glidercli 0.3.8 → 0.3.10

package/README.md

@@ -58,6 +58,7 @@
 | | Browser | Config |
 |:---:|--------|--------|
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/chrome.webp" width="16" alt=""> | Google Chrome | Default for `glider connect`|
+| <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/chrome-canary.webp" width="16" alt=""> | Chrome Canary | n/a |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/arc.webp" width="16" alt=""> | Arc | [browser.json](config/browser.json.example) (`{ "use": "arc" }`) |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/microsoft/microsoft-edge.webp" width="16" alt=""> | Microsoft Edge | n/a |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/brave.webp" width="16" alt=""> | Brave | n/a |
@@ -85,9 +86,13 @@
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/mullvad-browser.webp" width="16" alt=""> | Mullvad Browser | Gecko- same constraints as Firefox |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/icecat.webp" width="16" alt=""> | IceCat | Gecko- same constraints as Firefox |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/safari.webp" width="16" alt=""> | Safari | WebKit (Apple desktop). Not Chromium |
+| <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/safari-technology-preview.webp" width="16" alt=""> | Safari Technology Preview | WebKit preview channel (Apple desktop). Not Chromium |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/orion.webp" width="16" alt=""> | Orion | WebKit-based desktop browser. Not Chromium |
+| <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/dia-browser.webp" width="16" alt=""> | Dia | AI-first browser, not in Glider’s supported Chromium + CWS model today |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/chatgpt-atlas.webp" width="16" alt=""> | ChatGPT Atlas | AI-first browser, not in Glider’s supported Chromium + CWS model today |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/perplexity-comet.webp" width="16" alt=""> | Perplexity Comet | AI-first browser, not in Glider’s supported Chromium + CWS model today |
+| <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/whale-browser.webp" width="16" alt=""> | Whale Browser | Chromium-based, support not implemented in Glider today |
+| <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/yandex-browser.webp" width="16" alt=""> | Yandex Browser | Chromium-based, support not implemented in Glider today |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/bromite.webp" width="16" alt=""> | Bromite | Chromium-derived, no practical Chrome Web Store path for Glider |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/chromium.webp" width="16" alt=""> | Chromite | Chromium-derived, no practical Chrome Web Store path for Glider |
 | <img src="https://raw.githubusercontent.com/vdutts7/squircle/main/webp/grapheneos.webp" width="16" alt=""> | Vanadium | Chromium-derived (GrapheneOS), no practical Chrome Web Store path for Glider |
@@ -111,7 +116,7 @@ Set browser by key from the browsers registry. Run `glider use <key>` to write t
 }
 ```
 
-Registry is loaded from (first found): `$HOME/.cursor/registry/browsers.json`, `$HOME/.glider/config/browsers-registry.json`. Keys are predefined (e.g. `arc`, `brave`, `chrome`, `edge`, `opera`, `vivaldi`, `chromium`). Edit the registry to add or change paths
+Registry is loaded from: `$HOME/.glider/config/browsers-registry.json`. Keys are predefined (e.g. `arc`, `brave`, `chrome`, `edge`, `opera`, `vivaldi`, `chromium`). Edit the registry to add or change paths
 
 **Option B- Explicit name/path:**
 
@@ -147,9 +152,8 @@ Check app name in Finder/Spotlight, process name: `ps aux | grep -i <name>`
 
 A single registry file can define all Chromium browsers, Glider picks one by **key**
 
-**Registry location (first found):**
+**Registry location:**
 
-- `$HOME/.cursor/registry/browsers.json`
 - `$HOME/.glider/config/browsers-registry.json`
 
 **Registry format:**
@@ -190,7 +194,7 @@ Add or edit entries in the registry to match your machine (e.g. custom install p
 |-------|--------|
 | Supported | Chromium-based + Chrome Web Store extension (see table above). |
 | Not supported | See **Future** in this README. |
-| Configure | `$HOME/.glider/config/browser.json` (use key or name/path). Registry: `$HOME/.cursor/registry/browsers.json` or `$HOME/.glider/config/browsers-registry.json` |
+| Configure | `$HOME/.glider/config/browser.json` (use key or name/path). Registry: `$HOME/.glider/config/browsers-registry.json` |
 | Switch | `glider use <key>` (e.g. `glider use arc`, `glider use brave`). |
 | Path | Optional, use when app is not in default location |
 

package/bin/glider.js

@@ -39,6 +39,14 @@ const STATE_FILE = '/tmp/glider-state.json';
 const LOG_FILE = '/tmp/glider.log';
 const REGISTRY_FILE = path.join(LIB_DIR, 'registry.json');
 
+// Active CDP session (multi-tab). Env or --session / --session-id on CLI.
