natureco-cli 5.64.7 → 5.65.0

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to NatureCo CLI will be documented in this file.
 
+## [5.65.0] - 2026-07-13 — Persistent browser agent
+
+### Added
+- Replaced the one-shot headless browser with a persistent Chrome/Chromium agent using the installed system browser and a dedicated NatureCo profile.
+- Added a structured `open → snapshot → @ref click/fill → snapshot` workflow with visible mode by default, persistent login/storage, keyboard actions, screenshots, text extraction, and explicit session close.
+- Added cross-platform system-browser discovery without downloading a bundled Chromium; `playwright-core` supplies the automation protocol.
+- Added an end-to-end browser smoke test that opens a real page, produces a stable interactive reference, and closes the session.
+
+### Safety
+- Navigation accepts only HTTP(S), interactions require fresh snapshot references instead of guessed selectors, and the prompt distinguishes the NatureCo browser profile from the user's already-open Chrome window.
+- Added attribution for the MIT-licensed gstack browser architecture patterns reviewed during development.
+
+### Verification
+- Live system-Chrome smoke test completed `open → snapshot → close` and exposed the expected `@e1` reference.
+
 ## [5.64.7] - 2026-07-13 — Resilient GUI vision decisions
 
 ### Fixed

package/README.md

@@ -51,6 +51,7 @@ natureco code
 
 | Version | Highlights |
 |---------|-----------|
+| **v5.65.0** | **Persistent browser agent:** visible system Chrome/Chromium, persistent login/storage, and reliable `snapshot → @ref click/fill → verify` automation replace one-shot headless browsing. |
 | **v5.64.7** | **Resilient GUI vision:** invalid action parameters and truncated vision JSON are rejected safely and retried instead of crashing macOS automation. |
 | **v5.64.6** | **Reliable MiniMax tool calls:** XML parameters are converted to their declared schema types, fixing `computer_use_loop` failures such as `maxSteps: expected number, got string`. |
 | **v5.64.5** | **Deterministic GUI recovery:** visible web tasks use one verified GUI loop; failures expose their concrete reason and stop blind browser/AppleScript fallback chains. |

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,12 @@
+# Third-party notices
+
+NatureCo CLI's persistent browser-agent design was informed by the open-source
+gstack browser project, particularly its persistent session, snapshot/reference,
+and observe-act-observe patterns.
+
+gstack is Copyright (c) 2026 Garry Tan and distributed under the MIT License:
+https://github.com/garrytan/gstack
+
+NatureCo's implementation is independently written for its CommonJS tool and
+execution-gateway architecture. Playwright is used through `playwright-core` and
+retains its own license and notices.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "natureco-cli",
-  "version": "5.64.7",
+  "version": "5.65.0",
   "description": "Terminal-native AI agent CLI with bilingual TR/EN UI, multi-agent orchestration, persistent memory, secure tools and messaging integrations.",
   "bin": {
     "natureco": "bin/natureco.js"
@@ -15,6 +15,7 @@
     "CHANGELOG.md",
     "AUDIT.md",
     "SECURITY_AUDIT_SUMMARY.md",
+    "THIRD_PARTY_NOTICES.md",
     "DEPLOY_v2.0.0.md"
   ],
   "scripts": {
@@ -28,6 +29,7 @@
     "lint:errors-only": "eslint src/ bin/ test/ --quiet",
     "smoke": "node --check bin/natureco.js && node bin/natureco.js help",
     "smoke:context": "node scripts/e2e-context-smoke.js",
+    "smoke:browser": "node scripts/e2e-browser-smoke.js",
     "postinstall": "node scripts/postinstall.js",
     "prepublishOnly": "node --check bin/natureco.js && eslint src/ bin/ test/ --quiet && vitest run"
   },
@@ -82,6 +84,7 @@
     "node-telegram-bot-api": "^1.1.2",
     "openai": "^6.45.0",
     "pino": "^8.21.0",
+    "playwright-core": "^1.61.1",
     "qrcode": "^1.5.4",
     "qrcode-terminal": "^0.12.0",
     "semver": "^7.8.1",

