opensteer 0.8.18 → 0.9.1

package/skills/opensteer/SKILL.md

@@ -1,179 +1,150 @@
 ---
 name: opensteer
-description: "Handles Opensteer browser automation, structured DOM extraction, and browser-backed API reverse engineering. Use when the user mentions Opensteer, browser automation, real Chromium sessions, DOM extraction, network capture, reverse-engineering a site API, or browser-grade fetch."
+description: "Use when the task needs real browser automation, DOM exploration, browser session state, network capture, or browser-backed request replay with Opensteer. The default pattern is: explore with the CLI first, then write the final code with the SDK."
 argument-hint: "[goal]"
 ---
 
 # Opensteer
 
-Opensteer gives agents a real Chromium browser for two jobs normal code cannot do:
+Opensteer gives AI agents a real Chromium browser — local or cloud. Use it when normal code is not enough because the task depends on a live browser session.
 
-1. **DOM automation** — interact with pages and extract structured data via snapshot-based element targeting.
-2. **API reverse engineering** — capture real browser traffic, identify APIs, test transport portability, and write reusable code.
+Default workflow:
 
-The workflow is always: **explore with CLI, then write reusable code with SDK.**
+1. CLI to explore the site and discover behavior.
+2. Save stable targets with `persist`.
+3. SDK to write the final reusable TypeScript.
 
-## When To Use
-
-- Task involves a website's API, network traffic, auth headers, or replay → **API workflow**
-- Task involves page content, forms, clicking, typing, or extracting visible data → **DOM workflow**
-- Task involves browser profiles, attaching to Chrome, or workspace setup → **Browser management**
-- Unsure → Start with the API workflow. Capture traffic first, then decide.
-
-## Rules
-
-1. Set `--workspace <id>` on every command, or export `OPENSTEER_WORKSPACE`.
-2. Re-snapshot after every navigation before using element numbers.
-3. Import as `import { Opensteer } from "opensteer"` — never a relative path.
-4. SDK constructor needs only two fields:
-   ```ts
-   const opensteer = new Opensteer({ workspace: "demo", rootDir: process.cwd() });
-   ```
-5. `persist` is the only naming mechanism for reusable targets and extractions.
-6. `--capture-network <label>` is opt-in. Add it to any action when you need traffic.
-7. `opensteer.fetch()` works without a page open — it uses the session cookie jar and transport stack directly.
-8. Element numbers come from `c="N"` attributes in snapshot HTML. Always snapshot first, then act.
-
----
+Do not stop at manual exploration if the user needs automation.
 
-## DOM Automation
+## Setup
 
-### Step 1: Open and snapshot
+Install the Opensteer skill so the coding agent can use it:
 
 ```bash
-opensteer open https://example.com --workspace demo
-opensteer snapshot action --workspace demo
+opensteer skills install
 ```
 
-Read the `html` output. Find `c="N"` markers — these are your element IDs.
+This registers the skill with the agent's tool system. Only needed once per environment.
 
-### Step 2: Interact
+## When To Use
 
-```bash
-opensteer click 7 --workspace demo --persist "search button"
-opensteer input 5 "laptop" --workspace demo --press-enter --persist "search input"
-opensteer hover 3 --workspace demo --persist "menu trigger"
-opensteer scroll down 400 --workspace demo
-```
+- Real browser session needed (clicks, forms, DOM extraction, navigation).
+- Cookies, localStorage, sessionStorage, or auth state involved.
+- Reverse-engineering a site API from real browser traffic.
+- Browser-backed `fetch()` instead of plain Node HTTP.
+- Coordinate-based interaction (canvas, WebGL, hard-to-target UI).
+- Need to reuse a real user's logged-in browser profile.
 
-`--persist <key>` saves the element's structural DOM path for deterministic SDK replay. Element number is always required on CLI — persist is save-only, not a targeting mode.
+If the user wants to manually drive a browser and record the flow, use the `recorder` skill instead.
 
-### Step 3: Extract
+## Core Rules
 
-Re-snapshot, then extract with a JSON schema referencing element numbers:
+1. Always use a workspace for stateful commands: `--workspace <id>` or `OPENSTEER_WORKSPACE`.
+2. In this repo, prefer `pnpm run opensteer:local -- <command>` instead of bare `opensteer ...`.
+3. Re-snapshot after navigation or big UI changes before reusing element numbers.
+4. CLI to discover, SDK for the final implementation.
+5. Use `persist` for stable reusable targets and extraction payloads.
+6. Use `exec` for SDK code and API experiments. Use `evaluate` only for page-context JavaScript.
+7. If `fetch()` fails with auth errors, inspect `state()`, `cookies()`, and `storage()` before changing transport.
+8. Keep output simple. Prefer ordinary TypeScript with `Opensteer`, no extra abstraction.
+9. Close the browser when done. Do not leave headed browsers running. Use `opensteer browser delete --workspace <id>` or SDK cleanup when the session does not need to stay open.
 
