oh-my-opencode 5.0.0-beta.62 → 5.0.0-beta.63

package/packages/shared-skills/skills/ultimate-browsing/ATTRIBUTION.md

@@ -1,8 +1,7 @@
 # ATTRIBUTION / NOTICE
 
 This skill (`ultimate-browsing`, part of `@oh-my-opencode/shared-skills`) ships
-project-original content, one vendored-and-modified upstream engine, plus two
-third-party tools that it installs at runtime (it does NOT vendor their source).
+project-original content and one vendored-and-modified upstream engine.
 Each component's provenance, license, and required notices are reproduced below.
 
 ---
@@ -50,83 +49,3 @@ license obligation:
 These reference platform-native CLIs and public APIs by name (e.g. `xhs`, `yt-dlp`,
 `agent-reach`, `mcporter`, Jina Reader, V2EX public API). Those are external tools the
 user installs separately; this skill includes none of their source.
-
----
-
-## 3. CloakBrowser (CloakHQ) — Tier-2 stealth Chromium (runtime dependency)
-
-The Tier-2 stealth browser is **CloakBrowser**, installed at runtime via `pip`
-(`pip install cloakbrowser`). No CloakBrowser source is vendored in this repository.
-
-- Source: https://github.com/CloakHQ/CloakBrowser
-- Pinned runtime version: **0.5.7** (documented in `references/chrome-stealth.md`;
-  this is a documented version string, not an automated drift check).
-- Wrapper source license: MIT License.
-- Binary license: the compiled CloakBrowser Chromium binary downloaded by
-  `cloakbrowser.ensure_binary()` is governed by the separate CloakBrowser
-  Binary License:
-  https://github.com/CloakHQ/CloakBrowser/blob/main/BINARY-LICENSE.md
-- Redistribution note: this npm package does not redistribute the CloakBrowser
-  binary, does not repackage it, and does not include it in `skills/` or
-  `dist/skills`. Users who run the Tier-2 setup download the binary directly
-  from CloakHQ's official distribution channels and must comply with that
-  binary license.
-
-MIT wrapper source license:
-
-```
-MIT License
-
-Copyright (c) 2026 CloakHQ
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-```
-
----
-
-## 4. agent-browser (vercel-labs) — Tier-2 CDP automation CLI (runtime dependency)
-
-The Tier-2 automation CLI is **agent-browser**, installed at runtime via `npm`
-(`bun add -g agent-browser`). No agent-browser source is vendored in this repository.
-
-- Source: https://github.com/vercel-labs/agent-browser
-- Pinned runtime version: **0.34.0** (documented in `references/chrome-stealth.md`;
-  documented version string, no automated drift check).
-- Licensed under the Apache License, Version 2.0 (the "License"); you may not use
-  these files except in compliance with the License. You may obtain a copy of the
-  License at:
-
-      http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing, software distributed under
-  the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-  KIND, either express or implied. See the License for the specific language governing
-  permissions and limitations under the License.
-
-- **Changes (Apache-2.0 §4(b)):** none. agent-browser is installed unmodified at
-  runtime; no agent-browser source file is copied, modified, or redistributed by this
-  skill. This skill only documents how to invoke the upstream CLI.
-
-- **NOTICE:** the upstream agent-browser distribution may include a `NOTICE` file. As
-  this skill redistributes no agent-browser source, no upstream NOTICE content is
-  bundled here; consult the upstream repository for its `NOTICE` file when present.
-
-- **Trademark notice:** "agent-browser" and "Vercel" are referenced by name for
-  identification only. No trademark license is granted under the Apache License 2.0
-  (Section 6).

package/packages/shared-skills/skills/ultimate-browsing/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: ultimate-browsing
-description: "Reaches web pages a plain fetch cannot: renders JS, drives clicks and forms, captures screenshots, holds a login, and gets past WAF blocks through platform-native readers and stealth Chrome. Use for any page work beyond retrieving static text."
+description: "Renders, drives, and screenshots web pages: JS-rendered sources, clicks and forms, persistent logins, WAF-blocked hosts (platform-native readers, stealth Chrome), and the browsing lane of a research run, with screenshots as provenance. Not for plain search or unblocked static fetch."
 ---
 