+let activeSessionId = process.env.GLIDER_SESSION_ID || null;
+let jsonOutput = false;
+let allowedDomainList = null;
+const SESSION_STORE = path.join(os.homedir(), '.glider', 'config', 'active-session.json');
+const { resolveAllowedDomains, assertUrlAllowed, urlAllowed } = require(path.join(LIB_DIR, 'guard.js'));
+const { buildSnapshotExpression, formatSnapshotText } = require(path.join(LIB_DIR, 'bsnapshot.js'));
+
 // Load pattern registry
 let REGISTRY = {};
 if (fs.existsSync(REGISTRY_FILE)) {
@@ -49,6 +57,7 @@ if (fs.existsSync(REGISTRY_FILE)) {
 
 // Direct CDP module
 const { DirectCDP, checkChrome } = require(path.join(LIB_DIR, 'cdp-direct.js'));
+const { resolveDomain } = require(path.join(LIB_DIR, 'domain-resolve.js'));
 
 // Domain extensions - load from ~/.glider/config/domains.json
 const DOMAIN_CONFIG_PATHS = [
@@ -197,10 +206,63 @@ function httpGet(urlPath) {
   });
 }
 
+function loadPersistedSession() {
+  if (activeSessionId) return;
+  if (!fs.existsSync(SESSION_STORE)) return;
+  try {
+    const data = JSON.parse(fs.readFileSync(SESSION_STORE, 'utf8'));
+    if (data.sessionId) activeSessionId = data.sessionId;
+  } catch { /* ignore */ }
+}
+
+function persistSession(sessionId) {
+  activeSessionId = sessionId;
+  fs.mkdirSync(path.dirname(SESSION_STORE), { recursive: true });
+  fs.writeFileSync(SESSION_STORE, JSON.stringify({ sessionId, updated: new Date().toISOString() }, null, 2));
+}
+
+function emitJson(ok, observation, error = null, warnings = []) {
+  console.log(JSON.stringify({ ok, observation, error, warnings }, null, 2));
+  if (!ok) process.exit(1);
+}
+
+async function assertCurrentUrlAllowed(action) {
+  if (!allowedDomainList) return;
+  const result = await httpPost('/cdp', {
+    method: 'Runtime.evaluate',
+    params: { expression: 'location.href', returnByValue: true },
+  });
+  const url = result?.result?.value;
+  if (url) assertUrlAllowed(url, allowedDomainList, action);
+}
+
+function parseGlobalFlags(argv) {
+  const rest = [];
+  const cliDomains = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if ((a === '--session' || a === '--session-id') && argv[i + 1]) {
+      activeSessionId = argv[++i];
+    } else if (a === '--json') {
+      jsonOutput = true;
+    } else if (a === '--allowed-domains' && argv[i + 1]) {
+      cliDomains.push(...String(argv[++i]).split(',').map((s) => s.trim()).filter(Boolean));
+    } else {
+      rest.push(a);
+    }
+  }
+  allowedDomainList = resolveAllowedDomains(cliDomains);
+  return rest;
+}
+
 function httpPost(urlPath, body) {
+  const payload = { ...body };
+  if (urlPath === '/cdp' && activeSessionId && payload.sessionId == null) {
+    payload.sessionId = activeSessionId;
+  }
   return new Promise((resolve, reject) => {
     const url = new URL(urlPath, SERVER_URL);
-    const data = JSON.stringify(body);
+    const data = JSON.stringify(payload);
     const req = http.request(url, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
@@ -421,21 +483,33 @@ async function cmdGoto(url) {
     process.exit(1);
   }
   
-  // Auto-connect if not connected
   if (!await ensureConnected()) {
     process.exit(1);
   }
+
+  try {
+    assertUrlAllowed(url, allowedDomainList, 'goto');
+  } catch (e) {
+    if (jsonOutput) emitJson(false, null, e.message);
+    log.fail(e.message);
+    process.exit(1);
+  }
   
-  log.info(`Navigating to: ${url}`);
+  if (!jsonOutput) log.info(`Navigating to: ${url}`);
   
   try {
     const result = await httpPost('/cdp', {
       method: 'Page.navigate',
       params: { url }
     });
-    console.log(JSON.stringify(result));
-    log.ok('Navigated');
+    if (jsonOutput) {
+      emitJson(true, { url, navigate: result });
+    } else {
+      console.log(JSON.stringify(result));
+      log.ok('Navigated');
+    }
   } catch (e) {
+    if (jsonOutput) emitJson(false, null, e.message);
     log.fail(`Navigation failed: ${e.message}`);
     process.exit(1);
   }
@@ -462,14 +536,18 @@ async function cmdEval(js) {
       }
     });
     
-    if (result.result?.value !== undefined) {
-      console.log(JSON.stringify(result.result.value));
+    const value = result.result?.value;
+    if (jsonOutput) {
+      emitJson(true, value !== undefined ? value : result.result);
+    } else if (value !== undefined) {
+      console.log(JSON.stringify(value));
     } else if (result.result?.description) {
       console.log(result.result.description);
     } else {
       console.log(JSON.stringify(result));
     }
   } catch (e) {
+    if (jsonOutput) emitJson(false, null, e.message);
     log.fail(`Eval failed: ${e.message}`);
     process.exit(1);
   }
@@ -481,10 +559,17 @@ async function cmdClick(selector) {
     process.exit(1);
   }
   
-  // Auto-connect if not connected
   if (!await ensureConnected()) {
     process.exit(1);
   }
+
+  try {
+    await assertCurrentUrlAllowed('click');
+  } catch (e) {
+    if (jsonOutput) emitJson(false, null, e.message);
+    log.fail(e.message);
+    process.exit(1);
+  }
   
   const js = `
     (() => {
@@ -502,11 +587,17 @@ async function cmdClick(selector) {
     });
     
     if (result.result?.value?.error) {
+      if (jsonOutput) emitJson(false, null, result.result.value.error);
       log.fail(result.result.value.error);
       process.exit(1);
     }
-    log.ok(`Clicked: ${selector}`);
+    if (jsonOutput) {
+      emitJson(true, { selector, clicked: true });
+    } else {
+      log.ok(`Clicked: ${selector}`);
+    }
   } catch (e) {
+    if (jsonOutput) emitJson(false, null, e.message);
     log.fail(`Click failed: ${e.message}`);
     process.exit(1);
   }
@@ -979,7 +1070,7 @@ async function cmdWindow(args) {
 }
 
 async function cmdDomains() {
-  const domainKeys = Object.keys(DOMAINS);
+  const domainKeys = Object.keys(DOMAINS).filter((k) => k !== 'meta');
   if (domainKeys.length === 0) {
     log.warn('No domains configured');
     log.info('Add domains to ~/.glider/config/domains.json');
@@ -988,14 +1079,30 @@ async function cmdDomains() {