-```bash
-opensteer snapshot extraction --workspace demo
-opensteer extract '{"items":[{"name":{"element":13},"price":{"element":14}}]}' \
-  --persist "search results" --workspace demo
+## Choose A Path
+
+```
+What does the task need?
+├─ Click, type, navigate, extract visible data → DOM path
+├─ Find or replay a site API → Network path
+├─ Analyze, deobfuscate, or sandbox page JavaScript → Scripts analysis
+├─ Canvas, WebGL, or hard-to-target UI → Computer-use
+├─ Work with multiple tabs or popups → Tab management
+├─ Set up browser profile, clone, or attach → Browser sessions
+├─ Run browser in the cloud → Cloud mode
+├─ Watch what a headless browser is doing → Local view
+└─ Unsure → start by capturing network traffic
 ```
 
-The positional argument is the JSON schema. `--persist` names it for SDK replay.
+## DOM Path
 
-### Step 4: Close
+Use this when the goal is clicking, typing, navigating, or extracting visible data.
+
+### CLI exploration
 
 ```bash
-opensteer close --workspace demo
+opensteer open https://example.com --workspace demo
+opensteer snapshot action --workspace demo
+opensteer input 5 "laptop" --workspace demo --press-enter --persist "search input"
+opensteer click 7 --workspace demo --persist "search button"
+opensteer snapshot extraction --workspace demo
+opensteer extract '{"items":[{"name":{"element":13},"price":{"element":14}}]}' \
+  --workspace demo \
+  --persist "search results"
 ```
 
-### SDK Replay
+Element numbers come from `c="N"` markers in the snapshot HTML.
+
+### SDK implementation
 
 ```ts
 import { Opensteer } from "opensteer";
-const opensteer = new Opensteer({ workspace: "demo", rootDir: process.cwd() });
-
-try {
-  await opensteer.open("https://example.com");
 
-  // Replay by persist key — no element numbers or snapshots needed
-  await opensteer.input({ persist: "search input", text: "laptop", pressEnter: true });
-  await opensteer.click({ persist: "search button" });
+const opensteer = new Opensteer({ workspace: "demo", rootDir: process.cwd() });
 
-  // Extract using cached schema
-  const data = await opensteer.extract({ persist: "search results" });
-  console.log(data);
-} finally {
-  await opensteer.close();
-}
+await opensteer.open("https://example.com");
+await opensteer.input({ persist: "search input", text: "laptop", pressEnter: true });
+await opensteer.click({ persist: "search button" });
+const data = await opensteer.extract({ persist: "search results" });
 ```
 
-When `persist` is used with `element`, it **saves** the path. When used alone, it **resolves** from cache.
+Use `selector` in SDK code only when a stable CSS selector is cleaner than `persist`.
 
----
-
-## API Reverse Engineering
+## Network Path
 
-### Step 1: Capture traffic
+Use this when the goal is to find or replay a site API.
 
-Open the site and trigger the real browser action with `--capture-network`:
+### CLI exploration
 
 ```bash
 opensteer open https://example.com --workspace demo
 opensteer goto https://example.com/search --workspace demo --capture-network page-load
 opensteer input 5 "laptop" --workspace demo --press-enter --capture-network search
+opensteer network query --workspace demo --capture search --json
+opensteer network detail rec_123 --workspace demo --probe
 ```
 
-### Step 2: Find the API
-
-```bash
-opensteer network query --workspace demo --capture search
-opensteer network query --workspace demo --capture search --hostname api.example.com --json
-```
-
-`--json` filters to JSON and GraphQL responses only. Other filters: `--url`, `--path`, `--method`, `--status`, `--type`, `--before`, `--after`, `--limit`.
-
-### Step 3: Inspect and probe transport
-
-```bash
-opensteer network detail rec_123 --workspace demo
-opensteer network detail rec_123 --probe --workspace demo
-```
-
-The first command shows: URL, method, request headers, cookies sent, request/response body preview, GraphQL metadata, redirect chain.
-
-Add `--probe` to also test which transport works for this API:
+Use `network detail --probe` to learn which transport works.
 
-| Transport     | Meaning                        | SDK usage                                       |
-| ------------- | ------------------------------ | ----------------------------------------------- |
-| `direct-http` | Plain HTTP works               | `this.fetch(url)` (default)                     |
-| `matched-tls` | Needs TLS fingerprint matching | `this.fetch(url, { transport: "matched-tls" })` |
-| `page-http`   | Needs a live browser page      | `this.fetch(url, { transport: "page" })`        |
-
-### Step 4: Check browser state (if 401/403)
+### Session state checks
 
