaşlayın', 'yavaşlayın',
+      'istek sınırı', 'çok hızlı', 'daha sonra tekrar deneyin', 'güvenlik doğrulaması'
+    ];
+    var rateWordHit = hasAny(rateWords);
+    // 429 surfaced into DOM (some sites print the status), or retry-after hint
+    var rate429 = /\b429\b/.test(sample) && (sample.indexOf('request') >= 0 || sample.indexOf('istek') >= 0 || rateWordHit);
+    var retryAfter = /retry[\s-]?after/.test(sample);
+
+    // Decide highest rung present.
+    if (blockHit && thinPage) {
+      out.level = 'hard_block';
+      out.signals.push('keyword:' + blockHit);
+      out.detail = 'Access denied / banned page with no real content.';
+    } else if (otpWordHit || otpInput) {
+      out.level = 'otp_sms';
+      if (otpWordHit) out.signals.push('keyword:' + otpWordHit);
+      if (otpInput) out.signals.push('input:otp');
+      out.detail = 'SMS/OTP verification prompt detected.';
+    } else if ((pwInput || loginForm) && loginWordHit) {
+      out.level = 'login_wall';
+      out.signals.push('keyword:' + loginWordHit);
+      if (pwInput) out.signals.push('input:password');
+      if (loginForm) out.signals.push('form:login');
+      out.detail = 'Login wall gating the page content.';
+    } else if (loginWordHit && loginForm) {
+      out.level = 'login_wall';
+      out.signals.push('keyword:' + loginWordHit);
+      out.signals.push('form:login');
+      out.detail = 'Login wall gating the page content.';
+    } else if (rateWordHit || rate429 || retryAfter) {
+      out.level = 'rate_limited';
+      if (rateWordHit) out.signals.push('keyword:' + rateWordHit);
+      if (rate429) out.signals.push('status:429');
+      if (retryAfter) out.signals.push('hint:retry-after');
+      out.detail = 'Rate-limit signal detected on page.';
+    }
+
+    return JSON.stringify(out);
+  } catch (e) {
+    return JSON.stringify({ level: 'none', signals: [], detail: '', error: String(e) });
+  }
+})()
+"""
+
 PROXY_CONFIG_FILE = os.path.join(PROFILE_DIR, 'proxy.json')
 HEADLESS_CONFIG_FILE = os.path.join(PROFILE_DIR, 'headless.json')
 STEALTH_CONFIG_FILE = os.path.join(PROFILE_DIR, 'stealth.json')
+MODE_CONFIG_FILE = os.path.join(PROFILE_DIR, 'mode.json')
 BLOCK_CONFIG_FILE = os.path.join(PROFILE_DIR, 'block.json')
 CAPTCHA_PROVIDERS_FILE = os.path.join(CDPILOT_HOME, 'captcha-providers.json')
 CAPTCHA_AUTO_FILE = os.path.join(PROFILE_DIR, 'captcha-auto.json')
@@ -480,6 +684,10 @@ ADAPTIVE_CONFIG_FILE = os.path.join(PROFILE_DIR, 'adaptive.json')
 ENTROPY_CONFIG_FILE = os.path.join(PROFILE_DIR, 'entropy.json')
 DOWNLOAD_CONFIG_FILE = os.path.join(PROFILE_DIR, 'download-config.json')
 SESSION_FILE = os.path.join(PROFILE_DIR, 'sessions.json')
+# Tabs that cdpilot itself opened (via go / new-tab / smart-click). The smart
+# `close` command only touches these — user tabs opened manually in the same
+# isolated profile are left alone.
+OWNED_TABS_FILE = os.path.join(PROFILE_DIR, 'owned-tabs.json')
 COOKIES_DIR = os.path.join(CDPILOT_HOME, 'cookies')
 COOKIES_AUTO_CONFIG_FILE = os.path.join(PROFILE_DIR, 'cookies-auto.json')
 CF_CLEARANCE_COOKIES = frozenset({'cf_clearance', '__cf_bm', '_cfuvid'})
@@ -1030,6 +1238,9 @@ def _create_session_window():
             "last_used": time.time(),
         }
         _save_sessions(sessions)
+        # Freshly created by cdpilot -> owned. (The reuse branch above does not
+        # mark, since that tab may have been opened by the user.)
+        _mark_owned_tab(target_id)
 
     return target_id
 
@@ -1405,11 +1616,16 @@ async def navigate_collect(ws_url, url, network=False, console=False, glow=True)
         # as long as this connection lives — which is exactly the window we
         # need (until Page.loadEventFired below). Stealth must run before
         # any page script inspects navigator; addScript guarantees that.
-        stealth_active = get_stealth_config()
-        if stealth_active:
+        #
+        # Three-tier selection: regular -> inject nothing, stealth -> LIGHT,
+        # undetected -> FULL. get_mode_config() folds in the legacy stealth
+        # toggle and the CDPILOT_STEALTH env var (set during adaptive
+        # escalation) so existing behavior is preserved.
+        stealth_source = stealth_js_for_tier(get_mode_config())
+        if stealth_source:
             await ws.send(json.dumps({
                 "id": 50, "method": "Page.addScriptToEvaluateOnNewDocument",
-                "params": {"source": STEALTH_JS}
+                "params": {"source": stealth_source}
             }))
 
         # Apply request blocking BEFORE navigate, on this same WS session.
@@ -1959,6 +2175,105 @@ def get_headless_config():
     return False
 
 
+# ─── Three-tier stealth mode (crawl4ai-style escalation) ──────────────────────
+# Tiers, weakest fingerprint footprint -> strongest spoof:
+#   regular    -> inject NOTHING (cleanest, default)
+#   stealth    -> STEALTH_JS_LIGHT (webdriver/chrome.runtime/permissions only)
+#   undetected -> STEALTH_JS_FULL  (light + plugins + WebGL + Worker)
+MODE_TIERS = ('regular', 'stealth', 'undetected')
+DEFAULT_MODE_TIER = 'regular'
+
+
+def get_mode_config():
+    """Return the active stealth tier as a string in MODE_TIERS.
+
+    Resolution order: CDPILOT_MODE env -> mode.json -> legacy stealth on/off
+    -> DEFAULT_MODE_TIER. Legacy `cdpilot stealth on` (no mode.json present)
+    maps to 'undetected' so the old binary toggle still produces the full
+    patch set; `stealth off` (or absent) keeps 'regular'.
+    """
+    env = os.environ.get('CDPILOT_MODE', '').strip().lower()
+    if env in MODE_TIERS:
+        return env
+    if os.path.exists(MODE_CONFIG_FILE):
+        try:
+            with open(MODE_CONFIG_FILE) as f:
+                tier = json.load(f).get('tier', DEFAULT_MODE_TIER)
+            if tier in MODE_TIERS:
+                return tier
+        except (OSError, ValueError):
+            pass
+    # Backwards-compat: no explicit mode set — honor the legacy stealth toggle.
+    # stealth on -> undetected (full), stealth off -> regular (clean).
+    return 'undetected' if get_stealth_config() else DEFAULT_MODE_TIER
+
+
+def set_mode_config(tier):
+    """Persist the active tier to mode.json. Returns the normalized tier."""
+    tier = (tier or '').strip().lower()
+    if tier not in MODE_TIERS:
+        raise ValueError(f"invalid tier: {tier!r}")
+    _atomic_write_json(MODE_CONFIG_FILE, {'tier': tier})
+    return tier
+
+
+def stealth_js_for_tier(tier):
+    """Return the fingerprint patch JS for a tier, or None for 'regular'.
+
+    regular    -> None (inject nothing)
+    stealth    -> STEALTH_JS_LIGHT
+    undetected -> STEALTH_JS_FULL
+    """
+    if tier == 'stealth':
+        return STEALTH_JS_LIGHT
+    if tier == 'undetected':
+        return STEALTH_JS_FULL
+    return None
+
+
+def cmd_mode(tier=None):
+    """Get or set the three-tier stealth mode (regular | stealth | undetected).
+
+    Usage:
+      cdpilot mode                 # show current tier + what it injects
+      cdpilot mode regular         # no fingerprint patch (cleanest, fastest)
+      cdpilot mode stealth         # light patch: webdriver/chrome.runtime/perms
+      cdpilot mode undetected      # full patch: + plugins + WebGL + Worker
+
+    Default: regular. Stealth Bench V1 found that the full patch set ALONE
+    lowered scores (-6.3p) because the synthetic plugin array leaks, while
+    light host-learning gained (+6.3p). The 'stealth' tier omits plugin
+    spoofing for this reason. Escalate to 'undetected' only for hard targets.
+    Effect applies on the NEXT navigation. Env override: CDPILOT_MODE=<tier>.
+    """
+    if tier is None or tier.strip().lower() in ('', 'status'):
+        current = get_mode_config()
+        patch = {
+            'regular': 'none (no fingerprint patch — cleanest)',
+            'stealth': 'STEALTH_JS_LIGHT (webdriver, chrome.runtime, permissions)',
+            'undetected': 'STEALTH_JS_FULL (light + plugins + WebGL + Worker)',
+        }[current]
+        print(f'Mode: {current}')
+        print(f'  Injects: {patch}')
+        return
+    t = tier.strip().lower()
+    if t not in MODE_TIERS:
+        print(f"Invalid tier: {tier}. Use one of: {', '.join(MODE_TIERS)}.", file=sys.stderr)
+        sys.exit(1)
+    set_mode_config(t)
+    # Keep the legacy stealth toggle coherent so `stealth status` and any code
+    # still reading get_stealth_config() agree with the tier:
+    #   regular   -> stealth off
+    #   stealth   -> stealth on  (a patch IS injected, just the light one)
+    #   undetected-> stealth on
+    try:
+        _atomic_write_json(STEALTH_CONFIG_FILE, {'stealth': t != 'regular'})
+    except Exception:
+        pass
+    print(f'Mode: {t}')
+    print('Effect applies on next navigation (`cdpilot go <url>`).')
+
+
 def get_stealth_config():
     """Return whether stealth fingerprint patches are enabled.
 
@@ -2012,6 +2327,31 @@ def _sanitize_profile_state(profile_dir):
 
 # ─── Commands ───
 
+def _minimize_browser_window():
+    """Minimize the browser window via CDP (Browser.setWindowBounds).
+
+    Reliable on macOS where negative --window-position is clamped back on
+    screen. Uses cdpilot's own async cdp_send over the browser-level WS —
+    no new dependency. Best-effort: any failure is swallowed by the caller.
+    """
+    ver = cdp_get('/json/version') or {}
+    ws_url = ver.get('webSocketDebuggerUrl')
+    if not ws_url:
+        return
+
+    async def _do():
+        r = await cdp_send(ws_url, [(1, "Browser.getWindowForTarget", {})])
+        win_id = ((r.get(1) or {}).get("result") or {}).get("windowId")
+        if win_id is None:
+            win_id = 1
+        await cdp_send(ws_url, [(2, "Browser.setWindowBounds", {
+            "windowId": win_id,
+            "bounds": {"windowState": "minimized"},
+        })])
+
+    asyncio.run(_do())
+
+
 def cmd_launch():
     """Launch the browser with CDP enabled (isolated session — does not touch existing browser)."""
     global CHROME_BIN, CDP_PORT, CDP_BASE
@@ -2098,6 +2438,12 @@ def cmd_launch():
             'InterestFeedContentSuggestions', 'CalculateNativeWinOcclusion',
             'PasswordManagerOnboarding', 'AutofillServerCommunication',
         ]),
+        # Anti-bot leak fix (2026-05-31): Chrome's blink runtime exposes an
+        # "automation controlled" flag when --remote-debugging-port is set;
+        # Patchright/nodriver disable this. Even though navigator.webdriver
+        # already reads false on vanilla Brave/Chrome, deeper detectors
+        # (Cloudflare/Datadome behavioral) probe the blink flag directly.
+        '--disable-blink-features=AutomationControlled',
         # ─── Chromium performance flags ───
         '--disable-background-networking',
         '--disable-background-timer-throttling',
@@ -2128,6 +2474,17 @@ def cmd_launch():
         '--new-window', 'about:blank',
     ]
 
+    # Off-screen window placement (opt-in). Keeps the browser HEADED (anti-bot
+    # detection still sees a real window / GPU) but parks it far off the visible
+    # desktop so it never steals focus or pops in front of the user — ideal for
+    # long bench runs on a workstation. CDPILOT_OFFSCREEN=1 or a custom
+    # CDPILOT_WINDOW_POSITION="x,y". No effect on headless.
+    _win_pos = os.environ.get('CDPILOT_WINDOW_POSITION', '')
+    if not _win_pos and os.environ.get('CDPILOT_OFFSCREEN') in ('1', 'true', 'yes', 'on'):
+        _win_pos = '-3000,-3000'
+    if _win_pos:
+        chrome_args.append(f'--window-position={_win_pos}')
+
     # Dev extensions
     dev_exts = get_dev_extensions()
     valid_exts = [p for p in dev_exts if os.path.isdir(p)]
@@ -2154,6 +2511,16 @@ def cmd_launch():
         if cdp_get('/json/version'):
             if PROJECT_ID:
                 _register_project(PROJECT_ID, CDP_PORT, PROFILE_DIR, pid=proc.pid)
+            # Off-screen / minimized placement (opt-in). Keeps the browser
+            # HEADED (anti-bot still sees a real GPU-backed window) but parks it
+            # out of the way so long bench runs never steal focus or pop in
+            # front of the user. macOS clamps negative --window-position, so we
+            # also minimize via CDP (Browser.setWindowBounds) which is reliable.
+            if os.environ.get('CDPILOT_OFFSCREEN') in ('1', 'true', 'yes', 'on'):
+                try:
+                    _minimize_browser_window()
+                except Exception:
+                    pass
             proj_label = f' [{PROJECT_ID}]' if PROJECT_ID else ''
             print(f'CDP ready! (port {CDP_PORT}){proj_label}')
             return
@@ -2177,6 +2544,9 @@ async def cmd_go(url):
         cmd_launch()
 
     ws, page = get_page_ws()
+    # Mark this tab as cdpilot-owned so a later `close` knows it can shut it.
+    if isinstance(page, dict):
+        _mark_owned_tab(page.get("id"))
 
     try:
         from urllib.parse import urlparse
@@ -2188,12 +2558,20 @@ async def cmd_go(url):
     adaptive_stealth = False
     is_known_hostile = _adaptive_host_requires_stealth(url)
 
-    # Adaptive mode: if this hostname is in the learned stealth-required list,
-    # temporarily enable stealth for the navigation that's about to happen.
-    if is_known_hostile and not get_stealth_config():
-        os.environ['CDPILOT_STEALTH'] = '1'
+    # Adaptive mode (tier-aware): if we learned a tier for this host, start the
+    # navigation at that tier via CDPILOT_MODE. Falls back to the legacy
+    # stealth_hosts list (-> 'stealth' tier) for hosts learned before tiers
+    # existed. CDPILOT_MODE takes precedence in get_mode_config().
+    learned_tier = _adaptive_host_tier(url)
+    if learned_tier and learned_tier != 'regular' and get_mode_config() == 'regular':
+        os.environ['CDPILOT_MODE'] = learned_tier
         adaptive_stealth = True
-        sys.stderr.write(f"🛡️  Adaptive: enabling stealth for known-hostile host\n")
+        sys.stderr.write(f"🛡️  Adaptive: starting at learned tier '{learned_tier}' for known-hostile host\n")
+    elif is_known_hostile and get_mode_config() == 'regular':
+        # Legacy stealth_hosts entry with no tier learned yet — start at light.
+        os.environ['CDPILOT_MODE'] = 'stealth'
+        adaptive_stealth = True
+        sys.stderr.write(f"🛡️  Adaptive: enabling stealth tier for known-hostile host\n")
 
     # Fix 1: Per-task context isolation (opt-in via CDPILOT_ADAPTIVE_FRESH_CONTEXT=1) — spawn a fresh BrowserContext when
     # adaptive is on and we know this host is hostile. Prevents cross-task
@@ -2231,6 +2609,44 @@ async def cmd_go(url):
         except Exception:
             pass
 
