dev3000 0.0.182 → 0.0.184

package/README.md

@@ -1,210 +1,78 @@
-# d3k (dev3000)
+# d3k
 
-d3k is an agent-first local web debugging runtime. It starts your dev server, opens a monitored browser with a project-stable Chrome profile, and gives your coding agent one timeline of server logs, browser errors, network activity, interactions, and screenshots.
+d3k gives your coding agent a managed browser and a shared timeline of server output, browser console messages, exceptions, network requests, and interactions.
 
-Every app gets a stable Portless URL by default, so browser state and callbacks do not move when the underlying development port changes.
-
-The primary interface is the d3k skill: tell your agent what you want, and let it own the runtime.
-
-> "Let me test this project with d3k."
->
-> "Debug the checkout flow with d3k."
->
-> "Run this app with d3k and watch for errors while I reproduce the bug."
-
-The TUI is still available for people who want a standalone terminal dashboard, but it is not required for the agent workflow.
-
-## Install
-
-Node.js 24 or newer is required.
-
-Install the runtime globally:
-
-```bash
-bun install -g dev3000
-```
-
-npm also works:
-
-```bash
-npm install -g dev3000
-```
-
-Install the d3k skill for your coding agents:
+Install the skill, then ask your agent to run the project, reproduce an issue, and inspect what happened:
 
 ```bash
-bunx skills add vercel-labs/dev3000 --skill d3k --agent '*' -g -y
+pnpm dlx skills add vercel-labs/dev3000 --skill d3k
 ```
 
-The skill teaches agents to start d3k non-interactively, retain the background process, reuse the managed browser, and inspect the unified evidence instead of launching a separate dev server or browser.
-
-## The Agent Workflow
-
-When you ask to use d3k, the agent should:
-
-1. Run `d3k portless status --json` and complete `d3k portless setup` if required.
-2. Run `d3k status --json` and reuse only a ready Portless project session.
-3. Start `d3k -t` in a retained background tool session when needed.
-4. Wait for d3k to report a port-free HTTPS URL and managed browser.
-5. Either hand the headed browser to you or drive it with `d3k agent-browser`, depending on your request.
-6. Read `d3k errors --context` and the unified logs after reproduction.
-7. Keep the same runtime and project-stable Chrome profile alive across edits and retests.
+> Use d3k to run this project and help me debug the checkout flow.
 
-That gives the user one stable URL, one browser, one evidence stream, and one dev server.
+The skill owns a small background JavaScript runtime. No global d3k binary or terminal dashboard is required. Node.js 24+, pnpm, and Chrome are needed. The installed skill runs the JavaScript runtime under Node; Bun is only used for development in this repository.
 
-### "Let me test" vs. "Test this"
+## Try the source
 
-"Let me test with d3k" means the agent prepares the headed monitored browser and hands control to you. It should wait while you reproduce the issue, then inspect what d3k captured.
-
-"Test/debug this with d3k" means the agent can drive the managed browser and investigate autonomously.
-
-## Agent Commands
+Until this runtime is released, use the helper from this checkout. Run these commands from the **app you want to debug**, replacing `/path/to/dev3000` with this checkout:
 
 ```bash
-# Is this project's runtime ready?
-d3k status --json
-
-# Is canonical Portless HTTPS ready?
-d3k portless status --json
-
-# Start the runtime manually in agent-safe mode (non-TUI default)
-d3k -t
-
-# Inspect unified evidence
-d3k errors --context
-d3k logs -n 200
-d3k logs --type browser
-d3k logs --type server
-
-# Drive the exact browser d3k is monitoring
-d3k agent-browser snapshot -i
-d3k agent-browser click @e2
-d3k agent-browser fill @e3 "text"
-d3k agent-browser --require-d3k-browser open https://my-app.localhost
+node /path/to/dev3000/skills/d3k/scripts/runtime.mjs portless status
+# One-time administrator authorization, if setup is required:
+node /path/to/dev3000/skills/d3k/scripts/runtime.mjs portless setup
+node /path/to/dev3000/skills/d3k/scripts/runtime.mjs start
 ```
 
