unbrowse 2.12.2 → 2.12.7

package/runtime-src/reverse-engineer/index.ts

@@ -6,8 +6,7 @@ import { nanoid } from "nanoid";
 import { inferEndpointSemantic } from "../graph/index.js";
 import { writeDebugTrace } from "../debug-trace.js";
 import { buildQueryBindingMap } from "../template-params.js";
-import { buildDescriptionPrompt, groundedDescription, extractResponseKeys } from "./description-prompt.js";
-import { isRscPayload, extractRscDataEndpoints } from "../capture/rsc.js";
+
 const SKIP_EXTENSIONS = /\.(js|mjs|css|png|jpg|jpeg|gif|svg|ico|woff|woff2|ttf|map|webp|html|avif)([?#]|$)/i;
 const SKIP_JS_BUNDLES = /\/(boq-|_\/mss\/|og\/_\/js\/|_\/scs\/)/i;
 const SKIP_PATHS = /\/_next\/static\/|\/_next\/data\/|\/_next\/image|\/static\/chunks\/|\/static\/media\/|\/cdn-cgi\//i;
@@ -55,19 +54,6 @@ const STRIP_HEADER_PREFIXES = [
   "x-firebase-",      // Firebase auth headers
 ];
 
-// Browser-captured headers that are not secrets themselves, but are still
-// required to replay authenticated requests after publish-time header redaction.
-const REPLAY_HEADER_PREFIXES = [
-  "x-li-",
-];
-const REPLAY_HEADER_EXACT = new Set([
-  "accept",
-  "csrf-token",
-  "origin",
-  "x-requested-with",
-  "x-restli-protocol-version",
-]);
-
 // Headers known to be safe (non-sensitive) — used by the catch-all filter below
 const SAFE_HEADERS = new Set([
   "accept", "accept-encoding", "accept-language", "cache-control",
@@ -178,36 +164,23 @@ function buildEndpointDescription(
   sampleResponse: unknown,
 ): string {
   const url = new URL(req.url);
-
-  // Build param descriptors from the flattened sample request so the
-  // description is grounded in the actual parameters observed at capture time.
-  const params: Array<{ name: string; in: string; example?: string }> = [];
-  for (const [key, value] of Object.entries(sampleRequest)) {
-    // Determine whether the param came from the query string or the body.
-    const inKind = url.searchParams.has(key) ? "query"
-      : url.pathname.includes(`{${key}}`) ? "path"
-      : "body";
-    const example = value != null && typeof value !== "object" ? String(value) : undefined;
-    params.push({ name: key, in: inKind, ...(example ? { example } : {}) });
-  }
-
-  const responseKeys = extractResponseKeys(sampleResponse);
-
-  const ctx = {
-    url_template: req.url,
-    method: req.method,
-    params,
-    sample_response_keys: responseKeys.length > 0 ? responseKeys : undefined,
-    domain: url.hostname,
-  };
-
-  // Build the grounding prompt (available for optional LLM polish in
-  // backend/services/descriptions.ts) and the deterministic description.
-  const _prompt = buildDescriptionPrompt(ctx);
-
-  // Use the grounded description builder from description-prompt.ts so
-  // every description references real params and response fields.
-  return groundedDescription(ctx);
+  const pathTail = url.pathname.split("/").filter(Boolean).slice(-2).join(" ");
+  const requestKeys = Object.keys(sampleRequest).slice(0, 4);
+  const response = summarizeResponseExample(sampleResponse);
+  const action = requestKeys.some((key) => /^(q|query|search|term)$/i.test(key)) || /search|find|lookup/.test(url.pathname)
+    ? "Searches"
+    : /status|health|incident|maintenance/.test(url.pathname)
+      ? "Returns status for"
+      : url.pathname.match(/\{[^}]+\}|\/[0-9A-Za-z_-]{4,}(\/|$)/)
+        ? "Returns details for"
+        : "Returns";
+  const subjectSource = new Set(["response", "data", "result", "results", "item", "items"]).has(response.subject.toLowerCase())
+    ? inferPathSubject(url.pathname)
+    : response.subject;
+  const subject = titleCase(subjectSource === "response" ? (pathTail || url.hostname) : subjectSource);
+  const fieldText = response.fields.length > 0 ? ` with ${response.fields.join(", ")}` : "";
+  const inputText = requestKeys.length > 0 ? ` using ${requestKeys.join(", ")}` : "";
+  return `${action} ${subject}${fieldText}${inputText}`;
 }
 