   console.log(`${GREEN}${domainKeys.length}${NC} domain(s) configured:\n`);
   for (const key of domainKeys) {
     const d = DOMAINS[key];
-    const type = d.script ? 'script' : 'url';
-    const target = d.script || d.url || '';
+    const shortcut = d.shortcut || {};
+    const type = shortcut.type || (d.script ? 'script' : d.url ? 'url' : 'none');
+    const target = shortcut.target || d.script || d.url || '';
     console.log(`  ${CYAN}${key}${NC} ${DIM}(${type})${NC}`);
+    if (d.host) console.log(`      ${DIM}host: ${d.host}${NC}`);
+    if (d.warch) console.log(`      ${DIM}warch: ${d.warch}${NC}`);
     if (d.description) console.log(`      ${d.description}`);
-    console.log(`      ${DIM}${target}${NC}`);
+    if (target) console.log(`      ${DIM}${target}${NC}`);
   }
 }
 
+async function cmdResolve(input, opts = []) {
+  if (!input) {
+    log.fail('Usage: glider resolve <url|host> [--json]');
+    process.exit(1);
+  }
+  const result = resolveDomain(input);
+  if (opts.includes('--json') || jsonOutput) {
+    console.log(JSON.stringify({ ok: true, ...result }));
+    return;
+  }
+  console.log(JSON.stringify(result, null, 2));
+}
+
 async function cmdOpen(url) {
   if (!url) {
     log.fail('Usage: glider open <url>');
@@ -1055,7 +1162,6 @@ async function cmdTitle() {
 }
 
 async function cmdUrl() {
-  // Auto-connect if not connected
   if (!await ensureConnected()) {
     process.exit(1);
   }
@@ -1065,13 +1171,106 @@ async function cmdUrl() {
       method: 'Runtime.evaluate',
       params: { expression: 'window.location.href', returnByValue: true }
     });
-    console.log(result.result?.value || '');
+    const url = result.result?.value || '';
+    if (jsonOutput) emitJson(true, { url });
+    else console.log(url);
   } catch (e) {
+    if (jsonOutput) emitJson(false, null, e.message);
     log.fail(`URL extraction failed: ${e.message}`);
     process.exit(1);
   }
 }
 
+async function cmdSnapshot(opts = []) {
+  let interactiveOnly = false;
+  for (const o of opts) {
+    if (o === '--interactive-only' || o === '-i') interactiveOnly = true;
+  }
+  if (!await ensureConnected()) process.exit(1);
+  try {
+    const result = await httpPost('/cdp', {
+      method: 'Runtime.evaluate',
+      params: {
+        expression: buildSnapshotExpression(interactiveOnly),
+        returnByValue: true,
+        awaitPromise: true,
+      },
+    });
+    const data = result?.result?.value;
+    if (!data || data.error) {
+      const err = data?.error || 'snapshot failed';
+      if (jsonOutput) emitJson(false, null, err);
+      log.fail(err);
+      process.exit(1);
+    }
+    if (jsonOutput) {
+      emitJson(true, data);
+    } else {
+      console.log(formatSnapshotText(data));
+    }
+  } catch (e) {
+    if (jsonOutput) emitJson(false, null, e.message);
+    log.fail(`Snapshot failed: ${e.message}`);
+    process.exit(1);
+  }
+}
+
+async function cmdTargets() {
+  const raw = await httpGet('/targets');
+  const targets = (Array.isArray(raw) ? raw : []).map((t) => ({
+    sessionId: t.sessionId,
+    targetId: t.targetId,
+    title: t.title || t.targetInfo?.title || '',
+    url: t.url || t.targetInfo?.url || '',
+  }));
+  if (jsonOutput) {
+    emitJson(true, { targets, activeSessionId });
+  } else {
+    if (!targets.length) {
+      log.warn('No targets');
+      return;
+    }
+    console.log(`${GREEN}${targets.length}${NC} target(s):\n`);
+    for (const t of targets) {
+      const mark = t.sessionId === activeSessionId ? `${GREEN}*${NC} ` : '  ';
+      console.log(`${mark}${CYAN}${t.sessionId}${NC}  ${t.title}`);
+      console.log(`      ${DIM}${t.url}${NC}`);
+    }
+  }
+}
+
+async function cmdUseSession(arg, opts = []) {
+  let sessionId = arg;
+  const urlIdx = opts.indexOf('--url');
+  if (urlIdx >= 0 && opts[urlIdx + 1]) {
+    const needle = opts[urlIdx + 1];
+    const raw = await httpGet('/targets');
+    const targets = Array.isArray(raw) ? raw : [];
+    const hit = targets.find((t) => {
+      const u = t.url || t.targetInfo?.url || '';
+      return u.includes(needle);
+    });
+    if (!hit) {
+      const msg = `no target matching --url ${needle}`;
+      if (jsonOutput) emitJson(false, null, msg);
+      log.fail(msg);
+      process.exit(1);
+    }
+    sessionId = hit.sessionId;
+  }
+  if (!sessionId) {
+    log.fail('Usage: glider use-session <sessionId> | glider use-session --url <host-fragment>');
+    process.exit(1);
+  }
+  persistSession(sessionId);
+  if (jsonOutput) {
+    emitJson(true, { sessionId, persisted: SESSION_STORE });
+  } else {
+    log.ok(`Active session: ${sessionId}`);
+    console.log(SESSION_STORE);
+  }
+}
+
 // Fetch URL using browser session (authenticated)
 async function cmdFetch(url, opts = []) {
   if (!url) {
@@ -1079,7 +1278,15 @@ async function cmdFetch(url, opts = []) {
     process.exit(1);
   }
   
-  log.info(`Fetching: ${url}`);
+  try {
+    assertUrlAllowed(url, allowedDomainList, 'fetch');
+  } catch (e) {
+    if (jsonOutput) emitJson(false, null, e.message);
+    log.fail(e.message);
+    process.exit(1);
+  }
+
+  if (!jsonOutput) log.info(`Fetching: ${url}`);
   
   let outputFile = null;
   for (let i = 0; i < opts.length; i++) {
@@ -1107,13 +1314,16 @@ async function cmdFetch(url, opts = []) {
     const data = result?.result?.value;
     const output = typeof data === 'object' ? JSON.stringify(data, null, 2) : data;
     
-    if (outputFile) {
+    if (jsonOutput) {
+      emitJson(true, { url, data });
+    } else if (outputFile) {
       fs.writeFileSync(outputFile, output);
       log.ok(`Saved to ${outputFile}`);
     } else {
       console.log(output);
     }
   } catch (e) {
+    if (jsonOutput) emitJson(false, null, e.message);
     log.fail(`Fetch failed: ${e.message}`);
     process.exit(1);
   }
@@ -1422,7 +1632,7 @@ async function cmdRegistry(patternName, opts = []) {
 // Explore site (clicks around, captures network)
 async function cmdExplore(url, opts = []) {
