octocode-cli 1.3.1 → 1.5.1

package/skills/octocode-chrome-devtools/references/INTENTS_ENVIRONMENT.md

@@ -0,0 +1,237 @@
+# CDP Environment And Runtime Intent Details
+
+## emulate
+
+**Trigger phrases:** "mobile", "emulate device", "throttle network", "slow 3G", "offline", "fake location", "geolocation", "tablet", "responsive", "test on mobile", "iPhone", "Android", "viewport", "mobile UA"
+
+**Purpose:** Override browser environment — device viewport, touch events, UA, network speed, geolocation — before running any other intent. All overrides are script-level and take effect before navigation.
+
+**Domains:** No `enable` call needed for `Emulation.*`. For network throttling: `Network.enable` first. For geolocation: `Browser.grantPermissions` first.
+
+
+### Two-level emulation model
+
+| Level | How | Controls |
+|---|---|---|
+| **Launch-level** | `open-browser.mjs --windowSize 390x844 --userAgent "<mobile-ua>"` | Window size, launch-time UA |
+| **Script-level** | `Emulation.setDeviceMetricsOverride` + `setUserAgentOverride` + `setTouchEmulationEnabled` | Viewport, DPR, mobile mode, UA, touch, Sec-CH-UA hints |
+
+**Prefer script-level emulation for accuracy** — it gives real mobile layout (media queries fire, `window.innerWidth` matches), real device pixel ratio, real touch events, and full UA hint spoofing. Launch-level `--windowSize` is useful for initial window dimensions before CDP attaches.
+
+
+### Device presets
+
+Replace `<current-version>` / `<current-major>` with the installed Chrome version before running a copied Android preset.
+
+| Device | Width | Height | DPR | User-Agent |
+|---|---|---|---|---|
+| iPhone 15 Pro | 393 | 852 | 3 | `Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1` |
+| iPhone 13 | 390 | 844 | 3 | `Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1` |
+| Pixel 7 (Android) | 412 | 915 | 2.625 | `Mozilla/5.0 (Linux; Android 14; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<current-version>.0.0.0 Mobile Safari/537.36` |
+| Samsung Galaxy S23 | 360 | 780 | 3 | `Mozilla/5.0 (Linux; Android 13; SM-S911B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/<current-version>.0.0.0 Mobile Safari/537.36` |
+| iPad Air (M2) | 820 | 1180 | 2 | `Mozilla/5.0 (iPad; CPU OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1` |
+| Desktop 1920 | 1920 | 1080 | 1 | _(use open-browser.mjs default — desktop UA)_ |
+
+
+
+**Adaptive emulation recipe:**
+
+Use launch flags for initial window shape only. Use script-level `Emulation.*` before navigation for viewport, DPR, touch, UA, and locale behavior. Replace UA/version hints with the installed browser version when spoofing Chrome.
+
+```js
+const device = { width: 393, height: 852, dpr: 3, mobile: true };
+await cdp.send('Page.enable', {});
+await cdp.send('Network.enable', {});
+await cdp.send('Emulation.setDeviceMetricsOverride', {
+  width: device.width, height: device.height,
+  deviceScaleFactor: device.dpr, mobile: device.mobile,
+});
+await cdp.send('Emulation.setTouchEmulationEnabled', { enabled: true, maxTouchPoints: 5 });
+// Optional: setUserAgentOverride with current, realistic UA + hints.
+await cdp.send('Page.navigate', { url: TARGET_URL });
+```
+
+After load, verify `window.innerWidth`, `devicePixelRatio`, and horizontal overflow. Feature-detect browser APIs inside the page when emulating capabilities, not just viewport.