-Do not run `npm run dev` or `bun run dev` alongside d3k. d3k is the dev-server owner for the session.
-
-Portless is required by default and only counts as ready when it provides a genuinely port-free URL such as `https://my-app.localhost`. `d3k portless setup` performs one-time administrator authorization to generate/trust the local HTTPS CA and install a root-owned startup service on port 443. After setup, every d3k server registers behind that proxy and the managed browser opens the Portless URL. d3k fails before starting the app when canonical Portless is unavailable; use `--no-portless` only when direct localhost routing is specifically required.
-
-## Why the Managed Browser Matters
-
-Each project gets a persistent Chrome profile under `~/.d3k/<project>/chrome-profile/`. Login state, cookies, and local storage survive across debugging sessions.
+Keep `start` in a retained background process session. The helper runs checkout source with Bun. An installed skill can target this source by setting `D3K_RUNTIME_ROOT=/path/to/dev3000`.
 
-d3k also connects browser activity to server output, so an agent can see the interaction that preceded an error instead of reasoning from disconnected terminal and browser snapshots.
+Canonical Portless HTTPS must be ready before starting the server or browser. The runtime uses a port-free URL such as `https://my-app.localhost`, with a project-stable Chrome profile for authentication. It fails before launching the app if setup is incomplete.
 
-For OAuth and other auth-sensitive flows, let d3k launch Chrome. A separate Playwright, browser MCP, raw Chrome, or custom `agent-browser --profile` session is a different browser identity and can break sign-in flows.
+## Read evidence
 
-## What d3k Captures
-
-- Development-server output
-- Browser console messages and exceptions
-- Network requests and responses
-- User interactions
-- Navigation and error screenshots
-- Chrome DevTools Protocol events
-- A session manifest that agents can discover with `d3k status --json`
-
-Artifacts are stored per project:
-
-| Artifact | Location |
-| --- | --- |
-| Active session | `~/.d3k/<project>/session.json` |
-| Consolidated log | `~/.d3k/<project>/d3k.log` or `logs/` |
-| Screenshots | `~/.d3k/<project>/screenshots/` |
-| Chrome profile | `~/.d3k/<project>/chrome-profile/` |
-| Crash log | `~/.d3k/crash.log` |
-
-## Standalone TUI
-
-Run `d3k` directly when you want the interactive terminal experience:
+The commands below use `d3k-runtime`, the package's JavaScript entrypoint. In a checkout, substitute `node /path/to/dev3000/skills/d3k/scripts/runtime.mjs`.
 
 ```bash
-d3k
+d3k-runtime status
+d3k-runtime browser snapshot -i
+d3k-runtime browser click @e2
+d3k-runtime events --session <sessionId> --after <cursor>
+d3k-runtime events --after <cursor> --source server
+d3k-runtime events --after <cursor> --level error
+d3k-runtime stop
 ```
 
-You can also launch an agent beside the TUI in tmux:
+Before reproducing an issue, retain the `sessionId` and `cursor` from `status`. Read events after that cursor, continuing while `hasMore` is true. A new session returns `reset: true`; `dropped` reports events evicted from the buffer. Filtered queries advance through examined events, so keep the original cursor when comparing multiple views of an interval.
 
-```bash
-d3k --with-agent claude
-d3k --with-agent codex
-d3k --with-agent opencode
-```
-
-The split-screen workflow requires tmux. The agent-first background workflow does not.
-
-## Runtime Options
+Server and browser events share sequence numbers assigned at collection time. Network events retain CDP request IDs, and exceptions retain stack traces. Chronological proximity to a server line does not establish causation.
 
-```bash
-d3k --help
-```
+The timeline holds at most 5,000 events or 8 MiB. Individual records are capped. No log files are written by the skill runtime, and its evidence disappears on exit. Request headers and bodies are omitted; URL query values are redacted. Console output and server messages can still contain application secrets.
 
-| Option | Purpose |
-| --- | --- |
-| `-p, --port <port>` | Override the detected dev-server port |
-| `-s, --script <script>` | Override the detected package script |
-| `-c, --command <command>` | Run a custom dev-server command |
-| `--app-url <url>` | Open a specific URL in the managed browser |
-| `--profile-dir <dir>` | Override the project Chrome profile |
-| `--no-portless` | Disable the default stable Portless URL |
-| `--headless` | Run Chrome headlessly for CI |
-| `--servers-only` | Intentionally disable browser monitoring |
-| `--tui` | Enable the interactive dashboard (off by default) |
-| `--no-agent` | Skip the standalone agent-selection prompt |
-| `-t, --tail` | Stream the consolidated log |
-| `--debug` | Print verbose runtime diagnostics |
-
-Prefer auto-detection. Use overrides only when the project has an unusual dev command, port, or target URL.
-
-## Diagnostic Commands
+Only browser profile and session discovery data persist under `~/.d3k/<project>/`. Local control uses authenticated IPC, not an HTTP listener on the network. Automatic screenshots are off; use `browser screenshot <absolute-path>` when needed.
 
