opensteer 0.9.0 → 0.9.1

package/dist/local-view/serve-entry.d.cts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/local-view/serve-entry.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/local-view/serve-entry.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { runLocalViewService } from '../chunk-Z53HNZ7Z.js';
+import '../chunk-BMPUL66S.js';
+
+// src/local-view/serve-entry.ts
+runLocalViewService().catch((error) => {
+  const payload = error instanceof Error ? {
+    error: {
+      name: error.name,
+      message: error.message
+    }
+  } : {
+    error: {
+      name: "Error",
+      message: String(error)
+    }
+  };
+  process.stderr.write(`${JSON.stringify(payload)}
+`);
+  process.exitCode = 1;
+});
+//# sourceMappingURL=serve-entry.js.map
+//# sourceMappingURL=serve-entry.js.map

package/dist/local-view/serve-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/local-view/serve-entry.ts"],"names":[],"mappings":";;;;;AAIA,mBAAA,EAAoB,CAAE,KAAA,CAAM,CAAC,KAAA,KAAU;AACrC,EAAA,MAAM,OAAA,GACJ,iBAAiB,KAAA,GACb;AAAA,IACE,KAAA,EAAO;AAAA,MACL,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,SAAS,KAAA,CAAM;AAAA;AACjB,GACF,GACA;AAAA,IACE,KAAA,EAAO;AAAA,MACL,IAAA,EAAM,OAAA;AAAA,MACN,OAAA,EAAS,OAAO,KAAK;AAAA;AACvB,GACF;AACN,EAAA,OAAA,CAAQ,OAAO,KAAA,CAAM,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC;AAAA,CAAI,CAAA;AACnD,EAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AACrB,CAAC,CAAA","file":"serve-entry.js","sourcesContent":["#!/usr/bin/env node\n\nimport { runLocalViewService } from \"./serve.js\";\n\nrunLocalViewService().catch((error) => {\n  const payload =\n    error instanceof Error\n      ? {\n          error: {\n            name: error.name,\n            message: error.message,\n          },\n        }\n      : {\n          error: {\n            name: \"Error\",\n            message: String(error),\n          },\n        };\n  process.stderr.write(`${JSON.stringify(payload)}\\n`);\n  process.exitCode = 1;\n});\n"]}

package/dist/opensteer-KZCRP425.js

@@ -0,0 +1,6 @@
+export { Opensteer } from './chunk-L4FWHBQJ.js';
+import './chunk-6PGXWW3X.js';
+import './chunk-4LP7QP2O.js';
+import './chunk-BMPUL66S.js';
+//# sourceMappingURL=opensteer-KZCRP425.js.map
+//# sourceMappingURL=opensteer-KZCRP425.js.map

package/dist/{opensteer-LKX3233A.js.map → opensteer-KZCRP425.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"opensteer-LKX3233A.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"opensteer-KZCRP425.js"}

package/dist/session-control-VGBFOH3Y.js

@@ -0,0 +1,39 @@
+import { OpensteerBrowserManager } from './chunk-4LP7QP2O.js';
+import { readLocalViewSessionManifest, readPersistedLocalBrowserSessionRecord, deleteLocalViewSessionManifest } from './chunk-BMPUL66S.js';
+
+// src/local-view/session-control.ts
+var LocalViewSessionCloseError = class extends Error {
+  constructor(message, statusCode) {
+    super(message);
+    this.statusCode = statusCode;
+    this.name = "LocalViewSessionCloseError";
+  }
+};
+async function closeLocalViewSessionBrowser(sessionId) {
+  const manifest = await readLocalViewSessionManifest(sessionId);
+  if (!manifest) {
+    throw new LocalViewSessionCloseError("Session not found.", 404);
+  }
+  if (manifest.ownership !== "owned") {
+    throw new LocalViewSessionCloseError(
+      "Only Opensteer-owned local browsers can be closed from the local view.",
+      409
+    );
+  }
+  const record = await readPersistedLocalBrowserSessionRecord(manifest.rootPath);
+  if (!record || record.pid !== manifest.pid || record.startedAt !== manifest.startedAt || record.engine !== manifest.engine) {
+    await deleteLocalViewSessionManifest(sessionId).catch(() => void 0);
+    throw new LocalViewSessionCloseError("Session not found.", 404);
+  }
+  const manager = new OpensteerBrowserManager({
+    rootPath: manifest.rootPath,
+    ...manifest.workspace === void 0 ? {} : { workspace: manifest.workspace },
+    engineName: record.engine,
+    browser: "persistent"
+  });
+  await manager.close();
+}
+
+export { LocalViewSessionCloseError, closeLocalViewSessionBrowser };
+//# sourceMappingURL=session-control-VGBFOH3Y.js.map
+//# sourceMappingURL=session-control-VGBFOH3Y.js.map