+        # Progressive-resilience friction probe (non-captcha rungs).
+        # rate_limited -> exponential backoff + re-nav (bounded). login/otp/hard
+        # -> stderr handoff warning only (NO autonomous bypass — ethics line).
+        # The captcha rung is left to the dedicated probe below.
+        try:
+            fr = await _detect_friction(active_ws)
+            fr_level = fr.get('level', 'none')
+            if fr_level == 'rate_limited' and _friction_backoff_enabled():
+                attempt = 0
+                while fr_level == 'rate_limited' and attempt < _friction_max_retry():
+                    wait_s = _friction_backoff_seconds(attempt)
+                    sys.stderr.write(
+                        f"⏳ Rate-limit tespit edildi ({','.join(fr.get('signals', [])) or '?'}); "
+                        f"{wait_s}s backoff, retry {attempt + 1}/{_friction_max_retry()}...\n")
+                    if expected_host:
+                        _adaptive_remember_host(expected_host)
+                    await asyncio.sleep(wait_s)
+                    await navigate_collect(active_ws, url)
+                    fr = await _detect_friction(active_ws)
+                    fr_level = fr.get('level', 'none')
+                    attempt += 1
+                if fr_level == 'rate_limited':
+                    sys.stderr.write("⚠️  Rate-limit backoff sonrası hâlâ sınırlı. Daha sonra deneyin.\n")
+                else:
+                    sys.stderr.write("✅ Rate-limit temizlendi.\n")
+            elif fr_level in ('login_wall', 'otp_sms', 'hard_block'):
+                act = _friction_action(fr_level)
+                payload = {'action': act['action'], 'url': url, 'level': fr_level,
+                           'signals': fr.get('signals', [])}
+                if act.get('backoff_suggested'):
+                    payload['backoff_suggested'] = True
+                # Human handoff: warn + emit JSON line, but DO NOT block the
+                # navigation (caller may still want the partial content).
+                sys.stderr.write(f"{act['message']}\n")
+                sys.stderr.write(json.dumps(payload, ensure_ascii=False) + "\n")
+        except Exception:
+            pass
+
         # Post-navigation CAPTCHA probe. Non-blocking: stderr warning only.
         try:
             info = await _detect_captcha(active_ws)
@@ -2238,20 +2654,26 @@ async def cmd_go(url):
                 types = ",".join(info.get("types", [])) or "unknown"
                 sys.stderr.write(f"⚠️  CAPTCHA tespit edildi ({types}). Çözüm için: cdpilot captcha-wait\n")
 
-                # Adaptive escalation: remember this host so the next visit
-                # starts in stealth. Re-nav is gated to once-per-call.
+                # Adaptive escalation (tier-aware): bump the host one tier up
+                # (regular -> stealth -> undetected), remember it, and re-nav
+                # once at the new tier. Re-nav is gated to once-per-call.
                 if cfg['enabled']:
+                    current_tier = get_mode_config()
+                    next_tier = _escalate_tier(current_tier)
                     if expected_host:
                         _adaptive_remember_host(expected_host)
-                        sys.stderr.write(f"🛡️  Adaptive: remembered {expected_host} as stealth-required\n")
+                        _adaptive_remember_host_tier(expected_host, next_tier)
+                        sys.stderr.write(f"🛡️  Adaptive: remembered {expected_host} at tier '{next_tier}'\n")
                         captcha_types = info.get('types', [])
                         _adaptive_remember_host_entropy(expected_host, captcha_types)
                         needs_entropy = any(CAPTCHA_ENTROPY_REQUIRED.get(t, True) for t in captcha_types)
                         if needs_entropy:
                             sys.stderr.write(f"🧬 Adaptive: per-host entropy enabled for {expected_host} ({','.join(captcha_types)})\n")
-                    if not adaptive_stealth and not get_stealth_config():
-                        sys.stderr.write("🛡️  Adaptive: retrying once with stealth on...\n")
-                        os.environ['CDPILOT_STEALTH'] = '1'
+                    # Only retry if escalation actually changes the tier (not
+                    # already at the undetected ceiling for this navigation).
+                    if next_tier != current_tier:
+                        sys.stderr.write(f"🛡️  Adaptive: retrying once at tier '{next_tier}'...\n")
+                        os.environ['CDPILOT_MODE'] = next_tier
                         # Fix 3: Idempotent re-nav — skip if already on target.
                         current_host = await _adaptive_current_host(active_ws)
                         norm = lambda h: h[4:] if h.startswith("www.") else h
@@ -2259,12 +2681,12 @@ async def cmd_go(url):
                             sys.stderr.write("🛡️  Adaptive: already on target host, skip re-nav\n")
                         else:
                             await navigate_collect(active_ws, url)
-                        # Re-probe after stealth re-nav
+                        # Re-probe after escalated re-nav
                         info2 = await _detect_captcha(active_ws)
                         if info2.get("detected"):
-                            sys.stderr.write("⚠️  Adaptive: CAPTCHA still present after stealth retry. Manual solve needed.\n")
+                            sys.stderr.write(f"⚠️  Adaptive: CAPTCHA still present after '{next_tier}' retry. Manual solve needed.\n")
                         else:
-                            sys.stderr.write("✅ Adaptive: CAPTCHA cleared with stealth.\n")
+                            sys.stderr.write(f"✅ Adaptive: CAPTCHA cleared at tier '{next_tier}'.\n")
                 # Captcha solver auto-mode: if provider configured + auto on, attempt solve
                 try:
                     await _captcha_auto_solve_if_enabled(active_ws, info, url)
@@ -2773,6 +3195,188 @@ async def _humanize_click(ws_url, x, y):
     await asyncio.sleep(r.uniform(0.08, 0.20))
 
 
+# ─── PerimeterX / HUMAN "Press & Hold" solver ───────────────────────────────
+# PerimeterX (HUMAN Security) gates content behind a button the user must press
+# AND HOLD for several seconds. The detector measures the mouse-hold *behaviour*
+# (press duration, micro-tremor during the hold, release timing) to tell a human
+# hand from a bot — it is NOT a token challenge, so there is nothing to fetch or
+# inject. The only way through is to emit a real, human-shaped press->hold->release
+# gesture. We reuse the existing humanized mouse path + Input.dispatchMouseEvent
+# (zero new deps, pure CDP) and add the natural hand-tremor PerimeterX looks for.
+
+# JS that locates the press-and-hold target and returns its viewport centre.
+# Tries the canonical #px-captcha / [class*="px-captcha"] hooks first, then any
+# element whose visible text matches "press & hold" / "press and hold" / the
+# Turkish "basili tut". Returns JSON: {found, cx, cy, w, h, how} or {found:false}.
+PRESS_HOLD_FIND_JS = r"""
+(function(userSel) {
+  try {
+    function centre(el, how) {
+      if (!el) return null;
+      try { el.scrollIntoView({behavior: 'instant', block: 'center'}); } catch (e) {}
+      var r = el.getBoundingClientRect();
+      if (r.width < 1 || r.height < 1) return null;
+      return JSON.stringify({
+        found: true,
+        cx: Math.round(r.left + r.width / 2),
+        cy: Math.round(r.top + r.height / 2),
+        w: Math.round(r.width), h: Math.round(r.height), how: how
+      });
+    }
+    if (userSel) {
+      var u = document.querySelector(userSel);
+      var cu = centre(u, 'user-selector');
+      if (cu) return cu;
+    }
+    // Canonical PerimeterX hooks.
+    var px = document.querySelector('#px-captcha, [class*="px-captcha"]');
+    if (px) {
+      // The visible hold target is often an inner button/div; prefer a child
+      // with real size, else the container itself.
+      var inner = px.querySelector('div[role="button"], button, [tabindex], div');
+      var ci = centre(inner, 'px-inner');
+      if (ci) return ci;
+      var cc = centre(px, 'px-container');
+      if (cc) return cc;
+    }
+    // Text-based fallback: any small interactive element saying press & hold.
+    var needles = ['press & hold', 'press and hold', 'press &amp; hold',
+                   'basili tut', 'basılı tut', 'press hold'];
+    var cands = document.querySelectorAll(
+      'button, [role="button"], div, span, a, p');
+    for (var i = 0; i < cands.length; i++) {
+      var el = cands[i];
+      var t = (el.textContent || '').toLowerCase().trim();
+      if (!t || t.length > 60) continue;
+      for (var j = 0; j < needles.length; j++) {
+        if (t.indexOf(needles[j]) >= 0) {
+          var ct = centre(el, 'text-match');
+          if (ct) return ct;
+        }
+      }
+    }
+    return JSON.stringify({ found: false });
+  } catch (e) {
+    return JSON.stringify({ found: false, error: String(e) });
+  }
+})
+"""
+
+
+def _press_hold_duration_ms():
+    """Gaussian-randomized hold duration in ms. mu~4000, clamped 3000..7000.
+
+    PerimeterX rejects a fixed duration (machine-like). We draw from a Gaussian
+    so each attempt looks individually human, then clamp to the band the widget
+    actually accepts.
+    """
+    return int(_gauss(4000, 900, 3000, 7000))
+
+
+async def _press_hold_gesture(ws_url, x, y, hold_ms):
+    """Emit one real press->hold(jitter)->release gesture at (x, y) over CDP.
+
+    1. Bezier-humanized mouse move to the target (reuses _humanize_mouse_move).
+    2. Input.dispatchMouseEvent mousePressed (button:left) at the target.
+    3. Hold loop: every 100-200ms emit a mouseMoved with +/-1-2px jitter WHILE the
+       left button stays pressed -- this is the natural hand-tremor PerimeterX
+       inspects. Total loop time == hold_ms.
+    4. Input.dispatchMouseEvent mouseReleased.
+    Returns the number of micro-jitter moves dispatched during the hold.
+    """
+    import random as _r
+    r = _r.Random(int(_ENTROPY_SEED)) if _ENTROPY_SEED else _r.Random()
+    # Land the cursor on the target with a human path + small final offset.
+    await _humanize_mouse_move(ws_url, x, y)
+    await asyncio.sleep(r.uniform(0.05, 0.18))
+    # Press and hold the left button at the target.
+    await cdp_send(ws_url, [(981, "Input.dispatchMouseEvent", {
+        "type": "mousePressed", "x": x, "y": y,
+        "button": "left", "buttons": 1, "clickCount": 1})])
+    jitters = 0
+    elapsed = 0.0
+    cur_x, cur_y = x, y
+    hold_s = hold_ms / 1000.0
+    while elapsed < hold_s:
+        step = r.uniform(0.10, 0.20)
+        # Don't overshoot the requested hold window.
+        if elapsed + step > hold_s:
+            step = max(0.0, hold_s - elapsed)
+        await asyncio.sleep(step)
+        elapsed += step
+        if elapsed >= hold_s:
+            break
+        # +/-1-2px tremor around the press point, button still held (buttons:1).
+        cur_x = x + r.randint(-2, 2)
+        cur_y = y + r.randint(-2, 2)
+        await cdp_send(ws_url, [(982, "Input.dispatchMouseEvent", {
+            "type": "mouseMoved", "x": cur_x, "y": cur_y,
+            "button": "left", "buttons": 1, "modifiers": 0})])
+        jitters += 1
+    # Release at (near) the press point.
+    await cdp_send(ws_url, [(983, "Input.dispatchMouseEvent", {
+        "type": "mouseReleased", "x": cur_x, "y": cur_y,
+        "button": "left", "buttons": 0, "clickCount": 1})])
+    return jitters
+
+
+async def _solve_press_and_hold(ws_url, target_sel=None):
+    """Solve a PerimeterX/HUMAN "Press & Hold" challenge with a humanized gesture.
+
+    Finds the hold target (#px-captcha / [class*="px-captcha"] / press-and-hold
+    text, or an explicit target_sel), then performs press->hold(with micro-tremor)
+    ->release. Verifies via _detect_captcha; retries once with a different hold
+    duration if the challenge is still present.
+
+    Returns: {"solved": bool, "method": "press_and_hold", "hold_ms": N,
+              "attempts": N, ...}. Never raises.
+    """
+    last_hold = 0
+    attempts = 0
+    max_attempts = 2
+    for attempts in range(1, max_attempts + 1):
+        # (Re)locate the target each attempt -- the widget may re-render.
+        try:
+            find_expr = f"({PRESS_HOLD_FIND_JS})({json.dumps(target_sel) if target_sel else 'null'})"
+            res = await cdp_send(ws_url, [(1, "Runtime.evaluate", {
+                "expression": find_expr, "returnByValue": True})], timeout=8)
+            raw = res.get(1, {}).get("result", {}).get("value")
+            loc = json.loads(raw) if raw else {"found": False}
+        except Exception as e:
+            return {"solved": False, "method": "press_and_hold",
+                    "hold_ms": last_hold, "attempts": attempts,
+                    "error": f"locate_failed:{str(e)[:80]}"}
+        if not loc.get("found"):
+            return {"solved": False, "method": "press_and_hold",
+                    "hold_ms": last_hold, "attempts": attempts,
+                    "error": "target_not_found"}
+
+        hold_ms = _press_hold_duration_ms()
+        last_hold = hold_ms
+        try:
+            jitters = await _press_hold_gesture(
+                ws_url, int(loc["cx"]), int(loc["cy"]), hold_ms)
+        except Exception as e:
+            return {"solved": False, "method": "press_and_hold",
+                    "hold_ms": hold_ms, "attempts": attempts,
+                    "error": f"gesture_failed:{str(e)[:80]}"}
+
+        # Settle, then check whether the challenge cleared.
+        import random as _r
+        await asyncio.sleep((_r.Random().uniform(500, 1500)) / 1000.0)
+        info = await _detect_captcha(ws_url)
+        still_px = 'perimeterx' in (info.get('types') or [])
+        if not still_px:
+            return {"solved": True, "method": "press_and_hold",
+                    "hold_ms": hold_ms, "attempts": attempts,
+                    "jitter_moves": jitters}
+        # else: loop and try once more with a fresh (re-drawn) hold duration.
+
+    return {"solved": False, "method": "press_and_hold",
+            "hold_ms": last_hold, "attempts": attempts,
+            "error": "still_present_after_retry"}
+
+
 async def _humanize_type(ws_url, text):
     """Type text with Gaussian inter-key and dwell delays via CDP key events."""
     import random as _r
@@ -3873,10 +4477,158 @@ async def cmd_debug(url=None):
     print(f"Debug complete: {url}")
 
