iframer-toolkit 0.11.0 → 0.11.2

package/README.md

@@ -227,6 +227,7 @@ Capture in a browser iframer doesn't control (T3 Code, Playwright MCP, ...):
     --out <dir>                    Output directory (default: ./<host>-api/)
     --keep                         Keep the capture file (default: deleted)
     --no-knowledge                 Don't update ~/.iframer/knowledge
+    --strict                       Refuse on any secret-looking value instead of replacing it
     --json                         One-line JSON summary
 
 Browser windows:
@@ -267,6 +268,7 @@ Setup:
   extension path                   Print the extension folder to load in chrome://extensions
   extension token                  Print the pairing token (only needed to pair by hand)
   update [--check]                 Update iframer via npm (--check: report only)
+  refresh                          Rewrite the in-page kit and the /iframer skill (update runs it)
   remove [chromium|mcp|extension]  Remove everything, or one piece
 
 Browser:
@@ -339,9 +341,11 @@ iframer ingest --latest --typed # finds the capture in T3's downloads -> ./<host
 ```
 
 - **Small for the agent:** the kit and the capture move as files, so neither lands in the agent's context. On the 40-endpoint test site, the whole install-capture-export round was about 550 tokens of tool calls.
-- **Shapes, not values:** paths are templated (`/users/{id}`), bodies and responses become type shapes, headers become names. `ingest` scans the result and refuses it if anything looks like a token, email or phone number.
+- **Shapes, not values:** paths are templated (`/users/{id}`), bodies and responses become type shapes, headers become names. `ingest` then swaps anything left that looks like a token, email or phone number for a placeholder, keeps the endpoint, and marks it with `privateValues`. `--strict` refuses the capture instead.
+- **Identity, without the values:** the kit learns which auth headers the page sends and where it keeps each value (a localStorage key, a field inside it, a cookie, or page memory). api.json records that under `identity`, and `__ifk.call` rebuilds the headers from there for every replay, so the generated client acts as the logged-in user.
 - **Output:** `api.json` (endpoint map with coverage), `client.js` (in-page client over `window.__ifk.call`), `client.d.ts` with `--typed`, and the domain's knowledge file.
 - **Replay stays in the page:** HttpOnly cookies are invisible to page JS, so generated calls run through the tab. Same-origin only, GET unless approved, 50 calls per session, and a hard stop on 403, 429 or a captcha page.
+- **Next.js:** dynamic route segments are named from the app's own route data, so `/wichitalife/dashboard` is saved as `/{communitySlug}/dashboard` and the client takes `communitySlug` as an argument. RSC responses (`text/x-component`) become data: the props the server passed to each client component, or a Server Action's return value. Server Actions are saved by export name and called with `window.__ifk.action(name, [args], {approved:true})`. The id is looked up again in the page's JS on every call, so it keeps working after a deploy.
 - **Not complete:** worker requests, redirect hops, cross-origin iframes and Set-Cookie are invisible to the kit, and every report says so.
 - **Survives the page:** after a full page load the agent re-runs one short `eval` and the capture continues. Works on sites that delete `window.sessionStorage` (Discord).
 - **Other tools:** `--for playwright-mcp` or `--for any`. Tools without file upload can evaluate `iframer kit --print` instead, which costs about 17 KB per page load.

package/dist/cli.js

@@ -11621,10 +11621,12 @@ function pageKit(opts) {
   var w = window;
   var VERSION = 1;
   var KEY = "__ifk_state";
-  if (w.__ifk && w.__ifk.version === VERSION) {
+  var BUILD = opts.build || "dev";
+  if (w.__ifk && w.__ifk.version === VERSION && w.__ifk.build === BUILD) {
     var s0 = w.__ifk.summary();
     return { installed: true, again: true, version: VERSION, seen: s0.seen };
   }
+  var replaced = null;
   var mode = opts.mode === "passive" ? "passive" : "hook";
   var hostRe = null;
   try {
@@ -11652,9 +11654,39 @@ function pageKit(opts) {
     }
   }
   var ss = store();
+  if (w.__ifk && w.__ifk.stop) {
+    replaced = w.__ifk.build || "old";
+    try {
+      var keep = {};
+      [KEY, "__ifk", "__ifkApi"].forEach(function(k) {
+        keep[k] = ss && ss.getItem(k);
+      });
+      w.__ifk.stop();
+      Object.keys(keep).forEach(function(k) {
+        if (keep[k] != null) ss.setItem(k, keep[k]);
+      });
+    } catch (e) {
+    }
+  }
+  function lstore() {
+    try {
+      if (w.localStorage) return w.localStorage;
+    } catch (e) {
+    }
+    try {
+      store();
+      return document.getElementById("__ifk_ss").contentWindow.localStorage;
+    } catch (e) {
+      return null;
+    }
+  }
   var m = {};
   var po = {};
   var budget = { calls: 0, stopped: null };
+  var authSrc = {};
+  var authMem = {};
+  var rp = {};
+  var acts = {};
   var restored = 0;
   try {
     var saved = JSON.parse(ss.getItem(KEY) || "null");
@@ -11662,6 +11694,8 @@ function pageKit(opts) {
       m = saved.m || {};
       po = saved.po || {};
       if (saved.budget) budget = saved.budget;
+      if (saved.authSrc) authSrc = saved.authSrc;
+      if (saved.acts) acts = saved.acts;
       restored = Object.keys(m).length;
     }
   } catch (e) {
@@ -11687,9 +11721,222 @@ function pageKit(opts) {
   }
   function tpl(p) {
     return p.split("/").map(function(s) {
+      var d = s;
+      try {
+        d = decodeURIComponent(s);
+      } catch (e) {
+      }
+      if (s && rp.hasOwnProperty(d)) return "{" + rp[d] + "}";
       return isValueLike(s) ? "{id}" : s;
     }).join("/");
   }
+  var PARAM_RE = /\["([A-Za-z_][\w-]{0,40})","([^"\\\/]{1,80})","(?:d|c|oc|ci|dc)"/g;
+  function learnParams(text) {
+    if (!text || text.indexOf('","d"') < 0 && text.indexOf('","c"') < 0 && text.indexOf('","oc"') < 0) return;
+    PARAM_RE.lastIndex = 0;
+    var x;
+    while (x = PARAM_RE.exec(text)) if (!rp.hasOwnProperty(x[2])) rp[x[2]] = x[1];
+  }
+  var nextIdx = 0;
+  function scanNext() {
+    try {
+      var f = w.__next_f;
+      if (f && f.length > nextIdx) {