package/dist/session-control-VGBFOH3Y.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/local-view/session-control.ts"],"names":[],"mappings":";;;;AAOO,IAAM,0BAAA,GAAN,cAAyC,KAAA,CAAM;AAAA,EACpD,WAAA,CACE,SACS,UAAA,EACT;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAFJ,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAGT,IAAA,IAAA,CAAK,IAAA,GAAO,4BAAA;AAAA,EACd;AACF;AAEA,eAAsB,6BAA6B,SAAA,EAAkC;AACnF,EAAA,MAAM,QAAA,GAAW,MAAM,4BAAA,CAA6B,SAAS,CAAA;AAC7D,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,IAAI,0BAAA,CAA2B,oBAAA,EAAsB,GAAG,CAAA;AAAA,EAChE;AAEA,EAAA,IAAI,QAAA,CAAS,cAAc,OAAA,EAAS;AAClC,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,wEAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,sCAAA,CAAuC,QAAA,CAAS,QAAQ,CAAA;AAC7E,EAAA,IACE,CAAC,MAAA,IACD,MAAA,CAAO,GAAA,KAAQ,QAAA,CAAS,GAAA,IACxB,MAAA,CAAO,SAAA,KAAc,QAAA,CAAS,SAAA,IAC9B,MAAA,CAAO,MAAA,KAAW,SAAS,MAAA,EAC3B;AACA,IAAA,MAAM,8BAAA,CAA+B,SAAS,CAAA,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AACrE,IAAA,MAAM,IAAI,0BAAA,CAA2B,oBAAA,EAAsB,GAAG,CAAA;AAAA,EAChE;AAEA,EAAA,MAAM,OAAA,GAAU,IAAI,uBAAA,CAAwB;AAAA,IAC1C,UAAU,QAAA,CAAS,QAAA;AAAA,IACnB,GAAI,SAAS,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAW,QAAA,CAAS,SAAA,EAAU;AAAA,IAC5E,YAAY,MAAA,CAAO,MAAA;AAAA,IACnB,OAAA,EAAS;AAAA,GACV,CAAA;AACD,EAAA,MAAM,QAAQ,KAAA,EAAM;AACtB","file":"session-control-VGBFOH3Y.js","sourcesContent":["import { readPersistedLocalBrowserSessionRecord } from \"../live-session.js\";\nimport { OpensteerBrowserManager } from \"../browser-manager.js\";\nimport {\n  deleteLocalViewSessionManifest,\n  readLocalViewSessionManifest,\n} from \"./session-manifest.js\";\n\nexport class LocalViewSessionCloseError extends Error {\n  constructor(\n    message: string,\n    readonly statusCode: 404 | 409,\n  ) {\n    super(message);\n    this.name = \"LocalViewSessionCloseError\";\n  }\n}\n\nexport async function closeLocalViewSessionBrowser(sessionId: string): Promise<void> {\n  const manifest = await readLocalViewSessionManifest(sessionId);\n  if (!manifest) {\n    throw new LocalViewSessionCloseError(\"Session not found.\", 404);\n  }\n\n  if (manifest.ownership !== \"owned\") {\n    throw new LocalViewSessionCloseError(\n      \"Only Opensteer-owned local browsers can be closed from the local view.\",\n      409,\n    );\n  }\n\n  const record = await readPersistedLocalBrowserSessionRecord(manifest.rootPath);\n  if (\n    !record ||\n    record.pid !== manifest.pid ||\n    record.startedAt !== manifest.startedAt ||\n    record.engine !== manifest.engine\n  ) {\n    await deleteLocalViewSessionManifest(sessionId).catch(() => undefined);\n    throw new LocalViewSessionCloseError(\"Session not found.\", 404);\n  }\n\n  const manager = new OpensteerBrowserManager({\n    rootPath: manifest.rootPath,\n    ...(manifest.workspace === undefined ? {} : { workspace: manifest.workspace }),\n    engineName: record.engine,\n    browser: \"persistent\",\n  });\n  await manager.close();\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opensteer",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Opensteer browser automation, replay, and reverse-engineering toolkit.",
   "license": "MIT",
   "type": "module",
@@ -56,14 +56,14 @@
     "sharp": "^0.34.5",
     "skills": "^1.4.6",
     "ws": "^8.18.0",
-    "@opensteer/runtime-core": "0.2.0",
-    "@opensteer/engine-playwright": "0.8.6"
+    "@opensteer/engine-playwright": "0.8.7",
+    "@opensteer/runtime-core": "0.2.1"
   },
   "optionalDependencies": {
     "webcrack": "^2.15.1"
   },
   "peerDependencies": {
-    "@opensteer/engine-abp": "0.8.7"
+    "@opensteer/engine-abp": "0.8.8"
   },
   "peerDependenciesMeta": {
     "@opensteer/engine-abp": {
@@ -71,12 +71,12 @@
     }
   },
   "devDependencies": {
-    "@opensteer/browser-core": "0.7.8",
-    "@opensteer/engine-abp": "0.8.7",
-    "@opensteer/protocol": "0.8.0"
+    "@opensteer/engine-abp": "0.8.8",
+    "@opensteer/browser-core": "0.7.9",
+    "@opensteer/protocol": "0.8.1"
   },
   "scripts": {
-    "build": "tsup && node ../../scripts/sync-package-skills.mjs",
+    "build": "tsup && node ../../scripts/copy-opensteer-local-view-assets.mjs && node ../../scripts/sync-package-skills.mjs",
     "clean": "rimraf dist skills",
     "typecheck": "tsc --noEmit -p tsconfig.json"
   }