 
-async def cmd_close():
-    ws, page = get_page_ws()
-    r = await cdp_send(ws, [(1, "Page.close", {})])
-    print("Tab closed")
+# ─── Owned-Tab Tracking ───
+# cdpilot records every target_id it opens so that `close` can distinguish its
+# own tabs from tabs the user opened manually in the same isolated profile.
+# Stored as a JSON list in the project profile dir; survives across CLI
+# invocations (each `go`/`new-tab` is a separate process).
+
+def _load_owned_tabs():
+    """Return the set of target_ids cdpilot opened in this project profile."""
+    try:
+        with open(OWNED_TABS_FILE) as f:
+            data = json.load(f)
+            return set(data.get("owned", []))
+    except (FileNotFoundError, json.JSONDecodeError, OSError):
+        return set()
+
+
+def _save_owned_tabs(owned):
+    """Persist the owned target_id set."""
+    try:
+        os.makedirs(os.path.dirname(OWNED_TABS_FILE), exist_ok=True)
+        with open(OWNED_TABS_FILE, "w") as f:
+            json.dump({"owned": sorted(owned)}, f)
+    except OSError:
+        pass
+
+
+def _mark_owned_tab(target_id):
+    """Record a target_id as cdpilot-owned. No-op on falsy input."""
+    if not target_id:
+        return
+    owned = _load_owned_tabs()
+    if target_id not in owned:
+        owned.add(target_id)
+        _save_owned_tabs(owned)
+
+
+def _is_chrome_internal_url(url):
+    """True for blank/new-tab/internal pages that don't count as 'real' tabs."""
+    if not url:
+        return True
+    u = url.strip().lower()
+    return (u in ("about:blank", "about:newtab", "")
+            or u.startswith("chrome://")
+            or u.startswith("edge://")
+            or u.startswith("chrome-extension://")
+            or u.startswith("devtools://")
+            or u.startswith("brave://")
+            or u.startswith("vivaldi://"))
+
+
+async def _browser_close_graceful():
+    """Ask the browser to shut down gracefully via the CDP Browser.close
+    command (cleanest cross-platform path — flushes state, no orphaned procs).
+    Returns True if the command was acknowledged. Falls back to a SIGTERM-based
+    process stop (never kill -9) when the WebSocket path fails."""
+    try:
+        browser_ws = await _get_browser_ws()
+        if browser_ws:
+            await cdp_send(browser_ws, [(1, "Browser.close", {})], timeout=5)
+            return True
+    except SystemExit:
+        raise
+    except Exception:
+        pass
+    # Fallback: graceful OS-level termination (SIGTERM on POSIX, taskkill on
+    # Windows). kill -9 is intentionally NOT used here — last resort only.
+    return _stop_browser_on_port(CDP_PORT)
+
+
+async def cmd_close(force_browser=False, keep_browser=False):
+    """Smart close: shut down cdpilot's own tabs, then close the whole browser
+    if no user tabs remain.
+
+    Behavior:
+      1. Close every cdpilot-owned tab (CDP Target.closeTarget).
+      2. Inspect the remaining page targets:
+         - 0 real tabs left (only about:blank / chrome:// / new-tab) ->
+           close the browser application gracefully (Browser.close, SIGTERM
+           fallback — never kill -9).
+         - one or more user tabs remain -> leave the browser open; only the
+           owned tabs were closed.
+
+    Flags:
+      keep_browser  — never close the browser, only the owned tabs.
+      force_browser — close the browser even if user tabs remain.
+    """
+    if not cdp_get("/json/version"):
+        print("No browser running.")
+        return
+
+    tabs = get_tabs()
+    pages = [t for t in tabs if t.get("type") == "page"]
+    owned = _load_owned_tabs()
+
+    # Make sure the current session window counts as owned even if it predates
+    # tracking (legacy session created before this feature shipped).
+    session_target = _get_session_window_target_id()
+    if session_target:
+        owned.add(session_target)
+
+    browser_ws = await _get_browser_ws()
+    closed = 0
+    for p in pages:
+        tid = p.get("id")
+        if tid and tid in owned:
+            try:
+                await cdp_send(browser_ws, [(1, "Target.closeTarget",
+                                             {"targetId": tid})], timeout=5)
+                closed += 1
+            except Exception:
+                pass
+
+    # Owned set is consumed — clear tracking + the CWD session window pointer so
+    # a later command starts clean.
+    _save_owned_tabs(set())
+    if session_target:
+        sessions = _load_sessions()
+        sid = _get_session_id()
+        sessions.pop(sid, None)
+        _save_sessions(sessions)
+    cdp_cache_invalidate()
+
+    print(f"Closed {closed} cdpilot tab(s).")
+
+    # Re-read remaining targets after closing owned tabs.
+    remaining = get_tabs()
+    remaining_pages = [t for t in remaining if t.get("type") == "page"]
+    user_pages = [p for p in remaining_pages
+                  if not _is_chrome_internal_url(p.get("url"))]
+
+    if keep_browser:
+        if user_pages:
+            print(f"Browser left open ({len(user_pages)} user tab(s)).")
+        else:
+            print("Browser left open (--keep).")
+        return
+
+    if user_pages and not force_browser:
+        print(f"Browser left open — {len(user_pages)} user tab(s) still present.")
+        return
+
+    # No user tabs remain (or --force) -> close the browser gracefully.
+    if await _browser_close_graceful():
+        print(f"Browser closed gracefully (port {CDP_PORT}).")
+        if PROJECT_ID:
+            registry = _load_registry()
+            if PROJECT_ID in registry:
+                registry[PROJECT_ID]["status"] = "stopped"
+                registry[PROJECT_ID]["pid"] = None
+                _save_registry(registry)
+    else:
+        print("Browser close failed.", file=sys.stderr)
 
 
 def cmd_session():
@@ -4300,6 +5052,7 @@ async def cmd_new_tab(url='about:blank'):
     data = cdp_get(f'/json/new?{urllib.parse.quote(url, safe=safe_chars)}')
     cdp_cache_invalidate()
     if data:
+        _mark_owned_tab(data.get("id"))
         print(f'New tab opened: {data.get("url", url)}')
         print(f'  ID: {data.get("id", "?")}')
     else:
@@ -4870,6 +5623,14 @@ def cmd_stealth(state=None):
     os.makedirs(os.path.dirname(STEALTH_CONFIG_FILE), exist_ok=True)
     with open(STEALTH_CONFIG_FILE, 'w') as f:
         json.dump({'stealth': enabled}, f)
+    # Backward-compat bridge to the three-tier model: keep mode.json coherent
+    # with the legacy toggle so `stealth on` -> 'undetected' (full patch) and
+    # `stealth off` -> 'regular'. Without this, an existing mode.json would
+    # silently override the toggle (get_mode_config reads mode.json first).
+    try:
+        set_mode_config('undetected' if enabled else 'regular')
+    except Exception:
+        pass
     print(f'Stealth: {"on" if enabled else "off"}')
     print('Effect applies on next navigation (`cdpilot go <url>`).')
 
@@ -5128,18 +5889,25 @@ async def _assert_host(ws_url, expected_host):
 
 
 def get_adaptive_config():
-    """Return {'enabled': bool, 'stealth_hosts': [hostname,...]}."""
+    """Return adaptive config with all learned-state keys carried through.
+
+    Keys: enabled, stealth_hosts, entropy_hosts, host_tiers. The latter two
+    MUST be preserved here because callers write the whole dict back via
+    _atomic_write_json — dropping a key would silently erase learned state.
+    """
     if not os.path.exists(ADAPTIVE_CONFIG_FILE):
-        return {'enabled': False, 'stealth_hosts': []}
+        return {'enabled': False, 'stealth_hosts': [], 'entropy_hosts': {}, 'host_tiers': {}}
     try:
         with open(ADAPTIVE_CONFIG_FILE) as f:
             data = json.load(f)
         return {
             'enabled': bool(data.get('enabled', False)),
             'stealth_hosts': list(data.get('stealth_hosts', [])),
+            'entropy_hosts': dict(data.get('entropy_hosts', {})),
+            'host_tiers': dict(data.get('host_tiers', {})),
         }
     except (OSError, ValueError):
-        return {'enabled': False, 'stealth_hosts': []}
+        return {'enabled': False, 'stealth_hosts': [], 'entropy_hosts': {}, 'host_tiers': {}}
 
 
 def _adaptive_remember_host(hostname):
@@ -5151,6 +5919,48 @@ def _adaptive_remember_host(hostname):
     _atomic_write_json(ADAPTIVE_CONFIG_FILE, cfg)
 
 
+def _escalate_tier(tier):
+    """Return the next-stronger tier. undetected is the ceiling."""
+    try:
+        i = MODE_TIERS.index(tier)
+    except ValueError:
+        i = 0
+    return MODE_TIERS[min(i + 1, len(MODE_TIERS) - 1)]
+
+
+def _adaptive_remember_host_tier(hostname, tier):
+    """Record the tier a host needs in adaptive.json under 'host_tiers'.
+
+    Monotonic: only ever ratchets UP (regular -> stealth -> undetected),
+    never down — mirrors the never-auto-demote policy of the stealth_hosts
+    list so a single false-negative CAPTCHA detection can't downgrade a host.
+    """
+    if tier not in MODE_TIERS:
+        return
+    cfg = get_adaptive_config()
+    host_tiers = cfg.get('host_tiers', {})
+    prev = host_tiers.get(hostname)
+    if prev in MODE_TIERS and MODE_TIERS.index(prev) >= MODE_TIERS.index(tier):
+        return  # already at or above this tier, skip write
+    host_tiers[hostname] = tier
+    cfg['host_tiers'] = host_tiers
+    _atomic_write_json(ADAPTIVE_CONFIG_FILE, cfg)
+
+
+def _adaptive_host_tier(url):
+    """Return the learned tier for a URL's host, or None if none/disabled."""
+    cfg = get_adaptive_config()
+    if not cfg.get('enabled'):
+        return None
+    try:
+        from urllib.parse import urlparse
+        host = (urlparse(url).hostname or '').lower()
+    except Exception:
+        return None
+    tier = cfg.get('host_tiers', {}).get(host)
+    return tier if tier in MODE_TIERS else None
+
+
 def _adaptive_host_requires_stealth(url):
     """True if the URL's hostname is in the adaptive stealth list."""
     cfg = get_adaptive_config()
@@ -5281,35 +6091,169 @@ async def _detect_captcha(ws_url):
         return {"detected": False, "error": str(e)[:120]}
 
 
-async def cmd_captcha_check():
-    """One-shot CAPTCHA detection on the active page. Prints JSON.
+# ─── Progressive-Resilience Escalation Ladder ───
+# Friction levels ordered low -> high. soft_captcha is detected by the existing
+# _detect_captcha (9 provider types); the other rungs come from
+# FRICTION_DETECT_JS. _detect_friction merges both and reports the highest.
+FRICTION_LEVELS = (
+    'none', 'rate_limited', 'soft_captcha', 'login_wall', 'otp_sms', 'hard_block',
+)
 
-    Exit codes: 0 = no CAPTCHA, 3 = CAPTCHA detected, 1 = error.
-    Useful in scripts: `cdpilot captcha-check && do-stuff`.
-    """
-    ws, _ = get_page_ws()
-    info = await _detect_captcha(ws)
-    print(json.dumps(info, ensure_ascii=False))
-    if info.get("error") and not info.get("detected"):
-        sys.exit(1)
-    sys.exit(3 if info.get("detected") else 0)
 
+def _friction_backoff_enabled():
+    """Whether cmd_go should auto-backoff on rate_limited. Default on."""
+    return os.environ.get('CDPILOT_FRICTION_BACKOFF', 'on').lower() not in ('off', '0', 'false', 'no')
 
-async def cmd_captcha_wait(timeout_arg=None):
-    """Detect CAPTCHA and wait for the user to solve it.
 
-    Behavior:
-      - Interactive (stdin is a TTY): print warning, block on Enter.
-      - Non-interactive (pipe / MCP): poll every 2s until the CAPTCHA
-        disappears or timeout expires; emit one JSON line per poll on
-        state change so callers can stream progress.
+def _friction_max_retry():
+    """Max rate-limit backoff retries in cmd_go. Default 2, clamped 0..5."""
+    try:
+        n = int(os.environ.get('CDPILOT_FRICTION_MAX_RETRY', '2'))
+    except (ValueError, TypeError):
+        n = 2
+    return max(0, min(n, 5))
 
-    Args:
-      timeout_arg: int seconds (default 300, max 1800). Passed as string from CLI.
 
-    Exit codes: 0 = solved (or none detected), 2 = timeout, 1 = error.
+def _friction_backoff_seconds(attempt):
+    """Exponential backoff with jitter: 2^attempt seconds, capped at 60s.
+
+    attempt is 0-based (first retry -> 2s base). Adds up to 25% jitter so
+    concurrent workers don't synchronize their retries.
     """
-    try:
+    import random as _r
+    base = min(2 ** (attempt + 1), 60)
+    jitter = _r.uniform(0, base * 0.25)
+    return round(min(base + jitter, 60), 2)
+
+
+def _friction_action(level):
+    """Map a friction level to the response policy cmd_go should apply.
+
+    ETHICS/SAFETY: login_wall, otp_sms and hard_block are NEVER bypassed
+    autonomously — they hand off to the human. Only rate_limited is auto-handled
+    (backoff + retry); soft_captcha defers to the existing captcha flow.
+
+    Returns a dict: {action, level, autonomous: bool, message}.
+    """
+    if level == 'rate_limited':
+        return {
+            'action': 'backoff', 'level': level, 'autonomous': True,
+            'message': 'Rate limited — exponential backoff then retry.',
+        }
+    if level == 'soft_captcha':
+        return {
+            'action': 'captcha', 'level': level, 'autonomous': True,
+            'message': 'CAPTCHA — defer to detect/wait/solver flow.',
+        }
+    if level == 'login_wall':
+        return {
+            'action': 'human_login_required', 'level': level, 'autonomous': False,
+            'message': '🔐 Login gerekli — kullanıcı girişi bekleniyor (otomatik giriş YOK).',
+        }
+    if level == 'otp_sms':
+        return {
+            'action': 'human_otp_required', 'level': level, 'autonomous': False,
+            'message': '📱 SMS/OTP doğrulama gerekli — kullanıcı çözmeli (otomatik çözüm YOK).',
+        }
+    if level == 'hard_block':
+        return {
+            'action': 'hard_blocked', 'level': level, 'autonomous': False,
+            'message': '🚫 Sert engelleme — geri çekil ve bekle.', 'backoff_suggested': True,
+        }
+    return {'action': 'proceed', 'level': 'none', 'autonomous': True, 'message': 'No friction.'}
+
+
+async def _detect_friction(ws_url):
+    """Detect the highest anti-bot friction rung on the active page.
+
+    Runs FRICTION_DETECT_JS (rate-limit / login-wall / OTP / hard-block) and
+    merges in the existing _detect_captcha result (soft_captcha). Returns the
+    HIGHEST rung present per FRICTION_LEVELS ordering.
+
+    Returns: {"level": str, "signals": [...], "detail": str, "captcha"?: {...}}
+    Never raises — failures degrade to {"level": "none", ...}.
+    """
+    friction = {"level": "none", "signals": [], "detail": ""}
+    try:
+        r = await cdp_send(ws_url, [(1, "Runtime.evaluate", {
+            "expression": FRICTION_DETECT_JS,
+            "returnByValue": True,
+        })], timeout=5)
+        raw = r.get(1, {}).get("result", {}).get("value")
+        if raw:
+            try:
+                parsed = json.loads(raw)
+                if isinstance(parsed, dict) and parsed.get("level") in FRICTION_LEVELS:
+                    friction = parsed
+            except (ValueError, TypeError):
+                pass
+    except Exception as e:
+        friction = {"level": "none", "signals": [], "detail": "", "error": str(e)[:120]}
+
+    # Merge soft_captcha from the dedicated captcha detector.
+    try:
+        cap = await _detect_captcha(ws_url)
+    except Exception:
+        cap = {"detected": False}
+    if cap.get("detected"):
+        cap_level = 'soft_captcha'
+        # Keep whichever rung is higher in the ladder.
+        cur_idx = FRICTION_LEVELS.index(friction.get('level', 'none')) if friction.get('level') in FRICTION_LEVELS else 0
+        cap_idx = FRICTION_LEVELS.index(cap_level)
+        if cap_idx > cur_idx:
+            sigs = list(friction.get('signals', []))
+            sigs.append('captcha:' + (",".join(cap.get('types', [])) or 'unknown'))
+            friction = {
+                'level': cap_level, 'signals': sigs,
+                'detail': 'CAPTCHA challenge present (' + (",".join(cap.get('types', [])) or 'unknown') + ').',
+            }
+        friction['captcha'] = {'types': cap.get('types', []), 'detected': True}
+    return friction
+
+
+async def cmd_friction():
+    """One-shot friction-level diagnostic on the active page. Prints JSON.
+
+    Reports the highest escalation rung (none/rate_limited/soft_captcha/
+    login_wall/otp_sms/hard_block) plus the recommended response policy.
+    Read-only — never attempts to bypass anything.
+    """
+    ws, _ = get_page_ws()
+    info = await _detect_friction(ws)
+    action = _friction_action(info.get('level', 'none'))
+    info['recommended'] = action
+    print(json.dumps(info, ensure_ascii=False))
+
+
+async def cmd_captcha_check():
+    """One-shot CAPTCHA detection on the active page. Prints JSON.
+
+    Exit codes: 0 = no CAPTCHA, 3 = CAPTCHA detected, 1 = error.
+    Useful in scripts: `cdpilot captcha-check && do-stuff`.
+    """
+    ws, _ = get_page_ws()
+    info = await _detect_captcha(ws)
+    print(json.dumps(info, ensure_ascii=False))
+    if info.get("error") and not info.get("detected"):
+        sys.exit(1)
+    sys.exit(3 if info.get("detected") else 0)
+
+
+async def cmd_captcha_wait(timeout_arg=None):
+    """Detect CAPTCHA and wait for the user to solve it.
+
+    Behavior:
+      - Interactive (stdin is a TTY): print warning, block on Enter.
+      - Non-interactive (pipe / MCP): poll every 2s until the CAPTCHA
+        disappears or timeout expires; emit one JSON line per poll on
+        state change so callers can stream progress.
+
+    Args:
+      timeout_arg: int seconds (default 300, max 1800). Passed as string from CLI.
+
+    Exit codes: 0 = solved (or none detected), 2 = timeout, 1 = error.
+    """
+    try:
         timeout = int(timeout_arg) if timeout_arg else 300
     except (ValueError, TypeError):
         print(f"Invalid timeout: {timeout_arg}", file=sys.stderr)
@@ -6089,6 +7033,387 @@ async def cmd_captcha_dispatch(args: list) -> None:
         sys.exit(1)
 