-```bash
-d3k errors
-d3k errors --context
-d3k errors --all
+## Server and browser ownership
 
-d3k logs
-d3k logs --type browser
-d3k logs --type server
-d3k logs --json
+The runtime detects the project's package manager and `dev` script. Use `start --command '<dev command>'` for other projects or custom servers. Use `--headless` for CI and `--servers-only` when browser monitoring is intentionally unwanted.
 
-d3k fix
-d3k fix --focus build
+Chrome's sandbox stays enabled in both headed and headless modes. If a constrained container cannot support Chrome sandboxing, explicitly set `D3K_CHROME_NO_SANDBOX=1` when starting the runtime. This disables browser isolation and emits a startup warning; use it only in an appropriately isolated environment. d3k does not retry without the sandbox automatically.
 
-d3k crawl
-d3k crawl --depth all
-```
+The agent and user share the same monitored browser. Do not launch a second server or substitute another browser profile during a session. Leave the runtime running when handing the browser to the user for testing.
 
-## Supported Projects
+## Compatibility
 
-d3k detects common web projects, including:
+`d3k` and `dev3000` retain the previous local CLI, including optional terminal UI and file-backed logging. The skill uses `d3k-runtime` instead. The two runtimes must not own the same project simultaneously. The npm package now ships JavaScript instead of platform-specific d3k binaries.
 
-- Next.js, Vite, React, Vue, Svelte, and Astro
-- Django, Flask, and FastAPI
-- Rails
-- Custom servers supplied through `--command`
+The website is a public landing page and changelog. Hosted dev agents, skill runners, workflow execution, sandboxes, OAuth, teams, admin controls, report/blob storage, and CLI telemetry have been removed. Existing remote deployments and stored data are not deleted by a source change.
 
 ## Development
 
-Use d3k itself as the local runtime for this repository:
-
-```bash
-d3k -t
-```
-
-After code changes:
-
 ```bash
+bun install
 bun run lint
 bun run typecheck
-```
-
-For CLI or TUI changes under `src/`:
-
-```bash
+bun run test
 bun run canary
 ```
 
-## License
+`bun run canary` builds, packs, installs, and smoke-tests the JavaScript package locally. It does not publish to npm. Use `./scripts/release.sh` from a clean `main` checkout to prepare a stable release; GitHub Actions publishes through Trusted Publishing.
 
 MIT

package/bin/d3k-runtime

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import "../dist/runtime/cli.js"