package/skills/README.md

@@ -2,6 +2,9 @@
 
 First-party Opensteer skills published from this repository. Install them through the upstream [`skills`](https://skills.sh) CLI into Codex, Cursor, Claude Code, and other compatible agents.
 
+From an Opensteer checkout, the installer prefers the local `skills/` directory so
+Codex, Cursor, and Claude Code see the current repo `SKILL.md` immediately.
+
 ## Install
 
 ```bash

package/skills/opensteer/SKILL.md

@@ -6,31 +6,34 @@ argument-hint: "[goal]"
 
 # Opensteer
 
-Use Opensteer when normal code is not enough because the task depends on a real browser:
+Opensteer gives AI agents a real Chromium browser — local or cloud. Use it when normal code is not enough because the task depends on a live browser session.
 
-- interact with a real page
-- inspect browser state like cookies or storage
-- capture real network traffic from real browser actions
-- replay requests through the browser session
-- turn the discovery into plain TypeScript
+Default workflow:
 
-The default workflow is:
+1. CLI to explore the site and discover behavior.
+2. Save stable targets with `persist`.
+3. SDK to write the final reusable TypeScript.
 
-1. Use the CLI to explore the site.
-2. Figure out the page or API behavior.
-3. Save stable targets with `persist` when useful.
-4. Write the final reusable code with the SDK.
+Do not stop at manual exploration if the user needs automation.
 
-Do not stop at manual exploration if the user needs automation. Explore first, then convert the result into SDK code.
+## Setup
+
+Install the Opensteer skill so the coding agent can use it:
+
+```bash
+opensteer skills install
+```
+
+This registers the skill with the agent's tool system. Only needed once per environment.
 
 ## When To Use
 
-- The task needs a real browser session.
-- The task involves clicks, forms, DOM extraction, or navigation.
-- The task involves cookies, localStorage, sessionStorage, or auth state.
-- The task involves reverse-engineering a site API from real browser traffic.
-- The task needs browser-backed `fetch()` instead of plain Node HTTP.
-- The task needs coordinate-based fallback because DOM targeting is not enough.
+- Real browser session needed (clicks, forms, DOM extraction, navigation).
+- Cookies, localStorage, sessionStorage, or auth state involved.
+- Reverse-engineering a site API from real browser traffic.
+- Browser-backed `fetch()` instead of plain Node HTTP.
+- Coordinate-based interaction (canvas, WebGL, hard-to-target UI).
+- Need to reuse a real user's logged-in browser profile.
 
 If the user wants to manually drive a browser and record the flow, use the `recorder` skill instead.
 
@@ -39,20 +42,27 @@ If the user wants to manually drive a browser and record the flow, use the `reco
 1. Always use a workspace for stateful commands: `--workspace <id>` or `OPENSTEER_WORKSPACE`.
 2. In this repo, prefer `pnpm run opensteer:local -- <command>` instead of bare `opensteer ...`.
 3. Re-snapshot after navigation or big UI changes before reusing element numbers.
-4. Use the CLI to discover. Use the SDK for the final implementation.
+4. CLI to discover, SDK for the final implementation.
 5. Use `persist` for stable reusable targets and extraction payloads.
 6. Use `exec` for SDK code and API experiments. Use `evaluate` only for page-context JavaScript.
 7. If `fetch()` fails with auth errors, inspect `state()`, `cookies()`, and `storage()` before changing transport.
-8. Keep the final output simple. Prefer ordinary TypeScript with `Opensteer`, not extra abstraction unless the user asks for it.
-9. Close the browser when you are done. Do not leave headed browser windows running on the user's machine. Use `opensteer browser delete --workspace <id>` or the matching SDK cleanup when the session does not need to stay open.
+8. Keep output simple. Prefer ordinary TypeScript with `Opensteer`, no extra abstraction.
+9. Close the browser when done. Do not leave headed browsers running. Use `opensteer browser delete --workspace <id>` or SDK cleanup when the session does not need to stay open.
 
 ## Choose A Path
 
-- Page interaction or extraction: use the DOM path.
-- API discovery or replay: use the network path.
-- Canvas, WebGL, or hard-to-target UI: use computer-use.
-- Browser profile, attach mode, or workspace management: use browser management.
-- Unsure: start by capturing network traffic.
+```
+What does the task need?
+├─ Click, type, navigate, extract visible data → DOM path