+
+**Network throttling snippets:**
+```js
+await cdp.send('Network.enable', {});
+
+// Slow 3G
+await cdp.send('Network.emulateNetworkConditions', {
+  offline: false, downloadThroughput: 50_000, uploadThroughput: 20_000, latency: 400,
+});
+console.log('[EMULATE] network: Slow 3G (50kb/s down, 400ms latency)');
+
+// Fast 3G
+await cdp.send('Network.emulateNetworkConditions', {
+  offline: false, downloadThroughput: 180_000, uploadThroughput: 84_000, latency: 100,
+});
+
+// Offline
+await cdp.send('Network.emulateNetworkConditions', {
+  offline: true, downloadThroughput: 0, uploadThroughput: 0, latency: 0,
+});
+
+// Reset
+await cdp.send('Network.emulateNetworkConditions', {
+  offline: false, downloadThroughput: -1, uploadThroughput: -1, latency: 0,
+});
+```
+
+**Geolocation:**
+```js
+await cdp.send('Browser.grantPermissions', { permissions: ['geolocation'] });
+await cdp.send('Emulation.setGeolocationOverride', { latitude: 40.7128, longitude: -74.0060, accuracy: 100 });
+console.log('[EMULATE] geolocation: New York City');
+```
+
+**Dark mode / media queries:**
+```js
+await cdp.send('Emulation.setEmulatedMedia', {
+  features: [{ name: 'prefers-color-scheme', value: 'dark' }],
+});
+```
+
+**Output prefixes:** `[EMULATE]` `[METRIC]` `[FINDING]`
+
+**`[FINDING]` conditions:**
+- Layout breaks at mobile viewport → `[FINDING] LAYOUT_BREAK: horizontal scroll or overflow at ${width}px`
+- Network throttle reveals slow resource → `[FINDING] SLOW_RESOURCE: ${url} took ${ms}ms on throttled connection`
+- Offline triggers uncaught exception → `[FINDING] NO_OFFLINE_HANDLING: app crashes when offline`
+
+**Ordering constraint:** `Emulation.*` overrides take effect on the next navigation. Call them before `Page.navigate` — media queries and viewport-dependent layout fire during the first parse, not on DOMContentLoaded.
+
+**Combine with:** `screenshot` (capture mobile layout), `performance` (measure on throttled network), `debug` (find mobile-only errors), `scrape` (scrape mobile-rendered content).
+
+## inject
+
+**Trigger phrases:** "inject script", "patch before load", "hook function", "override", "monkey-patch", "add script to page", "intercept before", "modify behavior", "bypass CSP", "add tracking"
+
+**Purpose:** Inject JavaScript into every new document before any page script runs. Use for hooking functions, overriding globals, adding instrumentation, or bypassing checks.
+
+**Domains:** `Page.enable`
+
+**Key methods:**
+- `Page.addScriptToEvaluateOnNewDocument({source})` → runs before page JS on every navigation
+- `Page.removeScriptToEvaluateOnNewDocument({identifier})` → remove when done
+- `Page.setBypassCSP({enabled:true})` → bypass Content-Security-Policy (required before injection on CSP-protected pages)
+
+**Injection patterns:**
+```js
+// Hook fetch to log all requests + bodies
+const { identifier } = await cdp.send('Page.addScriptToEvaluateOnNewDocument', {
+  source: `
+    const _fetch = window.fetch;
+    window.fetch = async function(...args) {
+      const [url, init] = args;
+      console.log('[INJECTED:FETCH]', typeof url === 'string' ? url : url.url, init?.body?.slice?.(0,200));
+      return _fetch.apply(this, args);
+    };
+  `
+});
+console.log('[INJECT] fetch hook installed, identifier:', identifier);
+
+// Hook XMLHttpRequest
+await cdp.send('Page.addScriptToEvaluateOnNewDocument', {
+  source: `
+    const _open = XMLHttpRequest.prototype.open;
+    XMLHttpRequest.prototype.open = function(method, url) {
+      this._xhrUrl = url; this._xhrMethod = method;
+      console.log('[INJECTED:XHR]', method, url);
+      return _open.apply(this, arguments);
+    };
+  `
+});
+
+// Expose a debug channel back to CDP
+await cdp.send('Runtime.addBinding', { name: '__cdpLog' });
+// then cdp.on('Runtime.bindingCalled', ({name, payload}) => ...) to receive messages from injected code
+
+// Override a specific function (e.g. disable analytics)
+await cdp.send('Page.addScriptToEvaluateOnNewDocument', {
+  source: `Object.defineProperty(window, 'analytics', { get: () => ({ track: () => {}, page: () => {} }) });`
+});
+
+// Bypass CSP before injection
+await cdp.send('Page.setBypassCSP', { enabled: true });
+```
+
+**Cleanup:** Remove injected scripts after the session — they persist across navigations until removed.
