lazycodex-ai 5.0.0-beta.62 → 5.0.0-beta.64

package/packages/shared-skills/skills/ultimate-browsing/engine/tests/test_playwright_stealth.py

@@ -0,0 +1,86 @@
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+from test_playwright_templates import (
+    TEMPLATE_NAMES,
+    TEMPLATES_DIR,
+    _install_fake_playwright,
+    _write_file,
+)
+
+
+class PlaywrightTemplateStealth(unittest.TestCase):
+    def test_extracts_html_and_closes_wrapped_chrome_when_stealth_is_installed(self) -> None:
+        for template_name in TEMPLATE_NAMES:
+            with self.subTest(template_name=template_name), tempfile.TemporaryDirectory() as tmp:
+                # Given: core has no plugin API; only addExtra supplies a registered wrapper.
+                root = Path(tmp)
+                modules = root / "node_modules"
+                profile = root / "profile"
+                receipt = root / "launch.json"
+                _install_fake_playwright(modules)
+                _write_file(modules / "puppeteer-extra-plugin-stealth/index.js", """
+                    module.exports = () => ({ name: 'stealth' });
+                """)
+                _write_file(modules / "playwright-extra/index.js", """
+                    const assert = require('node:assert/strict');
+                    const fs = require('node:fs');
+                    exports.addExtra = (core) => {
+                      assert.equal(core, require('playwright-core').chromium);
+                      assert.equal(Object.hasOwn(core, 'use'), false);
+                      const events = ['wrap'];
+                      let registered = false;
+                      return {
+                        use(plugin) {
+                          assert.equal(plugin.name, 'stealth');
+                          registered = true;
+                          events.push(plugin.name);
+                        },
+                        async launchPersistentContext(profileDir, options) {
+                          assert.equal(registered, true);
+                          events.push({ profileDir, channel: options.channel, viewport: options.viewport });
+                          const context = await core.launchPersistentContext(profileDir, options);
+                          return {
+                            ...context,
+                            async close() {
+                              await context.close();
+                              events.push('close');
+                              fs.writeFileSync(process.env.STEALTH_RECEIPT, JSON.stringify(events));
+                            },
+                          };
+                        },
+                      };
+                    };
+                """)
+                script = root / template_name
+                script.write_bytes((TEMPLATES_DIR / template_name).read_bytes())
+                env = {key: value for key, value in os.environ.items() if key != "NODE_PATH"}
+                env["STEALTH_RECEIPT"] = str(receipt)
+
+                # When: the actual bundled entry point consumes its normal stdin protocol.
+                result = subprocess.run(
+                    ["node", str(script)],
+                    input=json.dumps({"url": "https://example.com/", "profileDir": str(profile), "headless": True}),
+                    text=True, capture_output=True, timeout=5, env=env, check=False,
+                )
+
+                # Then: HTML arrives through the registered wrapper and the context is closed.
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertEqual(result.stdout, "<html><article>ok</article></html>")
+                self.assertEqual(result.stderr, "")
+                viewport = {"width": 390, "height": 844} if "mobile" in template_name else {"width": 1366, "height": 900}
+                self.assertEqual(json.loads(receipt.read_text(encoding="utf-8")), [
+                    "wrap", "stealth",
+                    {"profileDir": str(profile), "channel": "chrome", "viewport": viewport},
+                    "close",
+                ])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/packages/shared-skills/skills/ultimate-browsing/engine/tests/test_playwright_templates.py

@@ -21,7 +21,7 @@ def _write_file(path: Path, content: str) -> None:
 
 def _install_fake_playwright(node_modules: Path) -> None:
     _write_file(
-        node_modules / "playwright" / "index.js",
+        node_modules / "playwright-core" / "index.js",
         """
         const page = {
           async goto() {},
@@ -47,7 +47,6 @@ def _install_fake_playwright(node_modules: Path) -> None:
         };
 
         exports.chromium = {
-          use() {},
           async launchPersistentContext() { return context; },
         };
         exports.devices = {
@@ -78,9 +77,7 @@ def _install_working_playwright_extra(node_modules: Path) -> None:
     _write_file(
         node_modules / "playwright-extra" / "index.js",
         """
-        const playwright = require('playwright');
-        exports.chromium = playwright.chromium;
-        exports.devices = playwright.devices;
+        exports.addExtra = (browserType) => browserType;
         """,
     )
 