+├─ Find or replay a site API → Network path
+├─ Analyze, deobfuscate, or sandbox page JavaScript → Scripts analysis
+├─ Canvas, WebGL, or hard-to-target UI → Computer-use
+├─ Work with multiple tabs or popups → Tab management
+├─ Set up browser profile, clone, or attach → Browser sessions
+├─ Run browser in the cloud → Cloud mode
+├─ Watch what a headless browser is doing → Local view
+└─ Unsure → start by capturing network traffic
+```
 
 ## DOM Path
 
@@ -106,8 +116,6 @@ Use `network detail --probe` to learn which transport works.
 
 ### Session state checks
 
-Use these when auth or browser state matters:
-
 ```bash
 opensteer state example.com --workspace demo
 ```
@@ -151,6 +159,54 @@ export async function search(keyword: string) {
 
 Use ordinary `fetch()` syntax. Only set `transport` explicitly if probing showed you need it.
 
+## Scripts Analysis
+
+Use this when you need to understand what JavaScript a page is running — reverse-engineering obfuscated code, finding hidden API calls, or testing script behavior in isolation.
+
+### Capture scripts from the page
+
+```bash
+opensteer scripts capture --workspace demo
+opensteer scripts capture --workspace demo --url-filter "api" --external --dynamic
+```
+
+Flags: `--inline`, `--external`, `--dynamic`, `--workers` to filter by source type. `--persist` to save as an artifact. `--url-filter <pattern>` to match script URLs.
+
+### Beautify and deobfuscate
+
+```bash
+# Format minified code
+opensteer scripts beautify <artifactId> --workspace demo --persist
+
+# Deobfuscate packed/obfuscated code
+opensteer scripts deobfuscate <artifactId> --workspace demo --persist
+```
+
+### Sandbox execution
+
+Run captured JavaScript in isolation with controlled inputs:
+
+```bash
+opensteer scripts sandbox <artifactId> --workspace demo \
+  --fidelity standard \
+  --timeout 5000 \
+  --cookies '{"session":"abc123"}' \
+  --globals '{"window.API_KEY":"test"}' \
+  --ajax-routes '[{"url":"*/api/*","response":{"data":[]}}]'
+```
+
+Fidelity levels: `minimal` (fast, no DOM), `standard` (basic DOM), `full` (complete browser emulation).
+
+### Typical workflow
+
+```bash
+opensteer scripts capture --workspace demo --persist --external
+opensteer artifact read art_abc123 --workspace demo          # inspect raw
+opensteer scripts beautify art_abc123 --workspace demo --persist
+opensteer scripts deobfuscate art_def456 --workspace demo --persist
+opensteer scripts sandbox art_ghi789 --workspace demo
+```
+
 ## Computer-Use
 
 Use this only when DOM targeting is not enough.
@@ -170,54 +226,179 @@ await opensteer.computerExecute({
 
 After coordinate-based actions, switch back to normal extraction or request analysis as soon as possible.
 
-## Browser Management
+## Tab Management
+
+Use when handling OAuth popups, multi-page flows, or any task that opens new tabs.
+
+```bash
+opensteer tab list --workspace demo              # List all open tabs
+opensteer tab new https://example.com --workspace demo   # Open new tab
+opensteer tab 2 --workspace demo                 # Switch to tab 2
+opensteer tab close 3 --workspace demo           # Close tab 3
+opensteer tab close --workspace demo             # Close current tab
+```
+
+```ts
+const tabs = await opensteer.listPages();
+await opensteer.newPage("https://example.com");
+await opensteer.activatePage(2);
+await opensteer.closePage(3);
+```
+
+Re-snapshot after switching tabs — element numbers are per-page.
+
+## Browser Sessions
+
+Each workspace has one browser. Three modes:
+
+| Mode                     | What it does                                    | Data persists?                                                        |
+| ------------------------ | ----------------------------------------------- | --------------------------------------------------------------------- |
+| **Persistent** (default) | Browser tied to workspace, survives restarts    | Yes — cookies, localStorage, logins, history, extensions all retained |
+| **Temporary**            | Headless browser in `/tmp`, cleaned up on close | No                                                                    |
+| **Attach**               | Connects to an already-running browser via CDP  | Depends on that browser                                               |
+
+### Headless vs headed
 
-Use these when the task is about browser setup rather than page logic.
+Browsers launch headless by default. Use `--headless false` to see the browser window:
 