 
+# ─── Amazon classic image CAPTCHA (local OCR + BYOK image solvers) ────────
+# amazon.com rate-limit page: "Enter the characters you see below". The image
+# is a 6-char distorted glyph string at a fixed URL pattern. The optional
+# `amazoncaptcha` PyPI lib (pure-Python + Pillow, MIT) OCRs it offline with
+# ~90% accuracy. It is NOT a mandatory dependency — imported lazily.
+# BYOK fallback: CapSolver / 2Captcha image-to-text endpoints (HTTP only).
+
+
+async def _detect_amazon_captcha(ws_url: str) -> dict:
+    """Return {'detected': bool, 'img_src': str, 'input_id': str} for Amazon classic CAPTCHA.
+
+    Probes the active page for the #captchacharacters input + captcha image.
+    Never raises.
+    """
+    info = await _detect_captcha(ws_url)
+    if not info.get('detected'):
+        return {'detected': False}
+    for d in info.get('details', []):
+        if d.get('type') == 'amazon-classic':
+            return {
+                'detected': True,
+                'img_src': d.get('img_src', ''),
+                'input_id': d.get('input_id', 'captchacharacters'),
+            }
+    return {'detected': False}
+
+
+async def _fetch_image_bytes(ws_url: str, img_src: str) -> bytes | None:
+    """Download the captcha image bytes. Uses urllib (image URLs are public CDN)."""
+    if not img_src:
+        return None
+    try:
+        return await _captcha_urlopen_async(img_src, timeout=15)
+    except Exception:
+        return None
+
+
+def _solve_amazon_local(img_bytes: bytes) -> str | None:
+    """OCR Amazon classic CAPTCHA with the OPTIONAL amazoncaptcha library.
+
+    Returns the solved string, or None if the library is unavailable or fails.
+    Raises ImportError-as-signal via returning None; caller prints install hint.
+    """
+    try:
+        from amazoncaptcha import AmazonCaptcha  # optional dependency
+    except ImportError:
+        return None
+    try:
+        import io as _io
+        cap = AmazonCaptcha(_io.BytesIO(img_bytes))
+        solution = cap.solve()
+        if solution and solution.lower() != 'not solved':
+            return solution
+    except Exception:
+        return None
+    return None
+
+
+async def _solve_image_byok(img_bytes: bytes) -> dict:
+    """Solve an image CAPTCHA via a BYOK provider (CapSolver / 2Captcha).
+
+    Reads CAPSOLVER_API_KEY then TWOCAPTCHA_API_KEY from the environment.
+    Only stdlib HTTP — no new dependency. Returns {'token': text} or {'error': ...}.
+    """
+    import base64 as _b64
+    b64 = _b64.b64encode(img_bytes).decode('ascii')
+
+    capsolver_key = os.environ.get('CAPSOLVER_API_KEY')
+    if capsolver_key:
+        try:
+            payload = json.dumps({
+                'clientKey': capsolver_key,
+                'task': {'type': 'ImageToTextTask', 'body': b64},
+            }).encode()
+            raw = await _captcha_urlopen_async(
+                'https://api.capsolver.com/createTask', data=payload,
+                headers={'Content-Type': 'application/json'}, timeout=60,
+            )
+            r = json.loads(raw)
+            if r.get('errorId', 0) == 0:
+                text = (r.get('solution') or {}).get('text', '')
+                if text:
+                    return {'token': text, 'provider': 'capsolver'}
+            return {'error': f"capsolver: {r.get('errorDescription', r)}"}
+        except Exception as e:
+            return {'error': f'capsolver: {e}'}
+
+    twocaptcha_key = os.environ.get('TWOCAPTCHA_API_KEY')
+    if twocaptcha_key:
+        import urllib.parse as _uparse
+        try:
+            body = _uparse.urlencode({
+                'key': twocaptcha_key, 'method': 'base64',
+                'body': b64, 'json': '1',
+            }).encode()
+            raw = await _captcha_urlopen_async('https://2captcha.com/in.php', data=body, timeout=30)
+            resp = json.loads(raw)
+            if resp.get('status') != 1:
+                return {'error': f"2captcha submit: {resp.get('request', resp)}"}
+            task_id = resp['request']
+            poll = f"https://2captcha.com/res.php?key={twocaptcha_key}&action=get&id={task_id}&json=1"
+            deadline = time.time() + CAPTCHA_SOLVE_TIMEOUT
+            while time.time() < deadline:
+                await asyncio.sleep(5)
+                r2 = json.loads(await _captcha_urlopen_async(poll, timeout=15))
+                if r2.get('status') == 1:
+                    return {'token': r2['request'], 'provider': '2captcha'}
+                if r2.get('request') != 'CAPCHA_NOT_READY':
+                    return {'error': f"2captcha: {r2.get('request')}"}
+            return {'error': '2captcha timeout'}
+        except Exception as e:
+            return {'error': f'2captcha: {e}'}
+
+    return {'error': 'no_byok_key'}
+
+
+async def _fill_amazon_solution(ws_url: str, input_id: str, solution: str) -> bool:
+    """Type the solution into the Amazon CAPTCHA input and submit. Returns True on success."""
+    safe_id = json.dumps(input_id)
+    safe_val = json.dumps(solution)
+    js = f"""
+    (function() {{
+      try {{
+        var el = document.getElementById({safe_id}) || document.querySelector('#captchacharacters');
+        if (!el) return false;
+        var setter = Object.getOwnPropertyDescriptor(
+          window.HTMLInputElement.prototype, 'value').set;
+        setter.call(el, {safe_val});
+        el.dispatchEvent(new Event('input', {{bubbles: true}}));
+        el.dispatchEvent(new Event('change', {{bubbles: true}}));
+        var form = el.form || el.closest('form');
+        if (form) {{ form.submit(); return true; }}
+        var btn = document.querySelector('button[type=submit], input[type=submit]');
+        if (btn) {{ btn.click(); return true; }}
+        return true;
+      }} catch(e) {{ return false; }}
+    }})()
+    """
+    try:
+        r = await cdp_send(ws_url, [(1, 'Runtime.evaluate', {
+            'expression': js, 'returnByValue': True,
+        })], timeout=5)
+        return bool(r.get(1, {}).get('result', {}).get('value', False))
+    except Exception:
+        return False
+
+
+async def cmd_press_hold(selector=None):
+    """Solve a PerimeterX/HUMAN "Press & Hold" challenge (standalone, opt-in).
+
+    Performs a humanized press->hold(with micro-tremor)->release gesture on the
+    hold target. If no selector is given, auto-locates the px-captcha widget
+    (#px-captcha / [class*="px-captcha"] / "press & hold" text). Prints JSON;
+    exit 0 = solved, 1 = not solved / target not found.
+
+    Usage:
+      cdpilot press-hold              # auto-find the px-captcha target
+      cdpilot press-hold "#px-captcha button"
+    """
+    if not cdp_get("/json/version"):
+        print(json.dumps({'solved': False, 'error': 'no_browser',
+                          'hint': 'Run: cdpilot launch'}, ensure_ascii=False))
+        sys.exit(1)
+    ws, _ = get_page_ws()
+    res = await _solve_press_and_hold(ws, target_sel=selector)
+    print(json.dumps(res, ensure_ascii=False))
+    sys.exit(0 if res.get('solved') else 1)
+
+
+async def cmd_captcha_solve(provider=None):
+    """Solve the CAPTCHA on the current page (opt-in).
+
+    Providers:
+      amazon-local (default) — OCR Amazon classic image CAPTCHA with the optional
+                               `amazoncaptcha` lib (pip install amazoncaptcha).
+      capsolver / 2captcha   — BYOK image-to-text via CAPSOLVER_API_KEY /
+                               TWOCAPTCHA_API_KEY env vars (stdlib HTTP only).
+
+    Detects Amazon classic CAPTCHA (#captchacharacters + captcha image), solves,
+    fills the input and submits. Prints JSON; exit 0 = solved, 3 = no captcha,
+    1 = error / unsolvable.
+    """
+    provider = (provider or 'amazon-local').lower()
+    ws, _ = get_page_ws()
+
+    # PerimeterX / HUMAN "Press & Hold" is a behavioural (not token) challenge:
+    # there is no provider to call, the only solution is a real humanized
+    # press->hold->release gesture. Route it automatically whenever detected,
+    # regardless of the requested provider, before the Amazon/BYOK path.
+    pre = await _detect_captcha(ws)
+    if 'perimeterx' in (pre.get('types') or []):
+        res = await _solve_press_and_hold(ws)
+        print(json.dumps(res, ensure_ascii=False))
+        sys.exit(0 if res.get('solved') else 1)
+
+    amz = await _detect_amazon_captcha(ws)
+    if not amz.get('detected'):
+        # Not an Amazon classic captcha — report what (if anything) was found.
+        info = await _detect_captcha(ws)
+        print(json.dumps({
+            'solved': False, 'status': 'no_amazon_captcha',
+            'detected_types': info.get('types', []),
+        }, ensure_ascii=False))
+        sys.exit(3 if not info.get('detected') else 1)
+
+    img_src = amz.get('img_src', '')
+    input_id = amz.get('input_id', 'captchacharacters')
+    img_bytes = await _fetch_image_bytes(ws, img_src)
+    if not img_bytes:
+        print(json.dumps({'solved': False, 'error': 'image_fetch_failed', 'img_src': img_src}, ensure_ascii=False))
+        sys.exit(1)
+
+    solution = None
+    used_provider = None
+
+    if provider in ('amazon-local', 'amazon', 'local'):
+        solution = _solve_amazon_local(img_bytes)
+        used_provider = 'amazon-local'
+        if solution is None:
+            # Distinguish "lib missing" from "lib failed".
+            try:
+                import amazoncaptcha  # noqa: F401
+                print(json.dumps({
+                    'solved': False, 'status': 'ocr_failed',
+                    'provider': 'amazon-local',
+                    'hint': 'OCR returned no result; retry or use --provider capsolver',
+                }, ensure_ascii=False))
+            except ImportError:
+                print(json.dumps({
+                    'solved': False, 'status': 'amazoncaptcha_not_installed',
+                    'hint': 'amazoncaptcha not installed. Run: pip install amazoncaptcha (optional)',
+                }, ensure_ascii=False))
+            sys.exit(1)
+    elif provider in ('capsolver', '2captcha', 'twocaptcha'):
+        res = await _solve_image_byok(img_bytes)
+        if 'error' in res:
+            if res['error'] == 'no_byok_key':
+                print(json.dumps({
+                    'solved': False, 'status': 'no_byok_key',
+                    'hint': 'Set CAPSOLVER_API_KEY or TWOCAPTCHA_API_KEY in the environment',
+                }, ensure_ascii=False))
+            else:
+                print(json.dumps({'solved': False, 'error': res['error']}, ensure_ascii=False))
+            sys.exit(1)
+        solution = res.get('token')
+        used_provider = res.get('provider', provider)
+    else:
+        print(json.dumps({'solved': False, 'error': f'unknown_provider:{provider}'}, ensure_ascii=False))
+        sys.exit(1)
+
+    if not solution:
+        print(json.dumps({'solved': False, 'error': 'empty_solution', 'provider': used_provider}, ensure_ascii=False))
+        sys.exit(1)
+
+    filled = await _fill_amazon_solution(ws, input_id, solution)
+    print(json.dumps({
+        'solved': True, 'solution': solution, 'provider': used_provider,
+        'submitted': filled,
+    }, ensure_ascii=False))
+    sys.exit(0)
+
+
+# ─── Profile warm-up (reCAPTCHA v3 score aging) ──────────────────────────
+# New browser profiles get a -0.5 reCAPTCHA v3 trust penalty. Browsing a few
+# popular, safe sites ages the cookie jar / history so the profile reads as
+# "established", lifting the v3 score. Opt-in, uses the already-open session.
+
+WARM_SAFE_SITES = [
+    'https://en.wikipedia.org/wiki/Web_browser',
+    'https://github.com/',
+    'https://stackoverflow.com/',
+    'https://news.ycombinator.com/',
+    'https://www.bbc.com/news',
+    'https://www.reddit.com/',
+    'https://duckduckgo.com/',
+    'https://www.wikipedia.org/',
+]
+
+
+async def cmd_profile_warm(minutes=None, sites=None):
+    """Warm up the current profile by browsing safe popular sites (opt-in).
+
+    Ages cookies/history to boost reCAPTCHA v3 score. Uses the already-open
+    browser session (does not launch). Default ~2 minutes over a hardcoded
+    safe site list with randomized dwell + light scrolling between visits.
+
+    Args:
+      minutes: budget in minutes (default 2, max 30). String from CLI.
+      sites:   optional comma-separated override list of URLs.
+    """
+    import random as _r
+    try:
+        budget_min = float(minutes) if minutes else 2.0
+    except (ValueError, TypeError):
+        budget_min = 2.0
+    budget_min = max(0.5, min(budget_min, 30.0))
+
+    site_list = WARM_SAFE_SITES
+    if sites:
+        if isinstance(sites, str):
+            site_list = [s.strip() for s in sites.split(',') if s.strip()]
+        else:
+            site_list = list(sites)
+    if not site_list:
+        site_list = WARM_SAFE_SITES
+
+    if not cdp_get("/json/version"):
+        print(json.dumps({'error': 'no_browser', 'hint': 'Run: cdpilot launch'}, ensure_ascii=False))
+        sys.exit(1)
+
+    ws, _ = get_page_ws()
+    deadline = time.time() + budget_min * 60.0
+    rnd = _r.Random()
+    visited = 0
+    total = len(site_list)
+
+    for idx, url in enumerate(site_list, 1):
+        if time.time() >= deadline:
+            break
+        try:
+            await navigate_collect(ws, url)
+            visited += 1
+            sys.stderr.write(f"🔥 Warming profile: visited {visited}/{total} sites... ({url})\n")
+            sys.stderr.flush()
+        except Exception as e:
+            sys.stderr.write(f"🔥 Warm: skip {url} ({str(e)[:60]})\n")
+            continue
+
+        # Light scroll to look engaged (reuses humanized scroll).
+        try:
+            await _humanize_scroll(ws, rnd.randint(400, 1200))
+        except Exception:
+            pass
+
+        # Random aging delay 5-15s, but never overrun the budget.
+        remaining = deadline - time.time()
+        if remaining <= 0:
+            break
+        await asyncio.sleep(min(rnd.uniform(5, 15), max(0.1, remaining)))
+
+    print(json.dumps({
+        'warmed': True, 'visited': visited, 'sites': total,
+        'budget_minutes': budget_min,
+    }, ensure_ascii=False))
+
+
+async def cmd_profile_dispatch(args: list) -> None:
+    """Top-level dispatcher for 'cdpilot profile <subcommand> [args...]'.
+
+    Subcommands:
+      warm [--minutes N] [--sites url1,url2]   Warm up profile (reCAPTCHA v3 aging).
+    """
+    if not args:
+        print(
+            "Usage: cdpilot profile <subcommand>\n"
+            "  warm [--minutes N] [--sites url1,url2,...]   Age cookies/history to boost reCAPTCHA v3 score",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
+    sub = args[0].lower()
+    rest = args[1:]
+
+    def _get_flag(flag):
+        for i, a in enumerate(rest):
+            if a == flag and i + 1 < len(rest):
+                return rest[i + 1]
+            if a.startswith(flag + '='):
+                return a.split('=', 1)[1]
+        return None
+
+    if sub == 'warm':
+        await cmd_profile_warm(
+            minutes=_get_flag('--minutes') or _get_flag('-m'),
+            sites=_get_flag('--sites'),
+        )
+    else:
+        print(f"Unknown profile subcommand: {sub}", file=sys.stderr)
+        sys.exit(1)
+
+
 # ─── End Captcha Solver Plugin ───────────────────────────────────────────
 
