unbrowse 2.12.1 → 2.12.4

package/README.md

@@ -41,6 +41,13 @@ Typical MCP host config:
 
 ## Quick start
 
+```bash
+# One-line install from the latest GitHub release
+curl -fsSL https://unbrowse.ai/install.sh | sh
+```
+
+That installer now follows the Kuri pattern: detect platform, download the matching release tarball, install `unbrowse` into `~/.local/bin`, then run `unbrowse setup`.
+
 ```bash
 # Deterministic setup from a repo clone
 git clone --single-branch --depth 1 https://github.com/unbrowse-ai/unbrowse.git ~/unbrowse
@@ -62,6 +69,9 @@ npm install -g unbrowse
 unbrowse setup
 ```
 
+The npm package is binary-first: install downloads the prebuilt Bun-compiled CLI for your platform. It does not ship the TypeScript runtime or JS fallback launcher.
+On supported platforms, install now fails fast if the matching GitHub release asset is missing or unreachable.
+
 For generic MCP hosts:
 
 ```bash
@@ -140,6 +150,17 @@ unbrowse search --intent "get stock prices"
 
 For most MCP hosts, the standard flow is `unbrowse_resolve` first, then `unbrowse_execute`. For JS-heavy or first-time capture workflows, use the browser tool chain: `unbrowse_go -> unbrowse_snap -> action tools -> unbrowse_submit/unbrowse_sync -> unbrowse_close`.
 
+## Dependency walk for multi-step UIs
+
+Treat each successful browser submit as a dependency boundary.
+
+- Do not jump straight to guessed downstream URLs like `/date-selection.html` or `/payment.html` unless the current session already reached them through the real page flow.
+- Use `unbrowse_submit` for the actual transition, then trust the returned `url`, `session_id`, and any next-step hints over your own assumptions.
+- `unbrowse_sync` after a good transition so the route graph records which request chain unlocked the next page.
+- If a page later returns `abandonedCart`, `session_expired`, or a wrong audience/product variant, restart from the last known good upstream step and walk forward again.
+
+The dependency graph is not just API-to-API. On JS-heavy checkout flows it also captures browser-state prerequisites: selected product, resident/non-resident audience, date, slot, auth, and cart state. Future agents should reason from those prerequisites before calling deeper steps.
+
 ## Demo notes
 
 - First-time capture/indexing on a site can take 20-80 seconds. That is the slow path; repeats should be much faster.
@@ -220,6 +241,7 @@ Non-GET endpoints (POST, PUT, DELETE) require explicit confirmation:
 
 - `dry_run: true` — preview what would execute without side effects
 - `confirm_unsafe: true` — explicit user consent to proceed
+- `confirm_third_party_terms: true` — extra explicit confirmation for policy-sensitive domains/actions such as X write endpoints
 
 GET endpoints auto-execute. Mutations never fire without opt-in.