unbrowse 2.8.6 → 2.9.0

package/dist/cli.js

@@ -721,6 +721,51 @@ var init_client = __esm(() => {
 });
 
 // ../../src/transform/index.ts
+var exports_transform = {};
+__export(exports_transform, {
+  resolvePath: () => resolvePath,
+  project: () => project,
+  inferSchema: () => inferSchema,
+  detectEntityIndex: () => detectEntityIndex,
+  compact: () => compact,
+  buildEntityIndex: () => buildEntityIndex,
+  applyProjection: () => applyProjection
+});
+function buildEntityIndex(items) {
+  const index = new Map;
+  for (const item of items) {
+    if (item != null && typeof item === "object") {
+      const urn = item.entityUrn;
+      if (typeof urn === "string")
+        index.set(urn, item);
+    }
+  }
+  return index;
+}
+function detectEntityIndex(data) {
+  if (data == null || typeof data !== "object")
+    return null;
+  const candidates = [];
+  const obj = data;
+  if (Array.isArray(obj.included))
+    candidates.push(obj.included);
+  if (obj.data && typeof obj.data === "object") {
+    const d = obj.data;
+    if (Array.isArray(d.included))
+      candidates.push(d.included);
+  }
+  for (const arr of candidates) {
+    const items = arr;
+    if (items.length < 2)
+      continue;
+    const sample = items.slice(0, 5);
+    const hasUrns = sample.filter((i) => i != null && typeof i === "object" && typeof i.entityUrn === "string").length;
+    if (hasUrns >= sample.length * 0.5) {
+      return buildEntityIndex(items);
+    }
+  }
+  return null;
+}
 function resolvePath(obj, path4, entityIndex) {
   const parts = path4.split(".");
   let current = [obj];
@@ -1091,6 +1136,20 @@ function mergeContextTemplateParams(params, urlTemplate, contextUrl) {
 }
 
 // ../../src/graph/index.ts
+var exports_graph = {};
+__export(exports_graph, {
+  toAgentSkillChunkView: () => toAgentSkillChunkView,
+  resolveEndpointSemantic: () => resolveEndpointSemantic,
+  operationSoftPenalty: () => operationSoftPenalty,
+  knownBindingsFromInputs: () => knownBindingsFromInputs,
+  isRunnable: () => isRunnable,
+  isOperationHardExcluded: () => isOperationHardExcluded,
+  inferEndpointSemantic: () => inferEndpointSemantic,
+  getSkillChunk: () => getSkillChunk,
+  ensureSkillOperationGraph: () => ensureSkillOperationGraph,
+  computeReachableEndpoints: () => computeReachableEndpoints,
+  buildSkillOperationGraph: () => buildSkillOperationGraph
+});
 function normalizeTokenText(text) {
   return text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").replace(/([a-zA-Z])(\d)/g, "$1 $2").replace(/(\d)([a-zA-Z])/g, "$1 $2");
 }
@@ -2203,6 +2262,12 @@ function extractRscDataEndpoints(body) {
 }
 
 // ../../src/reverse-engineer/index.ts
+var exports_reverse_engineer = {};
+__export(exports_reverse_engineer, {
+  minePathTemplates: () => minePathTemplates,
+  extractEndpoints: () => extractEndpoints,
+  extractAuthHeaders: () => extractAuthHeaders
+});
 import { nanoid as nanoid2 } from "nanoid";
 function compactForSemanticExample(value, depth = 0) {
   if (depth > 2 || value == null)
@@ -3378,6 +3443,7 @@ __export(exports_capture, {
   navigatePageForCapture: () => navigatePageForCapture,
   isBrowserAccessAvailable: () => isBrowserAccessAvailable,
   isBlockedAppShell: () => isBlockedAppShell,
+  injectInterceptor: () => injectInterceptor,
   hasUsefulCapturedResponses: () => hasUsefulCapturedResponses,
   filterFirstPartySessionCookies: () => filterFirstPartySessionCookies,
   executeInBrowser: () => executeInBrowser,
@@ -3596,6 +3662,14 @@ async function collectInterceptedRequests(tabId) {
   } catch {}
   return [];
 }
+async function injectInterceptor(tabId) {
+  const SETUP = `(function(){if(window.__unbrowse_interceptor_installed)return;window.__unbrowse_interceptor_installed=true;window.__unbrowse_intercepted=[];window.__UB_MAX=2*1024*1024;window.__UB_MAX_JS=2*1024*1024;window.__UB_MAX_N=500;})()`;
+  const FETCH_PATCH = `(function(){if(!window.__unbrowse_interceptor_installed)return;var M=window.__UB_MAX,MJ=window.__UB_MAX_JS,MN=window.__UB_MAX_N;var oF=window.fetch;window.fetch=function(){var a=arguments,u=typeof a[0]==='string'?a[0]:(a[0]&&a[0].url?a[0].url:''),o=a[1]||{},m=(o.method||'GET').toUpperCase(),rb=o.body?String(o.body).substring(0,M):void 0,rh={};if(o.headers){if(typeof o.headers.forEach==='function')o.headers.forEach(function(v,k){rh[k]=v});else Object.keys(o.headers).forEach(function(k){rh[k]=o.headers[k]})}return oF.apply(this,a).then(function(r){if(window.__unbrowse_intercepted.length>=MN)return r;var ct=r.headers.get('content-type')||'';var isJ=ct.indexOf('javascript')!==-1||/\\.js(\\?|$)/.test(u);var isD=ct.indexOf('json')!==-1||ct.indexOf('x-protobuf')!==-1||ct.indexOf('text/plain')!==-1||u.indexOf('/api/')!==-1||u.indexOf('graphql')!==-1||u.indexOf('voyager')!==-1;if(!isJ&&!isD)return r;if(/\\.(css|woff2?|png|jpg|svg|ico)(\\?|$)/.test(u))return r;var c=r.clone();c.text().then(function(b){var lim=isJ?MJ:M;if(b.length>lim)return;var rr={};r.headers.forEach(function(v,k){rr[k]=v});window.__unbrowse_intercepted.push({url:u,method:m,request_headers:rh,request_body:rb,response_status:r.status,response_headers:rr,response_body:b,content_type:ct,is_js:isJ,timestamp:new Date().toISOString()})}).catch(function(){});return r}).catch(function(e){throw e})}})()`;
+  const XHR_PATCH = `(function(){if(!window.__unbrowse_interceptor_installed)return;var M=window.__UB_MAX,MJ=window.__UB_MAX_JS,MN=window.__UB_MAX_N;var oO=XMLHttpRequest.prototype.open,oS=XMLHttpRequest.prototype.send;XMLHttpRequest.prototype.open=function(m,u){this.__ub_m=m;this.__ub_u=u;this.__ub_h={};var oSH=this.setRequestHeader.bind(this);this.setRequestHeader=function(k,v){this.__ub_h[k]=v;oSH(k,v)}.bind(this);return oO.apply(this,arguments)};XMLHttpRequest.prototype.send=function(b){var x=this;x.addEventListener('load',function(){if(window.__unbrowse_intercepted.length>=MN)return;var ct=x.getResponseHeader('content-type')||'',u=x.__ub_u||'';var isJ=ct.indexOf('javascript')!==-1||/\\.js(\\?|$)/.test(u);var isD=ct.indexOf('json')!==-1||ct.indexOf('x-protobuf')!==-1||ct.indexOf('text/plain')!==-1||u.indexOf('/api/')!==-1||u.indexOf('graphql')!==-1||u.indexOf('voyager')!==-1;if(!isJ&&!isD)return;if(/\\.(css|woff2?|png|jpg|svg|ico)(\\?|$)/.test(u))return;var rb=x.responseText||'';var lim=isJ?MJ:M;if(rb.length>lim)return;window.__unbrowse_intercepted.push({url:u,method:(x.__ub_m||'GET').toUpperCase(),request_headers:x.__ub_h||{},request_body:b?String(b).substring(0,M):void 0,response_status:x.status,response_headers:{},response_body:rb,content_type:ct,is_js:isJ,timestamp:new Date().toISOString()})});return oS.apply(this,arguments)}})()`;
+  for (const chunk of [SETUP, FETCH_PATCH, XHR_PATCH]) {
+    await evaluate(tabId, chunk).catch(() => {});
+  }
+}
 function mergePassiveCaptureData(intercepted, harEntries, extensionEntries, responseBodies) {
   const seen = new Map;
   for (const entry of intercepted) {
@@ -4385,7 +4459,7 @@ var MAX_CONCURRENT_TABS = 3, activeTabs = 0, waitQueue, activeTabRegistry, inter
