unbrowse 1.1.1 → 1.1.3

package/README.md

@@ -15,7 +15,7 @@ One agent learns a site once. Every later agent gets the fast path.
 npx unbrowse setup
 ```
 
-`npx unbrowse setup` downloads the CLI on demand, installs browser assets, registers the Open Code `/unbrowse` command when Open Code is detected, and starts the local server.
+`npx unbrowse setup` downloads the CLI on demand, installs browser assets, lets you register with an email-shaped display identity, registers the Open Code `/unbrowse` command when Open Code is detected, and starts the local server.
 
 For daily use:
 
@@ -30,7 +30,7 @@ If your agent host uses skills:
 npx skills add unbrowse-ai/unbrowse
 ```
 
-Every CLI command auto-starts the local server on `http://localhost:6969` by default. Override with `UNBROWSE_URL`, `PORT`, or `HOST`. On first startup it auto-registers as an agent with the marketplace and caches credentials in `~/.unbrowse/config.json`.
+Every CLI command auto-starts the local server on `http://localhost:6969` by default. Override with `UNBROWSE_URL`, `PORT`, or `HOST`. On first startup it auto-registers as an agent with the marketplace and caches credentials in `~/.unbrowse/config.json`. `unbrowse setup` now prompts for an email-shaped identity first; headless setups can provide `UNBROWSE_AGENT_EMAIL`.
 
 Works with Claude Code, Open Code, Cursor, Codex, Windsurf, and any agent host that can call a local CLI or skill.
 
@@ -57,6 +57,10 @@ unbrowse search --intent "get stock prices"
 - For website tasks, keep the agent on Unbrowse instead of letting it drift into generic web search or ad hoc `curl`.
 - Reddit is still a harder target than most sites because of anti-bot protections. Prefer canonical `.json` routes when available.
 
+## Help shape the next eval
+
+If you tried Unbrowse on a site or API and could not get it to work, add it to [Discussion #53](https://github.com/unbrowse-ai/unbrowse/discussions/53). We use that thread to collect missing or broken targets so we can turn them into requirements for the next eval pass.
+
 ## How it works
 
 When an agent asks for something, Unbrowse first searches the marketplace for an existing skill. If one exists with enough confidence, it executes immediately. If not, Unbrowse captures the site, learns the APIs behind it, publishes a reusable skill, and executes that instead.
@@ -96,7 +100,7 @@ A background verification loop runs every 6 hours, executing safe (GET) endpoint
 
 ## Authentication for gated sites
 
-For most sites, auth is automatic. If you're logged into a site in Chrome or Firefox, Unbrowse reads your cookies directly from the browser's SQLite database — no extra steps needed. Cookies are resolved fresh on every call, so sessions stay current.
+For most sites, auth is automatic. If you're logged into a site in Chrome or Firefox, Unbrowse reads your cookies directly from the browser's SQLite database — no extra steps needed. Cookies are resolved fresh on every call, so sessions stay current. For Chromium-family apps and Electron shells, `/v1/auth/steal` also accepts a custom cookie DB path or user-data dir plus an optional macOS Safe Storage service name.
 
 | Strategy            | How it works                                       | When to use                                          |
 | ------------------- | -------------------------------------------------- | ---------------------------------------------------- |
@@ -124,6 +128,7 @@ See [SKILL.md](./SKILL.md) for the full API reference including all endpoints, s
 | POST   | `/v1/intent/resolve`     | Search marketplace, capture if needed, execute |
 | POST   | `/v1/skills/:id/execute` | Execute a specific skill                       |
 | POST   | `/v1/auth/login`         | Interactive browser login                      |
+| POST   | `/v1/auth/steal`         | Import cookies from browser/Electron storage   |
 | POST   | `/v1/search`             | Semantic search across all domains             |
 | POST   | `/v1/search/domain`      | Semantic search scoped to a domain             |
 | POST   | `/v1/feedback`           | Submit feedback (affects reliability scores)   |
@@ -154,6 +159,7 @@ See [SKILL.md](./SKILL.md) for the full API reference including all endpoints, s
 | `HOST`                     | `127.0.0.1`             | Server bind address          |
 | `UNBROWSE_URL`             | `http://localhost:6969` | Base URL for API calls       |
 | `UNBROWSE_API_KEY`         | auto-generated          | API key override             |
+| `UNBROWSE_AGENT_EMAIL`     | —                       | Preferred email-style agent name for registration |
 | `UNBROWSE_TOS_ACCEPTED`    | —                       | Accept ToS non-interactively |
 | `UNBROWSE_NON_INTERACTIVE` | —                       | Skip readline prompts        |
 