package/scripts/e2e-browser-smoke.js

@@ -0,0 +1,21 @@
+'use strict';
+
+const browser = require('../src/tools/browser');
+
+async function main() {
+  const opened = await browser.execute({ action: 'open', url: 'https://example.com', visible: false });
+  if (!opened.success) throw new Error('Open failed: ' + opened.error);
+  const snapshot = await browser.execute({ action: 'snapshot', visible: false });
+  if (!snapshot.success || snapshot.title !== 'Example Domain' || !snapshot.items.some(item => item.ref === '@e1')) {
+    throw new Error('Snapshot did not expose the expected page and element ref');
+  }
+  const closed = await browser.execute({ action: 'close' });
+  if (!closed.success) throw new Error('Close failed');
+  console.log(JSON.stringify({ ok: true, mode: opened.mode, title: snapshot.title, firstRef: snapshot.items[0] }));
+}
+
+main().catch(async error => {
+  try { await browser.execute({ action: 'close' }); } catch {}
+  console.error(error.message);
+  process.exitCode = 1;
+});

package/src/tools/browser.js

@@ -1,112 +1,159 @@
-const { getConfig } = require('../utils/config');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
 
-async function tryPlaywright(action, params) {
-  try {
-    const { chromium } = require('playwright');
-    const browser = await chromium.launch({ headless: true });
-    try {
-      const page = await browser.newPage();
-
-      if (action === 'open') {
-        await page.goto(params.url, { waitUntil: 'networkidle', timeout: 30000 });
-        const title = await page.title();
-        const content = await page.evaluate(() => document.body.innerText);
-        return { success: true, action, title, url: params.url, content: content.substring(0, 10000) };
-      }
+let contextPromise = null;
+let activePage = null;
 
-      if (action === 'screenshot') {
-        await page.goto(params.url, { waitUntil: 'networkidle', timeout: 30000 });
-        const screenshot = await page.screenshot({ type: 'png', fullPage: params.fullPage !== false });
-        return { success: true, action, url: params.url, screenshot: screenshot.toString('base64'), format: 'png' };
-      }
+function chromeCandidates(platform = process.platform) {
+  if (platform === 'darwin') return [
+    '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+    '/Applications/Chromium.app/Contents/MacOS/Chromium',
+    '/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge',
+  ];
+  if (platform === 'win32') return [
+    path.join(process.env.PROGRAMFILES || '', 'Google/Chrome/Application/chrome.exe'),
+    path.join(process.env['PROGRAMFILES(X86)'] || '', 'Google/Chrome/Application/chrome.exe'),
+    path.join(process.env.LOCALAPPDATA || '', 'Google/Chrome/Application/chrome.exe'),
+    path.join(process.env.PROGRAMFILES || '', 'Microsoft/Edge/Application/msedge.exe'),
+  ];
+  return ['/usr/bin/google-chrome', '/usr/bin/google-chrome-stable', '/usr/bin/chromium', '/usr/bin/chromium-browser', '/usr/bin/microsoft-edge'];
+}
 
-      if (action === 'evaluate') {
-        await page.goto(params.url, { waitUntil: 'networkidle', timeout: 30000 });
-        const result = await page.evaluate(params.script);
-        return { success: true, action, url: params.url, result: JSON.stringify(result) };
-      }
+function findChrome(platform = process.platform, exists = fs.existsSync) {
+  return chromeCandidates(platform).find(candidate => candidate && exists(candidate)) || null;
+}
 
-      if (action === 'html') {
-        await page.goto(params.url, { waitUntil: 'networkidle', timeout: 30000 });
-        const html = await page.content();
-        return { success: true, action, url: params.url, html: html.substring(0, 50000) };
-      }
+function safeUrl(value) {
+  const parsed = new URL(String(value || ''));
+  if (!['http:', 'https:'].includes(parsed.protocol)) throw new Error('Only http/https URLs are allowed');
+  return parsed.href;
+}
 
-      return { success: false, error: `Unknown browser action: ${action}` };
-    } finally {
-      await browser.close();
-    }
-  } catch (err) {
-    if (err.code === 'MODULE_NOT_FOUND' || err.message?.includes('Cannot find module')) {
-      return { success: false, error: 'Playwright kurulu değil. Yüklemek için: npm install playwright', fallback: true };
-    }
-    return { success: false, error: err.message };
-  }
+async function getContext({ visible = true } = {}) {
+  if (contextPromise) return contextPromise;
+  contextPromise = (async () => {
+    const { chromium } = require('playwright-core');
+    const executablePath = findChrome();
+    if (!executablePath) throw new Error('Google Chrome, Chromium, or Microsoft Edge was not found');
+    const userDataDir = path.join(os.homedir(), '.natureco', 'browser-profile');
+    fs.mkdirSync(userDataDir, { recursive: true });
+    const context = await chromium.launchPersistentContext(userDataDir, {
+      executablePath,
+      headless: !visible,
+      viewport: null,
+      args: ['--no-first-run', '--no-default-browser-check'],
+    });
+    context.on('close', () => { contextPromise = null; activePage = null; });
+    const pages = context.pages();
+    activePage = pages[0] || await context.newPage();
+    return context;
+  })().catch(error => { contextPromise = null; throw error; });
+  return contextPromise;
 }
 