   if (window.__unbrowse_interceptor_installed) return;
   window.__unbrowse_interceptor_installed = true;
   window.__unbrowse_intercepted = [];
-  var MAX_BODY = 512 * 1024;
+  var MAX_BODY = 2 * 1024 * 1024;
   var MAX_JS_BODY = 2 * 1024 * 1024;
   var MAX_ENTRIES = 500;
 
@@ -4409,9 +4483,10 @@ var MAX_CONCURRENT_TABS = 3, activeTabs = 0, waitQueue, activeTabRegistry, inter
       if (window.__unbrowse_intercepted.length >= MAX_ENTRIES) return response;
       var ct = response.headers.get('content-type') || '';
       var isJs = ct.indexOf('javascript') !== -1 || /\\.js(\\?|$)/.test(url);
-      var isData = ct.indexOf('application/json') !== -1 || ct.indexOf('+json') !== -1 ||
-                   ct.indexOf('application/x-protobuf') !== -1 || ct.indexOf('text/plain') !== -1 ||
-                   url.indexOf('batchexecute') !== -1 || url.indexOf('/api/') !== -1;
+      var isData = ct.indexOf('json') !== -1 || ct.indexOf('application/x-protobuf') !== -1 ||
+                   ct.indexOf('text/plain') !== -1 ||
+                   url.indexOf('batchexecute') !== -1 || url.indexOf('/api/') !== -1 ||
+                   url.indexOf('graphql') !== -1 || url.indexOf('voyager') !== -1;
       if (!isJs && !isData) return response;
       if (/\\.(css|woff2?|png|jpg|svg|ico)(\\?|$)/.test(url)) return response;
       var clone = response.clone();
@@ -4458,9 +4533,10 @@ var MAX_CONCURRENT_TABS = 3, activeTabs = 0, waitQueue, activeTabRegistry, inter
       var ct = xhr.getResponseHeader('content-type') || '';
       var url = xhr.__unbrowse_url || '';
       var isJs = ct.indexOf('javascript') !== -1 || /\\.js(\\?|$)/.test(url);
-      var isData = ct.indexOf('application/json') !== -1 || ct.indexOf('+json') !== -1 ||
-                   ct.indexOf('application/x-protobuf') !== -1 || ct.indexOf('text/plain') !== -1 ||
-                   url.indexOf('batchexecute') !== -1 || url.indexOf('/api/') !== -1;
+      var isData = ct.indexOf('json') !== -1 || ct.indexOf('application/x-protobuf') !== -1 ||
+                   ct.indexOf('text/plain') !== -1 ||
+                   url.indexOf('batchexecute') !== -1 || url.indexOf('/api/') !== -1 ||
+                   url.indexOf('graphql') !== -1 || url.indexOf('voyager') !== -1;
       if (!isJs && !isData) return;
       if (/\\.(css|woff2?|png|jpg|svg|ico)(\\?|$)/.test(url)) return;
       var respBody = xhr.responseText || '';
@@ -4547,6 +4623,21 @@ import { join as join3 } from "path";
 import { homedir as homedir2, hostname as hostname2 } from "os";
 import { randomBytes as randomBytes2, createHash as createHash2 } from "crypto";
 import { createInterface as createInterface2 } from "readline";
+function decodeBase64Json2(value) {
+  try {
+    if (typeof globalThis !== "undefined" && typeof globalThis.atob === "function") {
+      const binary = globalThis.atob(value);
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0;i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return JSON.parse(new TextDecoder("utf-8").decode(bytes));
+    }
+    return JSON.parse(Buffer.from(value, "base64").toString("utf8"));
+  } catch {
+    return;
+  }
+}
 function scopedSkillKey(skillId, scopeId) {
   return scopeId ? `${scopeId}:${skillId}` : skillId;
 }
@@ -4680,7 +4771,7 @@ async function findUsableApiKey2() {
 async function api2(method, path4, body, opts) {
   const key = opts?.noAuth ? "" : getApiKey2();
   const controller = new AbortController;
-  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS2);
+  const timer = setTimeout(() => controller.abort(), opts?.timeoutMs ?? API_TIMEOUT_MS2);
   let res;
   try {
     res = await fetch(`${API_URL2}${path4}`, {
@@ -4709,8 +4800,9 @@ async function api2(method, path4, body, opts) {
     throw new Error("ToS update required. Restart unbrowse to accept new terms.");
   }
   if (res.status === 402) {
-    const paymentTerms = res.headers.get("X-Payment-Required");
-    const terms = paymentTerms ? JSON.parse(paymentTerms) : data.terms;
+    const paymentRequired = res.headers.get("PAYMENT-REQUIRED");
+    const legacyPaymentTerms = res.headers.get("X-Payment-Required");
+    const terms = paymentRequired ? decodeBase64Json2(paymentRequired) : legacyPaymentTerms ? JSON.parse(legacyPaymentTerms) : data.terms;
     const err = new Error(`Payment required: ${data.error ?? "This skill requires payment"}`);
     err.x402 = true;
     err.terms = terms;
@@ -5002,7 +5094,7 @@ async function publishSkill(draft) {
   }
   if (LOCAL_ONLY2)
     throw new Error("local-only mode");
-  return api2("POST", "/v1/skills", draft);
+  return api2("POST", "/v1/skills", draft, { timeoutMs: PUBLISH_TIMEOUT_MS2 });
 }
 async function deprecateSkill(skillId) {
   if (LOCAL_ONLY2)
@@ -5194,7 +5286,7 @@ async function getCreatorEarnings(agentId) {
 async function setSkillPrice(skillId, priceUsd) {
   return api2("PATCH", `/v1/skills/${skillId}`, { base_price_usd: priceUsd });
 }
-var API_URL2, PROFILE_NAME2, recentLocalSkills2, LOCAL_ONLY2, EMAIL_RE2, API_TIMEOUT_MS2;
+var API_URL2, PROFILE_NAME2, recentLocalSkills2, LOCAL_ONLY2, EMAIL_RE2, API_TIMEOUT_MS2, PUBLISH_TIMEOUT_MS2;
 var init_client2 = __esm(() => {
   API_URL2 = process.env.UNBROWSE_BACKEND_URL || "https://beta-api.unbrowse.ai";
   PROFILE_NAME2 = sanitizeProfileName2(process.env.UNBROWSE_PROFILE ?? "");
@@ -5202,6 +5294,7 @@ var init_client2 = __esm(() => {
   LOCAL_ONLY2 = process.env.UNBROWSE_LOCAL_ONLY === "1";
   EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/i;
   API_TIMEOUT_MS2 = parseInt(process.env.UNBROWSE_API_TIMEOUT ?? "8000", 10);
+  PUBLISH_TIMEOUT_MS2 = parseInt(process.env.UNBROWSE_PUBLISH_TIMEOUT ?? "30000", 10);
 });
 
 // ../../src/marketplace/index.ts
@@ -7526,6 +7619,14 @@ function assessIntentResult(data, intent) {
 }
 
 // ../../src/extraction/index.ts
+var exports_extraction = {};
+__export(exports_extraction, {
+  parseStructured: () => parseStructured,
+  extractSPAData: () => extractSPAData,
+  extractFromDOMWithHint: () => extractFromDOMWithHint,
+  extractFromDOM: () => extractFromDOM,
+  cleanDOM: () => cleanDOM
+});
 import * as cheerio from "cheerio";
 function extractFlashNoticeSpecial(html, intent) {
   if (!/\b(flash|message|messages|alert|success|error|warning)\b/i.test(intent))
@@ -9057,6 +9158,11 @@ var init_agent_augment = __esm(() => {
 });
 
 // ../../src/execution/search-forms.ts
+var exports_search_forms = {};
+__export(exports_search_forms, {
+  isStructuredSearchForm: () => isStructuredSearchForm,
+  detectSearchForms: () => detectSearchForms
+});
 function isStructuredSearchForm(spec) {
   return spec.fields.length > 0 && !!spec.submit_selector;
 }
@@ -9370,6 +9476,26 @@ var init_payments = __esm(() => {
 });
 
 // ../../src/execution/index.ts
+var exports_execution = {};
+__export(exports_execution, {
+  validateExtractionQuality: () => validateExtractionQuality,
+  templatizeQueryParams: () => templatizeQueryParams,
+  shouldIgnoreLearnedBrowserStrategy: () => shouldIgnoreLearnedBrowserStrategy,