 function looksLikeAdResponse(body: string | undefined): boolean {
@@ -408,8 +381,8 @@ function inferCsrfPlan(req: RawRequest, parsedBody?: unknown): CsrfPlan | undefi
     Object.entries(req.request_headers).map(([key, value]) => [key.toLowerCase(), value]),
   );
   const cookies = parseCookieHeader(headers["cookie"]);
-  const csrfCookieNames = Object.keys(cookies).filter((name) => /^(ct0|csrf_token|_csrf|csrftoken|xsrf-token|_xsrf|jsessionid)$/i.test(name));
-  const headerName = ["x-csrf-token", "x-xsrf-token", "x-csrftoken", "csrf-token"].find((name) => typeof headers[name] === "string" && headers[name].length > 0);
+  const csrfCookieNames = Object.keys(cookies).filter((name) => /^(ct0|csrf_token|_csrf|csrftoken|xsrf-token|_xsrf)$/i.test(name));
+  const headerName = ["x-csrf-token", "x-xsrf-token", "x-csrftoken"].find((name) => typeof headers[name] === "string" && headers[name].length > 0);
   if (headerName && csrfCookieNames.length > 0) {
     return {
       source: "cookie",
@@ -575,8 +548,6 @@ function scoreRequest(req: RawRequest): number {
   // Penalise Next.js RSC navigation requests — framework wire format, not data
   if (req.url.includes("_rsc=")) score -= 3;
   if (ct.includes("text/x-component")) score -= 10; // RSC wire format
-  // #227: Structural RSC body detection — catches payloads without URL/content-type hints
-  if (isRscPayload(req.response_body ?? "")) score -= 15;
   // Penalise on-domain noise (framework plumbing, recaptcha, consent, ad bids)
   try { if (ON_DOMAIN_NOISE.test(new URL(req.url).pathname)) score -= 15; } catch {}
   // Reward rich JSON responses (data endpoints have deep objects, noise has shallow)
@@ -629,46 +600,7 @@ export function extractEndpoints(requests: RawRequest[], wsMessages?: CapturedWs
       continue;
     }
     if (!hasAdmissibleParsedBody(req.response_body)) {
-      // API endpoints may have large/truncated/missing response bodies.
-      // Admit them anyway if the URL pattern is clearly an API endpoint.
-      const urlPath = (() => { try { return new URL(req.url).pathname; } catch { return ""; } })();
-      const isApiUrl = /\/(api|graphql)\b/i.test(urlPath) || /\.(json)(\?|$)/.test(req.url);
-
-      // For GraphQL: extract operationName from request body or URL
-      let graphqlOpName: string | undefined;
-      if (/graphql/i.test(req.url)) {
-        if (req.request_body) {
-          try {
-            const body = JSON.parse(req.request_body);
-            graphqlOpName = body.operationName ?? body.query?.match(/(?:query|mutation)\s+(\w+)/)?.[1];
-          } catch { /* not JSON */ }
-        }
-        // Also try extracting from URL query (GET GraphQL endpoints encode operationName in URL)
-        if (!graphqlOpName) {
-          const urlMatch = req.url.match(/\/graphql\/\w+\/(\w+)/);
-          if (urlMatch) graphqlOpName = urlMatch[1];
-        }
-      }
-
-      // For .json endpoints: use the last path segment as description
-      const jsonEndpointName = /\.(json)(\?|$)/.test(req.url) ? urlPath.split("/").pop()?.replace(".json", "") : undefined;
-
-      if (!isApiUrl) {
-        traceRows.push({ url: req.url, method: req.method, score, kept: false, reason: "body_not_json_or_html" });
-        continue;
-      }
-
-      // Inject a synthetic response body so downstream processing works
-      const syntheticName = graphqlOpName ?? jsonEndpointName ?? "api_endpoint";
-      req.response_body = JSON.stringify({ data: { __typename: syntheticName } });
-      req.response_headers = { ...req.response_headers, "content-type": "application/json" };
-    }
-    // #227: Reject React Server Components wire format payloads — they are framework
-    // rendering wire format, not data APIs. Use the proper RSC parser instead of
-    // relying solely on URL heuristics (_rsc=) or content-type (text/x-component).
-    if (isRscPayload(req.response_body ?? "")) {
-      const rscUrls = extractRscDataEndpoints(req.response_body ?? "");
-      traceRows.push({ url: req.url, method: req.method, score, kept: false, reason: "rsc_payload", rsc_embedded_urls: rscUrls.length > 0 ? rscUrls : undefined });
+      traceRows.push({ url: req.url, method: req.method, score, kept: false, reason: "body_not_json_or_html" });
       continue;
     }
     if (affinityDomains.size > 0) {
@@ -689,16 +621,6 @@ export function extractEndpoints(requests: RawRequest[], wsMessages?: CapturedWs
   }
   scored.sort((a, b) => b.score - a.score);
 