+```js
+await cdp.send('Page.removeScriptToEvaluateOnNewDocument', { identifier });
+```
+
+**Output prefixes:** `[INJECT]` `[FINDING]`
+
+**`[FINDING]` conditions:**
+- Injected hook never fires → `[FINDING] INJECT_NO_CALLS: hook installed but never triggered`
+- Page detects injection and shows error → `[FINDING] INJECTION_DETECTED: page responded to override`
+
+**Combine with:** `debug` (observe injected logs), `network` (correlate injected fetch logs with CDP network events), `security` (hook crypto APIs to observe key usage).
+
+## monitor
+
+**Trigger phrases:** "monitor", "watch", "keep watching", "check every N seconds", "poll", "alert me when", "watch for changes", "continuous", "long-running"
+
+**Purpose:** Long-running observation loop — poll a page or condition repeatedly and emit findings when state changes. Useful for catching intermittent errors, watching a live dashboard, or waiting for an event.
+
+**Domains:** `Network.enable`, `Runtime.enable`, `Log.enable` (others as needed)
+
+
+**Adaptive monitor recipe:**
+
+Monitor only the condition the user cares about. Use event listeners for async errors and one small `Runtime.evaluate` snapshot per interval.
+
+```js
+export async function run(cdp) {
+  const INTERVAL_MS = 5000;
+  const DURATION_MS = 60000;
+  await cdp.send('Runtime.enable', {});
+  await cdp.send('Network.enable', {});
+  await cdp.send('Log.enable', {});
+
+  const queue = [];
+  cdp.on('Runtime.exceptionThrown', ({ exceptionDetails }) => queue.push(exceptionDetails.text));
+  cdp.on('Network.responseReceived', ({ response }) => {
+    if (response.status >= 400) queue.push(`HTTP ${response.status} ${response.url}`);
+  });
+
+  for (const end = Date.now() + DURATION_MS; Date.now() < end;) {
+    const { result } = await cdp.send('Runtime.evaluate', {
+      expression: `JSON.stringify({ url: location.href, title: document.title,
+        errorEls: document.querySelectorAll('.error,[aria-invalid="true"],[data-error]').length })`,
+      returnByValue: true,
+    });
+    console.log(`[MONITOR] ${result.value}`);
+    while (queue.length) console.log(`[FINDING] MONITOR_EVENT: ${queue.shift()}`);
+    await new Promise(r => setTimeout(r, INTERVAL_MS));
+  }
+}
+```
+
+Write a JSON log to `cdp.outputDir` only if the user needs an artifact. Increase duration or add screenshot/network details only after the first run shows they are useful.
+
+**Output prefixes:** `[MONITOR]` `[FINDING]` `[METRIC]` `[ACTION]`
+
+**`[FINDING]` conditions:**
+- Error count increases between iterations → `[FINDING] MONITOR_ERROR: new error at ${elapsed}s`
+- URL changes unexpectedly → `[FINDING] MONITOR_REDIRECT: URL changed to ${url} at ${elapsed}s`
+- DOM error indicators appear → `[FINDING] MONITOR_DOM_ERROR: error elements appeared at ${elapsed}s`
+- Page becomes unresponsive (evaluate times out) → `[FINDING] MONITOR_HANG: page unresponsive at ${elapsed}s`
+- Network 4xx/5xx mid-session → `[FINDING] MONITOR_NETWORK_ERROR: HTTP ${status} at ${elapsed}s`
+
+**Agent loop usage:**
+
+```
+REASON  → what condition am I watching for? how long?
+MONITOR → set TARGET_URL + DURATION_MS, run script → read [MONITOR] + [FINDING] lines
+OBSERVE → check === OBSERVE === block: changes, errors, redirects
+ACT     → follow [ACTION] lines: run debug on affected URL, inspect DOM errors
+SAVE    → change log auto-saved to cdp.outputDir/monitor-log.json
+REPEAT  → if condition not yet triggered, increase DURATION_MS and re-run
+```
+
+Stop when: target condition observed OR `[ACTION] page is stable` with zero errors.
+
+**Combine with:** `debug` (deep-dive on errors found), `screenshot` (capture state at each change), `network` (add network tracking).