   if (!url) {
-    log.fail('Usage: glider explore <url> [--depth N] [--output dir] [--har file]');
+    log.fail('Usage: glider explore <url> [--depth N] [--output dir] [--har file] [--session-id id]');
     process.exit(1);
   }
   
@@ -1435,7 +1645,16 @@ async function cmdExplore(url, opts = []) {
     if (opts[i] === '--depth' || opts[i] === '-d') depth = parseInt(opts[++i], 10);
     else if (opts[i] === '--output' || opts[i] === '-o') outputDir = opts[++i];
     else if (opts[i] === '--har') harFile = opts[++i];
-    else if (opts[i] === '--session-id') sessionId = opts[++i];
+    else if (opts[i] === '--session-id' || opts[i] === '--session') sessionId = opts[++i];
+  }
+  if (!sessionId && activeSessionId) sessionId = activeSessionId;
+
+  try {
+    assertUrlAllowed(url, allowedDomainList, 'explore');
+  } catch (e) {
+    if (jsonOutput) emitJson(false, null, e.message);
+    log.fail(e.message);
+    process.exit(1);
   }
   
   log.info(`Exploring: ${url} (depth: ${depth})`);
@@ -1739,7 +1958,8 @@ function showHelp() {
   showBanner();
   console.log(`
 ${B5}USAGE${NC}
-    glider <command> [args]
+    glider [--session <id>] [--json] [--allowed-domains 'host,*'] <command> [args]
+    ${DIM}GLIDER_SESSION_ID=session-N${NC}  ${DIM}pin tab for all /cdp commands${NC}
 
 ${B5}SETUP${NC}
     ${BW}install${NC}             Install daemon ${DIM}(runs at login, auto-restarts)${NC}
@@ -1752,6 +1972,8 @@ ${B5}STATUS${NC}
     ${BW}browser${NC}             Show browser config ${DIM}(name, path, processName, or use key)${NC}
     ${BW}use${NC} <key>           Set browser by registry key ${DIM}(e.g. arc, brave, chrome)${NC}
     ${BW}test${NC}                Run diagnostics
+    ${BW}domains${NC}             List ~/.glider domain shortcuts + warch paths
+    ${BW}resolve${NC} <url>        Resolve host to local warch intel ${DIM}(--json)${NC}
 
 ${B5}NAVIGATION${NC}
     ${BW}goto${NC} <url>          Navigate to URL
@@ -1761,6 +1983,7 @@ ${B5}NAVIGATION${NC}
     ${BW}screenshot${NC} [path]   Take screenshot
 
 ${B5}PAGE INFO${NC}
+    ${BW}snapshot${NC} [opts]      Page index for agents ${DIM}(--json, --interactive-only)${NC}
     ${BW}text${NC}                Get page text
     ${BW}html${NC} [selector]     Get HTML
     ${BW}title${NC}               Get page title
@@ -1776,6 +1999,8 @@ ${B5}MULTI-WINDOW${NC}
     ${BW}window list${NC}         List all windows/tabs
 
 ${B5}MULTI-TAB${NC}
+    ${BW}targets${NC}             List targets ${DIM}(sessionId, title, url)${NC}
+    ${BW}use-session${NC} <id>    Pin session ${DIM}(or --url host-fragment)${NC}
     ${BW}fetch${NC} <url>         Fetch URL with browser session ${DIM}(auth)${NC}
     ${BW}spawn${NC} <urls...>     Open multiple tabs
     ${BW}extract${NC} [opts]      Extract from all tabs
@@ -1923,7 +2148,8 @@ async function cmdUpdate() {
 
 // Main
 async function main() {
-  const args = process.argv.slice(2);
+  const args = parseGlobalFlags(process.argv.slice(2));
+  loadPersistedSession();
   const cmd = args[0];
   
   if (!cmd || cmd === '--help' || cmd === '-h') {
@@ -1937,7 +2163,7 @@ async function main() {
   }
   
   // Ensure server is running for most commands
-  if (!['start', 'stop', 'help', '--help', '-h', 'update', 'version', '-v', '--version'].includes(cmd)) {
+  if (!['start', 'stop', 'help', '--help', '-h', 'update', 'version', '-v', '--version', 'domains', 'resolve'].includes(cmd)) {
     if (!await checkServer()) {
       log.info('Server not running, starting...');
       await cmdStart();
@@ -1991,6 +2217,15 @@ async function main() {
     case 'tabs':
       await cmdTabs();
       break;
+    case 'targets':
+      await cmdTargets();
+      break;
+    case 'use-session':
+      await cmdUseSession(args[1], args.slice(2));
+      break;
+    case 'snapshot':
+      await cmdSnapshot(args.slice(1));
+      break;
     case 'window':
     case 'win':
       await cmdWindow(args.slice(1));
@@ -1998,6 +2233,9 @@ async function main() {
     case 'domains':
       await cmdDomains();
       break;
+    case 'resolve':
+      await cmdResolve(args[1], args.slice(2));
+      break;
     case 'goto':
     case 'navigate':
       await cmdGoto(args[1]);
@@ -2081,9 +2319,11 @@ async function main() {
       // Check if it's a domain command from config
       if (DOMAINS[cmd]) {
         const domain = DOMAINS[cmd];
-        if (domain.script) {
-          // Execute external script
-          const scriptPath = domain.script.replace(/^~/, os.homedir());
+        const shortcut = domain.shortcut || {};
+        const scriptPathRaw = shortcut.type === 'script' ? shortcut.target : domain.script;
+        const urlRaw = shortcut.type === 'url' ? shortcut.target : domain.url;
+        if (scriptPathRaw) {
+          const scriptPath = scriptPathRaw.replace(/^~/, os.homedir()).replace(/\$HOME/g, os.homedir());
           if (fs.existsSync(scriptPath)) {
             const { execSync } = require('child_process');
             try {
@@ -2095,9 +2335,8 @@ async function main() {
             log.fail(`Domain script not found: ${scriptPath}`);
             process.exit(1);
           }
-        } else if (domain.url) {
-          // Navigate to domain URL
-          await cmdGoto(domain.url);
+        } else if (urlRaw) {
+          await cmdGoto(urlRaw);
         }
         break;
       }

package/docs/setup.json

@@ -33,6 +33,8 @@
   },
   "config_paths": {
     "domains": "~/.glider/config/domains.json",
+    "domains_template": "$CURREGISTRY/glider/domains.template.json",
+    "resolve": "glider resolve <url> --json",
     "browser": "~/.glider/config/browser.json",
     "daemon_log": "~/.glider/daemon.log"
   },

package/lib/bexplore.js

@@ -10,8 +10,10 @@
 const WebSocket = require('ws');
 const fs = require('fs');
 const path = require('path');
+const http = require('http');
 
 const RELAY_URL = process.env.RELAY_URL || 'ws://127.0.0.1:19988/cdp';
+const RELAY_HTTP = process.env.RELAY_HTTP || 'http://127.0.0.1:19988';
 
 class SiteExplorer {