@@ -149,7 +146,7 @@ def _run_template(
 
 @unittest.skipUnless(shutil.which("node"), "node is required for Playwright template tests")
 class PlaywrightTemplateErrorHandling(unittest.TestCase):
-    def test_missing_playwright_extra_warns_and_falls_back_to_plain_playwright(self) -> None:
+    def test_missing_playwright_extra_warns_and_falls_back_to_playwright_core(self) -> None:
         for template_name in TEMPLATE_NAMES:
             with self.subTest(template_name=template_name):
                 result = _run_template(
@@ -166,7 +163,7 @@ class PlaywrightTemplateErrorHandling(unittest.TestCase):
                 self.assertIn("best-effort optional module playwright-extra failed:", result.stderr)
                 self.assertIn("Cannot find module 'playwright-extra'", result.stderr)
 
-    def test_missing_stealth_plugin_warns_and_falls_back_to_plain_playwright(self) -> None:
+    def test_missing_stealth_plugin_warns_and_falls_back_to_playwright_core(self) -> None:
         for template_name in TEMPLATE_NAMES:
             with self.subTest(template_name=template_name):
                 result = _run_template(

package/packages/shared-skills/skills/ultimate-browsing/references/chrome-stealth.md

@@ -1,127 +1,113 @@
-# Tier 2 — Chrome stealth (CloakBrowser + agent-browser)
+# Tier 2 — Chrome stealth through playwright-core scripts
 
-Real interaction (clicks, forms, screenshots, video, persistent login) for pages that defeat Tier 1/1.5. Two runtime tools, both installed on demand — neither is vendored in this skill:
-
-- **CloakBrowser** (`pip`) — stealth Chromium with source-level C++ fingerprint patches. The Python wrapper source is MIT; the downloaded Chromium binary is covered by CloakBrowser's separate binary license and is not redistributed by this package. Passes Cloudflare Turnstile, FingerprintJS, BrowserScan, and 30+ detectors. Pin **0.5.7**.
-- **agent-browser** (`npm`, Apache-2.0) — native CDP automation CLI that drives CloakBrowser. AX-tree snapshots, `@eN` refs, click/fill/type/scroll, screenshots, video, cookie/state/session management. Pin **0.34.0**.
-
-```
-CloakBrowser (stealth Chromium) <- CDP port 9242 -> agent-browser CLI
-  - 57 C++ fingerprint patches                  - AX-tree snapshots, @eN refs
-  - Canvas/WebGL consistency                    - click / fill / type / scroll
-  - navigator.webdriver = false at C++ source   - screenshot, video record
-  - Humanize mode (mouse curves, timing)        - cookie / state / session mgmt
-```
+For real-Chrome semantics, stealth, traces, or authenticated sessions, WRITE a
+script and run it from the js-eval kernel. Use installed local Chrome, not a
+managed browser download. Ordinary macOS captures on a Bun >= 1.4 kernel use
+`new Bun.WebView()`; Linux/Windows WebView needs installed Chrome/Chromium/Edge.
+Codex's ordinary browser surface is `browser:control-in-app-browser`.
 
 ## Install (one-time)
 
-CloakBrowser runs in a dedicated Python venv. Cross-platform: macOS, Linux, and Windows all supported by both tools (use the venv path convention for your OS).
-
-The venv lives at a fixed path so every session reuses one stealth-Chromium download instead of creating a new venv per working directory, and every command below calls its interpreter by absolute path — no `activate` step to forget.
-
-```bash
-# CloakBrowser (MIT wrapper source; separate binary license, pin 0.5.7):
-VENV="$HOME/.agents/cloak-venv"          # Windows: %USERPROFILE%\.agents\cloak-venv
-uv venv "$VENV" --python 3.13
-uv pip install --python "$VENV/bin/python" "cloakbrowser==0.5.7"
-"$VENV/bin/python" -c "import cloakbrowser; cloakbrowser.ensure_binary()"   # downloads stealth Chromium on first import
+Only the user installs these script dependencies, once in the skill's engine
+directory. Stealth plugins run inside scripts, never inside WebView:
 