package/dist/cli.js

@@ -22,13 +22,234 @@ var __require = /* @__PURE__ */ createRequire(import.meta.url);
 // ../../src/cli.ts
 import { config as loadEnv } from "dotenv";
 
+// ../../src/client/index.ts
+import { readFileSync, writeFileSync, existsSync, mkdirSync, readdirSync } from "fs";
+import { join } from "path";
+import { homedir, hostname } from "os";
+import { randomBytes } from "crypto";
+import { createInterface } from "readline";
+var API_URL = process.env.UNBROWSE_BACKEND_URL || "https://beta-api.unbrowse.ai";
+var PROFILE_NAME = sanitizeProfileName(process.env.UNBROWSE_PROFILE ?? "");
+var CONFIG_DIR = PROFILE_NAME ? join(homedir(), ".unbrowse", "profiles", PROFILE_NAME) : join(homedir(), ".unbrowse");
+var CONFIG_PATH = join(CONFIG_DIR, "config.json");
+var recentLocalSkills = new Map;
+var LOCAL_ONLY = process.env.UNBROWSE_LOCAL_ONLY === "1";
+function sanitizeProfileName(value) {
+  return value.trim().replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function loadConfig() {
+  try {
+    if (existsSync(CONFIG_PATH)) {
+      return JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
+    }
+  } catch {}
+  return null;
+}
+function saveConfig(config) {
+  if (!existsSync(CONFIG_DIR))
+    mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), { mode: 384 });
+}
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/i;
+function normalizeAgentEmail(value) {
+  return value.trim().toLowerCase();
+}
+function isValidAgentEmail(value) {
+  return EMAIL_RE.test(normalizeAgentEmail(value));
+}
+function buildDefaultAgentName() {
+  return `${hostname()}-${randomBytes(3).toString("hex")}`;
+}
+function resolveAgentName(preferredEmail, fallbackName) {
+  const normalized = normalizeAgentEmail(preferredEmail ?? "");
+  return isValidAgentEmail(normalized) ? normalized : fallbackName;
+}
+function getApiKey() {
+  if (LOCAL_ONLY)
+    return "local-only";
+  if (process.env.UNBROWSE_API_KEY)
+    return process.env.UNBROWSE_API_KEY;
+  const config = loadConfig();
+  if (config?.api_key) {
+    process.env.UNBROWSE_API_KEY = config.api_key;
+    return config.api_key;
+  }
+  return "";
+}
+var API_TIMEOUT_MS = parseInt(process.env.UNBROWSE_API_TIMEOUT ?? "8000", 10);
+async function api(method, path, body, opts) {
+  const key = opts?.noAuth ? "" : getApiKey();
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  let res;
+  try {
+    res = await fetch(`${API_URL}${path}`, {
+      method,
+      headers: {
+        "Content-Type": "application/json",
+        "Accept-Encoding": "gzip, deflate",
+        ...key ? { Authorization: `Bearer ${key}` } : {}
+      },
+      body: body ? JSON.stringify(body) : undefined,
+      signal: controller.signal
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+  let data;
+  try {
+    data = await res.json();
+  } catch {
+    throw new Error(`API error ${res.status} from ${path}`);
+  }
+  if (res.status === 403 && data.error === "tos_update_required") {
+    console.warn(`
+[unbrowse] The Terms of Service have been updated.`);
+    console.warn("[unbrowse] Please restart the unbrowse service to accept the new terms.");
+    throw new Error("ToS update required. Restart unbrowse to accept new terms.");
+  }
+  if (!res.ok) {
+    const errData = data;
+    const msg = errData.details?.length ? `${errData.error}: ${errData.details.join("; ")}` : errData.error ?? `API HTTP ${res.status}`;
+    throw new Error(msg);
+  }
+  return data;
+}
+async function promptTosAcceptance(summary, tosUrl) {
+  if (process.env.UNBROWSE_NON_INTERACTIVE === "1") {
+    if (process.env.UNBROWSE_TOS_ACCEPTED === "1") {
+      console.log("[unbrowse] ToS accepted by user via agent.");
+      return true;
+    }
+    console.log("[unbrowse] ToS acceptance required. Set UNBROWSE_TOS_ACCEPTED=1 after user consents.");
+    console.log(`[unbrowse] ToS summary:
+${summary}`);
+    console.log(`[unbrowse] Full terms: ${tosUrl}`);
+    return false;
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  console.log(`
+` + "=".repeat(60));
+  console.log("UNBROWSE TERMS OF SERVICE");