-  // For passive captures (no context page URL), pre-compute path templates across
-  // all candidate paths so individual endpoints can be annotated without needing
-  // collapseEndpoints' sibling grouping.
-  const minedTemplateMap = !context?.pageUrl
-    ? minePathTemplates(scored.map(({ req }) => {
-        try { return new URL(req.url).pathname; } catch { return ""; }
-      }).filter(Boolean))
-    : new Map<string, string>();
-
-
   for (const { req } of scored) {
     const normalized = normalizeUrl(req.url);
     const key = `${req.method}:${normalized}`;
@@ -827,12 +749,6 @@ export function extractEndpoints(requests: RawRequest[], wsMessages?: CapturedWs
       action_kind: endpoint.semantic?.action_kind,
       resource_kind: endpoint.semantic?.resource_kind,
     });
-    // Annotate with mined template when available (passive capture, no page context)
-    try {
-      const pathname = new URL(req.url).pathname;
-      const mined = minedTemplateMap.get(pathname);
-      if (mined) endpoint._minedTemplate = mined;
-    } catch { /* ignore bad URLs */ }
     endpoints.push(endpoint);
   }
 
@@ -981,15 +897,6 @@ function isSensitiveHeader(name: string): boolean {
   return false;
 }
 
-function isReplayCriticalHeader(name: string, value: string): boolean {
-  const lower = name.toLowerCase();
-  if (REPLAY_HEADER_EXACT.has(lower)) {
-    if (lower !== "accept") return true;
-    return /application\/vnd\./i.test(value);
-  }
-  return REPLAY_HEADER_PREFIXES.some((prefix) => lower.startsWith(prefix));
-}
-
 function sanitizeHeaders(headers: Record<string, string>): Record<string, string> {
   return Object.fromEntries(
     Object.entries(headers ?? {}).filter(([k]) => {
@@ -1011,7 +918,7 @@ export function extractAuthHeaders(requests: RawRequest[]): Record<string, strin
     for (const [k, v] of Object.entries(req.request_headers)) {
       const lower = k.toLowerCase();
       if (lower === "cookie" || lower === "content-length" || lower === "host") continue;
-      if ((isSensitiveHeader(k) || isReplayCriticalHeader(k, v)) && !authHeaders[lower]) {
+      if (isSensitiveHeader(k) && !authHeaders[lower]) {
         authHeaders[lower] = v;
       }
     }
@@ -1147,25 +1054,6 @@ function templatizePathSegments(
         pathParams[paramName] = oSeg;
         continue;
       }
-
-      // Pattern 3: Context-diff — endpoint URL segment differs from page URL at same position.
-      // If the page URL has a different value at this position, this segment is likely an entity