 
@@ -6989,16 +8314,48 @@ async def cmd_smart_click(text):
         cdpilot smart-click "Learn more"
     """
     ws_url, _ = get_page_ws()
+    # Snapshot page targets before the click so a new tab opened by the click
+    # (target=_blank, window.open) can be marked cdpilot-owned afterwards.
+    _pre_click_targets = {t.get("id") for t in (cdp_get("/json") or [])
+                          if t.get("type") == "page"}
+    # Locale-aware lowercase so Turkish/German chars round-trip safely.
+    # `toLocaleLowerCase()` (no arg) honors the browser's BCP-47 locale, which
+    # matches what the user sees in the DOM. Python's str.lower() handles
+    # ASCII fine for the *search* term that we marshal across; the in-page
+    # comparison uses the same locale-aware function on both sides.
     safe_text = json.dumps(text.lower())
     js = f"""
     (function() {{
-      var search = {safe_text};
+      // Walk into shadow roots so Salesforce Lightning / Polymer / any custom
+      // element with attachShadow({{mode:'open'}}) becomes searchable.
+      // Closed shadow roots are inaccessible by design — nothing we can do
+      // about those without a DevTools-only API.
+      function deepQuerySelectorAll(root, selector) {{
+        var found = Array.from(root.querySelectorAll(selector));
+        Array.from(root.querySelectorAll('*')).forEach(function(el) {{
+          if (el.shadowRoot) {{
+            found = found.concat(deepQuerySelectorAll(el.shadowRoot, selector));
+          }}
+        }});
+        return found;
+      }}
+
+      function lc(s) {{
+        // Locale-aware lowercase — `toLowerCase()` mishandles Turkish (İ → i̇
+        // combining sequence in some engines) and stays case-sensitive on
+        // ß in older runtimes. `toLocaleLowerCase()` matches the user's
+        // expected mental model: "İletişim" → "iletişim".
+        return (s == null ? '' : (s + '')).toLocaleLowerCase();
+      }}
+
+      var search = lc({safe_text}).trim();
       var candidates = [];
+      var disabledCount = 0;
 
       // Score: exact > startsWith > includes > partial
       function score(str) {{
         if (!str) return 0;
-        var s = str.toLowerCase().trim();
+        var s = lc(str).trim();
         if (s === search) return 100;
         if (s.startsWith(search)) return 80;
         if (s.includes(search)) return 60;
@@ -7009,13 +8366,13 @@ async def cmd_smart_click(text):
         return 0;
       }}
 
-      var els = document.querySelectorAll(
+      var els = deepQuerySelectorAll(document,
         'a, button, input[type=submit], input[type=button], ' +
         '[role=button], [role=link], [role=tab], [role=menuitem], ' +
         'summary, label, [onclick], [tabindex]'
       );
 
-      Array.from(els).forEach(function(el) {{
+      els.forEach(function(el) {{
         var rect = el.getBoundingClientRect();
         if (rect.width === 0 && rect.height === 0) return;
         var style = window.getComputedStyle(el);
@@ -7034,10 +8391,23 @@ async def cmd_smart_click(text):
         var bestMatch = '';
         texts.forEach(function(t) {{
           var s = score(t);
-          if (s > bestScore) {{ bestScore = s; bestMatch = t.trim().substring(0, 60); }}
+          if (s > bestScore) {{ bestScore = s; bestMatch = (t + '').trim().substring(0, 60); }}
         }});
 
         if (bestScore > 0) {{
+          // Reject elements that look clickable but won't fire — `<button
+          // disabled>`, `[aria-disabled=true]`, or a disabled ancestor
+          // (fieldset[disabled] propagates to children). Without this the
+          // command reports "Clicked" but nothing happens — silent fail.
+          var isDisabled = (
+            el.disabled === true ||
+            el.getAttribute('aria-disabled') === 'true' ||
+            (typeof el.closest === 'function' && el.closest('fieldset[disabled], [aria-disabled="true"]') !== null)
+          );
+          if (isDisabled) {{
+            disabledCount++;
+            return;
+          }}
           candidates.push({{
             el: el,
             score: bestScore,
@@ -7049,7 +8419,13 @@ async def cmd_smart_click(text):
         }}
       }});
 
-      if (candidates.length === 0) return JSON.stringify({{found: false}});
+      if (candidates.length === 0) {{
+        return JSON.stringify({{
+          found: false,
+          allDisabled: disabledCount > 0,
+          disabledCount: disabledCount
+        }});
+      }}
 
       candidates.sort(function(a, b) {{ return b.score - a.score; }});
       var best = candidates[0];
@@ -7078,10 +8454,26 @@ async def cmd_smart_click(text):
         return
 
     if not data.get("found"):
-        print(f'No element found matching: "{text}"', file=sys.stderr)
+        if data.get("allDisabled"):
+            # Distinguish "no match" from "match exists but disabled" — the
+            # latter is almost always a timing bug in the caller (form
+            # validation hasn't unlocked the submit button yet).
+            print(f'Error: no enabled element matches "{text}" '
+                  f'({data.get("disabledCount", 0)} disabled match(es) skipped)', file=sys.stderr)
+        else:
+            print(f'No element found matching: "{text}"', file=sys.stderr)
         sys.exit(1)
 
     await _vfx_ripple(ws_url, data["x"], data["y"])
+    # A click can spawn a new tab (target=_blank). Diff the target list and mark
+    # any newcomer as cdpilot-owned so `close` will clean it up later.
+    try:
+        cdp_cache_invalidate()
+        for t in (cdp_get("/json", no_cache=True) or []):
+            if t.get("type") == "page" and t.get("id") not in _pre_click_targets:
+                _mark_owned_tab(t.get("id"))
+    except Exception:
+        pass
     print(f'Clicked: {data["tag"].upper()} "{data["text"]}" (score:{data["score"]})')
     if data.get("alternatives"):
         print(f'  Also found: {", ".join(data["alternatives"])}')
@@ -7287,7 +8679,9 @@ async def cmd_dismiss(repeat=None):
 async def cmd_smart_fill(text, value):
     """Fill input by label/placeholder text — no CSS selector needed.
 
-    Finds input by: associated label, placeholder, aria-label, name, id match.
+    Finds input by: associated label, placeholder, aria-label, name, id match,
+    aria-labelledby, closest [aria-label], and nearby (4-prev) labels for
+    floating-label designs (Material UI, Ant Design, Chakra).
 
     Usage:
         cdpilot smart-fill "Email" "test@example.com"
@@ -7299,44 +8693,97 @@ async def cmd_smart_fill(text, value):
     safe_value = json.dumps(value)
     js = f"""
     (function() {{
-      var search = {safe_text};
+      // Shadow DOM traversal — same helper as smart-click. Custom-element
+      // form controls (e.g. <sf-input> in Salesforce Lightning) only
+      // expose their <input> via shadow root.
+      function deepQuerySelectorAll(root, selector) {{
+        var found = Array.from(root.querySelectorAll(selector));
+        Array.from(root.querySelectorAll('*')).forEach(function(el) {{
+          if (el.shadowRoot) {{
+            found = found.concat(deepQuerySelectorAll(el.shadowRoot, selector));
+          }}
+        }});
+        return found;
+      }}
+
+      function lc(s) {{
+        return (s == null ? '' : (s + '')).toLocaleLowerCase();
+      }}
+
+      var search = lc({safe_text}).trim();
       var value = {safe_value};
       var candidates = [];
 
       function score(str) {{
         if (!str) return 0;
-        var s = str.toLowerCase().trim();
+        var s = lc(str).trim();
         if (s === search) return 100;
         if (s.startsWith(search)) return 80;
         if (s.includes(search)) return 60;
         return 0;
       }}
 
-      var inputs = document.querySelectorAll('input, textarea, select, [contenteditable=true]');
-      Array.from(inputs).forEach(function(el) {{
+      var inputs = deepQuerySelectorAll(document,
+        'input, textarea, select, [contenteditable=true]');
+      inputs.forEach(function(el) {{
         var rect = el.getBoundingClientRect();
         if (rect.width === 0 && rect.height === 0) return;
 
         var scores = [];
-        // Check placeholder
+        // 1. placeholder
         scores.push(score(el.getAttribute('placeholder') || ''));
-        // Check aria-label
+        // 2. aria-label
         scores.push(score(el.getAttribute('aria-label') || ''));
-        // Check name/id
+        // 3. name / id
         scores.push(score(el.name || ''));
         scores.push(score(el.id || ''));
-        // Check associated label
+        // 4. label[for=id] (classic)
         if (el.id) {{
           var label = document.querySelector('label[for="' + el.id + '"]');
           if (label) scores.push(score(label.textContent || ''));
         }}
-        // Check parent label
+        // 5. parent <label>
         var parentLabel = el.closest('label');
         if (parentLabel) scores.push(score(parentLabel.textContent || ''));
-        // Check preceding text node/label
+        // 6. immediately-preceding sibling (legacy fallback)
         var prev = el.previousElementSibling;
         if (prev) scores.push(score(prev.textContent || ''));
 
+        // 7. aria-labelledby — the input points at one or more IDs whose
+        //    textContent forms the accessible name. ARIA spec says space-
+        //    separated tokens, in order.
+        var labelledby = el.getAttribute('aria-labelledby');
+        if (labelledby) {{
+          labelledby.split(/\\s+/).forEach(function(id) {{
+            if (!id) return;
+            var ref = document.getElementById(id);
+            if (ref) scores.push(score(ref.textContent || ''));
+          }});
+        }}
+        // 8. closest ancestor with [aria-label] — Material UI / Chakra wrap
+        //    the input in a labelled container instead of using <label>.
+        if (typeof el.closest === 'function') {{
+          var aria = el.closest('[aria-label]');
+          if (aria && aria !== el) scores.push(score(aria.getAttribute('aria-label') || ''));
+        }}
+        // 9. nearby label — walk up to 4 previous siblings looking for a
+        //    <label> or label-like element. Floating-label designs render
+        //    the label as a separate sibling at the parent level.
+        var node = el;
+        for (var depth = 0; depth < 2 && node && node.parentElement; depth++) {{
+          var sib = node.previousElementSibling;
+          for (var i = 0; i < 4 && sib; i++) {{
+            if (sib.tagName === 'LABEL' ||
+                sib.matches && (sib.matches('label, [class*="label" i], [class*="Label"]'))) {{
+              var t = (sib.textContent || '').trim();
+              if (t && t.length < 80) scores.push(score(t));
+              break;
+            }}
+            sib = sib.previousElementSibling;
+          }}
+          node = node.parentElement;
+        }}
+
         var bestScore = Math.max.apply(null, scores);
         if (bestScore > 0) {{
           candidates.push({{el: el, score: bestScore, tag: el.tagName.toLowerCase(), type: el.type || ''}});
@@ -7400,13 +8847,38 @@ async def cmd_smart_select(text, option_text):
     safe_option = json.dumps(option_text.lower())
     js = f"""
     (function() {{
-      var search = {safe_text};
-      var optSearch = {safe_option};
-      var selects = document.querySelectorAll('select');
+      // Shadow DOM + locale-aware comparison — same conventions as smart-click
+      // / smart-fill so all three commands behave consistently on Lightning,
+      // Polymer, and Turkish/German content.
+      function deepQuerySelectorAll(root, selector) {{
+        var found = Array.from(root.querySelectorAll(selector));
+        Array.from(root.querySelectorAll('*')).forEach(function(el) {{
+          if (el.shadowRoot) {{
+            found = found.concat(deepQuerySelectorAll(el.shadowRoot, selector));
+          }}
+        }});
+        return found;
+      }}
+
+      function lc(s) {{
+        return (s == null ? '' : (s + '')).toLocaleLowerCase();
+      }}
+
+      var search = lc({safe_text}).trim();
+      var optSearch = lc({safe_option}).trim();
+      var selects = deepQuerySelectorAll(document, 'select');
       var best = null;
       var bestScore = 0;
-
-      Array.from(selects).forEach(function(sel) {{
+      var disabledCount = 0;
+
+      selects.forEach(function(sel) {{
+        // Skip disabled selects — same rationale as smart-click: silently
+        // setting .value on a disabled <select> is a no-op and confusing.
+        var isDisabled = (
+          sel.disabled === true ||
+          sel.getAttribute('aria-disabled') === 'true' ||
+          (typeof sel.closest === 'function' && sel.closest('fieldset[disabled], [aria-disabled="true"]') !== null)
+        );
         var texts = [
           sel.getAttribute('aria-label') || '',
           sel.name || '', sel.id || ''
@@ -7418,21 +8890,30 @@ async def cmd_smart_select(text, option_text):
         var parent = sel.closest('label');
         if (parent) texts.push(parent.textContent || '');
 
+        var matched = false;
         texts.forEach(function(t) {{
-          var s = t.toLowerCase().trim();
+          var s = lc(t).trim();
           var sc = s === search ? 100 : s.includes(search) ? 60 : 0;
-          if (sc > bestScore) {{ bestScore = sc; best = sel; }}
+          if (sc > 0) matched = true;
+          if (sc > bestScore && !isDisabled) {{ bestScore = sc; best = sel; }}
         }});
+        if (matched && isDisabled) disabledCount++;
       }});
 
-      if (!best) return JSON.stringify({{found: false}});
+      if (!best) {{
+        return JSON.stringify({{
+          found: false,
+          allDisabled: disabledCount > 0,
+          disabledCount: disabledCount
+        }});
+      }}
 