-async function httpFallback(url) {
-  try {
-    const https = require('https');
-    const http = require('http');
-    const transport = url.startsWith('https') ? https : http;
+async function pageFor(params = {}) {
+  const context = await getContext({ visible: params.visible !== false });
+  if (!activePage || activePage.isClosed()) activePage = context.pages().find(page => !page.isClosed()) || await context.newPage();
+  return activePage;
+}
 
-    return new Promise((resolve) => {
-      const req = transport.get(url, { headers: { 'User-Agent': 'NatureCo-CLI/2.0' }, timeout: 15000 }, (res) => {
-        let data = '';
-        res.on('data', (chunk) => { data += chunk; });
-        res.on('end', () => {
-          const title = data.match(/<title>([^<]*)<\/title>/i)?.[1]?.trim() || '';
-          const text = data.replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim();
-          resolve({ success: true, action: 'open', title, url, content: text.substring(0, 10000), mode: 'http-fallback' });
-        });
-      });
-      req.on('error', (err) => resolve({ success: false, error: err.message }));
-      req.on('timeout', () => { req.destroy(); resolve({ success: false, error: 'timeout' }); });
+async function snapshot(page) {
+  const result = await page.evaluate(() => {
+    document.querySelectorAll('[data-natureco-ref]').forEach(el => el.removeAttribute('data-natureco-ref'));
+    const selector = 'a[href],button,input,textarea,select,[role="button"],[role="link"],[contenteditable="true"],[tabindex]:not([tabindex="-1"])';
+    const elements = Array.from(document.querySelectorAll(selector)).filter(el => {
+      const style = getComputedStyle(el);
+      const rect = el.getBoundingClientRect();
+      return style.visibility !== 'hidden' && style.display !== 'none' && rect.width > 0 && rect.height > 0;
+    }).slice(0, 250);
+    const items = elements.map((el, index) => {
+      const ref = `e${index + 1}`;
+      el.setAttribute('data-natureco-ref', ref);
+      const role = el.getAttribute('role') || el.tagName.toLowerCase();
+      const name = (el.getAttribute('aria-label') || el.getAttribute('placeholder') || el.innerText || el.getAttribute('value') || el.getAttribute('title') || '').trim().replace(/\s+/g, ' ').slice(0, 160);
+      const type = el.getAttribute('type') || '';
+      return { ref: `@${ref}`, role, name, type, disabled: Boolean(el.disabled) };
     });
-  } catch (err) {
-    return { success: false, error: err.message };
+    return { title: document.title, url: location.href, items, text: (document.body?.innerText || '').trim().slice(0, 6000) };
+  });
+  return result;
+}
+
+function refSelector(ref) {
+  if (!/^@e\d+$/.test(String(ref || ''))) throw new Error('Use a fresh @e reference from browser snapshot');
+  return `[data-natureco-ref="${String(ref).slice(1)}"]`;
+}
+
+async function execute(params) {
+  const action = params.action === 'navigate' ? 'open' : params.action;
+  if (action === 'close') {
+    const context = contextPromise ? await contextPromise : null;
+    if (context) await context.close();
+    return { success: true, action: 'close' };
+  }
+
+  try {
+    const page = await pageFor(params);
+    if (action === 'open') {
+      const url = safeUrl(params.url);
+      await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 30000 });
+      await page.bringToFront();
+      return { success: true, action: 'open', url: page.url(), title: await page.title(), mode: params.visible === false ? 'headless-persistent' : 'headed-persistent' };
+    }
+    if (action === 'snapshot') return { success: true, action, ...(await snapshot(page)) };
+    if (action === 'click') {
+      await page.locator(refSelector(params.ref)).click({ timeout: 15000 });
+      await page.waitForTimeout(300);
+      return { success: true, action, ref: params.ref, url: page.url() };
+    }
+    if (action === 'fill') {
+      if (typeof params.text !== 'string') throw new Error('fill requires text');
+      await page.locator(refSelector(params.ref)).fill(params.text, { timeout: 15000 });
+      return { success: true, action, ref: params.ref };
+    }
+    if (action === 'type') {
+      if (typeof params.text !== 'string') throw new Error('type requires text');
+      await page.keyboard.type(params.text);
+      return { success: true, action };
+    }
+    if (action === 'press') {
+      if (!params.key) throw new Error('press requires key');
+      await page.keyboard.press(params.key);
+      await page.waitForTimeout(300);
+      return { success: true, action, key: params.key, url: page.url() };
+    }
+    if (action === 'text') return { success: true, action, url: page.url(), content: (await page.locator('body').innerText()).slice(0, 10000) };
+    if (action === 'current_url') return { success: true, action, url: page.url(), title: await page.title() };
+    if (action === 'screenshot') {
+      const buffer = await page.screenshot({ type: 'png', fullPage: params.fullPage !== false });
+      return { success: true, action, url: page.url(), screenshot: buffer.toString('base64'), format: 'png' };
+    }
+    if (action === 'html') return { success: true, action, url: page.url(), html: (await page.content()).slice(0, 50000) };
+    if (action === 'evaluate') {
+      if (!params.script) throw new Error('evaluate requires script');
+      const result = await page.evaluate(params.script);
+      return { success: true, action, url: page.url(), result };
+    }
+    return { success: false, error: `Unknown browser action: ${params.action}` };
+  } catch (error) {
+    return { success: false, error: error.message };
   }
 }
 