+  resolveExecutionUrlTemplate: () => resolveExecutionUrlTemplate,
+  rankEndpoints: () => rankEndpoints,
+  projectResultForIntent: () => projectResultForIntent,
+  isCanonicalReplayEndpoint: () => isCanonicalReplayEndpoint,
+  isBundleInferredEndpoint: () => isBundleInferredEndpoint,
+  executeSkill: () => executeSkill,
+  executeEndpoint: () => executeEndpoint,
+  deriveStructuredDataReplayUrl: () => deriveStructuredDataReplayUrl,
+  deriveStructuredDataReplayTemplate: () => deriveStructuredDataReplayTemplate,
+  deriveStructuredDataReplayCandidatesFromInputs: () => deriveStructuredDataReplayCandidatesFromInputs,
+  deriveStructuredDataReplayCandidates: () => deriveStructuredDataReplayCandidates,
+  buildStructuredReplayHeaders: () => buildStructuredReplayHeaders,
+  buildPageArtifactCapture: () => buildPageArtifactCapture,
+  buildCanonicalDocumentEndpoint: () => buildCanonicalDocumentEndpoint
+});
 import { nanoid as nanoid5 } from "nanoid";
 function stampTrace(trace) {
   trace.trace_version = TRACE_VERSION;
@@ -10099,6 +10225,24 @@ async function executeSkill(skill, params = {}, projection, options) {
       const { endpoint_id: _, ...cleanParams } = params;
       return executeEndpoint(skill, target, cleanParams, projection, options);
     }
+    log("exec", `endpoint ${params.endpoint_id} not found in skill ${skill.skill_id} (${skill.endpoints.length} endpoints: ${skill.endpoints.map((e) => e.endpoint_id).join(", ")})`);
+    const trace = {
+      trace_id: nanoid5(),
+      skill_id: skill.skill_id,
+      endpoint_id: String(params.endpoint_id),
+      started_at: new Date().toISOString(),
+      completed_at: new Date().toISOString(),
+      success: false,
+      error: `endpoint_not_found: ${params.endpoint_id} not in skill ${skill.skill_id}`
+    };
+    return {
+      trace,
+      result: {
+        error: "endpoint_not_found",
+        message: `Endpoint ${params.endpoint_id} not found in skill ${skill.skill_id}. Available: ${skill.endpoints.map((e) => `${e.endpoint_id} (${e.description?.slice(0, 50)})`).join(", ")}`,
+        available_endpoints: skill.endpoints.map((e) => ({ endpoint_id: e.endpoint_id, description: e.description }))
+      }
+    };
   }
   const endpoint = selectBestEndpoint(skill.endpoints, options?.intent ?? skill.intent_signature, skill.domain, options?.contextUrl);
   return executeEndpoint(skill, endpoint, params, projection, options);
@@ -10573,6 +10717,22 @@ async function executeDomExtractionEndpoint(endpoint, url, intent, authHeaders,
     console.log(`[ssr-fast] miss, falling back to browser`);
   }
   const captured = await captureSession(url, authHeaders, cookies, intent);
+  if (captured.requests.length > 0) {
+    const { extractEndpoints: extractEps } = await Promise.resolve().then(() => (init_reverse_engineer(), exports_reverse_engineer));
+    const apiEndpoints = extractEps(captured.requests, undefined, { pageUrl: url, finalUrl: captured.final_url });
+    const jsonEndpoints = apiEndpoints.filter((ep) => ep.response_schema && !ep.dom_extraction);
+    if (jsonEndpoints.length > 0) {
+      const best = jsonEndpoints[0];
+      const matchingReq = captured.requests.find((r) => r.url.includes(best.url_template.split("?")[0].split("{")[0]) && r.response_body && r.response_status >= 200 && r.response_status < 400);
+      if (matchingReq?.response_body) {
+        try {
+          const data = JSON.parse(matchingReq.response_body);
+          console.log(`[dom-exec] found API response from browser capture: ${matchingReq.url.substring(0, 80)}`);
+          return { data, status: matchingReq.response_status, trace_id: nanoid5() };
+        } catch {}
+      }
+    }
+  }
   const html = captured.html ?? "";
   const extracted = extractFromDOMWithHint(html, intent, endpoint.dom_extraction);
   if (extracted.data) {
@@ -10947,7 +11107,19 @@ async function executeEndpoint(skill, endpoint, params = {}, projection, options
       if (result.status >= 200 && result.status < 400 && !shouldFallbackToBrowserReplay(result.data, endpoint, options?.intent ?? skill.intent_signature, options?.contextUrl)) {
         strategy = "server";
       } else if (endpoint.trigger_url && isSafe) {
-        result = await triggerAndIntercept(endpoint.trigger_url, endpoint.url_template, cookies, authHeaders);
+        let triggerUrl = endpoint.trigger_url;
+        if (Object.keys(mergedParams).length > 0) {
+          try {
+            const tu = new URL(endpoint.trigger_url);
+            for (const [k, v] of Object.entries(mergedParams)) {
+              if (v != null && !reservedMetaParams.has(k)) {
+                tu.searchParams.set(k, String(v));
+              }
+            }
+            triggerUrl = tu.toString();
+          } catch {}
+        }
+        result = await triggerAndIntercept(triggerUrl, endpoint.url_template, cookies, authHeaders);
         strategy = "trigger-intercept";
       } else {
         result = await withRetry(browserCall, (r) => isRetryableStatus(r.status));
@@ -10962,8 +11134,19 @@ async function executeEndpoint(skill, endpoint, params = {}, projection, options
         strategy = "server";
       }
     } else if (endpointStrategy === "trigger-intercept" && endpoint.trigger_url && isSafe) {
-      log("exec", `using learned strategy trigger-intercept via ${endpoint.trigger_url}`);
-      result = await triggerAndIntercept(endpoint.trigger_url, endpoint.url_template, cookies, authHeaders);
+      let triggerUrl = endpoint.trigger_url;
+      if (Object.keys(mergedParams).length > 0) {
+        try {
+          const tu = new URL(endpoint.trigger_url);
+          for (const [k, v] of Object.entries(mergedParams)) {
+            if (v != null && !reservedMetaParams.has(k))
+              tu.searchParams.set(k, String(v));
+          }
+          triggerUrl = tu.toString();
+        } catch {}
+      }
+      log("exec", `using learned strategy trigger-intercept via ${triggerUrl}`);
+      result = await triggerAndIntercept(triggerUrl, endpoint.url_template, cookies, authHeaders);
       strategy = "trigger-intercept";
     } else if (endpointStrategy === "browser") {
       if (shouldIgnoreLearnedBrowserStrategy(endpoint, url)) {
@@ -10994,7 +11177,18 @@ async function executeEndpoint(skill, endpoint, params = {}, projection, options
         } else {
           log("exec", `server fetch returned ${result.status}, falling back`);
           if (endpoint.trigger_url && isSafe) {
-            result = await triggerAndIntercept(endpoint.trigger_url, endpoint.url_template, cookies, authHeaders);
+            let triggerUrl = endpoint.trigger_url;
+            if (Object.keys(mergedParams).length > 0) {
+              try {
+                const tu = new URL(endpoint.trigger_url);
+                for (const [k, v] of Object.entries(mergedParams)) {
+                  if (v != null && !reservedMetaParams.has(k))
+                    tu.searchParams.set(k, String(v));
+                }
+                triggerUrl = tu.toString();
+              } catch {}