+        for (var i = nextIdx; i < f.length; i++) if (f[i] && typeof f[i][1] === "string") learnParams(f[i][1]);
+        nextIdx = f.length;
+      }
+    } catch (e) {
+    }
+    try {
+      var q = w.__NEXT_DATA__ && w.__NEXT_DATA__.query;
+      if (q) Object.keys(q).forEach(function(k) {
+        if (typeof q[k] === "string" && !rp.hasOwnProperty(q[k])) rp[q[k]] = k;
+      });
+    } catch (e) {
+    }
+  }
+  function learnFromBody(b, u) {
+    if (typeof b !== "string" || b.length > 2e4) return;
+    var j;
+    try {
+      j = JSON.parse(b);
+    } catch (e) {
+      return;
+    }
+    var segs = {};
+    (u.pathname + "/" + location.pathname).split("/").forEach(function(s) {
+      if (s) {
+        try {
+          segs[decodeURIComponent(s)] = 1;
+        } catch (e) {
+        }
+      }
+    });
+    (function walk(v, d) {
+      if (!v || typeof v !== "object" || d > 3) return;
+      Object.keys(v).forEach(function(k) {
+        var x = v[k];
+        if (typeof x === "string" && x.length > 1 && segs[x] && /(id|slug|key|handle|code|name)$/i.test(k) && !rp.hasOwnProperty(x)) rp[x] = k;
+        else walk(x, d + 1);
+      });
+    })(j, 0);
+  }
+  function parseFlight(t) {
+    var rows = {};
+    try {
+      var b = new TextEncoder().encode(t), dec = new TextDecoder(), i = 0, n = b.length;
+      while (i < n) {
+        var c = i;
+        while (c < n && b[c] !== 58 && b[c] !== 10) c++;
+        if (c >= n) break;
+        if (b[c] === 10) {
+          i = c + 1;
+          continue;
+        }
+        var id = dec.decode(b.subarray(i, c));
+        var j = c + 1;
+        if (b[j] === 84) {
+          var cm = j + 1;
+          while (cm < n && b[cm] !== 44) cm++;
+          var len = parseInt(dec.decode(b.subarray(j + 1, cm)), 16) || 0;
+          rows[id] = { text: dec.decode(b.subarray(cm + 1, cm + 1 + len)) };
+          i = cm + 1 + len;
+          if (b[i] === 10) i++;
+          continue;
+        }
+        var nl = j;
+        while (nl < n && b[nl] !== 10) nl++;
+        var p = dec.decode(b.subarray(j, nl));
+        i = nl + 1;
+        if (!/^[0-9a-f]+$/i.test(id)) continue;
+        var tag = (/^[A-Z]+/.exec(p) || [""])[0];
+        try {
+          rows[id] = { tag, v: JSON.parse(p.slice(tag.length)) };
+        } catch (e) {
+        }
+      }
+    } catch (e) {
+    }
+    return rows;
+  }
+  function flightData(rows) {
+    function resolve(v, d) {
+      if (d > 30) return null;
+      if (typeof v === "string") {
+        if (v === "$undefined") return void 0;
+        if (/^\$D/.test(v)) return v.slice(2);
+        var r = /^\$@?([0-9a-f]+)$/.exec(v);
+        if (r && rows[r[1]] && rows[r[1]].v !== void 0) return resolve(rows[r[1]].v, d + 1);
+        if (r && rows[r[1]] && rows[r[1]].text !== void 0) return rows[r[1]].text;
+        return v.charAt(0) === "$" && v.charAt(1) === "$" ? v.slice(1) : v;
+      }
+      if (Array.isArray(v)) return v.map(function(x) {
+        return resolve(x, d + 1);
+      });
+      if (v && typeof v === "object") {
+        var o = {};
+        Object.keys(v).forEach(function(k) {
+          o[k] = resolve(v[k], d + 1);
+        });
+        return o;
+      }
+      return v;
+    }
+    var r0 = rows["0"] && rows["0"].v;
+    if (r0 && typeof r0 === "object" && !Array.isArray(r0) && typeof r0.a === "string" && /^\$@/.test(r0.a)) {
+      return { action: resolve(r0.a, 0) };
+    }
+    var names = {};
+    Object.keys(rows).forEach(function(id) {
+      var r = rows[id];
+      if (r.tag !== "I" || !r.v) return;
+      var nm = Array.isArray(r.v) ? r.v[2] : r.v.name;
+      names["$L" + id] = nm && nm !== "default" && nm !== "*" ? nm : "Component" + id;
+    });
+    var comps = {}, seen = 0;
+    function walk(v, d) {
+      if (d > 60 || seen > 400 || !v || typeof v !== "object") return;
+      if (Array.isArray(v)) {
+        if (v[0] === "$" && typeof v[1] === "string" && v.length === 4) {
+          var props = v[3];
+          if (props && typeof props === "object" && names[v[1]]) {
+            var data = {}, has = false;
+            Object.keys(props).forEach(function(k) {
+              if (k !== "children") {
+                data[k] = resolve(props[k], 0);
+                has = true;
+              }
+            });
+            if (has) {
+              seen++;
+              (comps[names[v[1]]] = comps[names[v[1]]] || []).push(data);
+            }
+          }
+          if (props && typeof props === "object") walk(props.children, d + 1);
+          return;
+        }
+        v.forEach(function(x) {
+          walk(x, d + 1);
+        });
+        return;
+      }
+      Object.keys(v).forEach(function(k) {
+        walk(v[k], d + 1);
+      });
+    }
+    Object.keys(rows).forEach(function(id) {
+      if (!rows[id].tag && rows[id].v !== void 0) walk(rows[id].v, 0);
+    });
+    Object.keys(comps).forEach(function(k) {
+      if (comps[k].length === 1) comps[k] = comps[k][0];
+    });
+    return { components: comps };
+  }
+  function isFlight(ct) {
+    return /text\/x-component/i.test(ct || "");
+  }
+  var ACT_RE = /\(\s*"([0-9a-f]{40,44})"\s*,[^"()]{0,200}?,\s*"([A-Za-z_$][\w$]*)"\s*\)/g;
+  var actScan = null;
+  function scanActions(fresh) {
+    if (actScan && !fresh) return actScan;
+    var srcs = {};
+    try {
+      [].slice.call(document.scripts).forEach(function(sc) {
+        if (sc.src) srcs[sc.src] = 1;
+      });
+    } catch (e) {
+    }
+    try {
+      performance.getEntriesByType("resource").forEach(function(r) {
+        if (r.initiatorType === "script" || /\.js(\?|$)/.test(r.name)) srcs[r.name] = 1;
+      });
+    } catch (e) {
+    }
+    var found = {};
+    actScan = Promise.all(Object.keys(srcs).filter(function(s) {
+      var u = abs(s);
+      return u && u.origin === location.origin && /\/_next\//.test(u.pathname);
+    }).map(function(s) {
+      return origFetch.call(w, s, { cache: fresh ? "no-cache" : "default" }).then(function(r) {
+        return r.text();
+      }).then(function(t) {
+        ACT_RE.lastIndex = 0;
+        var x;
+        while (x = ACT_RE.exec(t)) {
+          found[x[1]] = x[2];
+          acts[x[1]] = x[2];
+        }
+      }, function() {
+      });
+    })).then(function() {
+      persistSoon();