package/bin/dev3000

@@ -1,120 +1,3 @@
 #!/usr/bin/env node
-/**
- * Platform wrapper script for d3k
- *
- * This script detects the current platform and executes the appropriate
- * pre-compiled binary from the platform-specific optional dependency.
- */
-
-import { spawn } from "child_process"
-import { existsSync } from "fs"
-import { createRequire } from "module"
-import { arch, platform } from "os"
-import { dirname, join } from "path"
-import { fileURLToPath } from "url"
-
-const __filename = fileURLToPath(import.meta.url)
-const __dirname = dirname(__filename)
-const require = createRequire(import.meta.url)
-
-// Map of platform-arch to package name
-const PLATFORMS = {
-  "darwin-arm64": "@d3k/darwin-arm64",
-  "linux-x64": "@d3k/linux-x64",
-  "win32-x64": "@d3k/windows-x64",
-  // "darwin-x64": "@d3k/darwin-x64",  // Add later
-  // "linux-arm64": "@d3k/linux-arm64", // Add later
-}
-
-function findBinary() {
-  const key = `${platform()}-${arch()}`
-  const pkgName = PLATFORMS[key]
-
-  if (!pkgName) {
-    console.error(`\n  Unsupported platform: ${key}`)
-    console.error(`  Currently supported platforms: macOS ARM64 (Apple Silicon), Linux x64, Windows x64`)
-    console.error(`\n  For other platforms, please open an issue at:`)
-    console.error(`  https://github.com/vercel-labs/dev3000/issues\n`)
-    process.exit(1)
-  }
-
-  // Windows binaries have .exe extension
-  const isWindows = platform() === "win32"
-  const binaryName = isWindows ? "dev3000.exe" : "dev3000"
-
-  // Try to find the binary in node_modules
-  // It could be in the local node_modules or a parent directory
-  const possiblePaths = [
-    // Installed as a dependency
-    join(__dirname, "..", "node_modules", pkgName, "bin", binaryName),
-    // Installed globally (npm)
-    join(__dirname, "..", "..", pkgName, "bin", binaryName),
-    // Installed globally (pnpm)
-    join(__dirname, "..", "node_modules", ".pnpm", `${pkgName}@*`, "node_modules", pkgName, "bin", binaryName),
-  ]
-
-  for (const binPath of possiblePaths) {
-    if (existsSync(binPath)) {
-      return binPath
-    }
-  }
-
-  // Try to resolve through require
-  try {
-    const pkgPath = require.resolve(`${pkgName}/package.json`)
-    const pkgDir = join(pkgPath, "..")
-    const binPath = join(pkgDir, "bin", binaryName)
-    if (existsSync(binPath)) {
-      return binPath
-    }
-  } catch {
-    // Package not found via require.resolve
-  }
-
-  console.error(`\n  Could not find ${pkgName} binary.`)
-  console.error(`  Please ensure the package is properly installed:`)
-  console.error(`    npm install -g dev3000`)
-  console.error(`  or`)
-  console.error(`    pnpm install -g dev3000\n`)
-  process.exit(1)
-}
-
-function main() {
-  const binPath = findBinary()
-
-  // Keep the JavaScript launcher alive so it can forward terminal signals to
-  // the compiled runtime. This matters when the runtime owns detached child
-  // process groups such as Portless-managed dev servers.
-  const child = spawn(binPath, process.argv.slice(2), {
-    stdio: "inherit",
-    shell: false,
-  })
-
-  const forwardSignal = (signal) => {
-    if (!child.killed) {
-      child.kill(signal)
-    }
-  }
-
-  process.on("SIGINT", () => forwardSignal("SIGINT"))
-  process.on("SIGTERM", () => forwardSignal("SIGTERM"))
-  if (process.platform !== "win32") {
-    process.on("SIGHUP", () => forwardSignal("SIGHUP"))
-  }
-
-  child.on("error", (error) => {
-    console.error(`Failed to start d3k: ${error.message}`)
-    process.exit(1)
-  })
-
-  child.on("exit", (code, signal) => {
-    if (code !== null) {
-      process.exit(code)
-    }
-
-    const signalExitCodes = { SIGINT: 130, SIGTERM: 143, SIGHUP: 129 }
-    process.exit(signalExitCodes[signal] || 1)
-  })
-}
-
-main()
+// Compatibility CLI. The skill uses bin/d3k-runtime, which doesn't load this UI.
+import "../dist/cli.js"

package/dist/cdp-monitor.d.ts

@@ -1,4 +1,6 @@
 import { WebSocket } from "ws";
+/** Sandbox exceptions must be explicit; headless mode alone never disables it. */
+export declare function getChromeSandboxFlags(env?: NodeJS.ProcessEnv): string[];
 export interface CDPEvent {
     method: string;
     params: Record<string, unknown>;
@@ -25,6 +27,10 @@ export declare function selectCDPTarget(targets: CDPTargetInfo[], options?: {
     initialAppUrl?: string;
 }): CDPTargetInfo;
 export declare class CDPMonitor {
+    private eventObserver?;
+    private automaticScreenshots;
+    setEventObserver(observer: (event: CDPEvent) => void): void;
+    setAutomaticScreenshots(enabled: boolean): void;
     private browser;
     private connection;
     private debugPort;