       // Find matching option
       var options = Array.from(best.options);
       var match = options.find(function(o) {{
-        return o.text.toLowerCase().trim() === optSearch;
+        return lc(o.text).trim() === optSearch;
       }}) || options.find(function(o) {{
-        return o.text.toLowerCase().includes(optSearch);
+        return lc(o.text).includes(optSearch);
       }});
 
       if (!match) return JSON.stringify({{found: true, optionFound: false, available: options.map(function(o) {{ return o.text; }}).slice(0, 10)}});
@@ -7451,7 +8932,11 @@ async def cmd_smart_select(text, option_text):
         return
 
     if not data.get("found"):
-        print(f'No select found matching: "{text}"', file=sys.stderr)
+        if data.get("allDisabled"):
+            print(f'Error: no enabled select matches "{text}" '
+                  f'({data.get("disabledCount", 0)} disabled match(es) skipped)', file=sys.stderr)
+        else:
+            print(f'No select found matching: "{text}"', file=sys.stderr)
         sys.exit(1)
     if not data.get("optionFound"):
         print(f'Option "{option_text}" not found. Available: {", ".join(data.get("available", []))}', file=sys.stderr)
@@ -9567,8 +11052,8 @@ class MCPServer:
              "inputSchema": {"type": "object", "properties": {"selector": {"type": "string", "description": "CSS selector for the input element"}, "value": {"type": "string", "description": "Value to set in the input field"}}, "required": ["selector", "value"]}},
             {"name": "browser_launch", "description": "Launch an isolated browser instance with Chrome DevTools Protocol enabled. Uses existing Brave/Chrome/Chromium installation — no browser download needed. Creates an isolated profile directory so your personal browser data is never touched.",
              "inputSchema": {"type": "object", "properties": {}}},
-            {"name": "browser_close", "description": "Close the currently active browser tab. Use this to clean up after automation tasks or to close unwanted popups/tabs that were opened during navigation.",
-             "inputSchema": {"type": "object", "properties": {}}},
+            {"name": "browser_close", "description": "Smart close: shut down every tab cdpilot opened during this automation, then close the whole browser application gracefully ONLY if no user-opened tabs remain. If the user has their own tabs open in the same browser, those are left untouched and the browser stays open. Use this to clean up after automation. Set force=true to close the browser even when user tabs remain; set keep_browser=true to only close cdpilot's tabs and never quit the browser.",
+             "inputSchema": {"type": "object", "properties": {"force": {"type": "boolean", "description": "Close the browser application even if user-opened tabs remain.", "default": False}, "keep_browser": {"type": "boolean", "description": "Only close cdpilot's own tabs; never quit the browser.", "default": False}}}},
             {"name": "browser_extract", "description": "Extract structured data from elements matching a CSS selector. No LLM needed — pure DOM extraction. Returns text (default), JSON (with tag, text, attrs, href, src), specific attributes, or clean list. Use for scraping tables, lists, links, form values. Limit: 100 elements for JSON, 200 for text.",
              "inputSchema": {"type": "object", "properties": {"selector": {"type": "string", "description": "CSS selector to match elements (e.g. 'table tr', '.product', 'a')"}, "format": {"type": "string", "enum": ["text", "json", "list"], "description": "Output format: 'text' (one per line), 'json' (full structure with attrs), 'list' (numbered)", "default": "text"}}, "required": ["selector"]}},
             {"name": "browser_observe", "description": "List all interactive elements on the current page with their available actions (CLICK, FILL, NAVIGATE, TOGGLE, SELECT, SUBMIT, UPLOAD). Like Stagehand observe() but deterministic — no LLM needed. Shows what you CAN DO on the page. Use this to understand page structure before acting.",
@@ -9577,6 +11062,11 @@ class MCPServer:
              "inputSchema": {"type": "object", "properties": {"text": {"type": "string", "description": "Visible text of the element to click (e.g. 'Login', 'Submit Order', 'Learn more')"}}, "required": ["text"]}},
             {"name": "browser_dismiss", "description": "Find and click the strongest 'dismiss / continue without account' button on the page. Built-in pattern library covers English + Turkish dismissive phrases ('Stay signed out', 'No thanks', 'Skip', 'Continue without', etc.) and explicitly excludes destructive lookalikes (Delete account, Sign out, Subscribe). Designed for LLM chat sites that gate queries behind a sign-up modal. Pass 'aggressive' or an integer N (max 10) to handle chained modals.",
              "inputSchema": {"type": "object", "properties": {"repeat": {"type": "string", "description": "Optional. Number of dismiss attempts (1-10) or 'aggressive' (up to 5 chained). Default: 1.", "default": "1"}}}},
+            {"name": "browser_captcha_solve", "description": "Solve the CAPTCHA on the current page (opt-in). Detects and solves Amazon classic image CAPTCHA (the \"Type the characters you see\" rate-limit page) by OCRing the image, filling the input, and submitting. Default provider 'amazon-local' uses the optional amazoncaptcha library (pip install amazoncaptcha) for offline OCR. BYOK providers 'capsolver' / '2captcha' use image-to-text APIs via CAPSOLVER_API_KEY / TWOCAPTCHA_API_KEY env vars. Returns JSON with solved status. For token-based CAPTCHAs (reCAPTCHA, hCaptcha, Turnstile) use the captcha config/auto CLI instead.",
+             "inputSchema": {"type": "object", "properties": {"provider": {"type": "string", "enum": ["amazon-local", "capsolver", "2captcha"], "description": "Solver provider. Default: amazon-local (offline OCR via optional amazoncaptcha lib).", "default": "amazon-local"}}}},
+            {"name": "browser_press_hold", "description": "Solve a PerimeterX/HUMAN \"Press & Hold\" challenge on the current page (opt-in). PerimeterX is a BEHAVIOURAL challenge -- the user must press AND HOLD a button for several seconds while the detector measures hold duration, natural hand-tremor, and release timing. It is NOT token-based, so there is no provider to call: the only solution is a real humanized press->hold->release gesture, which this tool emits via CDP Input events (Gaussian-randomized ~3-7s hold with +/-1-2px micro-jitter while the button is held). Auto-locates the #px-captcha widget (or pass an explicit selector). Returns JSON with solved status, hold_ms, and attempts. Use this when browser_friction/captcha-check reports a 'perimeterx' type.", "inputSchema": {"type": "object", "properties": {"selector": {"type": "string", "description": "Optional CSS selector for the hold target. If omitted, auto-finds the px-captcha button."}}}},
+            {"name": "browser_friction", "description": "Detect the highest anti-bot 'friction' rung on the current page and return the recommended response policy as JSON. Real sites stack defenses incrementally (rate-limit -> CAPTCHA -> login-wall -> SMS/OTP -> hard-block); this reports which rung is currently active. Levels (low->high): none, rate_limited, soft_captcha, login_wall, otp_sms, hard_block. Bilingual (English + Turkish) DOM heuristics. Read-only — never bypasses anything. login_wall/otp_sms/hard_block are flagged for HUMAN handoff (not autonomously solved) for safety/ethics; rate_limited recommends exponential backoff; soft_captcha defers to the captcha tools. Use this for diagnosis before deciding how to proceed on a gated site.",
+             "inputSchema": {"type": "object", "properties": {}}},
             {"name": "browser_smart_fill", "description": "Fill an input by its label or placeholder text — no CSS selector needed. Finds input by associated label, placeholder, aria-label, name, or id. React-compatible value setting. Use when you know WHAT field to fill but not the exact selector.",
              "inputSchema": {"type": "object", "properties": {"label": {"type": "string", "description": "Label or placeholder text of the input (e.g. 'Email', 'Password', 'Search')"}, "value": {"type": "string", "description": "Value to fill in the input"}}, "required": ["label", "value"]}},
             {"name": "browser_smart_select", "description": "Select a dropdown option by label and option text — no CSS selector needed. Finds the select element by label/name, then selects the matching option. Use for dropdown interactions without knowing selectors.",
@@ -9607,6 +11097,32 @@ class MCPServer:
              "inputSchema": {"type": "object", "properties": {"selector": {"type": "string", "description": "CSS selector for the element expected to be hidden"}}, "required": ["selector"]}},
             {"name": "browser_screenshot_diff", "description": "Compare two screenshot PNG files byte-by-byte. Returns MATCH if files are identical or DIFF with file sizes if different. Use this for visual regression testing — take a baseline screenshot, perform actions, take another screenshot, then compare.",
              "inputSchema": {"type": "object", "properties": {"path1": {"type": "string", "description": "Absolute path to the first (baseline) screenshot PNG"}, "path2": {"type": "string", "description": "Absolute path to the second (current) screenshot PNG"}}, "required": ["path1", "path2"]}},
+            {"name": "browser_watch_start", "description": "Begin a continuous JPEG screencast of the active page to disk. CDP's Page.startScreencast streams frames at 10-30fps so the model can actually SEE animation, mouse cursors, and short visual events that single screenshots miss. Spawns a background daemon that writes JPEGs into a per-project ring buffer (default 5 min retention, 100MB cap). Use this to capture video playback, animated demos, or any time-based UI for later multimodal analysis.",
+             "inputSchema": {"type": "object", "properties": {
+                 "url": {"type": "string", "description": "URL or file:// path to load before recording. Pass '-' or omit to attach to the currently-loaded page."},
+                 "fps": {"type": "integer", "description": "Frames per second (1-30). Higher = more detail but bigger ring buffer.", "default": 10},
+                 "quality": {"type": "integer", "description": "JPEG quality 1-100.", "default": 70},
+                 "max_width": {"type": "integer", "description": "Maximum frame width in pixels (shrinks proportionally).", "default": 1280},
+                 "retention_s": {"type": "integer", "description": "Seconds to keep frames before eviction.", "default": 300},
+                 "disk_cap_mb": {"type": "integer", "description": "Maximum total frame size in MB before oldest-first eviction.", "default": 100},
+                 "seek": {"type": "string", "description": "Optional MM:SS or seconds to seek the page's first <video> element to."}
+             }}},
+            {"name": "browser_watch_stop", "description": "Stop the background screencast daemon and (by default) delete the captured frames. Use after you've finished querying so you don't leak disk. Pass keep_frames=true to keep the ring buffer for later inspection.",
+             "inputSchema": {"type": "object", "properties": {
+                 "keep_frames": {"type": "boolean", "description": "Keep the captured frames on disk instead of deleting them.", "default": False}
+             }}},
+            {"name": "browser_watch_query", "description": "Return the file paths of JPEG frames captured around a target time window. Frames live on local disk so you can read them and feed them to a multimodal API (vision call) to actually understand what happened. Choose ONE of: at_window (centered on a video time), last (relative to the newest frame), since_last (everything new since the previous query). Returns at most `max` frames (default 16) — when more frames fall in the window we downsample, preferring high-motion moments when Pillow is available.",
+             "inputSchema": {"type": "object", "properties": {
+                 "at": {"type": "string", "description": "Video time to center on, MM:SS or seconds (e.g. '1:23'). Measured from screencast start."},
+                 "window": {"type": "string", "description": "Width of the window around `at`, e.g. '5s', '500ms'.", "default": "5s"},
+                 "last": {"type": "string", "description": "Return frames from the last N seconds (e.g. '5s'). Relative to the newest frame on disk."},
+                 "since_last": {"type": "boolean", "description": "Return only frames newer than the previous watch_query call."},
+                 "max": {"type": "integer", "description": "Maximum number of frame paths to return (downsampled if window has more).", "default": 16}
+             }}},
+            {"name": "browser_watch_status", "description": "Report the current screencast daemon state: running flag, frame count, total disk usage, oldest/newest timestamps. Use before browser_watch_query to confirm frames are actually being captured.",
+             "inputSchema": {"type": "object", "properties": {}}},
+            {"name": "browser_mode", "description": "Get or set the three-tier stealth mode (crawl4ai-style escalation). Tiers from lightest to heaviest fingerprint footprint: 'regular' injects NO anti-fingerprint patch (cleanest, fastest, fewest leaks — the default and best for most sites); 'stealth' injects a light patch (navigator.webdriver, chrome.runtime, permissions only — deliberately omits plugin spoofing which leaks); 'undetected' injects the full patch (light + plugin array + WebGL vendor + Worker patch — highest plausibility on naive checks but highest entropy). Omit 'tier' to read the current mode. Effect applies on the next navigation. Escalate to 'undetected' only for hard anti-bot targets.",
+             "inputSchema": {"type": "object", "properties": {"tier": {"type": "string", "enum": ["regular", "stealth", "undetected"], "description": "Tier to set. Omit to get the current tier."}}}},
         ]
 
     def _handle_request(self, request):
@@ -9657,12 +11173,15 @@ class MCPServer:
             "browser_a11y": lambda a: ["a11y"] + ([a["mode"]] if a.get("mode") and a["mode"] != "full" else []),
             "browser_fill": lambda a: ["fill", a.get("selector", ""), a.get("value", "")],
             "browser_launch": lambda a: ["launch"],
-            "browser_close": lambda a: ["close"],
+            "browser_close": lambda a: ["close"] + (["--force"] if a.get("force") else []) + (["--keep"] if a.get("keep_browser") else []),
             "browser_extract": lambda a: ["extract", a.get("selector", "")] + ([f"--{a['format']}"] if a.get("format") and a["format"] != "text" else []),
             "browser_observe": lambda a: ["observe"],
             "browser_smart_click": lambda a: ["smart-click", a.get("text", "")],
             "browser_dismiss": lambda a: ["dismiss"] + ([str(a["repeat"])] if a.get("repeat") else []),
             "browser_smart_fill": lambda a: ["smart-fill", a.get("label", ""), a.get("value", "")],
+            "browser_captcha_solve": lambda a: ["captcha-solve"] + ([f"--provider={a['provider']}"] if a.get("provider") else []),
+            "browser_press_hold": lambda a: ["press-hold"] + ([a["selector"]] if a.get("selector") else []),
+            "browser_friction": lambda a: ["friction"],
             "browser_smart_select": lambda a: ["smart-select", a.get("label", ""), a.get("option", "")],
             "browser_describe": lambda a: ["describe"],
             "browser_assert": lambda a: ["assert", a.get("selector", "")] + ([a["text"]] if a.get("text") else []),
@@ -9677,6 +11196,11 @@ class MCPServer:
             "browser_assert_visible": lambda a: ["assert-visible", a.get("selector", "")],
             "browser_assert_hidden": lambda a: ["assert-hidden", a.get("selector", "")],
             "browser_screenshot_diff": lambda a: ["screenshot-diff", a.get("path1", ""), a.get("path2", "")],
+            "browser_watch_start": lambda a: ["watch", "start"] + ([a["url"]] if a.get("url") else []) + ([f"--fps={a['fps']}"] if a.get("fps") else []) + ([f"--quality={a['quality']}"] if a.get("quality") else []) + ([f"--max-width={a['max_width']}"] if a.get("max_width") else []) + ([f"--retention={a['retention_s']}"] if a.get("retention_s") else []) + ([f"--disk-cap={a['disk_cap_mb']}"] if a.get("disk_cap_mb") else []) + ([f"--seek={a['seek']}"] if a.get("seek") else []),
+            "browser_watch_stop": lambda a: ["watch", "stop"] + (["--keep-frames"] if a.get("keep_frames") else []),
+            "browser_watch_query": lambda a: ["watch", "query"] + ([f"--at={a['at']}"] if a.get("at") else []) + ([f"--window={a['window']}"] if a.get("window") else []) + ([f"--last={a['last']}"] if a.get("last") else []) + (["--since-last"] if a.get("since_last") else []) + ([f"--max={a['max']}"] if a.get("max") else []),
+            "browser_watch_status": lambda a: ["watch", "status"],
+            "browser_mode": lambda a: ["mode"] + ([a["tier"]] if a.get("tier") else []),
         }
         if tool_name not in tool_map:
             return {"jsonrpc": "2.0", "id": req_id, "error": {"code": -32602, "message": f"Unknown tool: {tool_name}"}}
@@ -10409,25 +11933,848 @@ def _dispatch_blog_cmd(args):
 # ─── End Blog Publish Namespace ───────────────────────────────────────────────
 
 
-# ─── CLI ───
+# ─── cdpilot watch — continuous screencast for AI video understanding ─────────
+#
+# Why this exists: still screenshots taken at command-rate intervals (~1s)
+# cannot capture animation, mouse cursors, scroll dynamics, or short visual
+# events ("kedi sola mı sağa mı koştu?"). CDP's built-in Page.startScreencast
+# streams JPEG frames at 10-30fps directly from the renderer. We tee the
+# stream onto a disk ring buffer so AI orchestrators (Claude, etc.) can query
+# any time window after the fact and get real frames to feed into a
+# multimodal API. Two-process design: a long-lived daemon owns the WS and
+# writes frames; foreground `query/status/stop` commands only read disk.
 