 ```bash
 opensteer state example.com --workspace demo
 ```
 
-Look for session cookies, CSRF tokens, or storage-backed auth that the request depends on.
-
-### Step 5: Test and write code with exec
+```ts
+const cookies = await opensteer.cookies("example.com");
+const localStorage = await opensteer.storage("example.com", "local");
+const sessionStorage = await opensteer.storage("example.com", "session");
+const state = await opensteer.state("example.com");
+```
 
-Use `exec` to test the API call with the SDK. The code you write here is the same code that goes in your final script:
+### Prove the request with `exec`
 
 ```bash
 opensteer exec "
-  const r = await this.fetch('https://api.example.com/search', {
+  const response = await this.fetch('https://api.example.com/search', {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify({ keyword: 'laptop', count: 24 }),
   });
-  return { status: r.status, data: await r.json() };
+  return { status: response.status, data: await response.json() };
 " --workspace demo
 ```
 
-`exec` runs JavaScript with the Opensteer SDK bound as `this`. It supports `await` and has access to `this.fetch()`, `this.cookies()`, `this.evaluate()`, and all other SDK methods.
-
-IMPORTANT: Use `exec` instead of `evaluate` for API calls. `evaluate` runs inside the browser page where anti-bot scripts can detect and block programmatic requests. `exec` runs through the framework's transport stack which automatically finds the least detectable path.
-
-### Step 6: Write the final SDK script
-
-```bash
-opensteer close --workspace demo
-```
+### SDK implementation
 
 ```ts
 import { Opensteer } from "opensteer";
+
 const opensteer = new Opensteer({ workspace: "demo", rootDir: process.cwd() });
 
 export async function search(keyword: string) {
@@ -186,161 +157,248 @@ export async function search(keyword: string) {
 }
 ```
 
-`opensteer.fetch()` accepts standard Web Fetch API syntax (`body` as string, `headers` as `Record<string, string>`). It auto-selects the best transport and includes browser cookies by default.
+Use ordinary `fetch()` syntax. Only set `transport` explicitly if probing showed you need it.
 
----
+## Scripts Analysis
+
+Use this when you need to understand what JavaScript a page is running — reverse-engineering obfuscated code, finding hidden API calls, or testing script behavior in isolation.
 
-## Browser Management
+### Capture scripts from the page
 
-### Import a Chrome profile
+```bash
+opensteer scripts capture --workspace demo
+opensteer scripts capture --workspace demo --url-filter "api" --external --dynamic
+```
 
-Copy cookies, localStorage, and session state from an existing Chrome installation:
+Flags: `--inline`, `--external`, `--dynamic`, `--workers` to filter by source type. `--persist` to save as an artifact. `--url-filter <pattern>` to match script URLs.
+
+### Beautify and deobfuscate
 
 ```bash
-opensteer browser clone --workspace my-site \
-  --source-user-data-dir "$HOME/Library/Application Support/Google/Chrome" \
-  --source-profile-directory Default
+# Format minified code
+opensteer scripts beautify <artifactId> --workspace demo --persist
+
+# Deobfuscate packed/obfuscated code
+opensteer scripts deobfuscate <artifactId> --workspace demo --persist
 ```
 
-### Attach to a running browser
+### Sandbox execution
 
-Start Chrome with remote debugging, then connect Opensteer:
+Run captured JavaScript in isolation with controlled inputs:
 
 ```bash
-# Terminal 1: launch Chrome
-/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222
+opensteer scripts sandbox <artifactId> --workspace demo \
+  --fidelity standard \
+  --timeout 5000 \
+  --cookies '{"session":"abc123"}' \
+  --globals '{"window.API_KEY":"test"}' \
+  --ajax-routes '[{"url":"*/api/*","response":{"data":[]}}]'
+```
 