 # Ultimate Browsing
 
 Web access for everything a plain fetch cannot finish: a page that renders in JS, a click or a form, a screenshot, a login that must persist across pages, or a host that blocks generic fetchers (WAF / 403 / Cloudflare). Start at the cheapest tier that can do the job and climb only when it cannot:
 
-**Tier 1 — insane-search** (headless extraction + WAF bypass) -> **Tier 1.5 — agent-reach** (platform-native APIs, esp. Chinese platforms) -> **Tier 2 — a real browser**: 2a a code-driven kernel browser, 2b Chrome stealth (CloakBrowser + agent-browser) when the page fights back.
+**Tier 1 — insane-search** (headless extraction + WAF bypass) -> **Tier 1.5 — agent-reach** (platform-native APIs, esp. Chinese platforms) -> **Tier 2 — a real browser**: 2a Bun.WebView, 2b a local-Chrome `playwright-core` script from js eval for Chrome semantics, stealth, trace, or auth.
 
 ## PHASE 0 — ROUTE FIRST (MANDATORY)
 
@@ -86,33 +86,26 @@ Routing table, per-platform auth (set `TWITTER_*` env vars, `gh auth login`, a t
 
 ### Tier 2a — kernel browser (default)
 
-Drive the page from the code cell you are already in, with no CLI process and no open CDP port. On a Bun >= 1.4 runtime that is `new Bun.WebView()` (`navigate`, `click`, `type`, `evaluate`, `screenshot`, raw `cdp`); elsewhere it is `playwright-core`/`puppeteer-core` against the local Chrome. Snapshots and screenshots come back in-process, so this is the cheapest way to answer "what does the page actually render".
+Use `new Bun.WebView()` from the js-eval kernel on Bun >= 1.4: macOS defaults to system WebKit; Linux/Windows need installed Chrome/Chromium/Edge. WebView is headless, WebKit has no CDP, and `type()` emits no keyboard events. For other kernels or when those differences matter, use 2b.
 
 ```js
-await using view = new Bun.WebView({ width: 1280, height: 800 })
-await view.navigate(url)
-const title = await view.evaluate("document.title")
-await view.screenshot({ path: "/tmp/page.png" })
+const view = new Bun.WebView({ width: 1280, height: 800 })
+try {
+  await view.navigate(url)
+  const title = await view.evaluate("document.title")
+  await Bun.write(pngPath, await view.screenshot())
+} finally {
+  view[Symbol.dispose]()
+}
 ```
 
-Climb to 2b when the site detects automation (Turnstile, FingerprintJS, "unusual traffic"), when the flow needs a persistent logged-in profile or injected cookies, or when the kernel browser cannot reach the page at all.
+Use 2b for real-Chrome semantics, stealth, trace, authenticated profiles, or a page the kernel browser cannot reach.
 
 ### Tier 2b — Chrome stealth (blocked or logged-in pages)
 
-CloakBrowser is a stealth Chromium with source-level fingerprint patches that passes Cloudflare Turnstile, FingerprintJS, BrowserScan, and 30+ detectors; agent-browser is the CDP automation CLI that drives it. Both are runtime-installed tools (not vendored here). Full setup, version pins, launch flow, cookie login, and cross-platform notes are in [references/chrome-stealth.md](references/chrome-stealth.md).
+WRITE a `playwright-core` script and run it from js eval against installed local Chrome: `chromium.launch({ channel: "chrome" })`, or `launchPersistentContext` on a task-owned profile. For authenticated state, CLONE the user's profile first (`rsync -a <profile>/ <tmp-clone>/`); NEVER launch against or clear cookies/cache/site data from the live profile. Codex: prefer `browser:control-in-app-browser` for ordinary page control.
 