package/dist/cdp-monitor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cdp-monitor.d.ts","sourceRoot":"","sources":["../src/cdp-monitor.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAA;AAE9B,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,SAAS,CAAA;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AA6DD,eAAO,MAAM,sCAAsC,UAIlD,CAAA;AAyFD,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAcvE;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAyB,GAAG,MAAM,EAAE,CAS1G;AAwDD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,aAAa,EAAE,EACxB,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;CAClB,GACL,aAAa,CA4Cf;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,aAAa,CAA+C;IACpE,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,MAAM,CAA2C;IACzD,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,WAAW,CAAC,CAAQ;IAC5B,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,eAAe,CAAI;IAC3B,OAAO,CAAC,gBAAgB,CAA8B;IACtD,OAAO,CAAC,eAAe,CAAiB;IACxC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,kBAAkB,CAAY;IACtC,OAAO,CAAC,qBAAqB,CAAe;IAC5C,OAAO,CAAC,oBAAoB,CAAiB;IAC7C,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,sBAAsB,CAA4B;IAC1D,OAAO,CAAC,aAAa,CAAC,CAAQ;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAQ;IAC9B,OAAO,CAAC,eAAe,CAAC,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,SAAS,CAAC,CAA+B;IACjD,OAAO,CAAC,oBAAoB,CAAiB;IAC7C,OAAO,CAAC,wBAAwB,CAAY;IAC5C,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,mBAAmB,CAAwC;IAEnE,YACE,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,EACjD,KAAK,GAAE,OAAe,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,eAAe,GAAE,OAAe,EAChC,aAAa,CAAC,EAAE,MAAM,EACtB,aAAa,CAAC,EAAE,MAAM,EACtB,mBAAmB,GAAE,MAAsC,EAC3D,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,GAAE,OAAe,EACzB,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,EACzC,eAAe,CAAC,EAAE,MAAM,EAmBzB;IAED,OAAO,CAAC,iCAAiC;IA6BzC,OAAO,CAAC,QAAQ;YAMF,UAAU;YAuBV,aAAa;IAqD3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAgClB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CA6B3B;IAED,SAAS,IAAI,MAAM,GAAG,IAAI,CAEzB;IAED,aAAa,IAAI,MAAM,EAAE,CAExB;IAED,yBAAyB,CAAC,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAE7D;YAEa,kBAAkB;IA2BhC,OAAO,CAAC,iBAAiB;IA2CzB,OAAO,CAAC,2BAA2B;IA4CnC;;;;OAIG;YACW,6BAA6B;YAoC7B,YAAY;YAmMZ,YAAY;YAuJZ,gBAAgB;YA2BhB,cAAc;IAiD5B,OAAO,CAAC,kBAAkB;YAMZ,qBAAqB;YAsDrB,gBAAgB;YAqBhB,gBAAgB;IA0E9B,OAAO,CAAC,kBAAkB;IAiU1B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,wBAAwB;IAQhC,OAAO,CAAC,gBAAgB;IA+ClB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,GAAE,MAAiC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiE5F;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,OAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;YAEa,wBAAwB;IAqTtC,OAAO,CAAC,uBAAuB;IAkG/B,OAAO,CAAC,6BAA6B;YAuBvB,cAAc;IA4CtB,kBAAkB,CAAC,WAAW,EAAE;QACpC,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,CAAC,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QACtC,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACnC,EAAE,CAAC,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC7B,IAAI,CAAC,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDhB;IAED;;;OAGG;IACH,eAAe,IAAI,IAAI,CAGtB;YAEa,kBAAkB;YAyBlB,uBAAuB;IAoF/B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAkF9B;YAEa,2BAA2B;CA+C1C"}