+            }
+            result = await triggerAndIntercept(triggerUrl, endpoint.url_template, cookies, authHeaders);
             strategy = "trigger-intercept";
           } else {
             result = await withRetry(browserCall, (r) => isRetryableStatus(r.status));
@@ -13404,22 +13598,6 @@ function dedupeObservedOverBundle(ranked) {
   }
   return Array.from(byRoute.values()).sort((a, b) => b.score - a.score);
 }
-function extractBinaryVerdict(payload) {
-  for (const value of Object.values(payload)) {
-    if (typeof value !== "string")
-      continue;
-    const normalized = value.trim().toLowerCase();
-    if (normalized === "pass" || normalized.startsWith("pass "))
-      return "pass";
-    if (normalized === "fail" || normalized.startsWith("fail "))
-      return "fail";
-    if (normalized.includes('"pass"'))
-      return "pass";
-    if (normalized.includes('"fail"'))
-      return "fail";
-  }
-  return "skip";
-}
 function obviousSemanticMismatch(intent, endpoint, result) {
   const haystack = `${intent} ${endpoint.url_template} ${endpoint.description ?? ""}`.toLowerCase();
   const wantsChannels = /\b(channel|channels|guild|guilds|message|messages|thread|threads|dm|chat)\b/.test(intent.toLowerCase());
@@ -13692,88 +13870,7 @@ async function inferParamsFromIntent(urlTemplate, intent, unboundParams, endpoin
       }
     }
   }
-  const system = `You extract URL query/path parameter values from a user's natural-language intent.
-Given a URL template with placeholder parameters and the user's intent, return a JSON object mapping parameter names to their values.
-
-Rules:
-- Only fill in parameters where the intent clearly implies a value
-- For search/query parameters, extract the search terms from the intent
-- For filter parameters (location, category, price, date, etc.), extract if mentioned
-- Strip meta-phrases like "search for", "find me", "on amazon" — just return the core value
-- If you can't determine a value for a parameter, omit it from the response
-- Return raw values, not URL-encoded
-
-Examples:
-  URL: https://amazon.com/s?k={k}&ref={ref}
-  Intent: "search for wireless headphones under $50"
-  → {"k": "wireless headphones under $50"}
-
-  URL: https://yelp.com/search?find_desc={find_desc}&find_loc={find_loc}
-  Intent: "find pizza restaurants in san francisco"
-  → {"find_desc": "pizza restaurants", "find_loc": "san francisco"}
-
-  URL: https://booking.com/searchresults.html?ss={ss}&checkin={checkin}&checkout={checkout}
-  Intent: "hotels in tokyo for march 20 to march 25"
-  → {"ss": "tokyo", "checkin": "2026-03-20", "checkout": "2026-03-25"}`;
-  const user = `URL template: ${urlTemplate}
-${endpointDescription ? `Endpoint description: ${endpointDescription}` : ""}
-Unbound parameters: ${unboundParams.join(", ")}
-User intent: ${intent}
-
-Return JSON mapping parameter names to values. Only include parameters you can confidently fill from the intent.`;
-  const result = await callJsonAgent(system, user, {});
-  const unboundSet = new Set(unboundParams);
-  const filtered = {};
-  for (const [k, v] of Object.entries(result)) {
-    if (unboundSet.has(k) && v != null && v !== "") {
-      filtered[k] = String(v);
-    }
-  }
-  return filtered;
-}
-async function callJsonAgent(system, user, fallback) {
-  const providers = [
-    OPENAI_API_KEY ? { url: OPENAI_CHAT_URL2, key: OPENAI_API_KEY, model: JUDGE_MODEL } : null,
-    NEBIUS_API_KEY ? { url: CHAT_URL2, key: NEBIUS_API_KEY, model: JUDGE_MODEL } : null
-  ].filter((p) => !!p);
-  if (providers.length === 0)
-    return fallback;
-  const controller = new AbortController;
-  const timeout = setTimeout(() => controller.abort(), 8000);
-  try {
-    for (const provider of providers) {
-      const res = await fetch(provider.url, {
-        method: "POST",
-        headers: {
-          "content-type": "application/json",
-          Authorization: `Bearer ${provider.key}`
-        },
-        body: JSON.stringify({
-          model: provider.model,
-          temperature: 0,
-          max_tokens: 400,
-          response_format: { type: "json_object" },
-          messages: [
-            { role: "system", content: system },
-            { role: "user", content: user }
-          ]
-        }),
-        signal: controller.signal
-      });
-      if (!res.ok)
-        continue;
-      const json = await res.json();
-      const content = json.choices?.[0]?.message?.content;
-      if (!content)
-        continue;
-      return JSON.parse(content);
-    }
-    return fallback;
-  } catch {
-    return fallback;
-  } finally {
-    clearTimeout(timeout);
-  }
+  return {};
 }
 async function withOpTimeout(label, ms, work) {
   return await Promise.race([
@@ -13922,62 +14019,21 @@ function prioritizeIntentMatchedApis(ranked, intent, contextUrl) {
     ...ranked.filter((candidate) => !preferredIds.has(candidate.endpoint.endpoint_id))
   ];
 }
-async function agentSelectEndpoint(intent, skill, ranked, contextUrl) {
-  const topRanked = ranked.slice(0, 5);
-  const preferred = inferPreferredEntityTokens(intent);
-  const concreteEntityIntent = isConcreteEntityDetailIntent(intent, contextUrl);
-  const hasObservedCandidate = topRanked.some((r) => !/inferred from js bundle/i.test(r.endpoint.description ?? ""));
-  const narrowedBase = hasObservedCandidate ? topRanked.filter((r) => !/inferred from js bundle/i.test(r.endpoint.description ?? "")) : topRanked;
-  const hasPreferredObservedApi = concreteEntityIntent && preferred.length > 0 && narrowedBase.some((candidate) => candidateMatchesPreferredEntity(candidate, preferred) && !isDocumentLikeCandidate(candidate, contextUrl));
-  const narrowed = hasPreferredObservedApi ? narrowedBase.filter((candidate) => !isDocumentLikeCandidate(candidate, contextUrl)) : narrowedBase;
-  const top = narrowed.map((r) => ({
-    endpoint_id: r.endpoint.endpoint_id,
-    method: r.endpoint.method,
-    url: r.endpoint.url_template,
-    description: r.endpoint.description ?? "",
-    score: Math.round(r.score * 10) / 10,
-    schema: r.endpoint.response_schema ? summarizeSchema(r.endpoint.response_schema) : null,
-    dom_extraction: !!r.endpoint.dom_extraction,
-    trigger_url: r.endpoint.trigger_url ?? null
-  }));
-  const fallback = { ordered_endpoint_ids: top.map((r) => r.endpoint_id) };
-  const judged = await callJsonAgent("You pick the best endpoint(s) for a website task. Return JSON only.", JSON.stringify({
-    task: "rank_endpoints_for_execution",
-    intent,
-    domain: skill.domain,
-    context_url: contextUrl ?? null,
-    endpoints: top,
-    rules: [
-      "Prefer endpoints that directly satisfy the intent, not adjacent metadata.",
-      "Prefer final user-visible data over experiments, config, telemetry, auth, status, or affinity endpoints.",
-      "If the intent asks for channels/messages/people/documents/listings, reject endpoints that return unrelated experiments or scores.",
-      "Return ordered_endpoint_ids best-first. Do not invent ids."