-NEVER clear cookies, cache, or site data (`Network.clearBrowserCookies`, `Storage.clearCookies`, `chrome.browsingData.remove`, "clear browsing data") on the user's real/main browser profile — it wipes their logged-in state everywhere. If the task needs that profile's login state, clone the profile directory first (`rsync -a <profile>/ <tmp-clone>/`) and launch CloakBrowser / agent-browser with the clone as the user-data-dir; run any clearing on the clone only.
-
-```bash
-# 1. Launch CloakBrowser with CDP on :9242 (see chrome-stealth.md for install + venv).
-# 2. CloakBrowser launches tabless — open the first tab via CDP before any agent-browser command:
-curl -s -X PUT "http://127.0.0.1:9242/json/new?https://example.com"
-# 3. Drive it with agent-browser over CDP:
-agent-browser --cdp 9242 snapshot -i        # interactive elements (@eN refs)
-agent-browser --cdp 9242 click @e3
-agent-browser --cdp 9242 screenshot out.png
-agent-browser --cdp 9242 close
-```
+Keep the engine's Playwright templates for script-based extraction. Stealth is optional: the user installs `playwright-extra` + `puppeteer-extra-plugin-stealth` once in the engine directory and the script wraps the `playwright-core` browser type. Setup, persistent-context arguments, screenshots, and cleanup are in [references/chrome-stealth.md](references/chrome-stealth.md). A stealth flag is not proof of access: inspect the rendered result and report challenges that remain.
 
 ### Cookie login (cross-platform)
 
@@ -134,14 +127,11 @@ Cookie export files are written with owner-only `0600` permissions. Do not place
 |------|-------------|
 | [references/insane-search/README.md](references/insane-search/README.md) | Tier-1 engine harness (R1-R7, Phase 0 API index, no-site-name rule) + its `*.md` deep-dives |
 | [references/agent-reach/README.md](references/agent-reach/README.md) | Tier-1.5 routing table, platform auth, per-category `*.md` |
-| [references/chrome-stealth.md](references/chrome-stealth.md) | Tier-2 CloakBrowser + agent-browser install, CDP flow, version pins, cookie login |
+| [references/chrome-stealth.md](references/chrome-stealth.md) | Tier-2 playwright-core scripts, optional stealth setup, cloned profiles, cookie login |
 
 ## Environment variables
 
 ```bash
-CLOAK_CDP_PORT=9242              # CloakBrowser CDP port (default 9242)
-AGENT_BROWSER_USER_AGENT="..."   # override UA to hide HeadlessChrome
-AGENT_BROWSER_HEADED=1           # show the browser window
 # agent-reach auth: set the channel-specific env vars from each tool's docs only if you have access
 # insane-search needs no env vars — it auto-installs deps on first run
 ```
@@ -149,9 +139,7 @@ AGENT_BROWSER_HEADED=1           # show the browser window
 ## Anti-patterns
 
 - Do NOT launch Chrome stealth for plain text extraction — use Tier 1.
-- Do NOT pass an `--init-script` for the webdriver flag — CloakBrowser already patches it at source; the only required override is `--user-agent`.
-- Do NOT run agent-browser before creating the first tab via `curl -X PUT .../json/new` — CloakBrowser launches tabless.
-- Do NOT use vanilla Chrome when stealth is needed — always CloakBrowser.
-- Do NOT forget to `close` the session when done.
+- Use stealth plugins only in an explicitly installed script environment, not injected into WebView.
+- Close every WebView/browser context when done and remove only task-owned profile clones.
 - Do NOT inject cookies without reloading the page.
 - Do NOT hardcode site domains/selectors into `engine/**` or `waf_profiles.yaml` — runtime hints only (see the no-site-name rule in the insane-search reference).

package/packages/shared-skills/skills/ultimate-browsing/engine/AGENTS.md

@@ -65,7 +65,8 @@ is a regression, not an upgrade:
 - **De-personalization** — no personal absolute paths, no personal auth token literals,
   no personal browser choice; enforced by `depersonalization-gate.test.ts`.
 - **Skill-level layering** — the engine is Tier 1 under a router that also owns Tier 1.5
-  (agent-reach) and Tier 2 (CloakBrowser + agent-browser). Upstream has no such tiering.
+  (agent-reach) and Tier 2 (Bun.WebView / local-Chrome playwright-core scripts from js eval).
+  Upstream has no such tiering.
 