+      return found;
+    });
+    return actScan;
+  }
+  function actionLabel(id) {
+    return acts[id] || id.slice(0, 8);
+  }
   function abs(u, base) {
     try {
       return new URL(String(u), base || location.href);
@@ -11753,6 +12000,13 @@ function pageKit(opts) {
       } catch (e) {
       }
     }
+    if (isFlight(ct)) {
+      learnParams(text);
+      try {
+        return { rsc: shape(flightData(parseFlight(text))) };
+      } catch (e) {
+      }
+    }
     return { contentType: (ct || "").split(";")[0], bytes: text.length };
   }
   function cap(t) {
@@ -11761,7 +12015,7 @@ function pageKit(opts) {
   var persistTimer = null;
   function persist() {
     try {
-      ss.setItem(KEY, JSON.stringify({ v: VERSION, m, po, budget }));
+      ss.setItem(KEY, JSON.stringify({ v: VERSION, m, po, budget, authSrc, acts }));
     } catch (e) {
     }
   }
@@ -11772,13 +12026,105 @@ function pageKit(opts) {
       persist();
     }, 300);
   }
+  function findIn(st, from, needle) {
+    if (!st) return null;
+    for (var i = 0; i < st.length; i++) {
+      var k = st.key(i);
+      if (!k || k.indexOf("__ifk") === 0) continue;
+      var v = st.getItem(k);
+      if (!v || v.indexOf(needle) < 0) continue;
+      if (v === needle) return { from, key: k };
+      try {
+        var j = JSON.parse(v);
+        if (j === needle) return { from, key: k, json: true };
+        var path15 = findPath(j, needle, 0);
+        if (path15) return { from, key: k, path: path15 };
+      } catch (e) {
+      }
+    }
+    return null;
+  }
+  function findPath(o, needle, d) {
+    if (!o || typeof o !== "object" || d > 4) return null;
+    for (var k in o) {
+      if (o[k] === needle) return [k];
+      var p = findPath(o[k], needle, d + 1);
+      if (p) return [k].concat(p);
+    }
+    return null;
+  }
+  function sourceOf(value) {
+    var pre = (/^(bearer|token|basic|jwt)\s+/i.exec(value) || [""])[0];
+    var raw = value.slice(pre.length);
+    if (raw.length < 8) return null;
+    var hit = findIn(lstore(), "localStorage", raw) || findIn(ss, "sessionStorage", raw);
+    if (!hit) {
+      try {
+        document.cookie.split(/;\s*/).forEach(function(c) {
+          var i = c.indexOf("=");
+          if (!hit && i > 0 && decodeURIComponent(c.slice(i + 1)) === raw) hit = { from: "cookie", key: c.slice(0, i) };
+        });
+      } catch (e) {
+      }
+    }
+    hit = hit || { from: "memory" };
+    if (pre) hit.prefix = pre;
+    return hit;
+  }
+  function learnAuth(name, value, u) {
+    if (typeof value !== "string" || name === "cookie" || u.origin !== location.origin) return;
+    authMem[name] = value;
+    var cur = authSrc[name];
+    if (!cur || cur.from === "memory") {
+      var s = sourceOf(value);
+      if (s) authSrc[name] = s;
+    }
+  }
+  function readAuth() {
+    var out = {};
+    Object.keys(authSrc).forEach(function(name) {
+      var s = authSrc[name], v = null;
+      try {
+        if (s.from === "localStorage" || s.from === "sessionStorage") {
+          var st = s.from === "localStorage" ? lstore() : ss;
+          v = st && st.getItem(s.key);
+          if (v != null && (s.json || s.path)) {
+            v = JSON.parse(v);
+            (s.path || []).forEach(function(k) {
+              v = v == null ? v : v[k];
+            });
+          }
+        } else if (s.from === "cookie") {
+          document.cookie.split(/;\s*/).forEach(function(c) {
+            if (c.indexOf(s.key + "=") === 0) v = decodeURIComponent(c.slice(s.key.length + 1));
+          });
+        }
+      } catch (e) {
+        v = null;
+      }
+      if (typeof v !== "string" || !v) v = authMem[name] ? authMem[name].slice((s.prefix || "").length) : null;
+      if (v) out[name] = (s.prefix || "") + v;
+    });
+    return out;
+  }
   function rec(kind, method, url, headers, body, status, ct, text, base) {
     try {
       var u = abs(url, base);
       if (!u || !/^https?:$/.test(u.protocol)) return;
       if (hostRe && !hostRe.test(u.host)) return;
-      var k = String(method || "GET").toUpperCase() + " " + u.origin + tpl(u.pathname);
+      scanNext();
+      if (text !== void 0 && isFlight(ct)) learnParams(text);
+      learnFromBody(body, u);
+      var act = null;
+      Object.keys(headers || {}).forEach(function(h) {
+        if (h.toLowerCase() === "next-action" && typeof headers[h] === "string") act = headers[h];
+      });
+      var k = String(method || "GET").toUpperCase() + " " + u.origin + tpl(u.pathname) + (act ? "#" + actionLabel(act) : "");
       var e = m[k] || (m[k] = { kind, n: 0, status: [], query: [], headers: [], auth: [] });
+      if (act) {
+        e.next = { action: act };
+        if (!acts[act]) scanActions(true);
+      }
       e.n++;
       if (status != null && e.status.indexOf(status) < 0) e.status.push(status);
       u.searchParams.forEach(function(_, q) {
@@ -11789,6 +12135,7 @@ function pageKit(opts) {
         var l = h.toLowerCase();
         if (AUTH_H.test(l)) {
           if (e.auth.indexOf(l) < 0) e.auth.push(l);
+          learnAuth(l, headers[h], u);
         } else if (!NOISE_H.test(l) && !NOISE_H_PREFIX.test(l) && e.headers.indexOf(l) < 0) e.headers.push(l);
       });
       if (body !== void 0 && !e.req) e.req = bodyShape(body);
@@ -11837,19 +12184,19 @@ function pageKit(opts) {
           var url = isReq ? input.url : input;
           var hs = {};
           var src = init && init.headers || isReq && input.headers;
-          if (src) new win.Headers(src).forEach(function(_, k) {
-            hs[k] = 1;
+          if (src) new win.Headers(src).forEach(function(v, k) {
+            hs[k] = AUTH_H.test(k) || /^next-action$/i.test(k) ? v : 1;
           });
           var b = init && init.body;
           var at = base();
-          p.then(function(res) {
+          p.then(function(res2) {
             try {
-              var ct = res.headers.get("content-type");
-              if (/event-stream|octet|video|audio|image/i.test(ct || "")) return rec("fetch", method, url, hs, b, res.status, ct, void 0, at);
-              res.clone().text().then(function(t) {
-                rec("fetch", method, url, hs, b, res.status, ct, cap(t), at);
+              var ct = res2.headers.get("content-type");