+  console.log("=".repeat(60));
+  console.log(summary);
+  console.log("=".repeat(60));
+  return new Promise((resolve) => {
+    rl.question(`
+Do you accept the Terms of Service? (y/n): `, (answer) => {
+      rl.close();
+      resolve(answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes");
+    });
+  });
+}
+async function promptAgentEmail(defaultName) {
+  const envEmail = process.env.UNBROWSE_AGENT_EMAIL;
+  if (envEmail) {
+    const resolved = resolveAgentName(envEmail, defaultName);
+    if (resolved !== defaultName)
+      return resolved;
+    console.warn(`[unbrowse] Ignoring invalid UNBROWSE_AGENT_EMAIL: ${envEmail}`);
+  }
+  if (process.env.UNBROWSE_NON_INTERACTIVE === "1" || !process.stdin.isTTY || !process.stdout.isTTY) {
+    return defaultName;
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    for (;; ) {
+      const answer = await new Promise((resolve) => {
+        rl.question(`
+Email for this agent (leave blank to use a local device id): `, resolve);
+      });
+      const trimmed = answer.trim();
+      if (!trimmed)
+        return defaultName;
+      if (isValidAgentEmail(trimmed))
+        return normalizeAgentEmail(trimmed);
+      console.log("Please enter a valid email address or press Enter to skip.");
+    }
+  } finally {
+    rl.close();
+  }
+}
+async function checkTosStatus() {
+  const config = loadConfig();
+  let tosInfo;
+  try {
+    tosInfo = await api("GET", "/v1/tos/current");
+  } catch {
+    return;
+  }
+  if (config?.tos_accepted_version === tosInfo.version) {
+    return;
+  }
+  console.log(`
+The Unbrowse Terms of Service have been updated.`);
+  const accepted = await promptTosAcceptance(tosInfo.summary, tosInfo.url);
+  if (!accepted) {
+    console.log("You must accept the updated Terms of Service to continue using Unbrowse.");
+    process.exit(1);
+  }
+  try {
+    await api("POST", "/v1/agents/accept-tos", { tos_version: tosInfo.version });
+    if (config) {
+      config.tos_accepted_version = tosInfo.version;
+      config.tos_accepted_at = new Date().toISOString();
+      saveConfig(config);
+    }
+    console.log("Terms of Service accepted.");
+  } catch (err) {
+    console.warn(`Failed to record ToS acceptance: ${err.message}`);
+  }
+}
+async function ensureRegistered(options) {
+  if (LOCAL_ONLY)
+    return;
+  if (getApiKey()) {
+    await checkTosStatus();
+    return;
+  }
+  let tosInfo;
+  try {
+    tosInfo = await api("GET", "/v1/tos/current");
+  } catch {
+    console.warn("[unbrowse] Cannot reach unbrowse API. Registration requires internet access.");
+    console.warn("[unbrowse] Set UNBROWSE_API_KEY manually or try again when online.");
+    return;
+  }
+  const accepted = await promptTosAcceptance(tosInfo.summary, tosInfo.url);
+  if (!accepted) {
+    console.log("You must accept the Terms of Service to use Unbrowse.");
+    process.exit(1);
+  }
+  const fallbackName = buildDefaultAgentName();
+  const name = options?.promptForEmail ? await promptAgentEmail(fallbackName) : resolveAgentName(process.env.UNBROWSE_AGENT_EMAIL, fallbackName);
+  console.log(`Registering as "${name}"...`);
+  try {
+    const { agent_id, api_key } = await api("POST", "/v1/agents/register", { name, tos_version: tosInfo.version });
+    process.env.UNBROWSE_API_KEY = api_key;
+    saveConfig({
+      api_key,
+      agent_id,
+      agent_name: name,
+      registered_at: new Date().toISOString(),
+      tos_accepted_version: tosInfo.version,
+      tos_accepted_at: new Date().toISOString()
+    });
+    console.log(`Registered as ${name}. API key saved to ~/.unbrowse/config.json`);
+  } catch (err) {
+    console.warn(`Registration failed: ${err.message}`);
+    console.warn("Set UNBROWSE_API_KEY manually or try again.");
+    process.exit(1);
+  }
+}
+
 // ../../src/runtime/local-server.ts
-import { openSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { openSync, readFileSync as readFileSync2, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
 import path2 from "node:path";
 import { spawn } from "node:child_process";
 