-    ]
-  }), fallback);
-  const orderedRaw = judged.ordered_endpoint_ids ?? judged.endpoint_ids ?? judged.ids ?? [];
-  const ordered = orderedRaw.filter((id) => top.some((r) => r.endpoint_id === id));
-  return ordered.length > 0 ? ordered : fallback.ordered_endpoint_ids;
-}
-async function agentJudgeExecution(intent, endpoint, result) {
+async function agentSelectEndpoint(_intent, _skill, _ranked, _contextUrl) {
+  return null;
+}
+function agentJudgeExecution(intent, endpoint, result) {
   if (obviousSemanticMismatch(intent, endpoint, result))
     return "fail";
-  const verdict = await callJsonAgent("You judge whether returned data satisfies a web data intent. Return JSON only.", JSON.stringify({
-    task: "judge_endpoint_result",
-    intent,
-    endpoint: {
-      endpoint_id: endpoint.endpoint_id,
-      method: endpoint.method,
-      url: endpoint.url_template,
-      description: endpoint.description ?? ""
-    },
-    result,
-    rules: [
-      "pass only if the returned data directly answers the intent",
-      "fail if the data is empty, unrelated, config, experiment, telemetry, status, auth/session, or only a weak proxy",
-      "for list/search intents, wrong entity type is fail"
-    ]
-  }), { verdict: "skip" });
-  return verdict.verdict ?? verdict.result ?? verdict.judgment ?? extractBinaryVerdict(verdict);
+  if (result == null)
+    return "fail";
+  if (Array.isArray(result))
+    return result.length > 0 ? "pass" : "fail";
+  if (typeof result === "object")
+    return Object.keys(result).length > 0 ? "pass" : "fail";
+  if (typeof result === "string")
+    return result.length > 0 ? "pass" : "fail";
+  return "skip";
 }
 function normalizeParityRows(data, intent) {
   const projected = projectIntentData(data, intent);
@@ -14052,22 +14108,9 @@ function localParityVerdict(intent, browserBaseline, replayResult) {
   }
   return { verdict: "skip", reason: `low_overlap_${overlapRatio.toFixed(2)}` };
 }
-async function agentJudgeParity(intent, browserBaseline, replayResult) {
-  const browserProjected = projectIntentData(browserBaseline, intent);
-  const replayProjected = projectIntentData(replayResult, intent);
-  const verdict = await callJsonAgent("You judge whether a replay/API result is close enough to the browser-visible result for the same web task. Return JSON only.", JSON.stringify({
-    task: "judge_browser_replay_parity",
-    intent,
-    browser_result: browserProjected,
-    replay_result: replayProjected,
-    rules: [
-      "This is a soft parity check, not strict equality.",
-      "Pass when the replay captures substantially the same user-visible entities or records, even if order, counts, or some fields differ.",
-      "Fail when the replay is a different entity type, obviously unrelated, or misses almost all visible items.",
-      "Skip when evidence is too sparse or ambiguous."
-    ]
-  }), { verdict: "skip" });
-  return verdict.verdict ?? verdict.result ?? verdict.judgment ?? extractBinaryVerdict(verdict);
+function agentJudgeParity(intent, browserBaseline, replayResult) {
+  const local = localParityVerdict(intent, browserBaseline, replayResult);
+  return local.verdict;
 }
 function resolveEndpointTemplateBindings(endpoint, params = {}, contextUrl) {
   const merged = mergeContextTemplateParams(params, endpoint.url_template, contextUrl);
@@ -14294,7 +14337,8 @@ async function resolveAndExecute(intent, params = {}, context, projection, optio
           example_fields: r.endpoint.semantic?.example_fields?.slice(0, 12),
           sample_values: extractSampleValues(r.endpoint.semantic?.example_response_compact),
           dom_extraction: !!r.endpoint.dom_extraction,
-          trigger_url: r.endpoint.trigger_url
+          trigger_url: r.endpoint.trigger_url,
+          needs_params: r.endpoint.semantic?.requires?.some((b) => b.required) ?? false
         })),
         ...extraFields
       },
@@ -14608,7 +14652,7 @@ async function resolveAndExecute(intent, params = {}, context, projection, optio
             continue;
           }
           const trustDomExtraction = candidate.endpoint.dom_extraction && !isCapturedPageArtifact && localAssessment.verdict !== "fail" && candidate.score >= 0;
-          const judged = localAssessment.verdict === "pass" || trustDomExtraction ? "pass" : await agentJudgeExecution(intent, candidate.endpoint, execOut.result);
+          const judged = localAssessment.verdict === "pass" || trustDomExtraction ? "pass" : agentJudgeExecution(intent, candidate.endpoint, execOut.result);
           decisionTrace.autoexec_attempts.push({
             endpoint_id: candidate.endpoint.endpoint_id,
             score: Math.round(candidate.score * 10) / 10,
@@ -14918,9 +14962,104 @@ async function resolveAndExecute(intent, params = {}, context, projection, optio
       }
     }
   }
+  const shouldBypassBrowserFirstPass = shouldBypassLiveCaptureQueue(context?.url);
+  if (context?.url && !agentChoseEndpoint && !forceCapture && !shouldBypassBrowserFirstPass) {
+    console.log(`[fast-path] no local cache for ${requestedDomain} — skipping marketplace, going to browser`);
+    (async () => {
+      try {
+        const { domain_results, global_results } = await searchIntentResolve(queryIntent, requestedDomain ?? undefined, MARKETPLACE_DOMAIN_SEARCH_K, MARKETPLACE_GLOBAL_SEARCH_K);
+        const totalResults = domain_results.length + global_results.length;
+        if (totalResults > 0) {
+          console.log(`[fast-path:bg] marketplace found ${totalResults} candidates — will be cached for next resolve`);
+        }
+      } catch {}
+    })();
+    const firstPassResult = await tryFirstPassBrowserAction(intent, params, context.url, { signal: options?.signal, clientScope: options?.client_scope });
+    decisionTrace.first_pass = {
+      intentClass: firstPassResult.intentClass,
+      actionTaken: firstPassResult.actionTaken,
+      hit: firstPassResult.hit,
+      interceptedCount: firstPassResult.interceptedEntries.length,
+      timeMs: firstPassResult.timeMs,
+      fast_path: true
+    };
+    if (firstPassResult.hit && firstPassResult.miniSkill) {
+      const fpNow = new Date().toISOString();
+      const trace2 = {
+        trace_id: nanoid7(),
+        skill_id: firstPassResult.miniSkill.skill_id,
+        endpoint_id: firstPassResult.miniSkill.endpoints[0]?.endpoint_id ?? "",
+        started_at: fpNow,
+        completed_at: fpNow,
+        success: true,
+        network_events: firstPassResult.interceptedEntries
+      };
+      return {
+        result: firstPassResult.result,
+        trace: trace2,
+        source: "first-pass",
+        skill: firstPassResult.miniSkill,
+        timing: finalize("first-pass", firstPassResult.result, firstPassResult.miniSkill.skill_id, firstPassResult.miniSkill, trace2)
+      };
+    }
+    console.log(`[fast-path] first-pass miss — opening browse session for agent`);
+    if (firstPassResult.tabId && context.url) {
+      const tabId = firstPassResult.tabId;
+      const domain = new URL(context.url).hostname.replace(/^www\./, "");
+      try {
+        const { extractBrowserCookies: extractBrowserCookies2 } = await Promise.resolve().then(() => (init_browser_cookies(), exports_browser_cookies));