-# Terminal 2: attach Opensteer
-opensteer open https://example.com --workspace demo --attach-endpoint http://localhost:9222
+Fidelity levels: `minimal` (fast, no DOM), `standard` (basic DOM), `full` (complete browser emulation).
+
+### Typical workflow
+
+```bash
+opensteer scripts capture --workspace demo --persist --external
+opensteer artifact read art_abc123 --workspace demo          # inspect raw
+opensteer scripts beautify art_abc123 --workspace demo --persist
+opensteer scripts deobfuscate art_def456 --workspace demo --persist
+opensteer scripts sandbox art_ghi789 --workspace demo
 ```
 
-### Headful mode
+## Computer-Use
+
+Use this only when DOM targeting is not enough.
+
+```bash
+opensteer computer click 245 380 --workspace demo --capture-network action
+opensteer computer type "search query" --workspace demo
+opensteer computer key Enter --workspace demo
+opensteer computer screenshot --workspace demo
+```
+
+```ts
+await opensteer.computerExecute({
+  action: { type: "click", x: 245, y: 380 },
+});
+```
+
+After coordinate-based actions, switch back to normal extraction or request analysis as soon as possible.
+
+## Tab Management
+
+Use when handling OAuth popups, multi-page flows, or any task that opens new tabs.
+
+```bash
+opensteer tab list --workspace demo              # List all open tabs
+opensteer tab new https://example.com --workspace demo   # Open new tab
+opensteer tab 2 --workspace demo                 # Switch to tab 2
+opensteer tab close 3 --workspace demo           # Close tab 3
+opensteer tab close --workspace demo             # Close current tab
+```
+
+```ts
+const tabs = await opensteer.listPages();
+await opensteer.newPage("https://example.com");
+await opensteer.activatePage(2);
+await opensteer.closePage(3);
+```
+
+Re-snapshot after switching tabs — element numbers are per-page.
+
+## Browser Sessions
+
+Each workspace has one browser. Three modes:
+
+| Mode                     | What it does                                    | Data persists?                                                        |
+| ------------------------ | ----------------------------------------------- | --------------------------------------------------------------------- |
+| **Persistent** (default) | Browser tied to workspace, survives restarts    | Yes — cookies, localStorage, logins, history, extensions all retained |
+| **Temporary**            | Headless browser in `/tmp`, cleaned up on close | No                                                                    |
+| **Attach**               | Connects to an already-running browser via CDP  | Depends on that browser                                               |
+
+### Headless vs headed
+
+Browsers launch headless by default. Use `--headless false` to see the browser window:
 
 ```bash
 opensteer open https://example.com --workspace demo --headless false
 ```
 
+Use headed mode for debugging or when the user wants to watch. For hands-free automation, keep headless and use `opensteer view` if a human needs to observe.
+
+### Persistent sessions
+
+When you `opensteer open` with a workspace, the browser's full Chrome user-data directory lives at `~/.opensteer/workspaces/<id>/browser/user-data/`. Everything Chrome normally persists (cookies, localStorage, IndexedDB, history, extensions) survives between runs.
+
+Re-running `opensteer open --workspace demo` reconnects to the existing browser if it's still alive, or launches a fresh one with the same profile if it died.
+
+### Profile cloning
+
+Clone a real user's Chrome profile to start a workspace with their logins already active:
+
+```bash
+# Discover available local browsers and profiles
+opensteer browser discover
+
+# Clone a profile into a workspace
+opensteer browser clone --workspace demo \
+  --source-user-data-dir "$HOME/Library/Application Support/Google/Chrome" \
+  --source-profile-directory Default
+```
+
+This copies cookies, localStorage, extensions, and settings from the source browser. Caches and lock files are skipped. The source browser does not need to be closed — cloning while running is safe.
+
+### Attach to an existing browser
+
+```bash
+opensteer open https://example.com --workspace demo --attach-endpoint http://localhost:9222
+```
+
 ### Workspace lifecycle
 
 ```bash
-opensteer browser status --workspace demo
-opensteer browser reset --workspace demo     # reset browser data, keep workspace
-opensteer browser delete --workspace demo    # delete workspace entirely
+opensteer browser status --workspace demo    # Check if browser is running
+opensteer browser reset --workspace demo     # Wipe browser data, keep workspace
+opensteer browser delete --workspace demo    # Delete workspace entirely
 ```
 
----
+## Cloud Mode
+
+Run the browser on Opensteer's cloud infrastructure instead of locally. Use cloud mode when you need browsers that run 24/7, or when the local machine should not run Chromium.
 
-## Tabs
+### Setup
 