-      // that should be parameterized. e.g. page=/r/singularity/ endpoint=/r/programming/.json
-      if (context?.pageUrl) {
-        try {
-          const contextSegments = new URL(context.pageUrl).pathname.split("/");
-          const contextSeg = contextSegments[i];
-          if (contextSeg && contextSeg !== tSeg &&
-              !contextSeg.includes(".") &&
-              contextSeg.length >= 2 && contextSeg.length <= 40 &&
-              !/^(api|v\d+|www|en|es|fr|de|latest|search|i)$/i.test(contextSeg)) {
-            const paramName = inferParamName(tSegments, i, "slug", usedNames);
-            tSegments[i] = `{${paramName}}`;
-            pathParams[paramName] = contextSeg; // use context URL value as default
-            continue;
-          }
-        } catch { /* skip */ }
-      }
     }
 
     return { url: `${tOrigin}${tSegments.join("/")}`, pathParams };
@@ -1210,18 +1098,6 @@ function tryParseBody(body: string): Record<string, unknown> | undefined {
  * Used by collapseEndpoints to avoid merging distinct API actions
  * like /relationships/connectionsSummary + /relationships/invitationsSummary.
  */
-/** Compute Shannon entropy (bits per character) for a string. */
-function computeEntropy(s: string): number {
-  const freq = new Map<string, number>();
-  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
-  let h = 0;
-  for (const count of freq.values()) {
-    const p = count / s.length;
-    h -= p * Math.log2(p);
-  }
-  return h;
-}
-
 function looksLikeEntityId(segment: string): boolean {
   if (segment.startsWith("{")) return true;
   // UUID (with or without dashes)
@@ -1236,12 +1112,6 @@ function looksLikeEntityId(segment: string): boolean {
   if (/^[A-Z]{1,5}(\.[A-Z])?$/.test(segment)) return true;
   // Comma-separated lists
   if (segment.includes(",")) return true;
-  // Base64-encoded IDs: mixed case with = padding
-  if (/^[A-Za-z0-9+/]{6,}={1,2}$/.test(segment)) return true;
-
-  // High-entropy strings are likely encoded IDs (tokens, hashes, opaque cursors, etc.)
-  const entropy = computeEntropy(segment);
-  if (entropy > 3.5 && segment.length > 5) return true;
 
   // === NOT an entity ID — these are action/resource names ===
   // camelCase: lowercase letter followed by uppercase (e.g., connectionsSummary)
@@ -1251,9 +1121,6 @@ function looksLikeEntityId(segment: string): boolean {
   // Pure lowercase alphabetic word 3+ chars (REST resource: "connections", "settings")
   if (/^[a-z]{3,}$/.test(segment)) return false;
 