 module.exports = {
   name: 'browser',
-  description: 'Headless browser automation — open URLs, take screenshots, evaluate JS, get HTML. Uses Playwright if available, falls back to HTTP.',
+  description: 'Persistent Chrome/Chromium agent. Use open → snapshot → @ref click/fill → snapshot. Visible by default; preserves login and storage in the NatureCo browser profile.',
   inputSchema: {
     type: 'object',
     properties: {
-      action: { type: 'string', description: 'Action: open, screenshot, evaluate, html', enum: ['open', 'screenshot', 'evaluate', 'html'] },
-      url: { type: 'string', description: 'URL to navigate to' },
-      script: { type: 'string', description: 'JavaScript to evaluate (for evaluate action)' },
-      fullPage: { type: 'boolean', description: 'Full page screenshot (default: true)' }
+      action: { type: 'string', enum: ['open', 'navigate', 'snapshot', 'click', 'fill', 'type', 'press', 'text', 'current_url', 'screenshot', 'html', 'evaluate', 'close'] },
+      url: { type: 'string' }, ref: { type: 'string', description: '@e reference from the latest snapshot' },
+      text: { type: 'string' }, key: { type: 'string' }, script: { type: 'string' },
+      visible: { type: 'boolean', description: 'Show browser window (default true)' }, fullPage: { type: 'boolean' },
     },
-    required: ['action', 'url']
+    required: ['action'],
   },
-
-  async execute(params) {
-    if (params.action === 'open') {
-      const pw = await tryPlaywright('open', params);
-      if (pw.fallback) return httpFallback(params.url);
-      return pw;
-    }
-
-    if (params.action === 'screenshot') {
-      const pw = await tryPlaywright('screenshot', params);
-      if (pw.fallback) return { success: false, error: 'Screenshot için Playwright gerekli. Kur: npm install playwright' };
-      return pw;
-    }
-
-    if (params.action === 'evaluate') {
-      const pw = await tryPlaywright('evaluate', params);
-      if (pw.fallback) return { success: false, error: 'JS evaluate için Playwright gerekli. Kur: npm install playwright' };
-      return pw;
-    }
-
-    if (params.action === 'html') {
-      const pw = await tryPlaywright('html', params);
-      if (pw.fallback) return httpFallback(params.url);
-      return pw;
-    }
-
-    return { success: false, error: `Unknown action: ${params.action}` };
-  }
+  execute,
+  _test: { chromeCandidates, findChrome, safeUrl, refSelector },
 };