 // ../../src/runtime/paths.ts
-import { existsSync, mkdirSync, realpathSync } from "node:fs";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, realpathSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { createRequire as createRequire2 } from "node:module";
@@ -56,7 +277,7 @@ function runtimeArgsForEntrypoint(metaUrl, entrypoint) {
     const req = createRequire2(metaUrl);
     const tsxPkg = req.resolve("tsx/package.json");
     const tsxLoader = path.join(path.dirname(tsxPkg), "dist", "loader.mjs");
-    if (existsSync(tsxLoader))
+    if (existsSync2(tsxLoader))
       return ["--import", tsxLoader, entrypoint];
   } catch {}
   return ["--import", "tsx", entrypoint];
@@ -65,8 +286,8 @@ function getUnbrowseHome() {
   return path.join(os.homedir(), ".unbrowse");
 }
 function ensureDir(dir) {
-  if (!existsSync(dir))
-    mkdirSync(dir, { recursive: true });
+  if (!existsSync2(dir))
+    mkdirSync2(dir, { recursive: true });
   return dir;
 }
 function getLogsDir() {
@@ -116,7 +337,7 @@ function isPidAlive(pid) {
 }
 function readPidState(pidFile) {
   try {
-    return JSON.parse(readFileSync(pidFile, "utf-8"));
+    return JSON.parse(readFileSync2(pidFile, "utf-8"));
   } catch {
     return null;
   }
@@ -164,7 +385,7 @@ async function ensureLocalServer(baseUrl, noAutoStart, metaUrl) {
     }
   });
   child.unref();
-  writeFileSync(pidFile, JSON.stringify({
+  writeFileSync2(pidFile, JSON.stringify({
     pid: child.pid,
     base_url: baseUrl,
     started_at: new Date().toISOString(),
@@ -176,7 +397,7 @@ async function ensureLocalServer(baseUrl, noAutoStart, metaUrl) {
 }
 