 ```bash
+opensteer open https://example.com --workspace demo --headless false
+```
+
+Use headed mode for debugging or when the user wants to watch. For hands-free automation, keep headless and use `opensteer view` if a human needs to observe.
+
+### Persistent sessions
+
+When you `opensteer open` with a workspace, the browser's full Chrome user-data directory lives at `~/.opensteer/workspaces/<id>/browser/user-data/`. Everything Chrome normally persists (cookies, localStorage, IndexedDB, history, extensions) survives between runs.
+
+Re-running `opensteer open --workspace demo` reconnects to the existing browser if it's still alive, or launches a fresh one with the same profile if it died.
+
+### Profile cloning
+
+Clone a real user's Chrome profile to start a workspace with their logins already active:
+
+```bash
+# Discover available local browsers and profiles
 opensteer browser discover
-opensteer browser inspect --attach-endpoint http://localhost:9222
+
+# Clone a profile into a workspace
 opensteer browser clone --workspace demo \
   --source-user-data-dir "$HOME/Library/Application Support/Google/Chrome" \
   --source-profile-directory Default
-opensteer browser status --workspace demo
-opensteer browser reset --workspace demo
-opensteer browser delete --workspace demo
 ```
 
-Attach to an existing browser:
+This copies cookies, localStorage, extensions, and settings from the source browser. Caches and lock files are skipped. The source browser does not need to be closed — cloning while running is safe.
+
+### Attach to an existing browser
 