+        const { cookies } = extractBrowserCookies2(domain);
+        for (const c of cookies)
+          await setCookie(tabId, c).catch(() => {});
+      } catch {}
+      await evaluate(tabId, (await Promise.resolve().then(() => (init_capture(), exports_capture))).INTERCEPTOR_SCRIPT).catch(() => {});
+      await harStart(tabId).catch(() => {});
+      try {
+        const routesModule = await init_routes().then(() => exports_routes);
+        if (typeof routesModule.registerBrowseSession === "function") {
+          routesModule.registerBrowseSession(tabId, context.url, domain);
+        }
+      } catch {}
+      const fpNow = new Date().toISOString();
+      const trace2 = {
+        trace_id: nanoid7(),
+        skill_id: "browse-session",
+        endpoint_id: "",
+        started_at: fpNow,
+        completed_at: fpNow,
+        success: true
+      };
+      return {
+        result: {
+          status: "browse_session_open",
+          tab_id: tabId,
+          url: context.url,
+          domain,
+          next_step: "unbrowse snap",
+          commands: [
+            "unbrowse snap --filter interactive",
+            "unbrowse click <ref>",
+            "unbrowse fill <ref> <value>",
+            "unbrowse close"
+          ]
+        },
+        trace: trace2,
+        source: "browser-action",
+        skill: undefined,
+        timing: finalize("browser-action", null, "browse-session", undefined, trace2)
+      };
+    }
+  }
+  const MARKETPLACE_TIMEOUT_MS = context?.url ? 5000 : 30000;
   if (!forceCapture) {
     const ts0 = Date.now();
-    const { domain_results: domainResults, global_results: globalResults } = await searchIntentResolve(queryIntent, requestedDomain ?? undefined, MARKETPLACE_DOMAIN_SEARCH_K, MARKETPLACE_GLOBAL_SEARCH_K).catch(() => ({
+    const { domain_results: domainResults, global_results: globalResults } = await Promise.race([
+      searchIntentResolve(queryIntent, requestedDomain ?? undefined, MARKETPLACE_DOMAIN_SEARCH_K, MARKETPLACE_GLOBAL_SEARCH_K),
+      new Promise((resolve) => setTimeout(() => {
+        console.log(`[marketplace] timeout after ${MARKETPLACE_TIMEOUT_MS}ms — falling through to browser`);
+        resolve({ domain_results: [], global_results: [], skipped_global: true });
+      }, MARKETPLACE_TIMEOUT_MS))
+    ]).catch(() => ({
       domain_results: [],
       global_results: [],
       skipped_global: false
@@ -15055,7 +15194,7 @@ async function resolveAndExecute(intent, params = {}, context, projection, optio
       }
     } catch {}
   }
-  if (context?.url && !forceCapture) {
+  if (context?.url && !forceCapture && !shouldBypassBrowserFirstPass) {
     const firstPassResult = await tryFirstPassBrowserAction(intent, params, context.url, { signal: options?.signal, clientScope: options?.client_scope });
     decisionTrace.first_pass = {
       intentClass: firstPassResult.intentClass,
@@ -15171,7 +15310,7 @@ async function resolveAndExecute(intent, params = {}, context, projection, optio
       }
     }
   }
-  const bypassLiveCaptureQueue = shouldBypassLiveCaptureQueue(context?.url);
+  const bypassLiveCaptureQueue = shouldBypassBrowserFirstPass;
   const captureLockKey = scopedCacheKey(clientScope, captureDomain);
   let learned_skill;
   let trace;
@@ -15320,12 +15459,7 @@ async function resolveAndExecute(intent, params = {}, context, projection, optio
   function queuePassivePublishIfExecuted(skill, orchestratorResult, browserBaseline) {
     if (!orchestratorResult.trace.success || !orchestratorResult.trace.endpoint_id)
       return;
-    const parity = browserBaseline === undefined ? undefined : (async () => {
-      const local = localParityVerdict(intent, browserBaseline, orchestratorResult.result);
-      if (local.verdict !== "skip")
-        return local.verdict;
-      return await agentJudgeParity(intent, browserBaseline, orchestratorResult.result);
-    })();
+    const parity = browserBaseline === undefined ? undefined : Promise.resolve(agentJudgeParity(intent, browserBaseline, orchestratorResult.result));
     queuePassiveSkillPublish(skill, { parity });
   }
   if (!learned_skill && !trace.success) {
@@ -15534,7 +15668,7 @@ function selectSkillIdsToHydrate(candidates, requestedDomain, limit = MARKETPLAC
   ];
   return [...new Set(prioritizedCandidates.map((c) => extractSkillId(c.metadata)).filter((value) => !!value))].slice(0, limit);
 }
-var CONFIDENCE_THRESHOLD = 0.3, NEBIUS_API_KEY, OPENAI_API_KEY, CHAT_URL2 = "https://api.tokenfactory.nebius.com/v1/chat/completions", OPENAI_CHAT_URL2 = "https://api.openai.com/v1/chat/completions", JUDGE_MODEL, LIVE_CAPTURE_TIMEOUT_MS, BROWSER_CAPTURE_SKILL_ID = "browser-capture", capturedDomainCache, captureInFlight, captureDomainLocks, skillRouteCache, ROUTE_CACHE_FILE, SKILL_SNAPSHOT_DIR, domainSkillCache, DOMAIN_CACHE_FILE, _routeCacheDirty = false, routeCacheFlushTimer, routeResultCache, ROUTE_CACHE_TTL, MARKETPLACE_HYDRATE_LIMIT, MARKETPLACE_GET_SKILL_TIMEOUT_MS, MARKETPLACE_DOMAIN_SEARCH_K, MARKETPLACE_GLOBAL_SEARCH_K, SEARCH_INTENT_STOPWORDS, SEARCH_DIRECTIVE_PREFIX, SEARCH_TRAILING_SITE_HINT, SEARCH_INSTRUCTION_NOISE, SEARCH_PRIORITY_PATTERN;
+var CONFIDENCE_THRESHOLD = 0.3, LIVE_CAPTURE_TIMEOUT_MS, BROWSER_CAPTURE_SKILL_ID = "browser-capture", capturedDomainCache, captureInFlight, captureDomainLocks, skillRouteCache, ROUTE_CACHE_FILE, SKILL_SNAPSHOT_DIR, domainSkillCache, DOMAIN_CACHE_FILE, _routeCacheDirty = false, routeCacheFlushTimer, routeResultCache, ROUTE_CACHE_TTL, MARKETPLACE_HYDRATE_LIMIT, MARKETPLACE_GET_SKILL_TIMEOUT_MS, MARKETPLACE_DOMAIN_SEARCH_K, MARKETPLACE_GLOBAL_SEARCH_K, SEARCH_INTENT_STOPWORDS, SEARCH_DIRECTIVE_PREFIX, SEARCH_TRAILING_SITE_HINT, SEARCH_INSTRUCTION_NOISE, SEARCH_PRIORITY_PATTERN;
 var init_orchestrator = __esm(async () => {
   init_client2();
   init_client();
@@ -15556,9 +15690,6 @@ var init_orchestrator = __esm(async () => {
     init_execution(),
     init_prefetch()
   ]);
-  NEBIUS_API_KEY = process.env.NEBIUS_API_KEY ?? "";
-  OPENAI_API_KEY = process.env.OPENAI_API_KEY ?? "";
-  JUDGE_MODEL = process.env.UNBROWSE_AGENT_JUDGE_MODEL ?? "gpt-4.1-mini";
   LIVE_CAPTURE_TIMEOUT_MS = Number(process.env.UNBROWSE_LIVE_CAPTURE_TIMEOUT_MS ?? "120000");
   capturedDomainCache = new Map;
   captureInFlight = new Map;
@@ -16545,8 +16676,90 @@ async function registerRoutes(app) {
     try {
       await publishSkill2(skill);
     } catch {}
+    try {
+      cachePublishedSkill(skill);
+    } catch {}
     return reply.send({ ok: true, endpoints_updated: reviews.length });
   });
+  app.post("/v1/skills/:skill_id/publish", async (req, reply) => {
+    const clientScope = clientScopeFor(req);
+    const { skill_id } = req.params;
+    const { endpoints: reviews } = req.body ?? {};
+    let skill = getRecentLocalSkill(skill_id, clientScope);
+    if (!skill) {
+      for (const [, entry] of domainSkillCache) {
+        if (entry.skillId === skill_id && entry.localSkillPath) {
+          try {
+            skill = JSON.parse(__require("fs").readFileSync(entry.localSkillPath, "utf-8"));
+          } catch {}
+          break;
+        }
+      }
+    }
+    if (!skill)
+      skill = await getSkill2(skill_id, clientScope);
+    if (!skill)