+{"version":3,"file":"cdp-monitor.d.ts","sourceRoot":"","sources":["../src/cdp-monitor.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAA;AAE9B,kFAAkF;AAClF,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,EAAE,CAEpF;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,SAAS,CAAA;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AA6DD,eAAO,MAAM,sCAAsC,UAIlD,CAAA;AAyFD,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAcvE;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAyB,GAAG,MAAM,EAAE,CAS1G;AAwDD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,aAAa,EAAE,EACxB,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;CAClB,GACL,aAAa,CA4Cf;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,aAAa,CAAC,CAA2B;IACjD,OAAO,CAAC,oBAAoB,CAAO;IAEnC,gBAAgB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,GAAG,IAAI,CAE1D;IAED,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAE9C;IAED,OAAO,CAAC,OAAO,CAA4B;IAC3C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,SAAS,CAAe;IAChC,OAAO,CAAC,aAAa,CAA+C;IACpE,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,MAAM,CAA2C;IACzD,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,WAAW,CAAC,CAAQ;IAC5B,OAAO,CAAC,cAAc,CAAQ;IAC9B,OAAO,CAAC,eAAe,CAAI;IAC3B,OAAO,CAAC,gBAAgB,CAA8B;IACtD,OAAO,CAAC,eAAe,CAAiB;IACxC,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,kBAAkB,CAAY;IACtC,OAAO,CAAC,qBAAqB,CAAe;IAC5C,OAAO,CAAC,oBAAoB,CAAiB;IAC7C,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,sBAAsB,CAA4B;IAC1D,OAAO,CAAC,aAAa,CAAC,CAAQ;IAC9B,OAAO,CAAC,aAAa,CAAC,CAAQ;IAC9B,OAAO,CAAC,eAAe,CAAC,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,SAAS,CAAC,CAA+B;IACjD,OAAO,CAAC,oBAAoB,CAAiB;IAC7C,OAAO,CAAC,wBAAwB,CAAY;IAC5C,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,mBAAmB,CAAwC;IAEnE,YACE,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,EACjD,KAAK,GAAE,OAAe,EACtB,WAAW,CAAC,EAAE,MAAM,EACpB,eAAe,GAAE,OAAe,EAChC,aAAa,CAAC,EAAE,MAAM,EACtB,aAAa,CAAC,EAAE,MAAM,EACtB,mBAAmB,GAAE,MAAsC,EAC3D,SAAS,CAAC,EAAE,MAAM,EAClB,QAAQ,GAAE,OAAe,EACzB,SAAS,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,EACzC,eAAe,CAAC,EAAE,MAAM,EAmBzB;IAED,OAAO,CAAC,iCAAiC;IA6BzC,OAAO,CAAC,QAAQ;YAMF,UAAU;YAuBV,aAAa;IAqD3B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAgClB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CA6B3B;IAED,SAAS,IAAI,MAAM,GAAG,IAAI,CAEzB;IAED,aAAa,IAAI,MAAM,EAAE,CAExB;IAED,yBAAyB,CAAC,QAAQ,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAE7D;YAEa,kBAAkB;IA2BhC,OAAO,CAAC,iBAAiB;IA2CzB,OAAO,CAAC,2BAA2B;IA4CnC;;;;OAIG;YACW,6BAA6B;YAoC7B,YAAY;YAsMZ,YAAY;YAuJZ,gBAAgB;YA2BhB,cAAc;IAiD5B,OAAO,CAAC,kBAAkB;YAMZ,qBAAqB;YAsDrB,gBAAgB;YAqBhB,gBAAgB;IA0E9B,OAAO,CAAC,kBAAkB;IAkU1B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,wBAAwB;IAQhC,OAAO,CAAC,gBAAgB;IAqDlB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,GAAE,MAAiC,GAAG,OAAO,CAAC,IAAI,CAAC,CAiE5F;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,OAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;YAEa,wBAAwB;IAoTtC,OAAO,CAAC,uBAAuB;IAkG/B,OAAO,CAAC,6BAA6B;YAuBvB,cAAc;IA6CtB,kBAAkB,CAAC,WAAW,EAAE;QACpC,IAAI,EAAE,MAAM,CAAA;QACZ,WAAW,CAAC,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QACtC,GAAG,CAAC,EAAE,MAAM,CAAA;QACZ,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACnC,EAAE,CAAC,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC7B,IAAI,CAAC,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAChC,GAAG,OAAO,CAAC,IAAI,CAAC,CAoDhB;IAED;;;OAGG;IACH,eAAe,IAAI,IAAI,CAGtB;YAEa,kBAAkB;YAyBlB,uBAAuB;IAoF/B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAkF9B;YAEa,2BAA2B;CA+C1C"}