-if __name__ == "__main__":
-    if len(sys.argv) < 2:
-        print(__doc__)
-        sys.exit(0)
+WATCH_DEFAULT_FPS = 10
+WATCH_DEFAULT_QUALITY = 70
+WATCH_DEFAULT_MAX_WIDTH = 1280
+WATCH_DEFAULT_RETENTION_S = 300     # 5 minutes
+WATCH_DEFAULT_DISK_CAP_MB = 100
+WATCH_DAEMON_FLAG = '--_watch-daemon'  # hidden — used only for re-entrant fork
 
-    cmd = sys.argv[1]
-    args = sys.argv[2:]
 
-    # POSIX-style flag aliases — accepted at the Python entry point too,
-    # not just at the Node wrapper. Lets `python src/cdpilot.py --version`
-    # work in CI and for users who skip the Node wrapper entirely.
-    if cmd in ('--version', '-v'):
-        cmd = 'version'
+def _watch_dir():
+    """Return per-project watch directory (state + frames + index)."""
+    pid = PROJECT_ID or _get_project_id()
+    return os.path.join(CDPILOT_HOME, 'projects', pid, 'watch')
+
+
+def _watch_frames_dir():
+    return os.path.join(_watch_dir(), 'frames')
+
+
+def _watch_state_path():
+    return os.path.join(_watch_dir(), 'state.json')
+
+
+def _watch_index_path():
+    return os.path.join(_watch_dir(), 'index.jsonl')
+
+
+def _watch_log_path():
+    return os.path.join(_watch_dir(), 'daemon.log')
+
+
+def _watch_load_state():
+    try:
+        with open(_watch_state_path()) as f:
+            return json.load(f)
+    except (OSError, ValueError):
+        return None
+
+
+def _watch_save_state(state):
+    os.makedirs(_watch_dir(), exist_ok=True)
+    tmp = _watch_state_path() + '.tmp'
+    with open(tmp, 'w') as f:
+        json.dump(state, f, indent=2)
+    os.replace(tmp, _watch_state_path())
+
+
+def _watch_clear_state():
+    for p in (_watch_state_path(), _watch_index_path()):
+        try:
+            os.remove(p)
+        except OSError:
+            pass
+
+
+def _watch_pid_alive(pid):
+    if not pid:
+        return False
+    try:
+        os.kill(int(pid), 0)
+        return True
+    except (OSError, ValueError):
+        return False
+
+
+def _watch_parse_timecode(spec):
+    """Parse '1:23', '83', '1:23.5' into seconds (float). Returns None on failure."""
+    if spec is None:
+        return None
+    s = str(spec).strip()
+    if not s:
+        return None
+    try:
+        if ':' in s:
+            mm, ss = s.split(':', 1)
+            return float(mm) * 60 + float(ss)
+        return float(s)
+    except ValueError:
+        return None
+
+
+def _watch_parse_window(spec):
+    """Parse '5s', '2.5', '500ms' into seconds (float). Returns 5.0 on failure."""
+    if spec is None:
+        return 5.0
+    s = str(spec).strip().lower()
+    if not s:
+        return 5.0
+    try:
+        if s.endswith('ms'):
+            return float(s[:-2]) / 1000.0
+        if s.endswith('s'):
+            return float(s[:-1])
+        return float(s)
+    except ValueError:
+        return 5.0
+
+
+def _watch_evict(retention_s, disk_cap_bytes):
+    """Drop frames older than retention OR over disk cap (oldest-first).
+
+    Returns (removed_count, bytes_freed).
+    """
+    fdir = _watch_frames_dir()
+    if not os.path.isdir(fdir):
+        return 0, 0
+    now_ms = int(time.time() * 1000)
+    cutoff_ms = now_ms - int(retention_s * 1000)
+
+    files = []
+    for name in os.listdir(fdir):
+        if not name.endswith('.jpg'):
+            continue
+        try:
+            ts_ms = int(name[:-4])
+        except ValueError:
+            continue
+        path = os.path.join(fdir, name)
+        try:
+            size = os.path.getsize(path)
+        except OSError:
+            continue
+        files.append((ts_ms, path, size))
+    files.sort()  # oldest first
+
+    removed = 0
+    freed = 0
+    # Age-based eviction
+    keep = []
+    for ts_ms, path, size in files:
+        if ts_ms < cutoff_ms:
+            try:
+                os.remove(path)
+                removed += 1
+                freed += size
+            except OSError:
+                pass
+        else:
+            keep.append((ts_ms, path, size))
+
+    # Disk-cap eviction (drop oldest until under cap)
+    total = sum(s for _, _, s in keep)
+    while keep and total > disk_cap_bytes:
+        ts_ms, path, size = keep.pop(0)
+        try:
+            os.remove(path)
+            removed += 1
+            freed += size
+            total -= size
+        except OSError:
+            pass
+
+    return removed, freed
+
+
+def _watch_list_frames():
+    """Scan the ring buffer dir, return sorted list of (ts_ms, path)."""
+    fdir = _watch_frames_dir()
+    out = []
+    if not os.path.isdir(fdir):
+        return out
+    for name in os.listdir(fdir):
+        if not name.endswith('.jpg'):
+            continue
+        try:
+            ts_ms = int(name[:-4])
+        except ValueError:
+            continue
+        out.append((ts_ms, os.path.join(fdir, name)))
+    out.sort()
+    return out
+
+
+def _watch_frame_diff(a_path, b_path):
+    """Mean absolute pixel difference (0.0..1.0). Returns None if PIL missing.
+
+    Graceful degradation: if PIL/Pillow is not installed we return None and
+    callers fall back to uniform frame picking.
+    """
+    try:
+        from PIL import Image, ImageChops, ImageStat  # type: ignore
+    except ImportError:
+        return None
+    try:
+        with Image.open(a_path) as a_img, Image.open(b_path) as b_img:
+            a_g = a_img.convert('L').resize((160, 90))
+            b_g = b_img.convert('L').resize((160, 90))
+            diff = ImageChops.difference(a_g, b_g)
+            stat = ImageStat.Stat(diff)
+            return float(stat.mean[0]) / 255.0
+    except Exception:
+        return None
+
+
+# ─── watch daemon (the actual screencast consumer) ───
+
+async def _watch_daemon_run(url, fps, quality, max_width, retention_s,
+                            disk_cap_bytes, seek_s):
+    """Long-lived process: open WS, subscribe to screencastFrame, write JPEGs.
+
+    Runs until SIGTERM / parent kill. Each frame:
+      1. base64-decode payload
+      2. write to frames/<unix_ms>.jpg
+      3. ACK with Page.screencastFrameAck (required, else stream stalls)
+      4. periodically evict (every ~2s)
+    """
+    import websockets
+
+    fdir = _watch_frames_dir()
+    os.makedirs(fdir, exist_ok=True)
+
+    # Launch browser if needed
+    if not cdp_get("/json/version"):
+        cmd_launch()
+
+    ws_url, _ = get_page_ws()
+
+    # Navigate first (so the page exists before we start screencasting).
+    # If url is empty we just attach to whatever is currently loaded.
+    if url:
+        try:
+            await navigate_collect(ws_url, url, glow=False)
+        except Exception as e:
+            sys.stderr.write(f"watch: navigate failed: {e}\n")
+
+    # Try to coax a <video> element into autoplay + (optional) seek.
+    # Best-effort — silent if the page has no video.
+    autoplay_js = (
+        "(()=>{const v=document.querySelector('video');"
+        "if(!v) return {ok:false,reason:'no-video'};"
+        "try{v.muted=true;v.playsInline=true;"
+        + (f"v.currentTime={float(seek_s)};" if seek_s is not None else "")
+        + "const p=v.play();if(p&&p.catch)p.catch(()=>{});"
+        "return {ok:true,duration:v.duration||0,currentTime:v.currentTime};}"
+        "catch(e){return {ok:false,reason:String(e)};}})()"
+    )
+    try:
+        await cdp_send(ws_url, [(81, "Runtime.evaluate", {
+            "expression": autoplay_js, "returnByValue": True,
+        })])
+    except Exception:
+        pass
+
+    # everyNthFrame: CDP samples at ~60fps native; nth=6 → ~10fps.
+    every_nth = max(1, int(round(60 / max(1, fps))))
+
+    # We bypass the pooled cdp_send for the screencast loop because we need
+    # to consume *unsolicited* event frames (Page.screencastFrame) for the
+    # entire daemon lifetime. The pool model assumes request/response.
+    async with websockets.connect(ws_url, max_size=100 * 1024 * 1024) as ws:
+        await ws.send(json.dumps({"id": 1, "method": "Page.enable", "params": {}}))
+        await ws.send(json.dumps({
+            "id": 2, "method": "Page.startScreencast",
+            "params": {
+                "format": "jpeg",
+                "quality": int(quality),
+                "maxWidth": int(max_width),
+                "everyNthFrame": every_nth,
+            },
+        }))
+
+        last_evict = time.time()
+        frame_count = 0
+        # Update state file with confirmed start so `status` shows "running"
+        st = _watch_load_state() or {}
+        st['screencast_started_at_ms'] = int(time.time() * 1000)
+        _watch_save_state(st)
+
+        while True:
+            try:
+                resp = await asyncio.wait_for(ws.recv(), timeout=5)
+            except asyncio.TimeoutError:
+                # Periodic eviction even if no frames arrive (e.g. page paused)
+                if time.time() - last_evict > 2.0:
+                    _watch_evict(retention_s, disk_cap_bytes)
+                    last_evict = time.time()
+                continue
+            try:
+                data = json.loads(resp)
+            except ValueError:
+                continue
+            if data.get("method") != "Page.screencastFrame":
+                continue
+            params = data.get("params", {})
+            session_id = params.get("sessionId")
+            b64 = params.get("data", "")
+            ts_ms = int(time.time() * 1000)
+
+            try:
+                raw = base64.b64decode(b64)
+            except Exception:
+                raw = b""
+            if raw:
+                fpath = os.path.join(fdir, f"{ts_ms}.jpg")
+                try:
+                    with open(fpath, 'wb') as f:
+                        f.write(raw)
+                    # Append to index (best-effort; missing entries are fine,
+                    # query falls back to scanning the dir directly)
+                    try:
+                        with open(_watch_index_path(), 'a') as idx:
+                            idx.write(json.dumps({
+                                "ts_ms": ts_ms,
+                                "filename": f"{ts_ms}.jpg",
+                                "size": len(raw),
+                            }) + "\n")
+                    except OSError:
+                        pass
+                    frame_count += 1
+                except OSError as e:
+                    sys.stderr.write(f"watch: write failed: {e}\n")
+
+            # ACK is REQUIRED — CDP stops sending frames until acknowledged.
+            try:
+                await ws.send(json.dumps({
+                    "id": 1000 + (frame_count % 10000),
+                    "method": "Page.screencastFrameAck",
+                    "params": {"sessionId": session_id},
+                }))
+            except Exception:
+                break
+
+            # Periodic eviction (every ~2s)
+            if time.time() - last_evict > 2.0:
+                _watch_evict(retention_s, disk_cap_bytes)
+                last_evict = time.time()
+
+
+def _cmd_watch_daemon_entry():
+    """Internal: re-entrant entry point when called with --_watch-daemon flag.
+
+    Reads parameters from state file, runs the async screencast loop forever.
+    Logs go to daemon.log so the foreground process can stay clean.
+    """
+    state = _watch_load_state() or {}
+    url = state.get('url') or ''
+    fps = int(state.get('fps') or WATCH_DEFAULT_FPS)
+    quality = int(state.get('quality') or WATCH_DEFAULT_QUALITY)
+    max_width = int(state.get('max_width') or WATCH_DEFAULT_MAX_WIDTH)
+    retention_s = float(state.get('retention_s') or WATCH_DEFAULT_RETENTION_S)
+    disk_cap_bytes = int(state.get('disk_cap_bytes') or WATCH_DEFAULT_DISK_CAP_MB * 1024 * 1024)
+    seek_s = state.get('seek_s')
+
+    state['pid'] = os.getpid()
+    state['daemon_started_at_ms'] = int(time.time() * 1000)
+    _watch_save_state(state)
+
+    try:
+        asyncio.run(_watch_daemon_run(
+            url, fps, quality, max_width, retention_s, disk_cap_bytes, seek_s
+        ))
+    except KeyboardInterrupt:
+        pass
+    except Exception as e:
+        try:
+            with open(_watch_log_path(), 'a') as f:
+                f.write(f"[{datetime.datetime.utcnow().isoformat()}] daemon crash: {e}\n")
+        except OSError:
+            pass
+
+
+def cmd_watch_start(*args):
+    """Start screencast capture in a background daemon.
+
+    cdpilot watch start <url|file://path|->  [--fps=10] [--quality=70]
+                                              [--max-width=1280]
+                                              [--retention=300]
+                                              [--disk-cap=100]
+                                              [--seek=1:23]
+
+    - URL may be omitted to attach to the currently-loaded page.
+    - `-` as URL also means "attach, don't navigate".
+    - Idempotent: if a daemon for this project is already running it is
+      stopped first (we never want two screencasts on the same target).
+    """
+    # Stop any prior daemon — two screencasts on one target would race.
+    prev = _watch_load_state()
+    if prev and _watch_pid_alive(prev.get('pid')):
+        try:
+            os.kill(int(prev['pid']), 15)
+        except OSError:
+            pass
+        # brief wait so the WS releases
+        for _ in range(20):
+            if not _watch_pid_alive(prev.get('pid')):
+                break
+            time.sleep(0.05)
+
+    # Wipe ring buffer + index from any prior run (same project, different video)
+    fdir = _watch_frames_dir()
+    if os.path.isdir(fdir):
+        for name in os.listdir(fdir):
+            if name.endswith('.jpg'):
+                try:
+                    os.remove(os.path.join(fdir, name))
+                except OSError:
+                    pass
+    try:
+        os.remove(_watch_index_path())
+    except OSError:
+        pass
+
+    # Parse args
+    url = ''
+    fps = WATCH_DEFAULT_FPS
+    quality = WATCH_DEFAULT_QUALITY
+    max_width = WATCH_DEFAULT_MAX_WIDTH
+    retention_s = WATCH_DEFAULT_RETENTION_S
+    disk_cap_mb = WATCH_DEFAULT_DISK_CAP_MB
+    seek_s = None
+
+    positional = []
+    for a in args:
+        if a.startswith('--fps='):
+            try:
+                fps = max(1, min(30, int(a.split('=', 1)[1])))
+            except ValueError:
+                pass
+        elif a.startswith('--quality='):
+            try:
+                quality = max(1, min(100, int(a.split('=', 1)[1])))
+            except ValueError:
+                pass
+        elif a.startswith('--max-width='):
+            try:
+                max_width = max(160, min(3840, int(a.split('=', 1)[1])))
+            except ValueError:
+                pass
+        elif a.startswith('--retention='):
+            try:
+                retention_s = max(5, int(a.split('=', 1)[1]))
+            except ValueError:
+                pass
+        elif a.startswith('--disk-cap='):
+            try:
+                disk_cap_mb = max(1, int(a.split('=', 1)[1]))
+            except ValueError:
+                pass
+        elif a.startswith('--seek='):
+            seek_s = _watch_parse_timecode(a.split('=', 1)[1])
+        elif not a.startswith('--'):
+            positional.append(a)
+
+    if positional:
+        url = positional[0]
+        if url == '-':
+            url = ''
+
+    os.makedirs(_watch_frames_dir(), exist_ok=True)
+    state = {
+        'url': url,
+        'fps': fps,
+        'quality': quality,
+        'max_width': max_width,
+        'retention_s': retention_s,
+        'disk_cap_bytes': disk_cap_mb * 1024 * 1024,
+        'seek_s': seek_s,
+        'started_at_ms': int(time.time() * 1000),
+        'project_id': PROJECT_ID,
+        'pid': None,
+    }
+    _watch_save_state(state)
+
+    # Fork the daemon. Use the same python + this script + the hidden flag.
+    script = os.path.abspath(__file__)
+    log_f = None
+    try:
+        log_f = open(_watch_log_path(), 'a')
+    except OSError:
+        log_f = subprocess.DEVNULL
+
+    env = os.environ.copy()
+    env['CDPILOT_PROJECT_ID'] = PROJECT_ID or _get_project_id()
+    # The daemon must use the same CDP port (same project's browser)
+    env['CDP_PORT'] = str(CDP_PORT)
+
+    proc = subprocess.Popen(
+        [sys.executable, script, WATCH_DAEMON_FLAG],
+        stdout=log_f, stderr=log_f,
+        env=env,
+        start_new_session=True,  # detach from this terminal's process group
+    )
+    state['pid'] = proc.pid
+    _watch_save_state(state)
+
+    # Wait briefly for the daemon to confirm screencast start
+    confirmed = False
+    for _ in range(40):  # up to ~2s
+        time.sleep(0.05)
+        st = _watch_load_state() or {}
+        if st.get('screencast_started_at_ms'):
+            confirmed = True
+            break
+        if not _watch_pid_alive(proc.pid):
+            break
+
+    out = {
+        'ok': confirmed or _watch_pid_alive(proc.pid),
+        'pid': proc.pid,
+        'url': url or '(attach)',
+        'fps': fps,
+        'quality': quality,
+        'max_width': max_width,
+        'retention_s': retention_s,
+        'disk_cap_mb': disk_cap_mb,
+        'frames_dir': _watch_frames_dir(),
+        'state_path': _watch_state_path(),
+    }
+    print(json.dumps(out, indent=2))
+    if not out['ok']:
+        sys.exit(1)
+
+
+def cmd_watch_stop(*args):
+    """Stop the watch daemon and optionally cleanup frames."""
+    keep_frames = '--keep-frames' in args
+    state = _watch_load_state()
+    if not state:
+        print(json.dumps({'ok': True, 'message': 'no active watch session'}))
+        return
+
+    pid = state.get('pid')
+    killed = False
+    if pid and _watch_pid_alive(pid):
+        try:
+            os.kill(int(pid), 15)
+            killed = True
+        except OSError:
+            pass
+        for _ in range(40):
+            if not _watch_pid_alive(pid):
+                break
+            time.sleep(0.05)
+        if _watch_pid_alive(pid):
+            try:
+                os.kill(int(pid), 9)
+            except OSError:
+                pass
+
+    removed = 0
+    if not keep_frames:
+        fdir = _watch_frames_dir()
+        if os.path.isdir(fdir):
+            for name in os.listdir(fdir):
+                if name.endswith('.jpg'):
+                    try:
+                        os.remove(os.path.join(fdir, name))
+                        removed += 1
+                    except OSError:
+                        pass
+        try:
+            os.remove(_watch_index_path())
+        except OSError:
+            pass
+
+    _watch_clear_state()
+    print(json.dumps({
+        'ok': True,
+        'killed': killed,
+        'pid': pid,
+        'frames_removed': removed,
+        'kept_frames': keep_frames,
+    }, indent=2))
+
+
+def cmd_watch_status(*args):
+    """Report daemon state, frame count, disk usage."""
+    state = _watch_load_state()
+    frames = _watch_list_frames()
+    total_size = sum(os.path.getsize(p) for _, p in frames if os.path.exists(p)) if frames else 0
+
+    out = {
+        'running': bool(state and _watch_pid_alive(state.get('pid'))),
+        'frames': len(frames),
+        'disk_bytes': total_size,
+        'disk_mb': round(total_size / (1024 * 1024), 2),
+        'oldest_ts_ms': frames[0][0] if frames else None,
+        'newest_ts_ms': frames[-1][0] if frames else None,
+    }
+    if state:
+        out['pid'] = state.get('pid')
+        out['url'] = state.get('url') or '(attach)'
+        out['fps'] = state.get('fps')
+        out['started_at_ms'] = state.get('started_at_ms')
+        out['screencast_started_at_ms'] = state.get('screencast_started_at_ms')
+        out['retention_s'] = state.get('retention_s')
+        out['disk_cap_mb'] = (state.get('disk_cap_bytes') or 0) // (1024 * 1024)
+    print(json.dumps(out, indent=2))
+
+
+def _watch_last_query_path():
+    return os.path.join(_watch_dir(), 'last-query.json')
+
+
+def cmd_watch_query(*args):
+    """Return frame paths inside a time window as JSON.
+
+    cdpilot watch query --at <mm:ss|sec> --window <Ns>  [--max=16]
+    cdpilot watch query --since-last [--max=16]
+    cdpilot watch query --last <Ns> [--max=16]    (relative to newest frame)
+
+    Time mapping: --at is interpreted as VIDEO time, measured from the moment
+    the screencast started (state['screencast_started_at_ms']). This matches
+    user intuition for "what happened at 0:35" because we begin capturing
+    right after autoplay.
+    """
+    state = _watch_load_state()
+    if not state:
+        print(json.dumps({'frames': [], 'count': 0, 'error': 'no watch session'}))
+        return
+
+    max_frames = 16
+    at_s = None
+    window_s = 5.0
+    since_last = False
+    last_window = None
+
+    args_list = list(args)
+    i = 0
+    while i < len(args_list):
+        a = args_list[i]
+        if a == '--at' and i + 1 < len(args_list):
+            at_s = _watch_parse_timecode(args_list[i + 1])
+            i += 2
+        elif a.startswith('--at='):
+            at_s = _watch_parse_timecode(a.split('=', 1)[1])
+            i += 1
+        elif a == '--window' and i + 1 < len(args_list):
+            window_s = _watch_parse_window(args_list[i + 1])
+            i += 2
+        elif a.startswith('--window='):
+            window_s = _watch_parse_window(a.split('=', 1)[1])
+            i += 1
+        elif a == '--max' and i + 1 < len(args_list):
+            try:
+                max_frames = max(1, min(64, int(args_list[i + 1])))
+            except ValueError:
+                pass
+            i += 2
+        elif a.startswith('--max='):
+            try:
+                max_frames = max(1, min(64, int(a.split('=', 1)[1])))
+            except ValueError:
+                pass
+            i += 1
+        elif a == '--since-last':
+            since_last = True
+            i += 1
+        elif a == '--last' and i + 1 < len(args_list):
+            last_window = _watch_parse_window(args_list[i + 1])
+            i += 2
+        elif a.startswith('--last='):
+            last_window = _watch_parse_window(a.split('=', 1)[1])
+            i += 1
+        else:
+            i += 1
+
+    frames = _watch_list_frames()
+    if not frames:
+        print(json.dumps({'frames': [], 'count': 0, 'duration_s': 0}))
+        return
+
+    sc_start_ms = state.get('screencast_started_at_ms') or state.get('started_at_ms') or frames[0][0]
+    selected = []
+
+    if since_last:
+        last_q = 0
+        try:
+            with open(_watch_last_query_path()) as f:
+                last_q = int(json.load(f).get('ts_ms') or 0)
+        except (OSError, ValueError):
+            last_q = 0
+        selected = [(ts, p) for ts, p in frames if ts > last_q]
+    elif last_window is not None:
+        newest_ts = frames[-1][0]
+        lo_ms = newest_ts - int(last_window * 1000)
+        selected = [(ts, p) for ts, p in frames if ts >= lo_ms]
+    elif at_s is not None:
+        # Map video time to wall-clock ms
+        center_ms = sc_start_ms + int(at_s * 1000)
+        half_ms = int((window_s / 2.0) * 1000)
+        lo_ms = center_ms - half_ms
+        hi_ms = center_ms + half_ms
+        selected = [(ts, p) for ts, p in frames if lo_ms <= ts <= hi_ms]
+    else:
+        # Default: the latest <window_s> seconds
+        newest_ts = frames[-1][0]
+        lo_ms = newest_ts - int(window_s * 1000)
+        selected = [(ts, p) for ts, p in frames if ts >= lo_ms]
+
+    # Downsample to max_frames (uniform pick, keep first + last)
+    if len(selected) > max_frames:
+        # Try motion-aware picking when PIL is available
+        motion_scores = []
+        for j in range(1, len(selected)):
+            d = _watch_frame_diff(selected[j - 1][1], selected[j][1])
+            motion_scores.append(d if d is not None else 0.0)
+        if motion_scores and any(s is not None for s in motion_scores):
+            # Pick frames around the highest-motion peaks
+            indices = sorted(range(len(motion_scores)),
+                             key=lambda k: motion_scores[k], reverse=True)
+            pick_idx = sorted(set([0, len(selected) - 1] + indices[:max_frames - 2]))
+            pick_idx = pick_idx[:max_frames]
+            selected = [selected[k] for k in pick_idx]
+        else:
+            # Uniform downsample
+            step = len(selected) / max_frames
+            picks = [int(j * step) for j in range(max_frames)]
+            picks[-1] = len(selected) - 1
+            selected = [selected[k] for k in picks]
+
+    if selected:
+        try:
+            with open(_watch_last_query_path(), 'w') as f:
+                json.dump({'ts_ms': selected[-1][0]}, f)
+        except OSError:
+            pass
+
+    duration_s = (selected[-1][0] - selected[0][0]) / 1000.0 if len(selected) >= 2 else 0.0
+    out = {
+        'frames': [p for _, p in selected],
+        'timestamps_ms': [t for t, _ in selected],
+        'count': len(selected),
+        'duration_s': round(duration_s, 3),
+        'window_s': window_s,
+        'at_s': at_s,
+        'screencast_started_at_ms': sc_start_ms,
+    }
+    print(json.dumps(out, indent=2))
+
+
+def cmd_watch_ask(*args):
+    """Tiny natural-language wrapper around `watch query`.
+
+    cdpilot watch ask "0:35'te kedi sola mı sağa mı koştu?"
+    cdpilot watch ask "son 5 saniyede ne oldu"
+
+    We don't actually do LLM inference here — this command just parses a
+    time window out of the question and emits the same JSON shape as
+    `watch query` so the orchestrator (Claude) can pick up the frames and
+    feed them to a multimodal API itself.
+    """
+    if not args:
+        print(json.dumps({'error': 'question required'}))
+        sys.exit(1)
+    question = ' '.join(args)
+    q_lower = question.lower()
+
+    # Find mm:ss or m:ss anywhere in the string
+    m = _re.search(r'(\d+):(\d{1,2})(?:\.\d+)?', question)
+    at_s = None
+    if m:
+        at_s = float(m.group(1)) * 60 + float(m.group(2))
+
+    # "son N saniye(de)" / "last N seconds"
+    last_match = _re.search(r'(?:son|last)\s+(\d+(?:\.\d+)?)\s*(?:saniye|sec|seconds?|s\b)', q_lower)
+    last_window = float(last_match.group(1)) if last_match else None
+
+    forward = []
+    if at_s is not None:
+        forward = ['--at', f'{int(at_s // 60)}:{at_s % 60:.2f}'.rstrip('0').rstrip('.'),
+                   '--window', '5s']
+    elif last_window is not None:
+        forward = ['--last', f'{last_window}s']
+    else:
+        forward = ['--last', '5s']
+
+    forward += ['--max', '8']
+    cmd_watch_query(*forward)
+
+
+def _dispatch_watch_cmd(args):
+    """Parse `cdpilot watch <sub> ...` and dispatch. Sync wrapper."""
+    sub = args[0] if args else ''
+    rest = args[1:]
+    if not sub or sub in ('--help', '-h', 'help'):
+        print("Usage: cdpilot watch <subcommand> [options]", file=sys.stderr)
+        print("", file=sys.stderr)
+        print("Subcommands:", file=sys.stderr)
+        print("  start [url|-] [--fps=N] [--quality=N] [--max-width=N]", file=sys.stderr)
+        print("                 [--retention=SEC] [--disk-cap=MB] [--seek=MM:SS]", file=sys.stderr)
+        print("  stop [--keep-frames]", file=sys.stderr)
+        print("  query --at MM:SS --window 5s [--max=16]", file=sys.stderr)
+        print("  query --since-last [--max=16]", file=sys.stderr)
+        print("  query --last 5s [--max=16]", file=sys.stderr)
+        print("  status", file=sys.stderr)
+        print("  ask \"<natural-language question>\"", file=sys.stderr)
+        sys.exit(0)
+    if sub == 'start':
+        cmd_watch_start(*rest)
+    elif sub == 'stop':
+        cmd_watch_stop(*rest)
+    elif sub == 'query':
+        cmd_watch_query(*rest)
+    elif sub == 'status':
+        cmd_watch_status(*rest)
+    elif sub == 'ask':
+        cmd_watch_ask(*rest)
+    else:
+        print(f"Unknown watch subcommand: {sub}. Run: cdpilot watch --help", file=sys.stderr)
+        sys.exit(1)
+
+
+# ─── End cdpilot watch namespace ──────────────────────────────────────────────
+
+
+# ─── CLI ───
+
+if __name__ == "__main__":
+    if len(sys.argv) < 2:
+        print(__doc__)
+        sys.exit(0)
+
+    cmd = sys.argv[1]
+    args = sys.argv[2:]
+
+    # POSIX-style flag aliases — accepted at the Python entry point too,
+    # not just at the Node wrapper. Lets `python src/cdpilot.py --version`
+    # work in CI and for users who skip the Node wrapper entirely.
+    if cmd in ('--version', '-v'):
+        cmd = 'version'
     elif cmd in ('--help', '-h'):
         print(__doc__)
         sys.exit(0)
 