   constructor(options = {}) {
@@ -24,7 +26,7 @@ class SiteExplorer {
     // Exploration state
     this.visited = new Set();
     this.toVisit = [];
-    this.depth = options.depth || 3;
+    this.depth = Number.isFinite(options.depth) ? options.depth : 3;
     this.outputDir = options.outputDir || '/tmp/explore';
     this.harFile = options.harFile;
     this.wantedSessionId = options.sessionId || null;
@@ -168,17 +170,18 @@ class SiteExplorer {
     this.eventHandlers.get(event).add(handler);
   }
 
-  async send(method, params = {}) {
+  async send(method, params = {}, options = {}) {
     const id = ++this.messageId;
     const msg = { id, method, params };
     if (this.sessionId) msg.sessionId = this.sessionId;
     this.ws.send(JSON.stringify(msg));
-    
+    const timeoutMs = options.timeoutMs ?? 30000;
+
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new Error(`Timeout: ${method}`));
-      }, 30000);
+      }, timeoutMs);
       this.pending.set(id, {
         resolve: (r) => { clearTimeout(timer); resolve(r); },
         reject: (e) => { clearTimeout(timer); reject(e); }
@@ -186,29 +189,92 @@ class SiteExplorer {
     });
   }
 
+  async sendWithRetry(method, params = {}, options = {}) {
+    const retries = options.retries ?? 3;
+    const delayMs = options.delayMs ?? 400;
+    let lastErr;
+    for (let attempt = 1; attempt <= retries; attempt++) {
+      try {
+        return await this.send(method, params, options);
+      } catch (err) {
+        lastErr = err;
+        if (attempt < retries) {
+          console.error(`[explore] ${method} attempt ${attempt}/${retries} failed: ${err.message}`);
+          await new Promise((r) => setTimeout(r, delayMs * attempt));
+        }
+      }
+    }
+    throw lastErr;
+  }
+
+  async fetchTargets() {
+    return new Promise((resolve, reject) => {
+      const url = new URL('/targets', RELAY_HTTP);
+      http.get(url, (res) => {
+        let body = '';
+        res.on('data', (chunk) => { body += chunk; });
+        res.on('end', () => {
+          try {
+            resolve(JSON.parse(body));
+          } catch (e) {
+            reject(new Error(`Invalid /targets JSON: ${e.message}`));
+          }
+        });
+      }).on('error', reject);
+    });
+  }
+
+  async prefetchSessionFromTargets() {
+    if (!this.wantedSessionId) return false;
+    const targets = await this.fetchTargets();
+    if (!Array.isArray(targets)) {
+      throw new Error('/targets did not return an array');
+    }
+    const hit = targets.find((t) => t.sessionId === this.wantedSessionId);
+    if (!hit) {
+      const available = targets.map((t) => t.sessionId).filter(Boolean).join(', ') || 'none';
+      throw new Error(`Session ${this.wantedSessionId} not in /targets (available: ${available})`);
+    }
+    this.sessionId = this.wantedSessionId;
+    console.error(`[explore] Session pinned from /targets: ${this.sessionId} (${hit.url || hit.title || 'tab'})`);
+    return true;
+  }
+
   async init() {
+    if (this.wantedSessionId) {
+      await this.prefetchSessionFromTargets();
+    }
+
     await this.send('Target.setAutoAttach', { autoAttach: true, waitForDebuggerOnStart: false, flatten: true });
-    await new Promise((resolve, reject) => {
-      this.sessionResolved = resolve;
-      setTimeout(() => {
-        if (!this.sessionId) reject(new Error('Timeout waiting for tab attachment'));
-        else resolve();
-      }, 10000);
-    });
+
+    if (!this.sessionId) {
+      await new Promise((resolve, reject) => {
+        this.sessionResolved = resolve;
+        setTimeout(() => {
+          if (!this.sessionId) reject(new Error('Timeout waiting for tab attachment'));
+          else resolve();
+        }, 10000);
+      });
+    } else if (this.sessionResolved) {
+      this.sessionResolved();
+    }
+
     if (!this.sessionId) throw new Error('No browser tab connected');
-    
-    // Enable ALL the things
-    await Promise.all([
-      this.send('Runtime.enable'),
-      this.send('Page.enable'),
-      this.send('DOM.enable'),
-      this.send('CSS.enable'),
-      this.send('Network.enable'),
-      this.send('Debugger.enable'),
-      this.send('Log.enable'),
-    ]);
-    
-    // Preserve log - don't clear on navigation
+
+    const domainEnables = [
+      ['Runtime.enable', {}],
+      ['Page.enable', {}],
+      ['DOM.enable', {}],
+      ['CSS.enable', {}],
+      ['Network.enable', {}],
+      ['Debugger.enable', {}],
+      ['Log.enable', {}],
+    ];
+    for (const [method, params] of domainEnables) {
+      const retries = method === 'CSS.enable' ? 4 : 2;
+      await this.sendWithRetry(method, params, { retries, delayMs: 500 });
+    }
+
     await this.send('Network.setCacheDisabled', { cacheDisabled: false });
     
     console.error('[explore] All CDP domains enabled');
@@ -492,7 +558,9 @@ class SiteExplorer {
   }
 
   async explore(startUrl, options = {}) {
-    console.error(`[explore] Starting exploration of ${startUrl}`);
+    const depth = this.depth;
+    this.clicksPerformed = 0;
+    console.error(`[explore] Starting exploration of ${startUrl} (depth=${depth})`);
     fs.mkdirSync(this.outputDir, { recursive: true });
     
     // If we want fresh network capture, reload the page
@@ -512,63 +580,70 @@ class SiteExplorer {
     const elements = await this.discoverElements();
     console.error(`[explore] Found: ${elements.tabs.length} tabs, ${elements.buttons.length} buttons, ${elements.links.length} links`);
     
-    // Click through tabs
-    for (const tab of elements.tabs.slice(0, 10)) {
-      if (tab.text) {
-        console.error(`[explore] Clicking tab: ${tab.text}`);
-        try {
-          await this.clickByText(tab.text);
-          await new Promise(r => setTimeout(r, 1000));
-          await this.screenshot(`tab-${tab.text.replace(/[^a-z0-9]/gi, '-').slice(0, 20)}`);
-          await this.discoverElements(); // Re-discover after tab change
-        } catch (e) {