-  // Low-entropy strings are likely readable names, not IDs
-  if (entropy < 2.5 && segment.length > 3) return false;
-
   // Ambiguous — allow collapsing (conservative)
   return true;
 }
@@ -1272,71 +1139,6 @@ function looksLikeEntityId(segment: string): boolean {
  * Only collapses when the majority (>50%) of varying segments look like entity
  * IDs, NOT distinct action/resource names (camelCase, REST words).
  */
-
-/**
- * Mine path templates from a batch of URL paths that lack a context page URL.
- * Builds a prefix trie and identifies positions where enough distinct children
- * look like entity IDs, replacing them with `{id}` placeholders.
- *
- * @param paths - Array of URL pathnames (e.g. "/api/users/123/posts")
- * @param maxChildren - Minimum distinct values at a position to trigger wildcarding (default 4)
- * @returns Map from original path to templated path (only paths that changed are included)
- */
-export function minePathTemplates(
-  paths: string[],
-  maxChildren = 4,
-): Map<string, string> {
-  // Build a prefix trie: prefix → Map<segment, count>
-  const trie = new Map<string, Map<string, number>>();
-
-  for (const path of paths) {
-    const segments = path.split("/").filter(Boolean);
-    for (let i = 0; i < segments.length; i++) {
-      const prefix = "/" + segments.slice(0, i).join("/");
-      const children = trie.get(prefix) ?? new Map<string, number>();
-      const seg = segments[i];
-      children.set(seg, (children.get(seg) ?? 0) + 1);
-      trie.set(prefix, children);
-    }
-  }
-
-  // Identify wildcard prefixes: positions where distinct children >= maxChildren
-  // AND more than 50% of those children look like entity IDs.
-  const wildcardPrefixes = new Set<string>();
-  for (const [prefix, children] of trie) {
-    if (children.size < maxChildren) continue;
-    const segs = Array.from(children.keys());
-    const entityCount = segs.filter((s) => looksLikeEntityId(s)).length;
-    if (entityCount / segs.length > 0.5) {
-      wildcardPrefixes.add(prefix);
-    }
-  }
-
-  if (wildcardPrefixes.size === 0) return new Map();
-
-  // Build original → template map for paths that contain wildcarded positions.
-  const result = new Map<string, string>();
-  for (const path of paths) {
-    const segments = path.split("/").filter(Boolean);
-    const templated: string[] = [];
-    let changed = false;
-    for (let i = 0; i < segments.length; i++) {
-      const prefix = "/" + segments.slice(0, i).join("/");
-      if (wildcardPrefixes.has(prefix)) {
-        templated.push("{id}");
-        changed = true;
-      } else {
-        templated.push(segments[i]);
-      }
-    }
-    if (changed) {
-      result.set(path, "/" + templated.join("/"));
-    }
-  }
-
-  return result;
-}
-
 function collapseEndpoints(endpoints: EndpointDescriptor[]): EndpointDescriptor[] {
   // Group by method + origin + all-but-last path segment
   const groups = new Map<string, EndpointDescriptor[]>();

package/runtime-src/runtime/local-server.ts

@@ -2,15 +2,12 @@ import { openSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { ensureDir, getPackageRoot, getServerAutostartLogFile, getServerPidFile, resolveSiblingEntrypoint, runtimeArgsForEntrypoint } from "./paths.js";
-import { LocalSupervisor } from "./supervisor.js";
 
 type PidState = {
   pid: number;
   base_url: string;
   started_at: string;
   entrypoint: string;
-  version?: string;
-  restart_count?: number;
 };
 
 async function isServerHealthy(baseUrl: string, timeoutMs = 2_000): Promise<boolean> {
@@ -63,34 +60,21 @@ function deriveListenEnv(baseUrl: string): Record<string, string> {
   return { HOST: host, PORT: port, UNBROWSE_URL: baseUrl };
 }
 
-/** Read package version from the nearest package.json. */
-function getVersion(metaUrl: string): string {
-  try {
-    const root = getPackageRoot(metaUrl);
-    const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf-8"));
-    return pkg.version ?? "unknown";
-  } catch {
-    return "unknown";
-  }
-}
+export async function ensureLocalServer(baseUrl: string, noAutoStart: boolean, metaUrl: string): Promise<void> {
+  if (await isServerHealthy(baseUrl)) return;
 
-function isCompiledBinary(): boolean {
-  return !!(process.versions.bun && !process.argv[1]?.match(/\.(ts|js|mjs)$/));
-}
+  const pidFile = getServerPidFile(baseUrl);
+  const existing = readPidState(pidFile);
+  if (existing?.pid && isPidAlive(existing.pid)) {
+    if (await waitForHealthy(baseUrl, 15_000)) return;
+  } else if (existing) {
+    clearStalePidFile(pidFile);
+  }
 