package/src/tools/workflow.js

@@ -243,13 +243,13 @@ async function workflow(params) {
           '\n\nTAM MOD ACIK — su araclara da ERISIMIN VAR; o an ne gerekiyorsa dogrudan cagir:',
           '- mac_app_open: macOS uygulamasi ac. parametre: appName (orn. "WhatsApp", "Google Chrome", "Spotify")',
           '- mac_app_quit: macOS uygulamasi kapat. parametre: appName',
-          '- browser: HEADLESS ve ETKILESIMSIZ icerik araci; kullaniciya GORUNMEZ. SADECE action=open|screenshot|evaluate|html; HER CAGRI url ister. navigate/click/type DESTEKLEMEZ.',
+          '- browser: kalici Chrome/Chromium ajani; varsayilan GORUNUR ve login/storage korur. Sira: open(url) → snapshot → snapshot\'taki @e ref ile click/fill → tekrar snapshot ile dogrula. action=open|snapshot|click|fill|type|press|text|current_url|screenshot|html|evaluate|close.',
           '- browser_use: ayri bulut/CLI tarayici servisi; yalniz kurulu ve hazirsa kullan. Acik Chrome penceresini kontrol etmek icin kullanma.',
           '- computer_use: GUI otomasyonu. parametreler: action ("screenshot"/"click"/"type"/"keypress"/"scroll"), x, y, text, key',
           '- computer_use_loop: GORUNUR, cok-adimli GUI icin TEK tercih. p: goal, maxSteps?. Kendi screenshot→vision→action→dogrulama dongusunu yapar.',
           '- social_open: muzik/video/sosyal ac. parametreler: query, platform (spotify/youtube...)',
           '- macos_screenshot: ekran goruntusu al',
-          '\nGORUNUR ACMA (onemli): Kullanici "kendi tarayicimda ac / gorunur ac / dinlemek/izlemek istiyorum" derse `browser` (headless, gorunmez) DEGIL, GORUNUR ac: macOS bash ile `open "https://..."` ya da `open -a "Google Chrome" "https://..."`; Windows `start "" "https://..."`. Uygulama icin `open -a WhatsApp` / mac_app_open. Muzik/video icin dogrudan YouTube/Spotify URL\'sini `open` ile ac.',
+          '\nTARAYICI SECIMI: Kullanici "Chromium/tarayici ajani" derse kalici `browser` kullan. "Su anda acik olan kendi Chrome pencerem" derse yalniz `computer_use_loop` kullan; ayri browser profili acma. Muzik/video yalniz acilacaksa dogrudan URL\'yi `open` ile ac.',
           '\nTum arac listesi (isimle cagir; parametre yanlissa <tool_results> duzeltir): ' + allNames.join(', '),
         ].join('\n');
       }
@@ -302,7 +302,7 @@ async function workflow(params) {
         '- Dosya degistirmeden ONCE read_file ile oku, edit_file ile hedefli degistir. Yerini bilmiyorsan file_search/grep_search ile kesfet.',
         '- Kod yazinca/degistirince bash ile calistir/test et, hata varsa duzelt. Coklu dosya = her biri icin AYRI write_file. Hep TAM yol; "masaustu" = ' + desktop + '.',
         '- Arac sonuclari <tool_results> icinde doner; is bitince arac cagirmadan tek cumlelik ozet yaz. Basit sohbette arac cagirma, dogrudan yanitla.',
-        execFull ? '- Kullanici uygulama ac / tarayici kontrol / muzik cal / ekran / GUI istediyse yukaridaki computer-use araclarini KULLAN. Gorsel geri bildirim gerektiren cok adimli GORUNUR GUI gorevinde SADECE computer_use_loop kullan; once tekil screenshot alip read_file ile PNG okuma, browser ile click/navigate deneme veya AppleScript ile pencere/tab indeksleri tarama. computer_use_loop hata verirse AYNI TURDA kor alternatif denemeler yapma; hata nedenini durustce bildir. Basariyi arac kanitlamadan tamamlandi deme.' : '',
+        execFull ? '- Tarayici gorevinde kullanicinin secimini izle: "Chromium/browser agent" → browser ile open→snapshot→ref action→snapshot; "acik kendi Chrome pencerem" → SADECE computer_use_loop. Bir yol hata verince ayni turda kor fallback zinciri kurma. Mesaj/gonderim/satin alma sonucunu son snapshot veya GUI kaniti olmadan tamamlandi deme.' : '',
         fullToolsBlock,
         treeDigest ? ('\n\nBILDIGIN KALICI HAFIZA (bu kullaniciya ait, onceki oturumlardan hatirladiklarin; kullaniciya ozel bir sey sorulursa ONCE BUNU KULLAN — dosya arama, uydurma):\n' + treeDigest) : '',
         treeIndex ? ('\n\nHafiza agaci yapisi (yukarida olmayan detay icin memory_tree(action:read/search) ile ilgili kok/dali oku):\n' + treeIndex) : '',

package/src/utils/tools.js

@@ -132,10 +132,10 @@ const TOOLSET_MAP = {
 };
 
 // ── check_fn'ler (tool availability kontrolleri) ────────────────────────
-function _checkBrowser() {
-  try {
-    require.resolve('playwright');
-    return true;
+function _checkBrowser() {
+  try {
+    require.resolve('playwright-core');
+    return true;
   } catch { return false; }
 }