-# agent-browser (Apache-2.0, pin 0.34.0):
-bun add -g agent-browser@0.34.0 && agent-browser install
-agent-browser --version   # 0.34.0
+```sh
+cd "$SKILL_DIR/engine"
+test -f package.json || cp templates/package.json package.json
+bun add playwright-core@1.62.1 playwright-extra@4.3.6 puppeteer-extra-plugin-stealth@2.11.2
 ```
 
-Verify CloakBrowser:
-
-```bash
-"$VENV/bin/python" -c "import cloakbrowser; print(cloakbrowser.__version__, cloakbrowser.CHROMIUM_VERSION, cloakbrowser.binary_info()['installed'])"
-# -> 0.5.7  <chromium-version>  True
-```
+Chrome must already be installed. The bundled `templates/playwright_real_chrome.js`
+and `templates/playwright_mobile_chrome.js` resolve these dependencies from their
+parent engine directory. Without optional plugins, templates report the fallback
+and use plain `playwright-core`; do not call that fallback stealth.
 
 ## Launch + drive
 
-NEVER clear cookies, cache, or site data (`Network.clearBrowserCookies`, `Storage.clearCookies`, `chrome.browsingData.remove`, "clear browsing data") on the user's real/main browser profile — it wipes their logged-in state everywhere. If you need that profile's login state, clone it first (`rsync -a <profile>/ <tmp-clone>/`) and launch with the clone as the user-data-dir; run any clearing on the clone only.
-
-```bash
-# 1. Launch CloakBrowser with CDP on :9242 (background). cloakbrowser lives only in the venv,
-#    so call its interpreter by absolute path — this works in any shell, activated or not:
-"$HOME/.agents/cloak-venv/bin/python" -c "import asyncio,cloakbrowser; asyncio.run(cloakbrowser.launch_async(headless=False, stealth_args=True, args=['--remote-debugging-port=9242']))" &
-
-# 2. CloakBrowser launches tabless -> agent-browser would say "No page found".
-#    Open the first tab via CDP before any agent-browser command:
-curl -s -X PUT "http://127.0.0.1:9242/json/new?https://example.com"
-
-# 3. Connect agent-browser. CloakBrowser already patches navigator.webdriver=false at the
-#    C++ source, so NO --init-script is required — only --user-agent to hide HeadlessChrome:
-agent-browser --cdp 9242 \
-  --user-agent "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.177 Safari/537.36" \
-  open https://example.com
-
-# 4. Interact:
-agent-browser --cdp 9242 snapshot -i        # interactive elements (@eN refs)
-agent-browser --cdp 9242 click @e3
-agent-browser --cdp 9242 screenshot out.png
-
-# 5. Close when done:
-agent-browser --cdp 9242 close
+Close the source browser before cloning its user-data directory for a consistent
+copy. Preserve its `Local State` alongside the selected profile. Use a private,
+task-owned clone, never the live user-data-dir. NEVER clear the live profile's
+cookies, cache, or site data. For unauthenticated QA, use a fresh task-owned profile.
+
+Write `capture.cjs` in the engine directory. `clonePath`, URL, and output path are
+arguments owned by this QA run; keep cookie values out of argv and logs:
+
+```js
+const { chromium: core } = require('playwright-core');
+const { addExtra } = require('playwright-extra');
+const stealth = require('puppeteer-extra-plugin-stealth');
+const [clonePath, url, pngPath] = process.argv.slice(2);
+const chromium = addExtra(core);
+chromium.use(stealth());
+
+async function capture() {
+  const context = await chromium.launchPersistentContext(clonePath, {
+    channel: 'chrome',
+    headless: true,
+    args: ['--disable-blink-features=AutomationControlled'],
+    ignoreDefaultArgs: ['--enable-automation'],
+    viewport: { width: 1280, height: 720 },
+  });
+  try {
+    const page = await context.newPage();
+    await page.goto(url, { waitUntil: 'load', timeout: 30000 });
+    await page.screenshot({ path: pngPath });
+    console.log(JSON.stringify({ pngPath, webdriver: await page.evaluate(() => navigator.webdriver) }));
+  } finally {
+    await context.close();
+  }
+}
+capture().catch((error) => { console.error(error); process.exitCode = 1; });
 ```
 
-agent-browser ships its own always-version-matched usage guide — load it instead of guessing flags:
+Run the script from js eval with a bounded process lifetime:
 