 ### WANT — upstream improvements worth porting forward
 

package/packages/shared-skills/skills/ultimate-browsing/engine/templates/package.json

@@ -2,9 +2,9 @@
   "name": "insane-search-templates",
   "version": "0.1.0",
   "private": true,
-  "description": "Local deps for Playwright real-Chrome templates. npm install && npx playwright install chrome",
+  "description": "Script-only dependencies for local Chrome templates driven from js eval; Chrome must already be installed.",
   "dependencies": {
-    "playwright": "^1.62.1",
+    "playwright-core": "^1.62.1",
     "playwright-extra": "^4.3.6",
     "puppeteer-extra-plugin-stealth": "^2.11.2"
   }

package/packages/shared-skills/skills/ultimate-browsing/engine/templates/playwright_mobile_chrome.js

@@ -76,11 +76,12 @@ async function main() {
   const playwrightExtra = requireOptionalModule('playwright-extra');
   const stealthPlugin = playwrightExtra ? requireOptionalModule('puppeteer-extra-plugin-stealth') : null;
   if (playwrightExtra && stealthPlugin) {
-    ({ chromium, devices } = playwrightExtra);
+    ({ devices } = require('playwright-core'));
+    chromium = playwrightExtra.addExtra(require('playwright-core').chromium);
     const stealth = stealthPlugin();
     chromium.use(stealth);
   } else {
-    ({ chromium, devices } = require('playwright'));
+    ({ chromium, devices } = require('playwright-core'));
   }
 
   const dev = devices[deviceName];
@@ -94,6 +95,8 @@ async function main() {
   try {
     ctx = await chromium.launchPersistentContext(profileDir, {
       channel: 'chrome',
+      args: ['--disable-blink-features=AutomationControlled'],
+      ignoreDefaultArgs: ['--enable-automation'],
       headless,
       ...dev,
     });

package/packages/shared-skills/skills/ultimate-browsing/engine/templates/playwright_real_chrome.js

@@ -10,9 +10,9 @@
  * NO-SITE-NAME RULE: this file must never branch on specific hostnames.
  * All site specifics come from the JSON input (url, waitSelector).
  *
- * Dependencies (install once on target machine):
- *   npm i -g playwright playwright-extra puppeteer-extra-plugin-stealth
- *   npx playwright install chrome    # system Chrome binary
+ * User setup: ../../references/chrome-stealth.md (engine-local dependencies).
+ * Chrome must already be installed; optional stealth plugins run only in this script.
+ * Execute this script from js eval; profileDir must be task-owned or a CLONED profile.
  */
 
 const fs = require('fs');
@@ -82,18 +82,20 @@ async function main() {
   const playwrightExtra = requireOptionalModule('playwright-extra');
   const stealthPlugin = playwrightExtra ? requireOptionalModule('puppeteer-extra-plugin-stealth') : null;
   if (playwrightExtra && stealthPlugin) {
-    ({ chromium } = playwrightExtra);
+    chromium = playwrightExtra.addExtra(require('playwright-core').chromium);
     const stealth = stealthPlugin();
     chromium.use(stealth);
   } else {
-    // Fallback to plain playwright (no stealth). Still uses channel:chrome.
-    ({ chromium } = require('playwright'));
+    // Core controls installed Chrome without downloading a managed browser.
+    ({ chromium } = require('playwright-core'));
   }
 
   let ctx;
   try {
     ctx = await chromium.launchPersistentContext(profileDir, {
       channel: 'chrome',          // real Chrome, not bundled Chromium
+      args: ['--disable-blink-features=AutomationControlled'],
+      ignoreDefaultArgs: ['--enable-automation'],
       headless,
       viewport,
     });

package/packages/shared-skills/skills/ultimate-browsing/engine/tests/test_playwright_stealth.py