 ```bash
-opensteer tab list --workspace demo
-opensteer tab new https://other-page.com --workspace demo
-opensteer tab 2 --workspace demo             # switch to tab 2
-opensteer tab close 2 --workspace demo
+export OPENSTEER_API_KEY=osk_your_key_here    # Required
+export OPENSTEER_PROVIDER=cloud               # Or use --provider cloud per command
 ```
 
-## Run JavaScript
+### Usage
 
-Use `exec` for API calls and SDK operations (runs in Node.js, avoids bot detection):
+All CLI commands work the same with `--provider cloud`:
 
 ```bash
-opensteer exec "await this.fetch('https://api.example.com/data').then(r => r.json())" --workspace demo
+opensteer open https://example.com --workspace demo --provider cloud
+opensteer snapshot action --workspace demo
+opensteer click 5 --workspace demo
 ```
 
-Use `evaluate` only for DOM inspection (runs inside the browser page):
+### Export local browser profile to cloud
+
+Sync a local browser's cookies to a cloud browser profile so the cloud session starts logged in:
 
 ```bash
-opensteer evaluate "document.title" --workspace demo
+# Reads cookies from local Chrome, decrypts them, uploads to cloud
+opensteer browser clone --workspace demo \
+  --source-user-data-dir "$HOME/Library/Application Support/Google/Chrome" \
+  --source-profile-directory Default \
+  --provider cloud
 ```
 
-## Computer-Use (Coordinate-Based)
+The cookies are extracted from the local SQLite database, decrypted, packaged into a portable format, and uploaded. The cloud browser then starts with those cookies applied.
+
+## Local View
 
-For canvas, WebGL, or complex iframes where DOM element targeting fails:
+When Opensteer runs headless, a human cannot see what the browser is doing. Local view streams live screenshots from headless sessions to a browser-based viewer.
 
 ```bash
-opensteer computer click 245 380 --workspace demo --capture-network action
-opensteer computer type "search query" --workspace demo
-opensteer computer key Enter --workspace demo
-opensteer computer scroll 400 300 --dx 0 --dy -200 --workspace demo
-opensteer computer screenshot --workspace demo
+opensteer view                   # Start viewer service, print URL
+opensteer view stop              # Stop the viewer service
+opensteer view --auto            # Auto-start viewer on every browser launch
+opensteer view --no-auto         # Only start viewer when manually requested
 ```
 
----
+The viewer is a local web UI that shows:
 
-## CLI Quick Reference
-
-| Command                                                    | Positional args      | Key flags                                                               |
-| ---------------------------------------------------------- | -------------------- | ----------------------------------------------------------------------- |
-| `open <url>`                                               | url                  | `--headless`, `--provider`, `--attach-endpoint`, `--attach-header`      |
-| `close`                                                    | —                    | —                                                                       |
-| `status`                                                   | —                    | —                                                                       |
-| `goto <url>`                                               | url                  | `--capture-network`                                                     |
-| `snapshot [mode]`                                          | action \| extraction | —                                                                       |
-| `click <element>`                                          | element number       | `--persist`, `--capture-network`, `--button`                            |
-| `hover <element>`                                          | element number       | `--persist`, `--capture-network`                                        |
-| `input <element> <text>`                                   | element, text        | `--persist`, `--press-enter`, `--capture-network`                       |
-| `scroll <dir> <amount>`                                    | direction, amount    | `--element`, `--persist`, `--capture-network`                           |
-| `extract <schema>`                                         | JSON schema          | `--persist`                                                             |
-| `evaluate <script>`                                        | JS expression        | —                                                                       |
-| `network query`                                            | —                    | `--capture`, `--url`, `--hostname`, `--json`, `--limit`, +6 filters     |
-| `network detail <id>`                                      | recordId             | `--probe`                                                               |
-| `fetch <url>`                                              | url                  | `--method`, `--header`, `--query`, `--body`, `--transport`, `--cookies` |
-| `state [domain]`                                           | domain (optional)    | —                                                                       |
-| `exec <expression>`                                        | JS expression        | —                                                                       |
-| `tab list / new / <n> / close`                             | varies               | —                                                                       |
-| `computer click/type/key/scroll/move/drag/screenshot/wait` | varies               | `--capture-network`                                                     |
-
-## SDK Quick Reference
+- Live JPEG stream of the active browser tab
+- Tab bar with switching
+- Navigation controls (back, forward, reload, URL bar)
 
-```ts
-// Browser lifecycle
-await opensteer.open(url);
-await opensteer.goto(url, { captureNetwork?: "label" });
-await opensteer.close();
-
-// DOM actions — save to cache
-await opensteer.click({ element: 7, persist: "name" });
-await opensteer.input({ element: 5, text: "...", persist: "name", pressEnter: true });
-await opensteer.hover({ element: 3, persist: "name" });
-await opensteer.scroll({ direction: "down", amount: 400 });
-
-// DOM actions — resolve from cache
-await opensteer.click({ persist: "name" });
-await opensteer.input({ persist: "name", text: "..." });
-
-// Extraction
-await opensteer.extract({ persist: "name" });                    // cached schema
-await opensteer.extract({ persist: "name", schema: { ... } });   // inline schema
-
-// Network discovery
-const records = await opensteer.network.query({ capture: "label", limit: 20 });
-const detail = await opensteer.network.detail(recordId);
-
-// Fetch — standard Web Fetch API syntax, auto-selects transport
-const response = await opensteer.fetch(url, {
-  method: "POST",
-  headers: { "content-type": "application/json" },
-  body: JSON.stringify({ keyword: "laptop" }),
-});
+Local view is a passive observer — it connects to the browser's existing CDP endpoint. Starting or stopping it has zero impact on running browser sessions.
+
+## Interaction Capture & Replay
 
-// Browser state
-const cookies = await opensteer.cookies("domain.com"); // .has(), .get(), .serialize()
-const state = await opensteer.state("domain.com");
+Record a trace of browser interactions (clicks, typing, network, DOM changes) and replay them deterministically. Useful for building repeatable test flows or comparing behavior across runs.
 
-// Snapshots
-const html = await opensteer.snapshot("action");
-const html = await opensteer.snapshot("extraction");
+```bash
+opensteer interaction capture --workspace demo --key "login-flow" --duration 30000
+opensteer interaction get <traceId> --workspace demo
+opensteer interaction replay <traceId> --workspace demo
+opensteer interaction diff <traceA> <traceB> --workspace demo
 ```
 