-const MAX_RESTART_ATTEMPTS = 3;
-const RESTART_BACKOFF_MS = 2_000;
+  if (noAutoStart) {
+    throw new Error("Server not running and auto-start disabled (--no-auto-start).");
+  }
 
-/**
- * Spawn the local server as a detached child process.
- * Returns the PidState written to the pid file.
- */
-function spawnServer(
-  baseUrl: string,
-  metaUrl: string,
-  pidFile: string,
-  restartCount = 0,
-): PidState {
   const entrypoint = resolveSiblingEntrypoint(metaUrl, "index");
   const packageRoot = getPackageRoot(metaUrl);
   const logFile = getServerAutostartLogFile();
@@ -110,130 +94,13 @@ function spawnServer(
   });
   child.unref();
 
-  const state: PidState = {
+  writeFileSync(pidFile, JSON.stringify({
     pid: child.pid!,
     base_url: baseUrl,
     started_at: new Date().toISOString(),
     entrypoint,
-    version: getVersion(metaUrl),
-    restart_count: restartCount,
-  };
-  writeFileSync(pidFile, JSON.stringify(state, null, 2));
-  return state;
-}
-
-/** Shared supervisor instance used for health checking. */
-const supervisor = new LocalSupervisor();
-
-export { supervisor };
-
-export async function ensureLocalServer(baseUrl: string, noAutoStart: boolean, metaUrl: string): Promise<void> {
-  if (await isServerHealthy(baseUrl)) {
-    // Server already healthy — ensure supervisor state reflects this
-    if (!supervisor.isRunning()) await supervisor.start();
-    return;
-  }
-
-  const pidFile = getServerPidFile(baseUrl);
-  const existing = readPidState(pidFile);
-
-  if (existing?.pid && isPidAlive(existing.pid)) {
-    // Process alive but not healthy — wait then try supervisor restart
-    if (await waitForHealthy(baseUrl, 15_000)) {
-      if (!supervisor.isRunning()) await supervisor.start();
-      return;
-    }
-    // Still unhealthy after wait — kill stale process and restart
-    try { process.kill(existing.pid, "SIGTERM"); } catch { /* ignore */ }
-    await new Promise((r) => setTimeout(r, 1_000));
-    clearStalePidFile(pidFile);
-    if (supervisor.isRunning()) await supervisor.stop();
-  } else if (existing) {
-    clearStalePidFile(pidFile);
-  }
-
-  if (noAutoStart) {
-    throw new Error("Server not running and auto-start disabled (--no-auto-start).");
-  }
-
-  // Single-binary mode: start server inline instead of spawning a child
-  if (isCompiledBinary()) {
-    const { startUnbrowseServer, installServerExitCleanup } = await import("../server.js");
-    installServerExitCleanup(pidFile);
-    const server = await startUnbrowseServer({ pidFile, scheduleVerification: true });
-    console.log(`[unbrowse] server started inline on http://${server.host}:${server.port}`);
-    await supervisor.start();
-    return;
-  }
-
-  // Spawn with supervisor retry
-  for (let attempt = 0; attempt <= MAX_RESTART_ATTEMPTS; attempt++) {
-    spawnServer(baseUrl, metaUrl, pidFile, attempt);
-
-    if (await waitForHealthy(baseUrl, 30_000)) {
-      await supervisor.start();
-      return;
-    }
-
-    // Failed to start — clear and retry with backoff
-    const state = readPidState(pidFile);
-    if (state?.pid) {
-      try { process.kill(state.pid, "SIGTERM"); } catch { /* ignore */ }
-    }
-    clearStalePidFile(pidFile);
-
-    if (attempt < MAX_RESTART_ATTEMPTS) {
-      const backoff = RESTART_BACKOFF_MS * (attempt + 1);
-      await new Promise((r) => setTimeout(r, backoff));
-    }
-  }
-
-  const logFile = getServerAutostartLogFile();
-  throw new Error(`Server failed to start after ${MAX_RESTART_ATTEMPTS + 1} attempts. Check ${logFile}`);
-}
-
-/**
- * Check if the running server version matches the installed CLI version.
- * Returns null if no server is running, or { running, installed, needs_restart }.
- */
-export function checkServerVersion(baseUrl: string, metaUrl: string): { running: string; installed: string; needs_restart: boolean } | null {
-  const pidFile = getServerPidFile(baseUrl);
-  const state = readPidState(pidFile);
-  if (!state) return null;
-  const installed = getVersion(metaUrl);
-  return {
-    running: state.version ?? "unknown",
-    installed,
-    needs_restart: state.version !== installed,
-  };
-}
-
-/**
- * Stop the running server gracefully.
- * Returns true if a server was stopped, false if none was running.
- */
-export function stopServer(baseUrl: string): boolean {
-  const pidFile = getServerPidFile(baseUrl);
-  const state = readPidState(pidFile);
-  if (!state?.pid) return false;
-  try {
-    process.kill(state.pid, "SIGTERM");
-    clearStalePidFile(pidFile);
-    // Synchronously mark supervisor as stopped (fire-and-forget the async stop)
-    if (supervisor.isRunning()) void supervisor.stop();
-    return true;
-  } catch {
-    clearStalePidFile(pidFile);
-    return false;
-  }
-}
+  }, null, 2));
 