-          console.error(`[explore] Tab click failed: ${e.message}`);
+    if (depth === 0) {
+      console.error('[explore] depth=0 passive — no clicks, scroll, or toggles');
+    } else {
+      // Click through tabs
+      for (const tab of elements.tabs.slice(0, depth)) {
+        if (tab.text) {
+          console.error(`[explore] Clicking tab: ${tab.text}`);
+          try {
+            await this.clickByText(tab.text);
+            this.clicksPerformed++;
+            await new Promise(r => setTimeout(r, 1000));
+            await this.screenshot(`tab-${tab.text.replace(/[^a-z0-9]/gi, '-').slice(0, 20)}`);
+            await this.discoverElements(); // Re-discover after tab change
+          } catch (e) {
+            console.error(`[explore] Tab click failed: ${e.message}`);
+          }
         }
       }
-    }
-    
-    // Click through buttons (non-destructive ones)
-    const safeButtons = elements.buttons.filter(b => {
-      const text = (b.text || '').toLowerCase();
-      return !text.includes('delete') && !text.includes('remove') && !text.includes('submit') && !text.includes('save') && !text.includes('menu');
-    });
-    
-    for (const btn of safeButtons.slice(0, 10)) {
-      if (btn.text) {
-        console.error(`[explore] Clicking button: ${btn.text}`);
-        try {
-          await this.clickByText(btn.text);
-          await new Promise(r => setTimeout(r, 500));
-        } catch (e) {
-          console.error(`[explore] Button click failed: ${e.message}`);
+      
+      // Click through buttons (non-destructive ones)
+      const safeButtons = elements.buttons.filter(b => {
+        const text = (b.text || '').toLowerCase();
+        return !text.includes('delete') && !text.includes('remove') && !text.includes('submit') && !text.includes('save') && !text.includes('menu');
+      });
+      
+      for (const btn of safeButtons.slice(0, depth)) {
+        if (btn.text) {
+          console.error(`[explore] Clicking button: ${btn.text}`);
+          try {
+            await this.clickByText(btn.text);
+            this.clicksPerformed++;
+            await new Promise(r => setTimeout(r, 500));
+          } catch (e) {
+            console.error(`[explore] Button click failed: ${e.message}`);
+          }
         }
       }
-    }
-    
-    // Expand dropdowns
-    for (const dropdown of elements.dropdowns.slice(0, 5)) {
-      console.error(`[explore] Opening dropdown`);
-      // Click to open, then click away
-    }
-    
-    // Scroll to trigger lazy loading
-    console.error('[explore] Scrolling to trigger lazy loading...');
-    await this.scrollToBottom();
-    await this.screenshot('scrolled');
-    
-    // Check all checkboxes (to see what filters do)
-    for (const cb of elements.checkboxes.slice(0, 5)) {
-      if (cb.label) {
-        console.error(`[explore] Toggling checkbox: ${cb.label}`);
-        try {
-          await this.evaluate(`
+      
+      // Expand dropdowns
+      for (const dropdown of elements.dropdowns.slice(0, Math.min(depth, 5))) {
+        console.error(`[explore] Opening dropdown`);
+        // Click to open, then click away
+      }
+      
+      // Scroll to trigger lazy loading
+      console.error('[explore] Scrolling to trigger lazy loading...');
+      await this.scrollToBottom();
+      await this.screenshot('scrolled');
+      
+      // Check all checkboxes (to see what filters do)
+      for (const cb of elements.checkboxes.slice(0, Math.min(depth, 5))) {
+        if (cb.label) {
+          console.error(`[explore] Toggling checkbox: ${cb.label}`);
+          try {
+            await this.evaluate(`
             const cb = Array.from(document.querySelectorAll('input[type="checkbox"]'))
               .find(e => e.labels?.[0]?.textContent?.includes(${JSON.stringify(cb.label)}));
             if (cb) cb.click();
           `);
-          await new Promise(r => setTimeout(r, 500));
-        } catch (e) {
-          console.error(`[explore] Checkbox toggle failed: ${e.message}`);
+            this.clicksPerformed++;
+            await new Promise(r => setTimeout(r, 500));
+          } catch (e) {
+            console.error(`[explore] Checkbox toggle failed: ${e.message}`);
+          }
         }
       }
     }
@@ -584,6 +659,10 @@ class SiteExplorer {
       url: this.siteMap.url,
       title: this.siteMap.title,
       timestamp: new Date().toISOString(),
+      depth: this.depth,
+      clicksPerformed: this.clicksPerformed ?? 0,
+      passive: this.depth === 0,
+      sessionId: this.sessionId,
       
       // Site structure
       structure: {
@@ -673,14 +752,16 @@ class SiteExplorer {
     steps.push({ wait: 2 });
     
     // Add clicks for key buttons (with selectors)
-    const actionButtons = (report.raw.buttons || [])
-      .filter(b => b.selector && b.qa && !b.qa.includes('history') && !b.qa.includes('search'))
-      .slice(0, 10);
-    
-    for (const btn of actionButtons) {
-      steps.push({ log: `Click: ${btn.text || btn.label}` });
-      steps.push({ click: btn.selector });
-      steps.push({ wait: 0.5 });
+    if (this.depth > 0) {
+      const actionButtons = (report.raw.buttons || [])
+        .filter(b => b.selector && b.qa && !b.qa.includes('history') && !b.qa.includes('search'))
+        .slice(0, this.depth);
+      
+      for (const btn of actionButtons) {
+        steps.push({ log: `Click: ${btn.text || btn.label}` });
+        steps.push({ click: btn.selector });
+        steps.push({ wait: 0.5 });
+      }
     }
     
     // Add screenshot at end
@@ -746,22 +827,27 @@ Usage:
   node bexplore.js [options]
 
 Options:
-  --depth N       Exploration depth (default: 3)
+  --depth N       Exploration depth (default: 3; 0 = passive, no clicks)
   --output DIR    Output directory (default: /tmp/explore)
   --har FILE      Save HAR file
+  --session-id ID CDP session (e.g. session-6 from GET /targets)
   --help          Show this help
 
+Depth 0 (passive): reload, discover DOM, screenshots, HAR — zero clicks.