+      return reply.code(404).send({ error: "Skill not found" });
+    if (reviews?.length) {
+      const updated = mergeAgentReview(skill.endpoints, reviews);
+      skill.endpoints = updated;
+      skill.updated_at = new Date().toISOString();
+      try {
+        cachePublishedSkill(skill);
+      } catch {}
+      const domain = skill.domain;
+      if (domain) {
+        const ck = buildResolveCacheKey(domain, skill.intent_signature ?? `browse ${domain}`, undefined);
+        const sk = scopedCacheKey(clientScope, ck);
+        writeSkillSnapshot(sk, skill);
+        const dk = getDomainReuseKey(domain);
+        if (dk) {
+          domainSkillCache.set(dk, {
+            skillId: skill.skill_id,
+            localSkillPath: snapshotPathForCacheKey(sk),
+            ts: Date.now()
+          });
+          persistDomainCache();
+        }
+      }
+      try {
+        await publishSkill2(skill);
+      } catch {}
+      try {
+        cachePublishedSkill(skill);
+      } catch {}
+      return reply.send({
+        ok: true,
+        skill_id: skill.skill_id,
+        endpoints_updated: reviews.length,
+        published: true
+      });
+    }
+    const ranked = rankEndpoints(skill.endpoints, skill.intent_signature, skill.domain);
+    const endpoints_to_describe = ranked.map((r) => ({
+      endpoint_id: r.endpoint.endpoint_id,
+      method: r.endpoint.method,
+      url: r.endpoint.url_template.length > 120 ? r.endpoint.url_template.slice(0, 120) + "..." : r.endpoint.url_template,
+      current_description: r.endpoint.description ?? "",
+      schema_summary: r.endpoint.response_schema ? summarizeSchema(r.endpoint.response_schema) : null,
+      sample_values: extractSampleValues(r.endpoint.semantic?.example_response_compact),
+      input_params: r.endpoint.semantic?.requires?.map((b) => ({
+        key: b.key,
+        type: b.type ?? b.semantic_type,
+        required: b.required ?? false,
+        example: b.example_value
+      })) ?? [],
+      dom_extraction: !!r.endpoint.dom_extraction,
+      _fill_description: "DESCRIBE THIS ENDPOINT — what it returns, key params, action type"
+    }));
+    return reply.send({
+      skill_id: skill.skill_id,
+      domain: skill.domain,
+      endpoint_count: skill.endpoints.length,
+      endpoints_to_describe,
+      _next_step: `Fill each endpoint's description, then call: unbrowse publish --skill ${skill.skill_id} --endpoints '[{endpoint_id, description, action_kind, resource_kind}]'`
+    });
+  });
   app.post("/v1/skills/:skill_id/chunk", async (req, reply) => {
     const clientScope = clientScopeFor(req);
     const { skill_id } = req.params;
@@ -16761,7 +16974,7 @@ async function registerRoutes(app) {
     await start().catch(() => {});
     const tabId = await newTab();
     await harStart(tabId).catch(() => {});
-    await evaluate(tabId, INTERCEPTOR_SCRIPT).catch(() => {});
+    await injectInterceptor(tabId);
     const session = { tabId, url: "about:blank", harActive: true, domain: "" };
     browseSessions.set("default", session);
     return session;
@@ -16801,7 +17014,7 @@ async function registerRoutes(app) {
     const finalUrl = await getCurrentUrl(session.tabId).catch(() => url);
     session.url = typeof finalUrl === "string" && finalUrl.startsWith("http") ? finalUrl : url;
     session.domain = profileName(session.url);
-    await evaluate(session.tabId, INTERCEPTOR_SCRIPT).catch(() => {});
+    await injectInterceptor(session.tabId);
     return reply.send({ ok: true, url: session.url, tab_id: session.tabId, auth_profile: session.domain });
   });
   app.post("/v1/browse/snap", async (req, reply) => {
@@ -17002,6 +17215,88 @@ async function registerRoutes(app) {
           invalidateRouteCacheForDomain(domain);
           console.log(`[passive-index] ${domain}: ${mergedEps.length} endpoints cached synchronously`);
         }
+      } else {
+        let domain2;
+        try {
+          domain2 = new URL(session.url).hostname;
+        } catch {
+          domain2 = session.domain;
+        }
+        try {
+          const html = await getPageHtml(session.tabId);
+          if (html && typeof html === "string" && html.startsWith("<")) {
+            const { extractFromDOM: extractFromDOM2 } = await Promise.resolve().then(() => (init_extraction(), exports_extraction));
+            const { detectSearchForms: detectSearchForms2, isStructuredSearchForm: isStructuredSearchForm2 } = await Promise.resolve().then(() => (init_search_forms(), exports_search_forms));
+            const { inferSchema: inferSchema2 } = await Promise.resolve().then(() => (init_transform(), exports_transform));
+            const { inferEndpointSemantic: inferEndpointSemantic2 } = await Promise.resolve().then(() => (init_graph(), exports_graph));
+            const { templatizeQueryParams: templatizeQueryParams2 } = await init_execution().then(() => exports_execution);
+            const extracted = extractFromDOM2(html, `browse ${domain2}`);
+            const searchForms = detectSearchForms2(html);
+            const validForm = searchForms.find((s) => isStructuredSearchForm2(s));
+            if (extracted.data || validForm) {
+              const urlTemplate = templatizeQueryParams2(session.url);
+              const ep = {
+                endpoint_id: nanoid8(),
+                method: "GET",
+                url_template: urlTemplate,
+                idempotency: "safe",
+                verification_status: "verified",
+                reliability_score: extracted.confidence ?? 0.7,
+                description: validForm ? `Search form for ${domain2}` : `Page content from ${domain2}`,
+                response_schema: extracted.data ? inferSchema2([extracted.data]) : undefined,
+                dom_extraction: {
+                  extraction_method: extracted.extraction_method ?? "repeated-elements",
+                  confidence: extracted.confidence ?? 0.7,
+                  ...extracted.selector ? { selector: extracted.selector } : {},
+                  ...validForm ? { search_form: validForm } : {}
+                },
+                trigger_url: session.url
+              };
+              ep.semantic = inferEndpointSemantic2(ep, {
+                sampleResponse: extracted.data,
+                observedAt: new Date().toISOString(),
+                sampleRequestUrl: session.url
+              });
+              const existing = findExistingSkillForDomain(domain2);
+              const allEps = existing ? mergeEndpoints(existing.endpoints, [ep]) : [ep];
+              for (const e of allEps) {
+                if (!e.description)
+                  e.description = generateLocalDescription(e);
+              }
+              const skill = {
+                skill_id: existing?.skill_id ?? nanoid8(),
+                version: "1.0.0",
+                schema_version: "1",
+                lifecycle: "active",
+                execution_type: "http",
+                created_at: existing?.created_at ?? new Date().toISOString(),
+                updated_at: new Date().toISOString(),
+                name: domain2,
+                intent_signature: `browse ${domain2}`,
+                domain: domain2,
+                description: `DOM skill for ${domain2}`,