-/**
- * Restart the local server (stop + start).
- * Used after CLI upgrades to pick up new code.
- */
-export async function restartServer(baseUrl: string, metaUrl: string): Promise<void> {
-  stopServer(baseUrl);
-  await new Promise((r) => setTimeout(r, 1_000));
-  await ensureLocalServer(baseUrl, false, metaUrl);
+  if (await waitForHealthy(baseUrl, 30_000)) return;
+  throw new Error(`Server failed to start. Check ${logFile}`);
 }

package/runtime-src/runtime/paths.ts

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, realpathSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { createRequire } from "node:module";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 
 export function getModuleDir(metaUrl: string): string {
   return path.dirname(fileURLToPath(metaUrl));
@@ -10,13 +10,9 @@ export function getModuleDir(metaUrl: string): string {
 
 export function getPackageRoot(metaUrl: string): string {
   if (process.env.UNBROWSE_PACKAGE_ROOT) return process.env.UNBROWSE_PACKAGE_ROOT;
-  let dir = getModuleDir(metaUrl);
-  const root = path.parse(dir).root;
-  while (dir !== root) {
-    if (existsSync(path.join(dir, "package.json"))) return dir;
-    dir = path.dirname(dir);
-  }
-  return getModuleDir(metaUrl);
+  const dir = getModuleDir(metaUrl);
+  const base = path.basename(dir);
+  return base === "src" || base === "dist" ? path.dirname(dir) : dir;
 }
 
 export function resolveSiblingEntrypoint(metaUrl: string, basename: string): string {
@@ -32,7 +28,7 @@ export function runtimeArgsForEntrypoint(metaUrl: string, entrypoint: string): s
     const req = createRequire(metaUrl);
     const tsxPkg = req.resolve("tsx/package.json");
     const tsxLoader = path.join(path.dirname(tsxPkg), "dist", "loader.mjs");
-    if (existsSync(tsxLoader)) return ["--import", pathToFileURL(tsxLoader).href, entrypoint];
+    if (existsSync(tsxLoader)) return ["--import", tsxLoader, entrypoint];
   } catch {
     // fall through to bare specifier
   }

package/runtime-src/runtime/setup.ts

@@ -4,9 +4,6 @@ import os from "node:os";
 import path from "node:path";
 import { ensureDir } from "./paths.js";
 import { findKuriBinary, getKuriSourceCandidates } from "../kuri/client.js";
-import { detectHostEnvironment, type HostEnvironment } from "./browser-host.js";
-import { log } from "../logger.js";
-import { checkWalletConfigured, type WalletCheckResult } from "../payments/wallet.js";
 
 export type SetupScope = "auto" | "global" | "project" | "off";
 