-```bash
-agent-browser skills get core            # core workflows, patterns, troubleshooting
-agent-browser skills get core --full     # + full command reference and templates
-agent-browser skills get electron        # Electron apps (VS Code, Slack, Discord, Figma, ...)
-agent-browser skills list                # everything available on the installed version
+```js
+const { promisify } = await import('node:util')
+const { execFile } = await import('node:child_process')
+const result = await promisify(execFile)('node', [scriptPath, clonePath, url, pngPath], { timeout: 45000 })
+console.log(result.stdout)
 ```
 
-## Verify stealth
-
-```bash
-agent-browser --cdp 9242 eval 'navigator.webdriver'   # must print false
-```
+For extraction, run a bundled template the same way, supplying its JSON input on
+stdin (`url`, `profileDir: clonePath`, `waitSelector`, `headless`). The template
+returns HTML on stdout. For traces, use `context.tracing.start()` before navigation
+and `context.tracing.stop({ path: tracePath })` before closing. Use `headless: false`
+only with an available display when headed behavior is the criterion.
 
-Verified 2026-07 with CloakBrowser 0.5.7 + agent-browser 0.34.0: `navigator.webdriver` reads the boolean false with no init-script, bot.sannysoft.com all-green, browserscan.net "Normal" (15/15), nowsecure.nl Turnstile bypassed.
+## Verify stealth
 
-> **agent-browser 0.33.x behavior note:** the daemon now defaults to a 1-hour idle timeout (saves restore state, closes the browser, exits after 1 h of no commands). Set `AGENT_BROWSER_IDLE_TIMEOUT_MS=0` to restore the old always-persist behavior. External WebSocket stream consumers see latest-wins frame delivery; `record` (CDP) and the dashboard are unaffected.
+Inspect the page, screenshot, and requested content. `navigator.webdriver === false`
+checks one browser property, NOT a promise to pass a detector or challenge.
+Persistent challenge pages or missing content are failures, even if the script
+exits zero. Do not keep retrying or silently swap browser tooling.
 
 ## Cookie login (cross-platform)
 
-`scripts/extract_cookies.py` reads cookies from a local browser profile and optionally injects them into the running CDP session. Profile-path resolution and value decryption are per-OS:
+`scripts/extract_cookies.py` exports local-browser cookies with owner-only `0600`
+permissions. Keep exports private and never commit them. For a persistent context,
+load the exported cookies with `context.addCookies(...)`, then navigate/reload.
+Browser- or device-bound login tokens may not transfer to a clone.
 
-| OS | Profile location | Cookie value decryption |
-|----|------------------|--------------------------|
-| macOS | `~/Library/Application Support/<app>/` | Keychain (AES-128-CBC, PBKDF2 salt `saltysalt`) |
-| Linux | `~/.config/<app>/` (Chromium), `~/.mozilla/firefox/` (Firefox) | libsecret/SecretService, then PBKDF2 + AES-128-CBC |
-| Windows | `%LOCALAPPDATA%\<app>\User Data\` | DPAPI (`CryptUnprotectData`) + AES-256-GCM (`os_crypt` key) |
-
-```bash
-# Extract to a file:
-mkdir -p ~/.local/state/omo-cookies
-python3 ../scripts/extract_cookies.py --browser chrome --domain youtube.com --output ~/.local/state/omo-cookies/youtube.cookies.json
-# Extract and inject into the running CDP session:
-python3 ../scripts/extract_cookies.py --browser chrome --domain youtube.com --inject --cdp 9242
-```
-
-Cookie export files are written with owner-only `0600` permissions. Do not place live auth cookies in shared temp directories or commit them to a repo. Cookie injection sends values to CDP over stdin rather than argv, so live cookie values do not appear in process listings. Cookies apply on next navigation — reload after injecting. Google services use fingerprint-bound tokens (SIDTS) that may not transfer across browser profiles. Firefox-family profiles store cookies unencrypted; Chromium-family profiles trigger a one-time OS-keyring prompt on macOS/Linux.
+The helper's `--inject --cdp <port>` targets a task-owned local Chrome CDP endpoint,
+which a script can also use via `chromium.connectOverCDP(...)`. Expose CDP on
+loopback only, never against the live profile. Values travel on stdin, not argv.
 
 ## Anti-patterns
 
-- Do NOT launch CloakBrowser for plain text extraction — use Tier 1.
-- Do NOT pass an `--init-script` for the webdriver flag — CloakBrowser already patches it at source; the only required override is `--user-agent`.
-- Do NOT run agent-browser before creating the first tab via `curl -X PUT .../json/new` — CloakBrowser launches tabless.
-- Do NOT use vanilla Chrome when stealth is needed — always CloakBrowser.
-- Do NOT forget to `close` the session when done.
-- Do NOT inject cookies without reloading the page.
+- Plain text extraction does not need a stealth browser: use the extraction lane.
+- Never launch against, clear, or delete the user's live profile.
+- Never claim stealth from successful startup alone; validate rendered content.
+- Never run plugins without explicit user-installed script dependencies.
 
 ## Troubleshooting
 
-```bash
-# Port 9242 already in use (macOS/Linux):
-lsof -ti:9242 | xargs kill -9
-# agent-browser can't connect:
-curl -s http://127.0.0.1:9242/json/version | head -5   # empty -> CloakBrowser not running
-# Update either tool:
-uv pip install --python "$HOME/.agents/cloak-venv/bin/python" --upgrade "cloakbrowser==0.5.7" && "$HOME/.agents/cloak-venv/bin/python" -c "import cloakbrowser; cloakbrowser.ensure_binary()"
-bun add -g agent-browser@0.34.0
-```
+A missing Chrome executable is a prerequisite failure: report it, do not download
+a replacement. Missing plugins require the one-time setup above; module errors
+inside installed plugins are real failures, not optional-dependency misses.
+A locked profile usually means the source was not cloned or another run owns the
+clone. Use a new task-owned clone instead of killing unrelated browsers.
+
+Always close contexts in `finally`, stop the fixture server, and remove only this
+run's clone and temporary scripts. Preserve requested PNG/trace evidence and record
+the cleanup receipt, including failures.

package/packages/shared-skills/skills/ultimate-browsing/references/insane-search/README.md

@@ -223,11 +223,17 @@ result = fetch(
 python3 -c "import curl_cffi, bs4, yaml" 2>/dev/null || pip install curl_cffi beautifulsoup4 pyyaml -q
 ```
 