 // ../../src/runtime/paths.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, realpathSync as realpathSync2 } from "node:fs";
 import path3 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function isMainModule(metaUrl) {
@@ -194,7 +415,7 @@ function isMainModule(metaUrl) {
 // ../../src/runtime/setup.ts
 import { execFileSync } from "node:child_process";
 import { createRequire as createRequire3 } from "node:module";
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3 } from "node:fs";
 import os2 from "node:os";
 import path4 from "node:path";
 var req = createRequire3(import.meta.url);
@@ -228,7 +449,7 @@ function getOpenCodeProjectCommandsDir(cwd) {
   return path4.join(cwd, ".opencode", "commands");
 }
 function detectOpenCode(cwd) {
-  return hasBinary("opencode") || existsSync3(path4.join(resolveConfigHome(), "opencode")) || existsSync3(path4.join(cwd, ".opencode"));
+  return hasBinary("opencode") || existsSync4(path4.join(resolveConfigHome(), "opencode")) || existsSync4(path4.join(cwd, ".opencode"));
 }
 function renderOpenCodeCommand() {
   return `---
@@ -256,13 +477,13 @@ function writeOpenCodeCommand(scope, cwd) {
   if (scope === "auto" && !detected) {
     return { detected: false, action: "not-detected", scope: "off" };
   }
-  const resolvedScope = scope === "project" ? "project" : scope === "global" ? "global" : existsSync3(path4.join(cwd, ".opencode")) ? "project" : "global";
+  const resolvedScope = scope === "project" ? "project" : scope === "global" ? "global" : existsSync4(path4.join(cwd, ".opencode")) ? "project" : "global";
   const commandsDir = resolvedScope === "project" ? getOpenCodeProjectCommandsDir(cwd) : getOpenCodeGlobalCommandsDir();
   const commandFile = path4.join(ensureDir(commandsDir), "unbrowse.md");
   const content = renderOpenCodeCommand();
-  const action = existsSync3(commandFile) ? "updated" : "installed";
-  mkdirSync3(path4.dirname(commandFile), { recursive: true });
-  writeFileSync2(commandFile, content);
+  const action = existsSync4(commandFile) ? "updated" : "installed";
+  mkdirSync4(path4.dirname(commandFile), { recursive: true });
+  writeFileSync3(commandFile, content);
   return {
     detected: detected || scope !== "auto",
     action,
@@ -273,7 +494,7 @@ function writeOpenCodeCommand(scope, cwd) {
 async function ensureBrowserEngineInstalled() {
   try {
     const { chromium } = await import("playwright-core");
-    if (existsSync3(chromium.executablePath())) {
+    if (existsSync4(chromium.executablePath())) {
       return { installed: true, action: "already-installed" };
     }
     const agentBrowserBin = req.resolve("agent-browser/bin/agent-browser.js");
@@ -330,7 +551,7 @@ function parseArgs(argv) {
   }
   return { command, args: positional, flags };
 }
-async function api(method, path5, body) {
+async function api2(method, path5, body) {
   const res = await fetch(`${BASE_URL}${path5}`, {
     method,
     headers: {
@@ -486,6 +707,41 @@ function hasMeaningfulValue(value) {
     return Object.values(value).some((item) => hasMeaningfulValue(item));
   return false;
 }
+function isPlainRecord(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function isScalarLike(value) {
+  if (value == null)
+    return false;
+  if (typeof value === "string")
+    return value.trim().length > 0;
+  if (typeof value === "number" || typeof value === "boolean")
+    return true;
+  if (Array.isArray(value)) {
+    return value.length > 0 && value.every((item) => item == null || typeof item === "string" || typeof item === "number" || typeof item === "boolean");
+  }
+  return false;
+}
+function looksStructuredForDirectOutput(value) {
+  if (Array.isArray(value)) {
+    const sample = value.filter(isPlainRecord).slice(0, 3);
+    if (sample.length === 0)
+      return false;
+    const simpleRows = sample.filter((row) => {
+      const keys2 = Object.keys(row);
+      const scalarFields2 = Object.values(row).filter(isScalarLike).length;
+      return keys2.length > 0 && keys2.length <= 20 && scalarFields2 >= 2;
+    });
+    return simpleRows.length >= Math.ceil(sample.length / 2);
+  }
+  if (!isPlainRecord(value))
+    return false;
+  const keys = Object.keys(value);
+  if (keys.length === 0 || keys.length > 20)
+    return false;
+  const scalarFields = Object.values(value).filter(isScalarLike).length;
+  return scalarFields >= 2;