+              if (/event-stream|octet|video|audio|image/i.test(ct || "")) return rec("fetch", method, url, hs, b, res2.status, ct, void 0, at);
+              res2.clone().text().then(function(t) {
+                rec("fetch", method, url, hs, b, res2.status, ct, cap(t), at);
               }, function() {
-                rec("fetch", method, url, hs, b, res.status, ct, void 0, at);
+                rec("fetch", method, url, hs, b, res2.status, ct, void 0, at);
               });
             } catch (e) {
             }
@@ -11872,9 +12219,9 @@ function pageKit(opts) {
         };
       });
       patch(X, "setRequestHeader", function(oSet) {
-        return function(k) {
+        return function(k, v) {
           try {
-            if (this.__ifkI) this.__ifkI.h[k] = 1;
+            if (this.__ifkI) this.__ifkI.h[k] = AUTH_H.test(k) || /^next-action$/i.test(k) ? v : 1;
           } catch (e) {
           }
           return oSet.apply(this, arguments);
@@ -12010,10 +12357,43 @@ function pageKit(opts) {
   } catch (e) {
   }
   w.addEventListener("pagehide", persist);
+  function retpl(s) {
+    var x = /^(https?:\/\/[^\/]+)(\/.*)?$/.exec(s);
+    return x ? x[1] + tpl(x[2] || "/") : s;
+  }
+  function rekey() {
+    scanNext();
+    var m2 = {};
+    Object.keys(m).forEach(function(k) {
+      var e = m[k], sp = k.indexOf(" "), rest = k.slice(sp + 1).split("#")[0];
+      var nk = k.slice(0, sp) + " " + retpl(rest) + (e.next ? "#" + actionLabel(e.next.action) : "");
+      if (e.next && acts[e.next.action]) e.next.name = acts[e.next.action];
+      var p = m2[nk];
+      if (!p) {
+        m2[nk] = e;
+        return;
+      }
+      p.n += e.n;
+      ["status", "query", "headers", "auth"].forEach(function(f) {
+        (e[f] || []).forEach(function(x) {
+          if (p[f].indexOf(x) < 0) p[f].push(x);
+        });
+      });
+      if (!p.req) p.req = e.req;
+      if (!p.res) p.res = e.res;
+    });
+    m = m2;
+    var po2 = {};
+    Object.keys(po).forEach(function(k) {
+      po2[retpl(k)] = po[k];
+    });
+    po = po2;
+  }
   function report() {
+    rekey();
     var hooked = {};
     Object.keys(m).forEach(function(k) {
-      hooked[k.slice(k.indexOf(" ") + 1)] = 1;
+      hooked[k.slice(k.indexOf(" ") + 1).split("#")[0]] = 1;
     });
     var pathOnly = Object.keys(po).filter(function(p) {
       return !hooked[p];
@@ -12034,6 +12414,9 @@ function pageKit(opts) {
         complete: false,
         blindSpots: ["HttpOnly cookies", "Set-Cookie", "browser-added headers", "worker traffic", "document POST responses", "redirect hops", "cross-origin iframes"]
       },
+      // What a replay needs besides the browser's own cookies: header names and
+      // where the page keeps their values. Never the values.
+      auth: { cookies: "browser session (sent automatically, HttpOnly included)", headers: authSrc },
       endpoints: m,
       pathOnly
     };
@@ -12045,6 +12428,7 @@ function pageKit(opts) {
   }
   w.__ifk = {
     version: VERSION,
+    build: BUILD,
     mode,
     summary: function() {
       var c = report().coverage;
@@ -12089,6 +12473,22 @@ function pageKit(opts) {
       }
       budget.calls++;
       var init = { method, credentials: "include", headers: o.headers || {} };
+      if ((o.rsc || /[?&]_rsc=/.test(String(path15))) && !Object.keys(init.headers).some(function(k) {
+        return k.toLowerCase() === "rsc";
+      })) init.headers.rsc = "1";
+      var used = [];
+      if (u.origin === location.origin && o.auth !== false) {
+        var a = readAuth();
+        Object.keys(a).forEach(function(h) {
+          var has = Object.keys(init.headers).some(function(k) {
+            return k.toLowerCase() === h;
+          });
+          if (!has) {
+            init.headers[h] = a[h];
+            used.push(h);
+          }
+        });
+      }
       if (o.json !== void 0) {
         init.body = JSON.stringify(o.json);
         init.headers["content-type"] = "application/json";
@@ -12097,13 +12497,33 @@ function pageKit(opts) {
       return origFetch.call(w, u.href, init).then(function(r) {
         return r.text().then(function(t) {
           var out = { status: r.status };
+          if (used.length) out.auth = used;
+          if (r.status === 401) {
+            var missing = Object.keys(authSrc).filter(function(h) {
+              return used.indexOf(h) < 0;
+            });
+            out.hint = missing.length ? "no value for " + missing.join(", ") + ": use the site once so it sends its token, then retry" : Object.keys(authSrc).length ? "auth headers were sent; the session may have expired" : "no auth header seen yet: use the site once while the kit records";
+          }
           var wall = looksLikeWall(r.status, t);
           if (wall) {
             budget.stopped = wall;
             out.stopped = wall;
           }
           persist();
-          if (t.length > maxBytes) {
+          var ct = r.headers.get("content-type");
+          if (isFlight(ct)) {
+            learnParams(t);
+            var data = flightData(parseFlight(t));
+            if (data.action !== void 0) data = data.action;
+            var size = JSON.stringify(data === void 0 ? null : data).length;
+            if (size > maxBytes && !o.full) {
+              out.shape = shape(data);
+              out.bytes = size;
+              out.hint = "big result, shown as its shape. Pass {full:true} and pick fields in the same evaluate: .then(r => r.data...)";
+            } else out.data = data;
+            return out;
+          }
+          if (t.length > maxBytes && !o.full) {
             out.truncated = t.length;
             t = t.slice(0, maxBytes);
           }
@@ -12111,6 +12531,7 @@ function pageKit(opts) {
             out.data = JSON.parse(t);
           } catch (e) {
             out.text = t.slice(0, 2e3);
+            if (/html/i.test(ct || "")) out.hint = "got HTML, not data. On Next.js pages pass {rsc:true}";
           }
           return out;
         });
@@ -12118,6 +12539,37 @@ function pageKit(opts) {
         return { error: String(e && e.message || e) };
       });
     },
+    // Calls a Next.js Server Action by export name (or id). The id is looked up
+    // in the current page's chunks first, so it survives deploys.