package/skills/octocode-chrome-devtools/references/INTENTS_INSPECT.md

@@ -0,0 +1,263 @@
+# CDP Inspection Surface Intent Details
+
+## security
+
+**Trigger phrases:** "security", "cookies", "tokens", "auth", "CSP", "headers", "data exfil", "what's being leaked", "credentials", "session", "localStorage", "is this safe"
+
+**Domains:** `Network.enable`, `Runtime.enable`, `DOM.enable`, `Page.enable`
+
+**Key events/methods:**
+- `Network.getCookies({ urls: [TARGET_URL] })` → cookies scoped to the target URL only (use this — `getAllCookies` returns the entire browser jar and floods output with third-party ad cookies)
+- `Network.requestWillBeSent` + `Network.getRequestPostData(requestId)` → actual POST bodies
+- `Network.responseReceived` → inspect response headers: `Content-Security-Policy`, `Strict-Transport-Security`, `X-Frame-Options`, `X-Content-Type-Options`
+- `Runtime.evaluate` → localStorage keys and sizes only; never emit stored values
+- `Runtime.evaluate` → sessionStorage keys and sizes only; never emit stored values
+- `DOMDebugger.getEventListeners({objectId})` → listeners on `document`, `window`, `input[type=password]` (get objectId via `Runtime.evaluate({expression:"document"})`)
+- `Runtime.evaluate` → `Object.keys(Object.getPrototypeOf(Object.prototype))` → prototype pollution check
+
+**Output prefixes:** `[SECURITY]` `[NETWORK]` `[FINDING]` `[METRIC]`
+
+**`[FINDING]` conditions to emit:**
+- Cookie missing `httpOnly` → `[FINDING] COOKIE_NO_HTTPONLY: ${name}`
+- Cookie missing `secure` flag → `[FINDING] COOKIE_NO_SECURE: ${name}`
+- Cookie `sameSite` is `None` without `secure` → `[FINDING] COOKIE_SAMESITE_NONE_INSECURE: ${name}`
+- POST body contains `token`, `password`, `secret`, `apiKey`, `jwt` → `[FINDING] SENSITIVE_IN_POST: ${url}`
+- Response missing `Content-Security-Policy` → `[FINDING] MISSING_CSP: ${url}`
+- CSP contains `unsafe-eval` or `unsafe-inline` → `[FINDING] WEAK_CSP: ${directive} in ${url}`
+- Response missing `Strict-Transport-Security` → `[FINDING] MISSING_HSTS: ${url}`
+- Response missing `X-Frame-Options` → `[FINDING] MISSING_XFRAME: ${url}`
+- `localStorage` key matches `token|auth|jwt|secret|key|password` → `[FINDING] SENSITIVE_IN_STORAGE: ${key}`
+- `keydown`/`keyup` listener on `document` from third-party script URL → `[FINDING] POSSIBLE_KEYLOGGER: ${listenerUrl}`
+- `copy`/`paste` listener on `document` → `[FINDING] CLIPBOARD_LISTENER: possible clipboard hijack`
+- `Object.prototype` has unexpected own properties → `[FINDING] PROTOTYPE_POLLUTION: ${keys}`
+- Request to unknown external domain → `[FINDING] DATA_EXFIL_SUSPECT: ${url}`
+
+**Pattern:** See **Security Audit** in `SCRIPT_PATTERNS.md` and trim it to the specific security question.
+
+## websocket
+
+**Trigger phrases:** "websocket", "WS", "socket", "real-time", "socket frames", "what's sent over WS"
+
+**Domains:** `Network.enable`
+
+**Key events/methods:**
+- `Network.webSocketCreated` → `{requestId, url, initiator}` — WS object constructed (`new WebSocket(url)`) — **this is the correct creation event, not `requestWillBeSent`**
+- `Network.webSocketHandshakeResponseReceived` → headers, status
+- `Network.webSocketFrameSent` → `{requestId, timestamp, response: {payloadData, opcode}}` — opcode 1 = text, 2 = binary
+- `Network.webSocketFrameReceived` → `{requestId, timestamp, response: {payloadData, opcode}}`
+- `Network.webSocketClosed` → `{requestId, timestamp}`
+
+**Output prefixes:** `[NETWORK]` `[FINDING]` `[METRIC]`
+
+**`[FINDING]` conditions to emit:**
+- WS endpoint on unknown third-party domain → `[FINDING] WS_UNKNOWN_HOST: ${url}`
+- Frame payload contains `token`, `password`, `key` → `[FINDING] SENSITIVE_IN_WS_FRAME: ${url}` (value redacted)
+- Base64-encoded payload (matches `/^[A-Za-z0-9+/]{40,}={0,2}$/`) → `[FINDING] WS_BASE64_FRAME: possible encoded data`
+- Frame size > 100KB → `[FINDING] LARGE_WS_FRAME: ${kb}KB sent` *(threshold is a default — adjust for your protocol)*
+- opcode === 2 → binary frame; base64-decode payload for inspection
+
+**WS inside Web Workers:** `Network.webSocketCreated` does **not** fire on the main session for WebSockets opened inside a Web Worker or Shared Worker. To capture those, enable the `workers` intent first (`Target.setAutoAttach`), then call `cdp.send('Network.enable', {}, sessionId)` on each attached worker session. See the **workers** intent and **WebSocket inside Workers** pattern in `SCRIPT_PATTERNS.md`.