package/dist/cdp-monitor.js

@@ -4,6 +4,10 @@ import { tmpdir } from "os";
 import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 import { WebSocket } from "ws";
+/** Sandbox exceptions must be explicit; headless mode alone never disables it. */
+export function getChromeSandboxFlags(env = process.env) {
+    return env.D3K_CHROME_NO_SANDBOX === "1" ? ["--no-sandbox", "--disable-setuid-sandbox"] : [];
+}
 const EMBEDDED_LOADING_HTML = `<!DOCTYPE html>
 <html>
 <head>
@@ -228,6 +232,14 @@ export function selectCDPTarget(targets, options = {}) {
     throw new Error(`CDP target mismatch on port ${options.appServerPort || "unknown"}; expected ${expectedDetails}, found ${debuggableTargets.map(formatTargetForLog).join(", ")}`);
 }
 export class CDPMonitor {
+    eventObserver;
+    automaticScreenshots = true;
+    setEventObserver(observer) {
+        this.eventObserver = observer;
+    }
+    setAutomaticScreenshots(enabled) {
+        this.automaticScreenshots = enabled;
+    }
     browser = null;
     connection = null;
     debugPort = 9222;
@@ -435,7 +447,7 @@ export class CDPMonitor {
         }
     }
     getCdpUrl() {
-        return this.cdpUrl;
+        return this.connection?.ws.readyState === 1 ? this.cdpUrl : null;
     }
     getChromePids() {
         return Array.from(this.chromePids);
@@ -640,8 +652,12 @@ export class CDPMonitor {
                     "--disable-sync",
                     "--metrics-recording-only",
                     "--disable-default-apps",
+                    ...getChromeSandboxFlags(),
                     ...CHROME_CRASH_RESTORE_SUPPRESSION_FLAGS
                 ];
+                if (chromeArgs.includes("--no-sandbox")) {
+                    this.logger("browser", "[CDP] WARNING: Chrome sandbox disabled explicitly by D3K_CHROME_NO_SANDBOX=1");
+                }
                 if (shouldEnableReactDevTools && reactDevToolsExtensionPath) {
                     chromeArgs.push(`--disable-extensions-except=${reactDevToolsExtensionPath}`);
                     chromeArgs.push(`--load-extension=${reactDevToolsExtensionPath}`);
@@ -654,9 +670,7 @@ export class CDPMonitor {
                 if (this.headless) {
                     // Use new headless mode (Chrome 112+) which has better compatibility
                     chromeArgs.push("--headless=new");
-                    // Additional flags needed for headless in serverless environments
-                    chromeArgs.push("--no-sandbox");
-                    chromeArgs.push("--disable-setuid-sandbox");
+                    // Headless rendering does not require disabling Chrome's sandbox.
                     chromeArgs.push("--disable-gpu");
                     chromeArgs.push("--disable-dev-shm-usage");
                     chromeArgs.push("--disable-background-timer-throttling");
@@ -1307,7 +1321,8 @@ export class CDPMonitor {
             this.debugLog(`Target destroyed: ${params.targetId}`);
             this.logger("browser", `[TARGET] Window/tab closed: ${params.targetId}`);
             // If this is our main tab/window being closed, trigger shutdown callback
-            if (this.onWindowClosedCallback && !this.isShuttingDown) {
+            const monitoredTarget = this.cdpUrl?.split("/").pop();
+            if (params.targetId === monitoredTarget && this.onWindowClosedCallback && !this.isShuttingDown) {
                 this.debugLog("Chrome window was manually closed, triggering d3k shutdown");
                 this.logger("browser", "[TARGET] Chrome window manually closed, shutting down d3k");
                 this.onWindowClosedCallback();
@@ -1345,6 +1360,12 @@ export class CDPMonitor {
         }
         if (message.method) {
             this.debugLog(`Received CDP event: ${message.method}`);
+            this.eventObserver?.({
+                method: message.method,
+                params: message.params || {},
+                timestamp: Date.now(),
+                sessionId: message.sessionId
+            });
             const handler = this.eventHandlers.get(message.method);
             if (handler) {
                 const event = {
@@ -1496,8 +1517,7 @@ export class CDPMonitor {
                 id: el.id || '',
                 className: el.className || '',
                 name: el.name || '',
-                type: el.type || '',
-                value: el.value || ''
+                type: el.type || ''
               };
               return JSON.stringify(details);
             }
@@ -1524,7 +1544,7 @@ export class CDPMonitor {
               let details = getElementDetails(e.target);
               // Send interaction data via custom event instead of console.log to avoid user visibility
               window.dispatchEvent(new CustomEvent('dev3000-interaction', {
-                detail: { type: 'KEY', key: e.key, element: details }
+                detail: { type: 'KEY', key: e.key.length === 1 ? '[character]' : e.key, element: details }
               }));
             });
             
@@ -1794,6 +1814,8 @@ export class CDPMonitor {
         }
     }
     async takeScreenshot(event) {
+        if (!this.automaticScreenshots)
+            return null;
         try {
             // Throttle screenshots to avoid spam
             const now = Date.now();