@@ -0,0 +1,86 @@
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+from test_playwright_templates import (
+    TEMPLATE_NAMES,
+    TEMPLATES_DIR,
+    _install_fake_playwright,
+    _write_file,
+)
+
+
+class PlaywrightTemplateStealth(unittest.TestCase):
+    def test_extracts_html_and_closes_wrapped_chrome_when_stealth_is_installed(self) -> None:
+        for template_name in TEMPLATE_NAMES:
+            with self.subTest(template_name=template_name), tempfile.TemporaryDirectory() as tmp:
+                # Given: core has no plugin API; only addExtra supplies a registered wrapper.
+                root = Path(tmp)
+                modules = root / "node_modules"
+                profile = root / "profile"
+                receipt = root / "launch.json"
+                _install_fake_playwright(modules)
+                _write_file(modules / "puppeteer-extra-plugin-stealth/index.js", """
+                    module.exports = () => ({ name: 'stealth' });
+                """)
+                _write_file(modules / "playwright-extra/index.js", """
+                    const assert = require('node:assert/strict');
+                    const fs = require('node:fs');
+                    exports.addExtra = (core) => {
+                      assert.equal(core, require('playwright-core').chromium);
+                      assert.equal(Object.hasOwn(core, 'use'), false);
+                      const events = ['wrap'];
+                      let registered = false;
+                      return {
+                        use(plugin) {
+                          assert.equal(plugin.name, 'stealth');
+                          registered = true;
+                          events.push(plugin.name);
+                        },
+                        async launchPersistentContext(profileDir, options) {
+                          assert.equal(registered, true);
+                          events.push({ profileDir, channel: options.channel, viewport: options.viewport });
+                          const context = await core.launchPersistentContext(profileDir, options);
+                          return {
+                            ...context,
+                            async close() {
+                              await context.close();
+                              events.push('close');
+                              fs.writeFileSync(process.env.STEALTH_RECEIPT, JSON.stringify(events));
+                            },
+                          };
+                        },
+                      };
+                    };
+                """)
+                script = root / template_name
+                script.write_bytes((TEMPLATES_DIR / template_name).read_bytes())
+                env = {key: value for key, value in os.environ.items() if key != "NODE_PATH"}
+                env["STEALTH_RECEIPT"] = str(receipt)
+
+                # When: the actual bundled entry point consumes its normal stdin protocol.
+                result = subprocess.run(
+                    ["node", str(script)],
+                    input=json.dumps({"url": "https://example.com/", "profileDir": str(profile), "headless": True}),
+                    text=True, capture_output=True, timeout=5, env=env, check=False,
+                )
+
+                # Then: HTML arrives through the registered wrapper and the context is closed.
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertEqual(result.stdout, "<html><article>ok</article></html>")
+                self.assertEqual(result.stderr, "")
+                viewport = {"width": 390, "height": 844} if "mobile" in template_name else {"width": 1366, "height": 900}
+                self.assertEqual(json.loads(receipt.read_text(encoding="utf-8")), [
+                    "wrap", "stealth",
+                    {"profileDir": str(profile), "channel": "chrome", "viewport": viewport},
+                    "close",
+                ])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/packages/shared-skills/skills/ultimate-browsing/engine/tests/test_playwright_templates.py

@@ -21,7 +21,7 @@ def _write_file(path: Path, content: str) -> None:
 
 def _install_fake_playwright(node_modules: Path) -> None:
     _write_file(
-        node_modules / "playwright" / "index.js",
+        node_modules / "playwright-core" / "index.js",
         """
         const page = {
           async goto() {},
@@ -47,7 +47,6 @@ def _install_fake_playwright(node_modules: Path) -> None:
         };
 
         exports.chromium = {
-          use() {},
           async launchPersistentContext() { return context; },
         };
         exports.devices = {
@@ -78,9 +77,7 @@ def _install_working_playwright_extra(node_modules: Path) -> None:
     _write_file(
         node_modules / "playwright-extra" / "index.js",
         """
-        const playwright = require('playwright');
-        exports.chromium = playwright.chromium;
-        exports.devices = playwright.devices;
+        exports.addExtra = (browserType) => browserType;
         """,
     )
 
@@ -149,7 +146,7 @@ def _run_template(
 
 @unittest.skipUnless(shutil.which("node"), "node is required for Playwright template tests")
 class PlaywrightTemplateErrorHandling(unittest.TestCase):
-    def test_missing_playwright_extra_warns_and_falls_back_to_plain_playwright(self) -> None:
+    def test_missing_playwright_extra_warns_and_falls_back_to_playwright_core(self) -> None:
         for template_name in TEMPLATE_NAMES:
             with self.subTest(template_name=template_name):
                 result = _run_template(
@@ -166,7 +163,7 @@ class PlaywrightTemplateErrorHandling(unittest.TestCase):
                 self.assertIn("best-effort optional module playwright-extra failed:", result.stderr)
                 self.assertIn("Cannot find module 'playwright-extra'", result.stderr)
 
-    def test_missing_stealth_plugin_warns_and_falls_back_to_plain_playwright(self) -> None:
+    def test_missing_stealth_plugin_warns_and_falls_back_to_playwright_core(self) -> None:
         for template_name in TEMPLATE_NAMES:
             with self.subTest(template_name=template_name):
                 result = _run_template(