+
+## service-worker
+
+**Trigger phrases:** "service worker", "SW lifecycle", "PWA worker", "offline cache", "push notifications", "background sync", "SW registered", "what service workers are running", "is there a service worker"
+
+**Domains:** `ServiceWorker.enable` + `Target.setAutoAttach` (to receive the SW as an attachable target)
+
+**Key events/methods:**
+- `ServiceWorker.enable` — must call before navigation to receive SW events
+- Event: `ServiceWorker.workerRegistrationUpdated` → `{registrations[]}` — fires when a SW registration is created or deleted; each `registration` has `{registrationId, scopeURL, isDeleted}`
+- Event: `ServiceWorker.workerVersionUpdated` → `{versions[]}` — fires on **every state transition**; each `version` has `{registrationId, versionId, scriptURL, status, runningStatus}`:
+  - `status`: `"new"` → `"installing"` → `"installed"` → `"activating"` → `"activated"` → `"redundant"`
+  - `runningStatus`: `"stopped"` → `"starting"` → `"running"` → `"stopping"`
+- `ServiceWorker.disable` — call at cleanup to stop receiving events
+
+**SW methods (imperative):**
+- `ServiceWorker.skipWaiting({scopeURL})` — force a waiting SW to activate immediately
+- `ServiceWorker.updateRegistration({scopeURL})` — trigger a SW update check
+- `ServiceWorker.unregister({scopeURL})` — unregister a SW
+
+**Output prefixes:** `[SW]` `[FINDING]` `[MONITOR]`
+
+**`[FINDING]` conditions to emit:**
+- New registration for a non-extension scope → `[FINDING] SW_REGISTERED: ${scopeURL}`
+- SW reaches `activated` state → `[FINDING] SW_ACTIVATED: ${scriptURL}`
+- SW `isDeleted` = true (unregistered or evicted) → `[FINDING] SW_REMOVED: ${scopeURL}`
+- SW script is on a third-party domain → `[FINDING] SW_THIRD_PARTY_SCRIPT: ${scriptURL}`
+
+**Tip — navigator API for a point-in-time snapshot (after page load):**
+```js
+const regs = await cdp.send('Runtime.evaluate', {
+  expression: `navigator.serviceWorker.getRegistrations().then(r=>JSON.stringify(r.map(x=>({scope:x.scope,state:(x.active||x.installing||x.waiting)?.state,script:(x.active||x.installing||x.waiting)?.scriptURL}))))`,
+  awaitPromise: true, returnByValue: false,
+});
+const sws = JSON.parse(regs.result.value ?? '[]');
+```
+Use the CDP domain (`ServiceWorker.enable` + events) for **live lifecycle tracking**; use `navigator.serviceWorker.getRegistrations()` for a **snapshot** after load.
+
+**Combine with:** `workers` (to attach to the SW target and capture its network traffic), `storage` (to read CacheStorage entries managed by the SW).