-Playwright 로컬 경로 사용 시 Node가 필요:
+브라우저를 직접 제어할 때는 js eval에서 Bun >= 1.4의 `new Bun.WebView()`를
+사용한다(macOS 기본; Linux/Windows는 설치된 Chrome/Chromium/Edge 필요).
+그 외 또는 Chrome 동작·stealth·trace·인증이 필요하면 `playwright-core` 스크립트를
+작성해 js eval에서 로컬 Chrome(`channel: "chrome"`)으로 실행한다.
+사용자가 엔진 디렉터리에서 한 번 설치할 스크립트 의존성:
 ```bash
-npm i -g playwright playwright-extra puppeteer-extra-plugin-stealth
-npx playwright install chrome
+cd "$SKILL_DIR/engine"
+test -f package.json || cp templates/package.json package.json
+bun add playwright-core@1.62.1 playwright-extra@4.3.6 puppeteer-extra-plugin-stealth@2.11.2
 ```
+Chrome은 이미 설치되어 있어야 한다. 인증 프로필은 먼저 복제하고 복제본만 사용한다.
 
 ## 빠른 참조 — Phase 0 명령어
 

package/packages/shared-skills/skills/ultimate-browsing/references/insane-search/playwright.md

@@ -16,10 +16,10 @@
 
 ### 의존성
 
-```bash
-claude mcp list 2>/dev/null | grep -q playwright && echo "OK" || echo "NOT CONNECTED"
-claude mcp add playwright -- npx @playwright/mcp@latest
-```
+이 항목은 이미 연결된 MCP를 사용하는 엔진 어댑터의 설명이다.
+새 브라우저 세션은 js eval의 Bun.WebView(Bun >= 1.4, macOS 기본;
+Linux/Windows는 설치된 Chrome/Chromium/Edge 필요), 그 외 또는 Chrome 동작·stealth·trace·인증은
+로컬 Chrome을 제어하는 `playwright-core` 스크립트로 실행한다. MCP를 새로 설치하지 않는다.
 
 ### 기본 워크플로
 
@@ -56,11 +56,11 @@ claude mcp add playwright -- npx @playwright/mcp@latest
 # Node (시스템 설치)
 node -v   # v18+ 권장
 
-# Playwright + stealth 플러그인
-npm i -g playwright playwright-extra puppeteer-extra-plugin-stealth
-
-# 시스템 Chrome 바이너리 (번들 Chromium 아님)
-npx playwright install chrome
+# 사용자가 엔진 디렉터리에서 한 번 설치하는 스크립트 의존성
+cd "$SKILL_DIR/engine"
+test -f package.json || cp templates/package.json package.json
+bun add playwright-core@1.62.1 playwright-extra@4.3.6 puppeteer-extra-plugin-stealth@2.11.2
+# Chrome은 이미 시스템에 설치되어 있어야 한다. 브라우저 다운로드 명령은 없다.
 ```
 
 ### 호출 (engine 내부)
@@ -81,7 +81,8 @@ attempt, html = run_playwright_fallback(
 ### 데스크톱 템플릿 (`playwright_real_chrome.js`)
 
 ```js
-const { chromium } = require('playwright-extra');
+const { addExtra } = require('playwright-extra');
+const chromium = addExtra(require('playwright-core').chromium);
 const stealth = require('puppeteer-extra-plugin-stealth')();
 chromium.use(stealth);
 