----
+## Artifacts
 
-## Common Issues
+Commands that use `--persist` save artifacts to the workspace. Read them back with:
+
+```bash
+opensteer artifact read <artifactId> --workspace demo
+```
 
-| Symptom                                      | Fix                                                                                                |
-| -------------------------------------------- | -------------------------------------------------------------------------------------------------- |
-| Element numbers wrong after navigation       | Re-snapshot before using element numbers                                                           |
-| `fetch()` returns 401/403                    | Check `state` — request depends on session cookies or tokens                                       |
-| Direct HTTP blocked, browser transport works | Site uses TLS fingerprinting — use `transport: "matched-tls"`                                      |
-| Extract returns empty data                   | Element numbers changed — re-snapshot and rebuild the schema                                       |
-| `fetch()` fails with no session              | Call `opensteer.goto(url)` first to establish cookies, then `fetch()`                              |
-| Using `evaluate` for API calls               | Use `exec` instead — `evaluate` runs inside the page where anti-bot scripts can intercept requests |
+Artifacts are created by `extract --persist`, `scripts capture --persist`, `scripts beautify --persist`, and other persist-enabled commands.
+
+## Useful SDK Surface
+
+- `open(url)`, `goto(url, { captureNetwork? })`, `close()`
+- `snapshot("action" | "extraction")`
+- `click()`, `hover()`, `input()`, `scroll()`
+- `extract()`
+- `listPages()`, `newPage()`, `activatePage()`, `closePage()`
+- `network.query()`, `network.detail()`
+- `waitForNetwork()`, `waitForResponse()`, `waitForPage()`
+- `cookies()`, `storage()`, `state()`
+- `fetch()`
+- `evaluate()`, `addInitScript()`
+- `route()` — intercept and modify network requests
+- `computerExecute()`
+- `browser.status()`, `browser.clone()`, `browser.reset()`, `browser.delete()`
+
+## Guardrails
+
+- Snapshot before using element numbers. Snapshot again after UI changes.
+- Do not use `evaluate` for API work — use `exec` or `fetch`.
+- Do not keep the result as a manual-only workflow if the user needs reusable automation.
+- Prefer a small final script over a large framework.
+- Close browsers when done. Do not leave headed browser windows open.
+- When cloning profiles, verify the source path exists with `opensteer browser discover` first.

package/skills/recorder/SKILL.md

@@ -81,4 +81,4 @@ Cloud recording requires:
 ## References
 
 - [Recorder Reference](references/recorder-reference.md)
-- [Opensteer SDK Reference](../opensteer/references/sdk-reference.md)
+- [Opensteer Skill](../opensteer/SKILL.md)