@@ -16,7 +13,6 @@ export type SetupReport = {
     release: string;
     arch: string;
   };
-  host_environment: HostEnvironment;
   package_managers: {
     npm: boolean;
     npx: boolean;
@@ -32,9 +28,7 @@ export type SetupReport = {
     detected: boolean;
     action: "installed" | "updated" | "skipped" | "not-detected";
     scope: "global" | "project" | "off";
-  };
-  wallet: WalletCheckResult & {
-    message: string;
+    command_file?: string;
   };
 };
 
@@ -185,52 +179,9 @@ export async function runSetup(options?: {
   installBrowser?: boolean;
 }): Promise<SetupReport> {
   const cwd = options?.cwd || process.cwd();
-
-  const hostEnv = detectHostEnvironment();
-  log("setup", `detected host environment: ${hostEnv}`);
-
   const browser = options?.installBrowser === false
     ? { installed: false, action: "skipped" as const }
     : await ensureBrowserEngineInstalled();
-  const walletCheck = checkWalletConfigured();
-  const skipWalletSetup = process.env.UNBROWSE_SKIP_WALLET_SETUP === "1";
-  const lobsterInstalled = hasBinary("lobstercash") ||
-    existsSync(path.join(os.homedir(), ".agents", "skills", "lobstercash", "SKILL.md"));
-
-  // Auto-setup lobster.cash wallet if skill is installed but wallet not configured
-  if (!skipWalletSetup && !walletCheck.configured && lobsterInstalled) {
-    console.log("[unbrowse] lobster.cash skill detected but wallet not configured — running wallet setup...");
-    try {
-      execFileSync("npx", ["@crossmint/lobster-cli", "setup"], {
-        stdio: "inherit",
-        timeout: 60_000,
-      });
-      // Re-check after setup
-      const recheck = checkWalletConfigured();
-      if (recheck.configured) {
-        console.log(`[unbrowse] wallet configured (${recheck.provider})`);
-      }
-    } catch {
-      console.warn("[unbrowse] lobster.cash wallet setup failed or was skipped — continuing without wallet");
-    }
-  }
-
-  // Re-check wallet state after potential setup
-  const finalWalletCheck = checkWalletConfigured();
-  const wallet = {
-    ...finalWalletCheck,
-    lobster_installed: lobsterInstalled,
-    message: finalWalletCheck.configured
-      ? `Wallet configured (${finalWalletCheck.provider}). This address is the contributor truth: it is synced onto your agent profile, used for contributor payouts when your routes earn, and used for paid-route spending.`
-      : lobsterInstalled
-        ? "lobster.cash installed but wallet not paired. Pair it now so this wallet address becomes your contributor payout target and your paid-route spending wallet. Run: lobstercash setup"
-        : "No wallet configured. Install/pair a wallet so your contributor payouts have a destination address and premium-route spending can clear automatically. Without it you stay in free indexing mode only.",
-    install_hint: finalWalletCheck.configured
-      ? undefined
-      : lobsterInstalled
-        ? "lobstercash setup"
-        : "npx skills add https://github.com/Crossmint/lobstercash-cli-skills --global --yes",
-  };
 
   return {
     os: {
@@ -238,10 +189,8 @@ export async function runSetup(options?: {
       release: os.release(),
       arch: process.arch,
     },
-    host_environment: hostEnv,
     package_managers: detectPackageManagers(),
     browser_engine: browser,
     opencode: writeOpenCodeCommand(options?.opencode ?? "auto", cwd),
-    wallet,
   };
 }