@@ -95,7 +96,9 @@ const ctx = await chromium.launchPersistentContext(profileDir, {
 ### 모바일 템플릿 (`playwright_mobile_chrome.js`)
 
 ```js
-const { chromium, devices } = require('playwright-extra');
+const { devices } = require('playwright-core');
+const { addExtra } = require('playwright-extra');
+const chromium = addExtra(require('playwright-core').chromium);
 const iPhone = devices['iPhone 13 Pro'];
 
 const ctx = await chromium.launchPersistentContext(profileDir, {
@@ -126,8 +129,8 @@ const ctx = await chromium.launchPersistentContext(profileDir, {
 
 ## 디버깅 팁
 
-- `profileDir`를 고정 경로로 두면 세션·쿠키가 유지되어 재시도 빠름 (`/tmp/.insane_pw_profile`)
-- Akamai 재시도가 잦으면 `profileDir`를 삭제해 fresh 상태로 리셋
+- 템플릿은 js eval에서 스크립트로 실행한다. `profileDir`는 작업 전용 경로나 사용자 프로필의 복제본만 사용한다.
+- 사용자의 실제 프로필을 실행·초기화·삭제하지 않는다. 작업 종료 시 컨텍스트를 닫고 작업 전용 복제본만 정리한다.
 - 실패 시 `result.trace`의 `error` 필드에 Node stderr 200자가 포함됨
 
 ## 사이트 예시 (독자 이해용, 코드 분기 근거 아님)

package/packages/shared-skills/skills/ultimate-browsing/scripts/extract_cookies.py

@@ -4,7 +4,7 @@
 The OS-keyring lookup is an injected boundary: cookie_paths resolves profile
 paths and cookie_crypto derives keys + decrypts values, both pure and testable
 with synthetic fixtures on any OS. This module wires them to a real browser DB
-and the agent-browser CDP session.
+and a local Chrome CDP session controlled by playwright-core scripts.
 
 Usage:
     python extract_cookies.py --browser chrome --domain youtube.com --output /tmp/cookies.json
@@ -255,7 +255,7 @@ def inject_cookies(cookies: list[CookieRecord], cdp_port: int) -> None:
     if proc.returncode != 0:
         raise RuntimeError((proc.stderr or "CDP cookie injection failed").strip())
     ok = int((proc.stdout or "0").strip() or "0")
-    print(f"Injected {ok}/{len(filtered)} cookies into agent-browser (CDP {cdp_port})")
+    print(f"Injected {ok}/{len(filtered)} cookies into local Chrome (playwright-core CDP {cdp_port})")
 
 
 def main() -> None:
@@ -263,7 +263,7 @@ def main() -> None:
     parser.add_argument("--browser", required=True, choices=sorted(BROWSERS.keys()))
     parser.add_argument("--domain", required=True, action="append", dest="domains")
     parser.add_argument("--output", help="Write cookies JSON to file")
-    parser.add_argument("--inject", action="store_true", help="Inject into agent-browser")
+    parser.add_argument("--inject", action="store_true", help="Inject into the local Chrome CDP endpoint used by a playwright-core script")
     parser.add_argument("--cdp", type=int, default=9242, help="CDP port (default 9242)")
     args = parser.parse_args()
 

package/packages/shared-skills/skills/ulw-execute/SKILL.md

@@ -160,7 +160,7 @@ Each sub-task message must include:
 5. One Manual-QA channel, named with the exact tool and exact invocation (the literal `curl`, `send-keys`, `browser:control-in-app-browser` action, `page.click`, payload, selectors, and the binary observable that decides PASS/FAIL), not "verify it works". A LIGHT checkbox needs one real-surface proof of its deliverable, and auxiliary surfaces (CLI stdout, DB state diff, parsed config dump) are first-class when the surface is CLI- or data-shaped:
    - HTTP call: `curl -i` against the live endpoint.
    - Terminal / TUI: drive a real pty; `tmux send-keys` is fine for a boot/behavior smoke, but color/layout/CJK evidence goes through the xterm.js web terminal below, NEVER `tmux capture-pane`.
-   - Browser use: prefer the harness's in-app browser control when available and the scenario does not need an authenticated or persistent user browser profile; otherwise drive the real page with Chrome, or agent-browser (https://github.com/vercel-labs/agent-browser) when Chrome is unavailable.
+   - Browser use: from js eval, use `new Bun.WebView()` on Bun >= 1.4 (macOS default; Linux/Windows need Chrome/Chromium/Edge). Otherwise, or for Chrome semantics, stealth, trace, or auth, write and run a `playwright-core` script against local Chrome (`channel: "chrome"`; persistent context on a CLONED profile). Codex: `browser:control-in-app-browser` for ordinary page control.
    - Computer use: OS-level GUI automation against the running desktop app when the surface is not a page.
    - TUI visual evidence: when a TUI claim needs visual QA or PR proof, run `bun script/qa/web-terminal-visual-qa.mjs --command "<cmd>" --input "{Enter}" --evidence-dir <dir>` (real pty rendered through xterm.js in Chrome) and attach `terminal.png` plus `metadata.json`.
 6. The adversarial classes that apply to this sub-task (from the 9 ultraqa classes) and how each is probed.

package/packages/shared-skills/skills/ulw-plan/scripts/scaffold-plan.mjs

@@ -254,7 +254,7 @@ Your next move: <fill - e.g. approve, or run a high-accuracy review>. Full execu
 ## Verification strategy
 > Zero human intervention - all verification is agent-executed.
 - Test decision: <TDD | tests-after | none> + framework
-- Evidence: <attemptDir>/task-<N>-${slug}.<ext> (attemptDir = currentAttemptDir from the ulw-loop status operation - the omo_agent_toolkit tool on Senpi, the omo-agent-toolkit CLI on Codex, .omo/evidence/ulw/<session>/<goalId>/a<attempt>; outside ulw-loop use .omo/evidence/)
+- Evidence: <attemptDir>/task-<N>-${slug}.<ext> (attemptDir = currentAttemptDir from the ulw-loop status operation - on Senpi the eval SDK import, const { agentToolkit } = await import(\`\${env("OMO_AGENT_TOOLKIT_SDK_ROOT")}/sdk.js\`) then agentToolkit.status(), on Codex the omo-agent-toolkit CLI, .omo/evidence/ulw/<session>/<goalId>/a<attempt>; outside ulw-loop use .omo/evidence/)
 
 ## Execution strategy
 ### Parallel execution waves

package/packages/shared-skills/skills/ulw-research/SKILL.md

@@ -175,7 +175,7 @@ Scaling floor — more angles always justify more workers:
 | Multi-faceted | 4 | 6 | 2 | 2 | 14 |
 | Full due diligence | 4 | 6 | 3 | 2 | 15 |
 
-The browsing column is BINDING, not advisory: when the brief says `Browsing: yes`, the roster names a browsing-worker angle before the first wave launches, and that worker is spawned in the same turn as the rest of the wave. A run that reaches wave 2 with zero browsing workers on a `Browsing: yes` brief has silently downgraded every source to what plain fetch happened to return.