+    action: function(nameOrId, args2, o) {
+      o = o || {};
+      if (budget.stopped) return Promise.resolve({ error: "stopped", reason: budget.stopped });
+      if (!o.approved) return Promise.resolve({ error: "write needs approval", hint: "a Server Action runs server code and may change data: ask the user, then pass {approved:true}" });
+      var self = this;
+      return scanActions(true).then(function(found) {
+        var id = null;
+        Object.keys(found).forEach(function(k) {
+          if (found[k] === nameOrId || k === nameOrId) id = k;
+        });
+        if (!id) Object.keys(acts).forEach(function(k) {
+          if (acts[k] === nameOrId) id = k;
+        });
+        if (!id && /^[0-9a-f]{40,44}$/.test(nameOrId)) id = nameOrId;
+        if (!id) return { error: "action not found", hint: "open a page that uses " + nameOrId + ", re-run the install eval, then retry" };
+        var body = JSON.stringify(Array.isArray(args2) ? args2 : args2 === void 0 ? [] : [args2]);
+        return self.call("POST", o.path || location.pathname + location.search, {
+          approved: true,
+          full: o.full,
+          maxBytes: o.maxBytes,
+          headers: { "next-action": id, accept: "text/x-component", "content-type": "text/plain;charset=UTF-8" },
+          body
+        }).then(function(r) {
+          if (r && r.status === 404) r.hint = "Server Action id not accepted (new deploy?): reload the page, re-run the install eval, retry";
+          if (r) r.actionId = id.slice(0, 8);
+          return r;
+        });
+      });
+    },
     // Removes every hook and forgets the capture.
     stop: function() {
       restores.forEach(function(r) {
@@ -12151,7 +12603,12 @@ function pageKit(opts) {
     }
   };
   persist();
-  return { installed: true, again: false, version: VERSION, mode, restored };
+  scanNext();
+  if (w.__next_f || w.__NEXT_DATA__) scanActions(false);
+  var res = { installed: true, again: false, version: VERSION, build: BUILD, mode, restored };
+  if (replaced) res.replaced = replaced;
+  if (w.__next_f || w.__NEXT_DATA__) res.nextjs = true;
+  return res;
 }
 var init_page_kit = __esm({
   "src/lib/kit/page-kit.ts"() {
@@ -12223,7 +12680,7 @@ function scanString(s, where, out) {
   if (TYPE_NAMES.has(s)) return;
   for (const [kind, re] of DETECTORS) {
     if (kind === "token") {
-      for (const part of s.split(/[/\s?&=#]/)) {
+      for (const part of splitWords(s)) {
         if (part.includes("{")) continue;
         if (re.test(part)) {
           out.push({ where, kind, sample: mask(part) });
@@ -12254,16 +12711,133 @@ function scanCapture(report) {
   for (const [key, ep] of Object.entries(report.endpoints)) {
     const where = `endpoints["${key.length > 80 ? key.slice(0, 80) + "\u2026" : key}"]`;
     scanString(key, where, out);
-    walkValues(ep, where, out);
+    walkValues({ ...ep, next: void 0 }, where, out);
   }
   report.pathOnly.forEach((p, i) => scanString(p, `pathOnly[${i}]`, out));
   return out;
 }
+function splitWords(s) {
+  const m = s.match(/^(?:[A-Z]+ )?https?:\/\/([^/]+)(.*)$/);
+  if (!m) return s.split(/[/\s?&=#:;,]/);
+  return [...m[1].split(/[.:]/), ...m[2].split(/[/\s?&=#:;,]/)];
+}
+function redactUrl(s) {
+  const kinds = [];
+  const hit = (part) => {
+    if (!part || part.includes("{")) return null;
+    let d = part;
+    try {
+      d = decodeURIComponent(part);
+    } catch {
+    }
+    for (const [kind, re] of DETECTORS) if (re.test(d)) return kind;
+    return null;
+  };
+  const fixSeg = (seg) => {
+    let found = false;
+    const parts = seg.split(/([^A-Za-z0-9_%@+])/).map((p) => {
+      const kk = hit(p);
+      if (kk) {
+        kinds.push(kk);
+        found = true;
+        return PLACEHOLDER;
+      }
+      return p;
+    });
+    if (found) return parts.join("");
+    const k = hit(seg);
+    if (k) {
+      kinds.push(k);
+      return PLACEHOLDER;
+    }
+    return seg;
+  };
+  const m = s.match(/^((?:[A-Z]+ )?https?:\/\/)([^/]+)(.*)$/);
+  if (!m) return { s: s.split("/").map(fixSeg).join("/"), kinds };
+  const host = m[2].split(".").map((l) => {
+    const k = hit(l);
+    if (k) {
+      kinds.push(k);
+      return "x";
+    }
+    return l;
+  }).join(".");
+  return { s: m[1] + host + m[3].split("/").map(fixSeg).join("/"), kinds };
+}
+function redactShape(v, kinds) {
+  if (typeof v === "string") {
+    if (TYPE_NAMES.has(v)) return v;
+    const f = [];
+    scanString(v, "", f);
+    if (f.length) {
+      kinds.push(f[0].kind);
+      return "string";
+    }
+    return v;
+  }
+  if (Array.isArray(v)) return v.map((x) => redactShape(x, kinds));
+  if (v && typeof v === "object") {
+    const o = {};
+    for (const [k, x] of Object.entries(v)) {
+      const f = [];
+      scanString(k, "", f);
+      const key = f.length ? "{key}" : k;
+      if (f.length) kinds.push(f[0].kind);
+      if (!(key in o)) o[key] = redactShape(x, kinds);
+    }
+    return o;
+  }
+  return v;
+}
+function redactCapture(report) {
+  const redacted = [];
+  const endpoints = {};
+  for (const [key, ep] of Object.entries(report.endpoints)) {
+    const kinds = [];
+    const { s: newKey, kinds: keyKinds } = redactUrl(key);
+    kinds.push(...keyKinds);
+    const clean = { ...ep };
+    clean.query = union((ep.query || []).map((q) => {
+      const f = [];
+      scanString(q, "", f);
+      if (f.length) kinds.push(f[0].kind);
+      return f.length ? "{key}" : q;
+    }));
+    clean.headers = (ep.headers || []).filter((h) => {
+      const f = [];
+      scanString(h, "", f);
+      if (f.length) kinds.push(f[0].kind);
+      return !f.length;
+    });
+    if (ep.req !== void 0) clean.req = redactShape(ep.req, kinds);
+    if (ep.res !== void 0) clean.res = redactShape(ep.res, kinds);
+    for (const k of new Set(kinds)) redacted.push({ where: newKey, kind: k, sample: "replaced" });
+    if (kinds.length) clean.redacted = union(ep.redacted, kinds);
+    const prev = endpoints[newKey];
+    endpoints[newKey] = prev ? {
+      ...prev,
+      n: prev.n + clean.n,
+      status: union(prev.status, clean.status),
+      query: union(prev.query, clean.query),
+      headers: union(prev.headers, clean.headers),
+      auth: union(prev.auth, clean.auth),
+      req: prev.req ?? clean.req,
+      res: prev.res ?? clean.res,
+      ...prev.redacted || clean.redacted ? { redacted: union(prev.redacted, clean.redacted) } : {}
+    } : clean;
+  }
+  const pathOnly = union(report.pathOnly.map((p) => {
+    const r = redactUrl(p);
+    for (const k of new Set(r.kinds)) redacted.push({ where: r.s, kind: k, sample: "replaced" });