+
+## workers
+
+**Trigger phrases:** "web worker", "shared worker", "worker thread", "background worker", "blob worker", "WS inside worker", "what workers are running", "worker targets", "worker network traffic"
+
+**Domains:** `Target.setAutoAttach` + `Target.setDiscoverTargets` — must be called **before navigation**
+
+**Key events/methods:**
+- `Target.setAutoAttach({autoAttach: true, waitForDebuggerOnStart: false, flatten: true})` — auto-attach to all child targets (workers, service workers) with flat session model
+- `Target.setDiscoverTargets({discover: true})` — emit `Target.targetCreated` for worker targets that Chrome discovers
+- Event: `Target.attachedToTarget` → `{targetInfo, sessionId}` — fires when a worker is attached; `targetInfo.type` is one of `"worker"` (Web Worker), `"shared_worker"`, `"service_worker"`
+- Event: `Target.targetCreated` → `{targetInfo}` — fires when a worker target is created (type = worker/shared_worker/service_worker)
+- `Target.getTargets({})` → `{targetInfos[]}` — list all known targets including workers (use after page settles)
+- `Target.detachFromTarget({sessionId})` — detach from a worker when done
+
+**Enabling Network on a worker (flat session model):**
+
+When `flatten: true` is set in `setAutoAttach`, worker sessions share the same WebSocket connection. Pass `sessionId` as the **third argument** to `cdp.send()` to route commands to that session:
+
+```js
+cdp.on('Target.attachedToTarget', async ({ targetInfo, sessionId }) => {
+  if (!['worker', 'shared_worker', 'service_worker'].includes(targetInfo.type)) return;
+  console.log(`[WORKER] Attached: type=${targetInfo.type} url=${targetInfo.url || '(blob)'}`);
+  // Enable Network on this worker's session to capture its HTTP + WS traffic
+  await cdp.send('Network.enable', {}, sessionId);
+  // All Network events from this worker now carry { sessionId } in their metadata.
+  // Route them with a wrapper that filters by sessionId.
+});
+```
+
+**Routing worker events (filter by sessionId):**
+```js
+// Generic: listen to an event on a specific worker session
+function onWorkerEvent(event, workerSessionId, handler) {
+  cdp.on(event, (params, meta) => {
+    if (meta?.sessionId === workerSessionId) handler(params);
+  });
+}
+// Then:
+onWorkerEvent('Network.webSocketCreated', sessionId, ({ requestId, url }) => {
+  console.log(`[WORKER] WS inside worker: ${url}`);
+});
+```
+
+**Output prefixes:** `[WORKER]` `[FINDING]` `[MONITOR]`
+
+**`[FINDING]` conditions to emit:**
+- Worker URL is a blob: URL → `[FINDING] WORKER_BLOB: ${url}` (expected but opaque; blob workers cannot be inspected via source)
+- Shared Worker detected → `[FINDING] SHARED_WORKER: ${url}` (multi-tab communication channel)
+- Service Worker detected → `[FINDING] SERVICE_WORKER_TARGET: ${url}` (complements service-worker intent)
+- WS connection inside a worker → `[FINDING] WS_IN_WORKER: type=${type} url=${wsUrl}`
+
+**Cleanup:**
+```js
+await cdp.send('Target.setAutoAttach', { autoAttach: false, waitForDebuggerOnStart: false, flatten: true });
+await cdp.send('Target.setDiscoverTargets', { discover: false });
+```
+
+**Combine with:** `websocket` (capture WS frames inside workers), `service-worker` (track SW lifecycle alongside its target session), `network` (capture HTTP requests made by workers).
+
+## intercept
+
+**Trigger phrases:** "intercept", "mock", "block request", "fake response", "modify request", "inject headers", "replace API response"
+
+**Domains:** `Fetch.enable` (call before navigation, no explicit `enable` method — call `Fetch.enable` with `patterns`)
+
+**Key events/methods:**
+- `Fetch.enable({patterns:[{urlPattern:"*", requestStage:"Request"}]})` → intercept all requests
+- Event: `Fetch.requestPaused` → `{requestId, request, responseStatusCode, responseHeaders}`
+- `Fetch.continueRequest({requestId})` → pass through unchanged
+- `Fetch.fulfillRequest({requestId, responseCode:200, body: btoa(JSON.stringify(mockData))})` → return mock
+- `Fetch.continueRequest({requestId, headers:[...]})` → modify headers before continuing
+
+**Output prefixes:** `[NETWORK]` `[FINDING]`
+
+**Note:** `Fetch.enable` must be called **before** navigation. `body` in `fulfillRequest` must be base64-encoded.