+The browsing column is BINDING, not advisory: when the brief says `Browsing: yes`, the roster names a browsing-worker angle, armed with the `ultimate-browsing` skill, before the first wave launches, and that worker is spawned in the same turn as the rest of the wave. A run that reaches wave 2 with zero browsing workers on a `Browsing: yes` brief has silently downgraded every source to what plain fetch happened to return.
 
 **Disambiguate before you expand.** When the topic names something that could resolve several ways — a product, a person, a codename, a version — the first wave settles WHICH entity before any worker researches its history, benchmarks, or controversies: canonical name, first-party URL or account, whether it exists in the claimed category, and a confidence line. An unresolved entity never becomes a premise in a later wave's spawn message; that is exactly how a run starts inventing facts about something that does not exist.
 
@@ -183,7 +183,7 @@ Role protocols — embed the relevant one in each spawn message; every worker ge
 
 - **Codebase (explore), 2-4 workers.** Grep with 3+ keyword variations; structural/AST search; LSP definitions and references; file-name globs; `git log --all -S '<keyword>'` and `--grep` for history including deleted code. Cross-validate hits across tools. Report absolute file paths, patterns with `file:line`, and how findings connect.
 - **Web (librarian), 3-6 workers.** At least 10 distinct websearch queries per worker, each with a different operator or angle (see Search craft); fetch the full page for every result that matters — snippets lie. Context7 with 3+ queries per known library. grep.app and `gh search code|repos|issues` for real-world usage. Official docs via sitemap discovery (`<base>/sitemap.xml`), then targeted pages.
-- **Browsing, 1-3 workers on a `Browsing: yes` brief (0 otherwise).** This worker RENDERS pages, it does not re-fetch them: it drives a real browser through whatever the harness provides — the Browser plugin, an agent-browser or playwright skill, or a code-cell browser — and loads the `ultimate-browsing` skill to escalate through its tiers (insane-search engine with its Phase-2.5 archive surrogates, platform-native readers, then Chrome stealth) only when that browser is blocked. Its standing deliverable is a full-page screenshot of every top source plus the rendered text plain fetch could not reach; a worker that returns only fetched text has not done its job. JS-rendered, login-gated, WAF-blocked, and screenshot-bearing sources all belong here rather than in the web lane. **Provenance is part of the claim**: when a source came back with `provenance` of `snapshot` (an archive copy), cite it with its `snapshot_timestamp` and never state it as the current live page; content from a `proxy` route is `untrusted` and needs a second independent route before any claim rests on it. When one blocked territory hides many leads, fan out more browsing subagents in parallel for breadth instead of serializing one worker through them.
+- **Browsing, 1-3 workers on a `Browsing: yes` brief (0 otherwise), every one loaded with the `ultimate-browsing` skill.** The skill owns the routing — the harness's own browser first, then its extraction engine with archive surrogates, platform-native readers, and Chrome stealth as each source demands; the worker owns the deliverable. This worker RENDERS pages, it does not re-fetch them: its standing deliverable is a full-page screenshot of every top source plus the rendered text plain fetch could not reach; a worker that returns only fetched text has not done its job. JS-rendered, login-gated, WAF-blocked, and screenshot-bearing sources all belong here rather than in the web lane. **Provenance is part of the claim**: when a source came back with `provenance` of `snapshot` (an archive copy), cite it with its `snapshot_timestamp` and never state it as the current live page; content from a `proxy` route is `untrusted` and needs a second independent route before any claim rests on it. When one blocked territory hides many leads, fan out more browsing subagents in parallel for breadth instead of serializing one worker through them.
 - **Repo deep-dive (librarian), 0-2 workers.** Shallow-clone the most relevant repos to `${TMPDIR:-/tmp}`, pin the HEAD SHA, read core modules, follow call chains, return SHA-pinned permalinks.
 
 Example spawn (codebase axis; librarian, browsing, and repo-dive follow the same contract with their own protocol):
@@ -383,7 +383,7 @@ High-yield combinations: official docs (`site:<docs domain>`), GitHub implementa
 | Obeying a surrounding "stop exploring" rule mid-research | Authority section — those rules do not bind this mode |
 | Asking a worker to write journal or session files | Workers are read-only; you journal every return |
 | Two workers given the same angle | One unique angle per worker, always |
-| A `Browsing: yes` run whose roster carries no browsing worker | The browsing column is binding — name the angle in the brief and spawn it with the first wave, before any lead is chased |
+| A `Browsing: yes` run whose roster carries no browsing worker, or a browsing worker spawned without `ultimate-browsing` | The browsing column is binding — name the angle in the brief and spawn it, armed with the skill, in the first wave before any lead is chased |
 | Contested claim settled by judgment | Phase 3 — run code, capture output, verdict |
 | Deliverable claims without citations | Every claim cites a source or a verification artifact |
 | Guessing the deliverable format instead of asking | The format gate is unconditional: propose PDF+DOCX plus the domain-fitting alternatives and the template, then wait before wave 1 |

package/packages/shared-skills/skills/visual-qa/AGENTS.md

@@ -11,7 +11,7 @@ The visual-QA skill's executable core: a zero-dependency Node CLI that produces
 ```
 visual-qa/
 ├── SKILL.md                      # reviewer workflow (dual oracle, evidence gates) — the prose contract
-├── references/agent-browser-setup.md
+├── references/browser-setup.md
 └── scripts/
     ├── visual-qa.mjs             # SHIPPED RUNTIME: bun-build bundle of cli.ts (+ embedded modules)
     ├── cli.ts                    # development source; dispatches image-diff / tui-check