+Depth N>0: up to N tab/button/checkbox interactions per category.
+
 The tool will:
   1. Discover all tabs, buttons, links, forms, tables
-  2. Click through tabs to reveal content
-  3. Click safe buttons to trigger XHR
-  4. Scroll to trigger lazy loading
-  5. Toggle checkboxes/filters
+  2. Click through tabs to reveal content (depth > 0 only)
+  3. Click safe buttons to trigger XHR (depth > 0 only)
+  4. Scroll to trigger lazy loading (depth > 0 only)
+  5. Toggle checkboxes/filters (depth > 0 only)
   6. Capture all network requests
   7. Save screenshots at each step
   8. Generate a comprehensive report
 
 Examples:
+  node bexplore.js --depth 0 --output /tmp/passive --har /tmp/passive.har --session-id session-3
   node bexplore.js --output /tmp/sage-explore --har /tmp/sage.har
   node bexplore.js --depth 5 --output ~/explore-results
 `);
@@ -774,7 +860,7 @@ Examples:
   let sessionId = null;
   
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === '--depth') depth = parseInt(args[++i]);
+    if (args[i] === '--depth') depth = parseInt(args[++i], 10);
     else if (args[i] === '--output') outputDir = args[++i];
     else if (args[i] === '--har') harFile = args[++i];
     else if (args[i] === '--session-id') sessionId = args[++i];

package/lib/bsnapshot.js

@@ -0,0 +1,69 @@
+'use strict';
+
+function buildSnapshotExpression(interactiveOnly) {
+  return `(() => {
+  const interactiveOnly = ${interactiveOnly ? 'true' : 'false'};
+  const vis = (el) => {
+    if (!el) return false;
+    const s = getComputedStyle(el);
+    if (s.visibility === 'hidden' || s.display === 'none') return false;
+    const r = el.getBoundingClientRect();
+    return r.width > 0 && r.height > 0;
+  };
+  const cssPath = (el) => {
+    if (el.id) return '#' + CSS.escape(el.id);
+    const tid = el.getAttribute('data-testid');
+    if (tid) return '[data-testid="' + tid.replace(/"/g, '\\\\"') + '"]';
+    const parts = [];
+    let cur = el;
+    while (cur && cur.nodeType === 1 && cur !== document.body) {
+      let part = cur.tagName.toLowerCase();
+      const parent = cur.parentElement;
+      if (parent) {
+        const sibs = Array.from(parent.children).filter((c) => c.tagName === cur.tagName);
+        if (sibs.length > 1) part += ':nth-of-type(' + (sibs.indexOf(cur) + 1) + ')';
+      }
+      parts.unshift(part);
+      cur = parent;
+      if (parts.length >= 4) break;
+    }
+    return parts.join(' > ');
+  };
+  const roleOf = (el) => el.getAttribute('role') || ({ A: 'link', BUTTON: 'button', INPUT: 'textbox', SELECT: 'combobox', TEXTAREA: 'textbox' }[el.tagName] || el.tagName.toLowerCase());
+  const textOf = (el) => (el.getAttribute('aria-label') || el.textContent || el.value || el.getAttribute('placeholder') || '').trim().replace(/\\s+/g, ' ').slice(0, 120);
+  const sel = interactiveOnly
+    ? 'a[href],button,input,select,textarea,[role="button"],[role="link"],[role="tab"],[role="menuitem"],[contenteditable="true"]'
+    : 'a[href],button,input,select,textarea,[role],[onclick],h1,h2,h3,label,summary';
+  const seen = new Set();
+  const elements = [];
+  let n = 0;
+  for (const el of document.querySelectorAll(sel)) {
+    if (!vis(el)) continue;
+    const selector = cssPath(el);
+    if (seen.has(selector)) continue;
+    seen.add(selector);
+    n += 1;
+    elements.push({
+      id: n,
+      role: roleOf(el),
+      text: textOf(el),
+      selector,
+      aria: el.getAttribute('aria-label') || null,
+      tag: el.tagName.toLowerCase(),
+      href: el.href || null,
+    });
+    if (n >= 200) break;
+  }
+  return { url: location.href, title: document.title, elements };
+})()`;
+}
+
+function formatSnapshotText(data) {
+  const lines = [`URL: ${data.url}`, `Title: ${data.title}`, '', 'Elements:'];
+  for (const el of data.elements || []) {
+    lines.push(`[${el.id}]<${el.role}> ${el.text || '(empty)'}  ${el.selector}`);
+  }
+  return lines.join('\n');
+}
+
+module.exports = { buildSnapshotExpression, formatSnapshotText };

package/lib/domain-resolve.js

@@ -0,0 +1,72 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { URL } = require('url');
+
+const DOMAIN_CONFIG_PATHS = [
+  path.join(os.homedir(), '.glider', 'config', 'domains.json'),
+  path.join(os.homedir(), '.glider', 'domains.json'),
+];
+
+function warchRoot() {
+  const base = process.env.CURREGISTRY || path.join(os.homedir(), '.cursor', 'registry');
+  return path.join(base, 'warch');
+}
+
+function loadDomainsIndex() {
+  for (const cfgPath of DOMAIN_CONFIG_PATHS) {
+    if (!fs.existsSync(cfgPath)) continue;
+    try {
+      return JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
+    } catch (_) { /* ignore */ }
+  }
+  return {};
+}
+
+function hostFromUrl(input) {
+  if (!input) return null;
+  try {
+    const u = input.includes('://') ? input : `https://${input}`;