+    return r.s;
+  }));
+  return { report: { ...report, endpoints, pathOnly }, redacted };
+}
 function splitKey(key) {
   const sp = key.indexOf(" ");
   const method = key.slice(0, sp);
   const rest = key.slice(sp + 1);
-  const m = rest.match(/^(https?:\/\/[^/]+)(\/.*)?$/);
+  const m = rest.split("#")[0].match(/^(https?:\/\/[^/]+)(\/.*)?$/);
   return { method, origin: m ? m[1] : "", path: m?.[2] || "/" };
 }
 function pascal(s) {
@@ -12284,7 +12858,7 @@ function functionNameFor(method, p, res, kind) {
 function buildApiMap(report) {
   const used = /* @__PURE__ */ new Map();
   const endpoints = Object.entries(report.endpoints).map(([key, ep]) => ({ key, ep, ...splitKey(key) })).sort((a, b) => a.path === b.path ? a.method.localeCompare(b.method) : a.path.localeCompare(b.path)).map(({ ep, method, origin, path: p }) => {
-    let fn = functionNameFor(method, p, ep.res, ep.kind);
+    let fn = ep.next?.name || (ep.next ? "action" + (pascal(p.split("/").filter((x) => x && !x.startsWith("{")).slice(-2).join(" ")) || "Root") : functionNameFor(method, p, ep.res, ep.kind));
     const n = used.get(fn) ?? 0;
     used.set(fn, n + 1);
     if (n) fn += n + 1;
@@ -12300,18 +12874,42 @@ function buildApiMap(report) {
       authHeaders: ep.auth,
       request: ep.req,
       response: ep.res,
-      functionName: fn
+      functionName: fn,
+      ...ep.redacted?.length ? { privateValues: ep.redacted } : {},
+      ...(ep.headers || []).includes("rsc") || (ep.query || []).includes("_rsc") ? { rsc: true } : {},
+      ...ep.next ? { action: { name: ep.next.name, id: ep.next.action } } : {}
     };
   });
   return {
     origin: report.origin,
     capturedAt: report.capturedAt,
     coverage: report.coverage,
+    identity: {
+      cookies: report.auth?.cookies ?? "browser session (sent automatically, HttpOnly included)",
+      headers: Object.entries(report.auth?.headers ?? {}).map(([name, src]) => ({ name, source: describeAuthSource(src) }))
+    },
     replay: "in-page only: load the kit, then the client, and call window.__ifkApi.<fn>() through the agent's evaluate tool. HttpOnly cookies never leave the browser, so the same calls fail from curl.",
     endpoints,
     pathOnly: report.pathOnly
   };
 }
+function describeAuthSource(s) {
+  const pre = s.prefix ? ` with "${s.prefix.trim()} " prefix` : "";
+  if (s.from === "memory") return `kept in page memory${pre}; __ifk.call reuses it after the site sends it once`;
+  const at = s.path?.length ? `${s.key} -> ${s.path.join(".")}` : s.key;
+  return `${s.from}["${at}"]${pre}; __ifk.call attaches it automatically`;
+}
+function pathParams(p) {
+  const used = /* @__PURE__ */ new Set();
+  return (p.match(/\{([^}]+)\}/g) || []).map((m) => {
+    let base = m.slice(1, -1).replace(/[^A-Za-z0-9_$]/g, "_");
+    if (!/^[A-Za-z_$]/.test(base)) base = "p_" + base;
+    let name = base, n = 2;
+    while (used.has(name)) name = `${base}${n++}`;
+    used.add(name);
+    return name;
+  });
+}
 function takesBody(ep) {
   return ep.request !== void 0 || ep.method === "POST" || ep.method === "PUT" || ep.method === "PATCH";
 }
@@ -12327,6 +12925,10 @@ function renderClient(map) {
   lines.push(`    if (!window.__ifk) return Promise.resolve({ error: "NOT_INSTALLED: eval(sessionStorage.__ifk) first" });`);
   lines.push(`    return window.__ifk.call(m, p, o);`);
   lines.push(`  }`);
+  lines.push(`  function a(name, args, o) {`);
+  lines.push(`    if (!window.__ifk) return Promise.resolve({ error: "NOT_INSTALLED: eval(sessionStorage.__ifk) first" });`);
+  lines.push(`    return window.__ifk.action(name, args, o);`);
+  lines.push(`  }`);
   lines.push(`  function q(query) {`);
   lines.push(`    if (!query) return "";`);
   lines.push(`    var s = new URLSearchParams(query).toString();`);
@@ -12342,17 +12944,20 @@ function renderClient(map) {
       skipped.push(`${ep.method} ${ep.origin}${ep.path} (cross-origin)`);
       continue;
     }
-    let ids = 0;
-    const params = [];
-    const urlExpr = JSON.stringify(ep.path).replace(/\{id\}/g, () => {
-      const name = ids++ === 0 ? "id" : `id${ids}`;
-      params.push(name);
-      return `" + encodeURIComponent(${name}) + "`;
-    }).replace(/ \+ ""$/, "").replace(/^"" \+ /, "");
+    if (ep.action) {
+      const ref = JSON.stringify(ep.action.name || ep.action.id);
+      lines.push(`    // Next.js Server Action at ${ep.path}. args: array of the action's arguments. Needs {approved:true}.`);
+      lines.push(`    ${ep.functionName}: function (args, opts) { return a(${ref}, args, opts); },`);
+      continue;
+    }
+    const params = pathParams(ep.path);
+    let i = 0;
+    const urlExpr = JSON.stringify(ep.path).replace(/\{[^}]+\}/g, () => `" + encodeURIComponent(${params[i++]}) + "`).replace(/ \+ ""$/, "").replace(/^"" \+ /, "");
     const hasBody = takesBody(ep);
     if (hasBody) params.push("body");
     params.push("query", "opts");
-    const optsExpr = hasBody ? `Object.assign({ json: body }, opts)` : `opts`;
+    const base = [hasBody ? "json: body" : "", ep.rsc ? "rsc: true" : ""].filter(Boolean).join(", ");
+    const optsExpr = base ? `Object.assign({ ${base} }, opts)` : `opts`;
     const doc = [
       ep.query.length ? `query: ${ep.query.join(", ")}` : "",
       ep.status.length ? `seen ${ep.status.join("/")}` : ""
@@ -12387,11 +12992,18 @@ ${indent}}`;
 function renderTypes(map) {
   const out = [`// Generated by \`iframer ingest\` from ${map.origin}. Shapes come from one sample each: fields may be optional.`];
   out.push(`type IfkResult<T> = Promise<{ status?: number; data?: T; text?: string; truncated?: number; error?: string; stopped?: string }>;`);
-  out.push(`type IfkOpts = { approved?: boolean; headers?: Record<string, string>; maxBytes?: number };`);
+  out.push(`type IfkOpts = { approved?: boolean; headers?: Record<string, string>; maxBytes?: number; full?: boolean; rsc?: boolean; auth?: boolean };`);
   out.push(`interface IfkApi {`);
   for (const ep of map.endpoints) {
     if (ep.kind === "ws" || ep.kind === "sse" || ep.kind === "beacon" || ep.origin !== map.origin) continue;
-    const ids = (ep.path.match(/\{id\}/g) || []).map((_, i) => `${i ? `id${i + 1}` : "id"}: string | number`);
+    if (ep.action) {
+      const args2 = ep.request?.json !== void 0 ? tsType(ep.request.json, "  ") : "unknown[]";
+      const r = ep.response?.rsc?.action;
+      out.push(`  /** Next.js Server Action ${ep.action.name || ep.action.id.slice(0, 8)} at ${ep.path} */`);
+      out.push(`  ${ep.functionName}(args: ${args2}, opts?: IfkOpts): IfkResult<${r !== void 0 ? tsType(r, "  ") : "unknown"}>;`);