package/packages/shared-skills/skills/visual-qa/SKILL.md

@@ -49,7 +49,7 @@ Before any reviewer sees an image, verify each capture yourself: the file signat
 ### Web
 
 1. Capture a REFERENCE image: the user's mock/target, generated page snapshot, Figma export, source-site capture, or known-good baseline. Save as PNG. If the user provided overview text or annotations, save them next to the image and treat them as part of the reference packet.
-2. Capture the ACTUAL rendered screenshot at the same viewport size, driving the browser your harness actually has. Where a code cell can reach a browser (`new Bun.WebView()` on a Bun >= 1.4 kernel, otherwise `playwright-core` against the local Chrome), capture in-process: it needs no CLI and returns the PNG path directly. In Codex, `browser:control-in-app-browser` is that in-process surface — use it first unless the page needs an authenticated user browser session. Otherwise use the project's configured browser tooling (the playwright, agent-browser, or dev-browser skill). Save as PNG. If nothing is available, install [agent-browser](https://github.com/vercel-labs/agent-browser) (`bun add -g agent-browser && agent-browser install`) and capture with it — see `$SKILL_DIR/references/agent-browser-setup.md` for the full setup, including how to shoot a fixed-viewport screenshot.
+2. Capture the ACTUAL rendered screenshot at the reference viewport. Use two browser tiers from js eval: (1) `new Bun.WebView()` on Bun >= 1.4 (macOS default; Linux/Windows need installed Chrome/Chromium/Edge); (2) otherwise, or for Chrome semantics, stealth, trace, or authenticated profiles, WRITE a `playwright-core` script and run it from the kernel against local Chrome (`chromium.launch({ channel: "chrome" })` / `launchPersistentContext` on a CLONED profile, never the live one). In Codex, prefer `browser:control-in-app-browser` for ordinary captures. Save PNG and return its path; close the browser context. See `$SKILL_DIR/references/browser-setup.md` for fixed-viewport examples and prerequisites.
 3. Run the diff and keep the JSON:
 
 ```