+
+## screenshot
+
+**Trigger phrases:** "screenshot", "capture", "take a photo", "visual", "PDF", "print page"
+
+**Domains:** `Page.enable`
+
+**Key events/methods:**
+- `Page.captureScreenshot({format:"png"})` → `data` (base64) → write to `cdp.outputDir/screenshot-<slug>.png`
+- `Page.printToPDF({printBackground:true})` → `data` (base64) → write to `cdp.outputDir/<slug>.pdf`
+- Wait for `Page.loadEventFired` before capturing — capturing too early yields a blank or partial screenshot
+
+**Output prefixes:** `[SCREENSHOT]`
+
+**Write file pattern — use `cdp.outputDir` (sandbox-safe, cross-platform):**
+```js
+const { writeFileSync } = await import('fs');
+const { join } = await import('path');
+const screenshotPath = join(cdp.outputDir, 'screenshot.png');
+writeFileSync(screenshotPath, Buffer.from(data, 'base64'));
+console.log(`[SCREENSHOT] ${screenshotPath}`);
+```
+
+## accessibility
+
+**Trigger phrases:** "accessibility", "a11y", "aria", "screen reader", "wcag", "alt text", "labels"
+
+**Domains:** `DOM.enable`, `Runtime.enable`, `Accessibility.enable`
+
+**Key events/methods:**
+- `Accessibility.getFullAXTree` → full semantic tree with `role`, `name`, `description`, `states`
+- `Runtime.evaluate` → `img:not([alt])`, `input:not([aria-label])`, `button:empty`, `[role]` checks
+
+**Output prefixes:** `[DOM]` `[FINDING]` `[METRIC]`
+
+**`[FINDING]` conditions to emit:**
+- AX node with `role:"img"` and empty `name` → `[FINDING] AX_MISSING_ALT: image has no accessible name`
+- AX node with `role:"button"` and empty `name` → `[FINDING] AX_EMPTY_BUTTON`
+- Input without label in AX tree → `[FINDING] AX_UNLABELED_INPUT`
+- Page has no `role:"main"` landmark → `[FINDING] AX_NO_MAIN_LANDMARK`
+- Heading order skips levels (h1 → h3) → `[FINDING] AX_HEADING_SKIP`
+
+## supply-chain
+
+**Trigger phrases:** "third-party scripts", "external scripts", "CDN", "supply chain", "what scripts load", "external JS"
+
+**Domains:** `Network.enable`, `Runtime.enable`, `Page.enable`
+
+**Key events/methods:**
+- `Network.requestWillBeSent` → filter for `.js` requests where origin ≠ page hostname
+- `Network.responseReceived` → check `Subresource-Integrity` / `integrity` attribute presence
+- `Runtime.evaluate` → `[...document.querySelectorAll('script[src]')].map(s=>({src:s.src,integrity:s.integrity||null}))` → list all script tags
+
+**Output prefixes:** `[NETWORK]` `[SECURITY]` `[FINDING]` `[METRIC]`
+
+**`[FINDING]` conditions to emit:**
+- Third-party JS loaded without SRI hash → `[FINDING] NO_SRI: ${url}`
+- Script from unknown CDN (not from well-known CDNs) → `[FINDING] UNKNOWN_CDN: ${url}`
+- More than 10 distinct third-party domains → `[FINDING] HIGH_THIRD_PARTY_COUNT: ${n} external domains` *(adjust for your expected vendor count)*
+- Script loaded over HTTP (not HTTPS) → `[FINDING] INSECURE_SCRIPT_LOAD: ${url}`
+- `window` gains new property after third-party script loads → `[FINDING] WINDOW_POLLUTION: ${key} added by ${url}`
+
+## full-audit
+
+**Trigger phrases:** "full audit", "everything", "all checks", "complete audit", "check it all"
+
+**Domains:** Enable all: `Network.enable`, `Runtime.enable`, `Log.enable`, `Performance.enable`, `DOM.enable`, `CSS.enable`, `HeapProfiler.enable`, `Page.enable`
+
+**Strategy:** Combine all intents above into one script. Run in this order:
+1. Enable all domains
+2. Attach all event listeners (network, console, exceptions, WS)
+3. Navigate to target
+4. Wait for `Page.loadEventFired`
+5. Run synchronous checks: `Performance.getMetrics`, DOM queries, `Network.getCookies({ urls: [TARGET_URL] })` (not `getAllCookies` — that returns the entire browser jar), localStorage key/size inventory, `DOMDebugger.getEventListeners`
+6. Wait 5–10s for async activity
+7. Emit `[METRIC]` summary for each category
+
+**Output prefixes:** All of the above.
+
+**Emit a summary block at the end:**
+```
+[METRIC] === AUDIT SUMMARY ===
+[METRIC] Network requests: N  Errors: N
+[METRIC] Console errors: N  Exceptions: N
+[METRIC] JS heap: NMB  DOM nodes: N
+[METRIC] Cookies: N  Missing httpOnly: N
+[METRIC] Missing CSP: yes/no  Missing HSTS: yes/no
+[METRIC] Third-party scripts: N  Without SRI: N
+```