+}
 function applyTransforms(result, flags) {
   let data = result;
   const entityIndex = detectEntityIndex(result);
@@ -561,6 +817,9 @@ function autoExtractOrWrap(obj) {
   const resultStr = JSON.stringify(obj.result ?? "");
   if (resultStr.length < 2000)
     return obj;
+  if (looksStructuredForDirectOutput(obj.result)) {
+    return slimTrace({ ...obj, extraction_hints: undefined, response_schema: undefined });
+  }
   if (!hints)
     return obj;
   if (hints.confidence === "high") {
@@ -585,7 +844,7 @@ function autoExtractOrWrap(obj) {
   return wrapWithHints(obj);
 }
 async function cmdHealth(flags) {
-  output(await api("GET", "/health"), !!flags.pretty);
+  output(await api2("GET", "/health"), !!flags.pretty);
 }
 async function cmdResolve(flags) {
   const intent = flags.intent;
@@ -615,7 +874,7 @@ async function cmdResolve(flags) {
   if (flags.raw || hasTransforms)
     body.projection = { raw: true };
   const startedAt = Date.now();
-  let result = await withPendingNotice(api("POST", "/v1/intent/resolve", body), "Still working. First-time capture/indexing for a site can take 20-80s. Waiting is usually better than falling back.");
+  let result = await withPendingNotice(api2("POST", "/v1/intent/resolve", body), "Still working. First-time capture/indexing for a site can take 20-80s. Waiting is usually better than falling back.");
   if (flags.schema) {
     output(schemaOnly(result), !!flags.pretty);
     return;
@@ -657,7 +916,7 @@ async function cmdExecute(flags) {
   const hasTransforms = !!(flags.path || flags.extract);
   if (flags.raw || hasTransforms)
     body.projection = { raw: true };
-  let result = await withPendingNotice(api("POST", `/v1/skills/${skillId}/execute`, body), "Still working. This endpoint may require browser replay or first-time auth/capture setup.");
+  let result = await withPendingNotice(api2("POST", `/v1/skills/${skillId}/execute`, body), "Still working. This endpoint may require browser replay or first-time auth/capture setup.");
   if (flags.schema) {
     output(schemaOnly(result), !!flags.pretty);
     return;
@@ -684,22 +943,22 @@ async function cmdFeedback(flags) {
     body.outcome = flags.outcome;
   if (flags.diagnostics)
     body.diagnostics = JSON.parse(flags.diagnostics);
-  output(await api("POST", "/v1/feedback", body), !!flags.pretty);
+  output(await api2("POST", "/v1/feedback", body), !!flags.pretty);
 }
 async function cmdLogin(flags) {
   const url = flags.url;
   if (!url)
     die("--url is required");
-  output(await api("POST", "/v1/auth/login", { url }), !!flags.pretty);
+  output(await api2("POST", "/v1/auth/login", { url }), !!flags.pretty);
 }
 async function cmdSkills(flags) {
-  output(await api("GET", "/v1/skills"), !!flags.pretty);
+  output(await api2("GET", "/v1/skills"), !!flags.pretty);
 }
 async function cmdSkill(args, flags) {
   const id = args[0] ?? flags.id;
   if (!id)
     die("skill <id> or --id required");
-  output(await api("GET", `/v1/skills/${id}`), !!flags.pretty);
+  output(await api2("GET", `/v1/skills/${id}`), !!flags.pretty);
 }
 async function cmdSearch(flags) {
   const intent = flags.intent;
@@ -710,14 +969,14 @@ async function cmdSearch(flags) {
   const body = { intent, k: Number(flags.k) || 5 };
   if (domain)
     body.domain = domain;
-  output(await api("POST", path5, body), !!flags.pretty);
+  output(await api2("POST", path5, body), !!flags.pretty);
 }
 async function cmdSessions(flags) {
   const domain = flags.domain;
   if (!domain)
     die("--domain is required");
   const limit = flags.limit ?? "10";
-  output(await api("GET", `/v1/sessions/${domain}?limit=${limit}`), !!flags.pretty);
+  output(await api2("GET", `/v1/sessions/${domain}?limit=${limit}`), !!flags.pretty);
 }
 async function cmdSetup(flags) {
   info("Running setup checks");
@@ -741,6 +1000,9 @@ async function cmdSetup(flags) {
       process.exit(1);
     return;
   }
+  if (!getApiKey()) {
+    await ensureRegistered({ promptForEmail: true });
+  }
   try {
     await ensureLocalServer(BASE_URL, false, import.meta.url);
     report.server = { started: true, base_url: BASE_URL };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbrowse",
-  "version": "1.1.1",
+  "version": "1.1.3",
   "description": "Reverse-engineer any website into reusable API skills. npm CLI + local engine.",
   "type": "module",
   "bin": {