+      continue;
+    }
+    const ids = pathParams(ep.path).map((n) => `${n}: string | number`);
     const hasBody = takesBody(ep);
     const req = ep.request?.json !== void 0 ? tsType(ep.request.json, "  ") : ep.request?.form || ep.request?.multipart ? "Record<string, string>" : "unknown";
     const res = ep.response && typeof ep.response === "object" && !Array.isArray(ep.response) && "contentType" in ep.response && "bytes" in ep.response ? "unknown" : tsType(ep.response, "  ");
@@ -12415,14 +13027,14 @@ function shortShape(s, depth = 0) {
   return "?";
 }
 function describeEndpoint(ep) {
-  const parts = [ep.kind, ep.status.length ? `status ${ep.status.join("/")}` : ""];
+  const parts = [ep.action ? `Next.js Server Action ${ep.action.name || ep.action.id.slice(0, 8)}` : ep.kind, ep.rsc ? "RSC (page data)" : "", ep.status.length ? `status ${ep.status.join("/")}` : ""];
   if (ep.request?.json !== void 0) parts.push(`body ${shortShape(ep.request.json)}`);
   else if (ep.request?.form) parts.push(`form ${Object.keys(ep.request.form).join(",")}`);
   if (ep.response !== void 0) parts.push(`returns ${shortShape(ep.response)}`);
   if (ep.authHeaders.length) parts.push(`auth ${ep.authHeaders.join(",")}`);
   return parts.filter(Boolean).join("; ");
 }
-var import_fs11, import_os4, import_path12, CaptureError, TYPE_NAMES, DETECTORS, VERB;
+var import_fs11, import_os4, import_path12, CaptureError, TYPE_NAMES, DETECTORS, PLACEHOLDER, union, VERB;
 var init_capture = __esm({
   "src/lib/kit/capture.ts"() {
     "use strict";
@@ -12439,6 +13051,8 @@ var init_capture = __esm({
       ["phone", /\+?\d[\d ().-]{8,}\d/],
       ["token", /(?=[A-Za-z0-9_\-.]*\d)(?=[A-Za-z0-9_\-.]*[A-Za-z])^[A-Za-z0-9_\-.]{24,}$/]
     ];
+    PLACEHOLDER = "{id}";
+    union = (a = [], b = []) => [.../* @__PURE__ */ new Set([...a, ...b])];
     VERB = { GET: "get", HEAD: "head", POST: "create", PUT: "update", PATCH: "update", DELETE: "delete" };
   }
 });
@@ -12449,6 +13063,7 @@ __export(kit_exports, {
   CaptureError: () => CaptureError,
   KIT_TARGETS: () => KIT_TARGETS,
   buildApiMap: () => buildApiMap,
+  describeAuthSource: () => describeAuthSource,
   describeEndpoint: () => describeEndpoint,
   downloadDirs: () => downloadDirs,
   findLatestCapture: () => findLatestCapture,
@@ -12456,6 +13071,7 @@ __export(kit_exports, {
   kitInstructions: () => kitInstructions,
   kitSource: () => kitSource,
   parseCapture: () => parseCapture,
+  redactCapture: () => redactCapture,
   renderClient: () => renderClient,
   renderTypes: () => renderTypes,
   scanCapture: () => scanCapture,
@@ -12467,7 +13083,9 @@ function kitSource(opts = {}) {
   if (opts.hostFilter) clean.hostFilter = opts.hostFilter;
   if (opts.maxBody) clean.maxBody = opts.maxBody;
   if (opts.maxCalls) clean.maxCalls = opts.maxCalls;
-  return `(${pageKit.toString()})(${JSON.stringify(clean)});
+  const fn = pageKit.toString();
+  const build = import_crypto13.default.createHash("sha1").update(fn).digest("hex").slice(0, 10);
+  return `(${fn})(${JSON.stringify({ ...clean, build })});
 `;
 }
 function kitDir() {
@@ -12484,6 +13102,7 @@ function kitInstructions(target, kitPath, clientPath) {
     `Rules:`,
     `- After EVERY full page load, run \`${INSTALL}\` again. It restores what was captured. Check with \`${STATUS}\`.`,
     `- Drive the site with your normal tools while it records. Only shapes are kept, never values.`,
+    `- Next.js sites: page data comes back from \`window.__ifk.call('GET','/path',{rsc:true})\` as {components:{Name:props}}. Server Actions: \`window.__ifk.action('exportName',[args],{approved:true})\` (the id is looked up again after deploys).`,
     `- Replay: \`window.__ifk.call('GET','/path')\` runs in the page with the user's cookies. Writes need {approved:true}, so ask the user first. It stops on 403, 429 or a captcha page: do not retry.`,
     `- Coverage is never complete: workers, redirect hops, HttpOnly cookies and cross-origin iframes are invisible to the kit.`,
     `- Done: \`window.__ifk.stop()\` removes the hooks.`
@@ -12552,10 +13171,11 @@ function drainFallback() {
     `until next is null, write the joined chunks to a file, then \`iframer ingest <file>\`.`
   ].join("\n");
 }
-var import_fs12, import_path13, KIT_TARGETS, MAKE_INPUT, SS, stash, STASH, INSTALL, INSTALL_CLIENT, STATUS;
+var import_crypto13, import_fs12, import_path13, KIT_TARGETS, MAKE_INPUT, SS, stash, STASH, INSTALL, INSTALL_CLIENT, STATUS;
 var init_kit = __esm({
   "src/lib/kit/index.ts"() {
     "use strict";
+    import_crypto13 = __toESM(require("crypto"));
     import_fs12 = __toESM(require("fs"));
     import_path13 = __toESM(require("path"));
     init_paths();
@@ -13662,6 +14282,14 @@ Screenshot: ${shot}`);
       break;
     }
     // ─── In-page capture kit (any agent browser, T3 Code first) ─────
+    case "refresh": {
+      const kit = await Promise.resolve().then(() => (init_kit(), kit_exports));
+      const kitPath = kit.writeKit({});
+      const skill = installSkill();
+      console.log(`  Kit: ${kitPath}`);
+      console.log(skill ? "  Skill: ~/.claude/commands/iframer.md" : "  Skill: not found in the package, skipped");
+      break;
+    }
     case "kit": {
       const kit = await Promise.resolve().then(() => (init_kit(), kit_exports));
       const target = parseFlag(args, "--for") || "t3";
@@ -13704,6 +14332,7 @@ Screenshot: ${shot}`);
         console.error("    --typed              Also write client.d.ts");
         console.error("    --keep               Keep the capture file (default: deleted after ingest)");
         console.error("    --no-knowledge       Don't update ~/.iframer/knowledge");
+        console.error("    --strict             Refuse the capture on any secret-looking value instead of replacing it");
         console.error("    --json               One-line JSON summary");
         process.exit(1);
       }
@@ -13723,6 +14352,8 @@ Screenshot: ${shot}`);
         console.error(`  ${e.message}`);
         process.exit(1);
       }
+      let redacted = [];
+      if (!hasFlag(args, "--strict")) ({ report, redacted } = kit.redactCapture(report));
       const findings = kit.scanCapture(report);
       if (findings.length) {
         removeInput();
@@ -13764,16 +14395,23 @@ Screenshot: ${shot}`);
           })),
           notes: [
             `In-page capture: ${c2.seen} seen, ${c2.withPayload} with payload, ${c2.pathOnly} path only. Not complete: ${c2.blindSpots.join(", ")}.`,
-            "Replay in the page (window.__ifk.call): HttpOnly cookies never leave the browser."