 ```bash
 opensteer open https://example.com --workspace demo --attach-endpoint http://localhost:9222
 ```
 
-Cloud mode:
+### Workspace lifecycle
+
+```bash
+opensteer browser status --workspace demo    # Check if browser is running
+opensteer browser reset --workspace demo     # Wipe browser data, keep workspace
+opensteer browser delete --workspace demo    # Delete workspace entirely
+```
+
+## Cloud Mode
 
-- Use `--provider cloud` on CLI when needed.
-- Common env vars are `OPENSTEER_BASE_URL`, `OPENSTEER_API_KEY`, and `OPENSTEER_CLOUD_APP_BASE_URL`.
+Run the browser on Opensteer's cloud infrastructure instead of locally. Use cloud mode when you need browsers that run 24/7, or when the local machine should not run Chromium.
 
-## Useful SDK Surface
+### Setup
+
+```bash
+export OPENSTEER_API_KEY=osk_your_key_here    # Required
+export OPENSTEER_PROVIDER=cloud               # Or use --provider cloud per command
+```
+
+### Usage
+
+All CLI commands work the same with `--provider cloud`:
+
+```bash
+opensteer open https://example.com --workspace demo --provider cloud
+opensteer snapshot action --workspace demo
+opensteer click 5 --workspace demo
+```
+
+### Export local browser profile to cloud
+
+Sync a local browser's cookies to a cloud browser profile so the cloud session starts logged in:
 
-Use these often:
+```bash
+# Reads cookies from local Chrome, decrypts them, uploads to cloud
+opensteer browser clone --workspace demo \
+  --source-user-data-dir "$HOME/Library/Application Support/Google/Chrome" \
+  --source-profile-directory Default \
+  --provider cloud
+```
+
+The cookies are extracted from the local SQLite database, decrypted, packaged into a portable format, and uploaded. The cloud browser then starts with those cookies applied.
+
+## Local View
+
+When Opensteer runs headless, a human cannot see what the browser is doing. Local view streams live screenshots from headless sessions to a browser-based viewer.
+
+```bash
+opensteer view                   # Start viewer service, print URL
+opensteer view stop              # Stop the viewer service
+opensteer view --auto            # Auto-start viewer on every browser launch
+opensteer view --no-auto         # Only start viewer when manually requested
+```
+
+The viewer is a local web UI that shows:
+
+- Live JPEG stream of the active browser tab
+- Tab bar with switching
+- Navigation controls (back, forward, reload, URL bar)
+
+Local view is a passive observer — it connects to the browser's existing CDP endpoint. Starting or stopping it has zero impact on running browser sessions.
+
+## Interaction Capture & Replay
+
+Record a trace of browser interactions (clicks, typing, network, DOM changes) and replay them deterministically. Useful for building repeatable test flows or comparing behavior across runs.
+
+```bash
+opensteer interaction capture --workspace demo --key "login-flow" --duration 30000
+opensteer interaction get <traceId> --workspace demo
+opensteer interaction replay <traceId> --workspace demo
+opensteer interaction diff <traceA> <traceB> --workspace demo
+```
+
+## Artifacts
+
+Commands that use `--persist` save artifacts to the workspace. Read them back with:
+
+```bash
+opensteer artifact read <artifactId> --workspace demo
+```
+
+Artifacts are created by `extract --persist`, `scripts capture --persist`, `scripts beautify --persist`, and other persist-enabled commands.
+
+## Useful SDK Surface
 
-- `open(url)`
-- `goto(url, { captureNetwork? })`
+- `open(url)`, `goto(url, { captureNetwork? })`, `close()`
 - `snapshot("action" | "extraction")`
 - `click()`, `hover()`, `input()`, `scroll()`
 - `extract()`
-- `network.query()`
-- `network.detail()`
+- `listPages()`, `newPage()`, `activatePage()`, `closePage()`
+- `network.query()`, `network.detail()`
 - `waitForNetwork()`, `waitForResponse()`, `waitForPage()`
 - `cookies()`, `storage()`, `state()`
 - `fetch()`
+- `evaluate()`, `addInitScript()`
+- `route()` — intercept and modify network requests
 - `computerExecute()`
-- `addInitScript()`
 - `browser.status()`, `browser.clone()`, `browser.reset()`, `browser.delete()`
 
 ## Guardrails
 
-- Snapshot before using element numbers.
-- Snapshot again after UI changes.
-- Do not use `evaluate` for API work.
+- Snapshot before using element numbers. Snapshot again after UI changes.
+- Do not use `evaluate` for API work — use `exec` or `fetch`.
 - Do not keep the result as a manual-only workflow if the user needs reusable automation.
 - Prefer a small final script over a large framework.
+- Close browsers when done. Do not leave headed browser windows open.
+- When cloning profiles, verify the source path exists with `opensteer browser discover` first.