+    return new URL(u).hostname || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+function resolveDomain(input) {
+  const host = hostFromUrl(input);
+  const root = warchRoot();
+  const warchPath = host ? path.join(root, host) : null;
+  const domains = loadDomainsIndex();
+  let indexHit = null;
+  for (const [key, val] of Object.entries(domains)) {
+    if (key === 'meta' || !val || typeof val !== 'object') continue;
+    if (val.host === host || key === host) {
+      indexHit = key;
+      break;
+    }
+  }
+  const gliderJsonPath = warchPath && path.join(warchPath, 'glider.json');
+  const gotchasPath = warchPath && path.join(warchPath, 'gotchas.json');
+  const gliderJsonExists = !!(gliderJsonPath && fs.existsSync(gliderJsonPath));
+  const gotchasExists = !!(gotchasPath && fs.existsSync(gotchasPath));
+  let gliderJson = null;
+  if (gliderJsonExists) {
+    try {
+      gliderJson = JSON.parse(fs.readFileSync(gliderJsonPath, 'utf8'));
+    } catch (_) { /* ignore */ }
+  }
+  return {
+    host,
+    warch_path: warchPath,
+    glider_json_exists: gliderJsonExists,
+    gotchas_exists: gotchasExists,
+    domains_index_hit: indexHit,
+    capture_mode: gliderJson?.capture_mode ?? null,
+    wait_ms: gliderJson?.wait_ms ?? null,
+  };
+}
+
+module.exports = { resolveDomain, hostFromUrl, warchRoot, loadDomainsIndex };

package/lib/glider-daemon.sh

@@ -1,45 +1,91 @@
 #!/bin/bash
+
 # Glider daemon - respawns relay forever with log rotation
 
+
+
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
 BSERVE="$SCRIPT_DIR/bserve.js"
+
 LOG_DIR="$HOME/.glider"
+
 LOG_FILE="$LOG_DIR/daemon.log"
+
 PID_FILE="$LOG_DIR/daemon.pid"
+
 MAX_LOG_SIZE=10485760  # 10MB
 
+
+
 mkdir -p "$LOG_DIR"
 
+
+
 # Rotate log if > 10MB
+
 rotate_log() {
+
   if [ -f "$LOG_FILE" ] && [ $(stat -f%z "$LOG_FILE" 2>/dev/null || echo 0) -gt $MAX_LOG_SIZE ]; then
-    rm -f "$LOG_FILE.3"
+
+    /bin/unlink "$LOG_FILE.3"
+
     [ -f "$LOG_FILE.2" ] && mv "$LOG_FILE.2" "$LOG_FILE.3"
+
     [ -f "$LOG_FILE.1" ] && mv "$LOG_FILE.1" "$LOG_FILE.2"
+
     mv "$LOG_FILE" "$LOG_FILE.1"
+
     echo "[$(date)] Log rotated" > "$LOG_FILE"
+
   fi
+
 }
 
+
+
 # Kill any existing
+
 if [ -f "$PID_FILE" ]; then
+
   kill $(cat "$PID_FILE") 2>/dev/null
+
   rm "$PID_FILE"
+
 fi
 
+
+
 echo $$ > "$PID_FILE"
 
+
+
 cleanup() {
-  rm -f "$PID_FILE"
+
+  /bin/unlink "$PID_FILE"
+
   exit 0
+
 }
+
 trap cleanup SIGTERM SIGINT
 
+
+
 while true; do
+
   rotate_log
+
   echo "[$(date)] Starting relay..." >> "$LOG_FILE"
+
   node "$BSERVE" >> "$LOG_FILE" 2>&1
+
   EXIT_CODE=$?
+
   echo "[$(date)] Relay exited with code $EXIT_CODE, restarting in 2s..." >> "$LOG_FILE"
+
   sleep 2
+
 done
+
+

package/lib/guard.js

@@ -0,0 +1,73 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const DOMAIN_CONFIG = path.join(os.homedir(), '.glider', 'config', 'allowed-domains.json');
+
+function parseDomainList(raw) {
+  if (!raw) return [];
+  return String(raw)
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+
+function loadConfigDomains() {
+  if (!fs.existsSync(DOMAIN_CONFIG)) return [];
+  try {
+    const data = JSON.parse(fs.readFileSync(DOMAIN_CONFIG, 'utf8'));
+    return Array.isArray(data) ? data : data.allowed || data.domains || [];
+  } catch {
+    return [];
+  }
+}
+
+function resolveAllowedDomains(cliList) {
+  const fromEnv = parseDomainList(process.env.GLIDER_ALLOWED_DOMAINS);
+  const fromCli = cliList && cliList.length ? cliList : [];
+  const fromFile = loadConfigDomains();
+  if (fromCli.length) return fromCli;
+  if (fromEnv.length) return fromEnv;
+  if (fromFile.length) return fromFile;
+  return null;
+}
+
+function hostMatchesPattern(host, pattern) {
+  const h = (host || '').toLowerCase();
+  const p = (pattern || '').toLowerCase();
+  if (!h || !p) return false;
+  if (p.includes('*')) {
+    const re = new RegExp(`^${p.replace(/\./g, '\\.').replace(/\*/g, '.*')}$`);
+    return re.test(h);
+  }
+  return h === p || h.endsWith(`.${p}`);
+}
+
+function urlAllowed(url, allowed) {
+  if (!allowed || !allowed.length) return true;
+  let host;
+  try {
+    host = new URL(url).hostname;
+  } catch {
+    return false;
+  }
+  return allowed.some((p) => hostMatchesPattern(host, p));
+}
+
+function assertUrlAllowed(url, allowed, action) {
+  if (urlAllowed(url, allowed)) return;
+  const host = (() => {
+    try { return new URL(url).hostname; } catch { return url; }
+  })();
+  throw new Error(`blocked by allowed_domains: ${action} on ${host}`);
+}
+
+module.exports = {
+  parseDomainList,
+  resolveAllowedDomains,
+  hostMatchesPattern,
+  urlAllowed,
+  assertUrlAllowed,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glidercli",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "description": "Browser automation CLI. Control Chrome from terminal via CDP, run YAML task files, autonomous loops until completion.",
   "main": "index.js",
   "bin": {