package/runtime-src/api/routes.ts

@@ -10,6 +10,7 @@ import { recordFeedback, recordDiagnostics, getApiKey, getRecentLocalSkill } fro
 import { ROUTE_LIMITS } from "../ratelimit/index.js";
 import type { ProjectionOptions } from "../types/index.js";
 import { getSkillChunk, toAgentSkillChunkView } from "../graph/index.js";
+import { listRecentSessionsForDomain } from "../session-logs.js";
 import { writeFileSync, existsSync, mkdirSync } from "fs";
 import { join } from "path";
 
@@ -206,20 +207,44 @@ export async function registerRoutes(app: FastifyInstance) {
     }
   });
 
-  // POST /v1/auth/steal — extract cookies from Chrome/Firefox SQLite DBs.
+  // POST /v1/auth/steal — extract cookies from Firefox/Chrome/custom Chromium-family SQLite DBs.
   // No browser launch, Chrome can stay open. Higher rate limit since it's instant.
   app.post("/v1/auth/steal", { config: { rateLimit: { max: 30, timeWindow: "1 minute" } } }, async (req, reply) => {
-    const { url, chrome_profile, firefox_profile } = req.body as {
+    const {
+      url,
+      browser,
+      chrome_profile,
+      firefox_profile,
+      chromium_profile,
+      chromium_user_data_dir,
+      chromium_cookie_db_path,
+      safe_storage_service,
+      browser_name,
+    } = req.body as {
       url: string;
+      browser?: "auto" | "firefox" | "chrome" | "chromium";
       chrome_profile?: string;
       firefox_profile?: string;
+      chromium_profile?: string;
+      chromium_user_data_dir?: string;
+      chromium_cookie_db_path?: string;
+      safe_storage_service?: string;
+      browser_name?: string;
     };
     if (!url) return reply.code(400).send({ error: "url required" });
     try {
       const domain = new URL(url).hostname;
       const result = await extractBrowserAuth(domain, {
+        browser,
         chromeProfile: chrome_profile,
         firefoxProfile: firefox_profile,
+        chromium: {
+          profile: chromium_profile,
+          userDataDir: chromium_user_data_dir,
+          cookieDbPath: chromium_cookie_db_path,
+          safeStorageService: safe_storage_service,
+          browserName: browser_name,
+        },
       });
       return reply.send(result);
     } catch (err) {
@@ -277,6 +302,18 @@ export async function registerRoutes(app: FastifyInstance) {
   // GET /health
   app.get("/health", async (_req, reply) => reply.send({ status: "ok", trace_version: TRACE_VERSION, code_hash: CODE_HASH, git_sha: GIT_SHA }));
 
+  // GET /v1/sessions/:domain — read local trace/debug files instead of proxying to backend
+  app.get("/v1/sessions/:domain", async (req, reply) => {
+    const { domain } = req.params as { domain: string };
+    const query = req.query as { limit?: string | number };
+    const limitRaw = typeof query.limit === "number" ? query.limit : Number(query.limit ?? 10);
+    const limit = Number.isFinite(limitRaw) ? Math.min(Math.max(limitRaw, 1), 50) : 10;
+    return reply.send({
+      domain,
+      sessions: listRecentSessionsForDomain(TRACES_DIR, domain, limit),
+    });
+  });
+
   // Catch-all proxy: forward unmatched /v1/* routes to beta-api.unbrowse.ai
   app.all("/v1/*", async (req, reply) => {
     const key = getApiKey();