+    # Hidden re-entrant entry for the watch daemon. `cdpilot watch start`
+    # forks this process with the flag so the screencast consumer runs in
+    # the background while the foreground process returns immediately.
+    if cmd == WATCH_DAEMON_FLAG:
+        _cmd_watch_daemon_entry()
+        sys.exit(0)
+
     sync_cmds = {
         'launch': cmd_launch,
         'tabs': cmd_tabs,
@@ -10437,6 +12784,7 @@ if __name__ == "__main__":
         'proxy': lambda: cmd_proxy(*args),
         'headless': lambda: cmd_headless(args[0] if args else None),
         'stealth': lambda: cmd_stealth(args[0] if args else None),
+        'mode': lambda: cmd_mode(args[0] if args else None),
         'block': lambda: cmd_block(*args),
         'context': lambda: cmd_context(*args),
         'show': lambda: cmd_show(args[0] if args else None),
@@ -10458,6 +12806,7 @@ if __name__ == "__main__":
         'test': lambda: cmd_test_dispatch(args),
         'trace': lambda: cmd_trace_dispatch(args),
         'blog': lambda: _dispatch_blog_cmd(args),
+        'watch': lambda: _dispatch_watch_cmd(args),
     }
 
     if cmd == "serve":
@@ -10497,6 +12846,15 @@ if __name__ == "__main__":
         cmd_switch_tab(args[0])
         sys.exit(0)
 
+    # `stop --smart` aliases the smart close (owned tabs + browser-if-empty).
+    # Bare `stop` keeps its legacy full-kill behavior for backward compatibility.
+    if cmd == "stop" and "--smart" in args:
+        asyncio.run(cmd_close(
+            force_browser="--force" in args,
+            keep_browser=("--keep" in args or "--keep-browser" in args),
+        ))
+        sys.exit(0)
+
     if cmd in sync_cmds:
         sync_cmds[cmd]()
         sys.exit(0)
@@ -10557,7 +12915,10 @@ if __name__ == "__main__":
         "emulate": lambda: (require_args(1, "emulate <device>"), None)[1] if not args else cmd_emulate(args[0]),
         "glow": lambda: cmd_glow(args[0] if args else "on"),
         "debug": lambda: cmd_debug(args[0] if args else None),
-        "close": cmd_close,
+        "close": lambda: cmd_close(
+            force_browser="--force" in args,
+            keep_browser=("--keep" in args or "--keep-browser" in args),
+        ),
         'new-tab': lambda: cmd_new_tab(args[0] if args else 'about:blank'),
         'close-tab': lambda: cmd_close_tab(args[0] if args else None),
         'pdf': lambda: cmd_pdf(args[0] if args else None),
@@ -10614,6 +12975,15 @@ if __name__ == "__main__":
         'captcha-check': cmd_captcha_check,
         'captcha-wait': lambda: cmd_captcha_wait(args[0] if args else None),
         'captcha': lambda: cmd_captcha_dispatch(args),
+        'friction': cmd_friction,
+        'captcha-solve': lambda: cmd_captcha_solve(
+            next((a.split('=')[1] for a in args if a.startswith('--provider=')),
+                 args[args.index('--provider') + 1] if '--provider' in args and args.index('--provider') + 1 < len(args)
+                 else (next((a for a in args if not a.startswith('--')), None))),
+        ),
+        'profile': lambda: cmd_profile_dispatch(args),
+        'press-hold': lambda: cmd_press_hold(
+            next((a for a in args if not a.startswith('--')), None)),
         'agent': lambda: _dispatch_agent_cmd(args),
     }
 
@@ -10621,7 +12991,8 @@ if __name__ == "__main__":
     NO_CONTROL_CMDS = {'glow', 'stop', 'tabs', 'close', 'close-tab', 'new-tab',
                        'dialog', 'download', 'throttle', 'permission', 'intercept',
                        'batch', 'screenshot-diff', 'run',
-                       'captcha-check', 'captcha-wait', 'captcha',
+                       'captcha-check', 'captcha-wait', 'captcha', 'friction',
+                       'profile',
                        'cookies'}  # v0.6.1: cookies auto-config doesn't need browser
     # Clean up idle sessions before running any command
     _cleanup_idle_sessions()