+            "Replay in the page (window.__ifk.call): HttpOnly cookies never leave the browser.",
+            ...map.identity.headers.map((h) => `Auth header ${h.name}: ${h.source}.`),
+            ...redacted.length ? [`Private values replaced with placeholders in ${new Set(redacted.map((r) => r.where)).size} endpoint(s); see privateValues in api.json and pass them per call.`] : []
           ]
         });
       }
       removeInput();
       const c = report.coverage;
       if (json) {
-        console.log(JSON.stringify({ ok: true, origin: report.origin, endpoints: map.endpoints.length, coverage: { seen: c.seen, withPayload: c.withPayload, pathOnly: c.pathOnly }, files: written, inputDeleted: !fromStdin && !hasFlag(args, "--keep") }));
+        console.log(JSON.stringify({ ok: true, origin: report.origin, endpoints: map.endpoints.length, coverage: { seen: c.seen, withPayload: c.withPayload, pathOnly: c.pathOnly }, redacted: redacted.map((r) => ({ kind: r.kind, at: r.where })), files: written, inputDeleted: !fromStdin && !hasFlag(args, "--keep") }));
       } else {
         console.log(`  ${report.origin}: ${map.endpoints.length} endpoints (${c.withPayload} with payload, ${c.pathOnly} path only). Not complete.`);
+        for (const h of map.identity.headers) console.log(`  Identity: ${h.name} <- ${h.source}`);
+        if (redacted.length) {
+          console.log(`  Replaced ${redacted.length} secret-looking value(s) with placeholders ({id}, {key}, "string"):`);
+          for (const r of redacted.slice(0, 10)) console.log(`    ${r.kind} at ${r.where}`);
+        }
         for (const e of map.endpoints.slice(0, 40)) console.log(`    ${e.method.padEnd(6)} ${e.origin === map.origin ? e.path : e.origin + e.path}  -> ${e.functionName}`);
         if (map.endpoints.length > 40) console.log(`    \u2026 ${map.endpoints.length - 40} more in api.json`);
         console.log(`  Wrote: ${written.join(", ")}`);
@@ -14004,6 +14642,11 @@ Screenshot: ${shot}`);
         console.error("    sudo npm install -g iframer-toolkit@latest");
         process.exit(1);
       }
+      try {
+        require("child_process").execSync("iframer refresh", { stdio: "inherit" });
+      } catch {
+        console.error("  Could not refresh the kit and skill. Run: iframer refresh");
+      }
       console.log();
       const hasExt = extensionInstalled();
       await reloadAndRestartServer(hasExt);
@@ -14082,6 +14725,7 @@ Screenshot: ${shot}`);
       --out <dir>                   Output directory (default: ./<host>-api/)
       --keep                        Keep the capture file (default: deleted)
       --no-knowledge                Don't update ~/.iframer/knowledge
+      --strict                      Refuse on any secret-looking value instead of replacing it
       --json                        One-line JSON summary
 
   Session:
@@ -14126,6 +14770,7 @@ Screenshot: ${shot}`);
     extension path                  Print the extension folder to load in chrome://extensions
     extension token                 Print the pairing token (only needed to pair by hand)
     update                        Update iframer via npm; reload the extension too if it's installed
+    refresh                       Rewrite the in-page kit and the /iframer skill from this version (update does it)
     update --check                  Report whether a newer version is available (no install)
     version, --version, -v          Print the installed version
     remove                          Remove everything (Chromium + MCP)

package/extension/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "iframer",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Let iframer drive a Chrome tab you choose, on your real logged-in session.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp2wbce98k+xDnEgtuzLyNXYBLEDY0nqChuvolb94B3VV1HsHFUulUyNe92eN6MjQuadDohQ2j5mj7zWs4yQoixgTQPe7Gm/+GHWdgxwM2s9t5opnLHwF90LPiJm6q1NGWLM4aK6JT+2I6FnUGmj2bzB4WIlf55C3aMEBoXTqIzG2U8s2cxkXGebWWqbPlMK/Phsmsvo4POWnidbGHPhBOq0iyPTu7RdSDlNdJdJ+dtdNXkMmltKUS881MQI9T6GcCCKhIKcZrJGGnk0xphlWyl+ublTAO0tbQSVB/K7D3JmCxMv690TPtYUPPhGi+C6VCv3IeutLmNo60mvux3wbGQIDAQAB",
   "permissions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iframer-toolkit",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Browser access toolkit for AI agents — CLI and MCP server for headless/headful browsing, login flows, and pipeline execution.",
   "keywords": [
     "iframer",

package/skills/iframer.md

@@ -182,7 +182,10 @@ When you already drive a browser through your own tools (a T3 Code preview tab,
 - Writes need `{approved:true}`: ask the user first. Replays stop for good on 403, 429 or a captcha page. Do not retry or work around it.
 - Sites that detect tampering: `iframer kit --mode passive` (no patching; URLs and form posts only).
 - Report coverage as the kit states it. It is never complete: workers, redirect hops and cross-origin iframes are invisible.
-- `ingest` refuses (exit 2) if anything value-like slipped into the capture. Don't edit the file to force it through; tell the user what was found.
+- Next.js sites: route segments come out named (`/{communitySlug}/...`) from the app's own route data. Page data: `window.__ifk.call('GET', path, {rsc:true})` (the generated client sets it) returns `{components: {Name: props}}`, not HTML. Server Actions: `window.__ifk.action('exportName', [args], {approved:true})`, or the client function of the same name. If a result is big you get its shape: pass `{full:true}` and pick fields in the same evaluate.
+- After `iframer update`, the kit file is rewritten. Installing it in a tab that still runs an older kit replaces it and keeps the capture.
+- Private values are separated from the API, not a reason to stop. `ingest` swaps anything token-, email- or phone-like for a placeholder (`{id}` in paths, `{key}` for keys) and lists what it replaced. Endpoints that had one carry `privateValues` in api.json: pass that value per call.
+- Identity: api.json `identity` (and the knowledge file) says which auth headers the site sends and where the page keeps each value, e.g. `localStorage["session -> user.token"]`. `__ifk.call` attaches them on its own, cookies included. If a call returns 401 with a `hint`, use the site once so it sends its token, then retry.
 
 ### Handle captchas