+                owner_type: "agent",
+                endpoints: allEps,
+                intents: [...new Set([...existing?.intents ?? [], `browse ${domain2}`])]
+              };
+              const ck = buildResolveCacheKey(domain2, `browse ${domain2}`, session.url);
+              const sk = scopedCacheKey("global", ck);
+              writeSkillSnapshot(sk, skill);
+              const dk = getDomainReuseKey(session.url ?? domain2);
+              if (dk) {
+                domainSkillCache.set(dk, { skillId: skill.skill_id, localSkillPath: snapshotPathForCacheKey(sk), ts: Date.now() });
+                persistDomainCache();
+              }
+              try {
+                cachePublishedSkill(skill);
+              } catch {}
+              invalidateRouteCacheForDomain(domain2);
+              console.log(`[close] ${domain2}: DOM endpoint created (form=${!!validForm})`);
+            }
+          }
+        } catch (err) {
+          console.log(`[close] DOM fallback failed: ${err instanceof Error ? err.message : err}`);
+        }
       }
     }
     passiveIndexFromRequests(allRequests, session.url);
@@ -17131,6 +17426,21 @@ var API_URL = process.env.UNBROWSE_BACKEND_URL || "https://beta-api.unbrowse.ai"
 var PROFILE_NAME = sanitizeProfileName(process.env.UNBROWSE_PROFILE ?? "");
 var recentLocalSkills = new Map;
 var LOCAL_ONLY = process.env.UNBROWSE_LOCAL_ONLY === "1";
+function decodeBase64Json(value) {
+  try {
+    if (typeof globalThis !== "undefined" && typeof globalThis.atob === "function") {
+      const binary = globalThis.atob(value);
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0;i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return JSON.parse(new TextDecoder("utf-8").decode(bytes));
+    }
+    return JSON.parse(Buffer.from(value, "base64").toString("utf8"));
+  } catch {
+    return;
+  }
+}
 function getConfigDir() {
   if (process.env.UNBROWSE_CONFIG_DIR)
     return process.env.UNBROWSE_CONFIG_DIR;
@@ -17185,6 +17495,7 @@ function getApiKey() {
   return "";
 }
 var API_TIMEOUT_MS = parseInt(process.env.UNBROWSE_API_TIMEOUT ?? "8000", 10);
+var PUBLISH_TIMEOUT_MS = parseInt(process.env.UNBROWSE_PUBLISH_TIMEOUT ?? "30000", 10);
 async function validateApiKey(key) {
   const controller = new AbortController;
   const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
@@ -17245,7 +17556,7 @@ async function findUsableApiKey() {
 async function api(method, path, body, opts) {
   const key = opts?.noAuth ? "" : getApiKey();
   const controller = new AbortController;
-  const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+  const timer = setTimeout(() => controller.abort(), opts?.timeoutMs ?? API_TIMEOUT_MS);
   let res;
   try {
     res = await fetch(`${API_URL}${path}`, {
@@ -17274,8 +17585,9 @@ async function api(method, path, body, opts) {
     throw new Error("ToS update required. Restart unbrowse to accept new terms.");
   }
   if (res.status === 402) {
-    const paymentTerms = res.headers.get("X-Payment-Required");
-    const terms = paymentTerms ? JSON.parse(paymentTerms) : data.terms;
+    const paymentRequired = res.headers.get("PAYMENT-REQUIRED");
+    const legacyPaymentTerms = res.headers.get("X-Payment-Required");
+    const terms = paymentRequired ? decodeBase64Json(paymentRequired) : legacyPaymentTerms ? JSON.parse(legacyPaymentTerms) : data.terms;
     const err = new Error(`Payment required: ${data.error ?? "This skill requires payment"}`);
     err.x402 = true;
     err.terms = terms;
@@ -18337,7 +18649,12 @@ async function cmdExecute(flags) {
     const items = Array.isArray(data) ? data : data != null ? [data] : [];
     const extracted = extractFlag ? applyExtract(items, extractFlag) : items;
     const limited = limitFlag ? extracted.slice(0, limitFlag) : extracted;
-    output({ trace: result.trace, data: limited, count: limited.length }, !!flags.pretty);
+    const trace = result.trace;
+    const out = { trace: result.trace, data: limited, count: limited.length };
+    if (trace?.skill_id && trace?.endpoint_id && limited.length > 0) {
+      out._review_hint = `After presenting results, improve this endpoint's description: unbrowse review --skill ${trace.skill_id} --endpoints '[{"endpoint_id":"${trace.endpoint_id}","description":"DESCRIBE WHAT THIS RETURNS","action_kind":"ACTION","resource_kind":"RESOURCE"}]'`;
+    }
+    output(out, !!flags.pretty);
     return;
   }
   if (!rawFlag && !pathFlag && !extractFlag && !schemaFlag) {
@@ -18386,6 +18703,20 @@ async function cmdReview(flags) {
     die("--endpoints must be a non-empty JSON array");
   output(await api3("POST", `/v1/skills/${skillId}/review`, { endpoints }), !!flags.pretty);
 }
+async function cmdPublish(flags) {
+  const skillId = flags.skill;
+  if (!skillId)
+    die("--skill is required");
+  const endpointsJson = flags.endpoints;
+  if (endpointsJson) {
+    const endpoints = JSON.parse(endpointsJson);
+    if (!Array.isArray(endpoints) || endpoints.length === 0)
+      die("--endpoints must be a non-empty JSON array");
+    output(await api3("POST", `/v1/skills/${skillId}/publish`, { endpoints }), !!flags.pretty);
+  } else {
+    output(await api3("POST", `/v1/skills/${skillId}/publish`, {}), !!flags.pretty);
+  }
+}
 async function cmdLogin(flags) {
   const url = flags.url;
   if (!url)
@@ -18465,6 +18796,7 @@ var CLI_REFERENCE = {
     { name: "execute", usage: "--skill ID --endpoint ID [opts]", desc: "Execute a specific endpoint" },
     { name: "feedback", usage: "--skill ID --endpoint ID --rating N", desc: "Submit feedback (mandatory after resolve)" },
     { name: "review", usage: "--skill ID --endpoints '[...]'", desc: "Push reviewed descriptions/metadata back to skill" },
+    { name: "publish", usage: "--skill ID [--endpoints '[...]']", desc: "Describe + publish skill to marketplace (two-phase)" },
     { name: "login", usage: '--url "..."', desc: "Interactive browser login" },
     { name: "skills", usage: "", desc: "List all skills" },
     { name: "skill", usage: "<id>", desc: "Get skill details" },
@@ -18512,7 +18844,9 @@ var CLI_REFERENCE = {
     "unbrowse execute --skill abc --endpoint def --schema --pretty",
     'unbrowse execute --skill abc --endpoint def --path "data.items[]" --extract "name,url" --limit 10 --pretty',
     "unbrowse feedback --skill abc --endpoint def --rating 5",
-    `unbrowse review --skill abc --endpoints '[{"endpoint_id":"def","description":"..."}]'`
+    `unbrowse review --skill abc --endpoints '[{"endpoint_id":"def","description":"..."}]'`,
+    "unbrowse publish --skill abc --pretty",
+    `unbrowse publish --skill abc --endpoints '[{"endpoint_id":"def","description":"Search court judgments by keywords","action_kind":"search","resource_kind":"judgment"}]'`
   ]
 };
 function printHelp() {
@@ -18856,6 +19190,7 @@ async function main() {
     "feedback",
     "fb",
     "review",
+    "publish",
     "login",
     "skills",
     "skill",
@@ -18918,6 +19253,8 @@ async function main() {
       return cmdFeedback(flags);
     case "review":
       return cmdReview(flags);
+    case "publish":
+      return cmdPublish(flags);
     case "login":
       return cmdLogin(flags);
     case "skills":