unbrowse 3.1.0-experiments.e503b7d → 3.1.0-experiments.ef43417

package/dist/cli.js

@@ -31,7 +31,7 @@ var __promiseAll = (args) => Promise.all(args);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // ../../src/build-info.generated.ts
-var BUILD_RELEASE_VERSION = "3.1.0-experiments.e503b7d", BUILD_GIT_SHA = "e503b7d2167b", BUILD_CODE_HASH = "1488fc1d92b7", BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiMy4xLjAtZXhwZXJpbWVudHMuZTUwM2I3ZCIsImdpdF9zaGEiOiJlNTAzYjdkMjE2N2IiLCJjb2RlX2hhc2giOiIxNDg4ZmMxZDkyYjciLCJ0cmFjZV92ZXJzaW9uIjoiMTQ4OGZjMWQ5MmI3QGU1MDNiN2QyMTY3YiIsImlzc3VlZF9hdCI6IjIwMjYtMDQtMDZUMDA6MzQ6MjIuMTg3WiJ9", BUILD_RELEASE_MANIFEST_SIGNATURE = "36eJ8u5UlMxjTqUP6YRiW3XcKkrqc77k0lsCcdLzCZw", BUILD_DEFAULT_BACKEND_URL = "https://unbrowse-backend-experiments.lewis-6d8.workers.dev";
+var BUILD_RELEASE_VERSION = "3.1.0-experiments.ef43417", BUILD_GIT_SHA = "ef434171bbc8", BUILD_CODE_HASH = "1488fc1d92b7", BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiMy4xLjAtZXhwZXJpbWVudHMuZWY0MzQxNyIsImdpdF9zaGEiOiJlZjQzNDE3MWJiYzgiLCJjb2RlX2hhc2giOiIxNDg4ZmMxZDkyYjciLCJ0cmFjZV92ZXJzaW9uIjoiMTQ4OGZjMWQ5MmI3QGVmNDM0MTcxYmJjOCIsImlzc3VlZF9hdCI6IjIwMjYtMDQtMDZUMDI6NTQ6MTAuMjU3WiJ9", BUILD_RELEASE_MANIFEST_SIGNATURE = "TWn8YbnQaAVxkiuNsLHcxl8-9saAN2wWFxDFtz9Xc0c", BUILD_DEFAULT_BACKEND_URL = "https://unbrowse-backend-experiments.lewis-6d8.workers.dev";
 
 // ../../src/version.ts
 import { createHash } from "crypto";

package/dist/mcp.js

@@ -225,11 +225,11 @@ import { dirname, join, parse } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../src/build-info.generated.ts
-var BUILD_RELEASE_VERSION = "3.1.0-experiments.e503b7d";
-var BUILD_GIT_SHA = "e503b7d2167b";
+var BUILD_RELEASE_VERSION = "3.1.0-experiments.ef43417";
+var BUILD_GIT_SHA = "ef434171bbc8";
 var BUILD_CODE_HASH = "1488fc1d92b7";
-var BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiMy4xLjAtZXhwZXJpbWVudHMuZTUwM2I3ZCIsImdpdF9zaGEiOiJlNTAzYjdkMjE2N2IiLCJjb2RlX2hhc2giOiIxNDg4ZmMxZDkyYjciLCJ0cmFjZV92ZXJzaW9uIjoiMTQ4OGZjMWQ5MmI3QGU1MDNiN2QyMTY3YiIsImlzc3VlZF9hdCI6IjIwMjYtMDQtMDZUMDA6MzQ6MjIuMTg3WiJ9";
-var BUILD_RELEASE_MANIFEST_SIGNATURE = "36eJ8u5UlMxjTqUP6YRiW3XcKkrqc77k0lsCcdLzCZw";
+var BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiMy4xLjAtZXhwZXJpbWVudHMuZWY0MzQxNyIsImdpdF9zaGEiOiJlZjQzNDE3MWJiYzgiLCJjb2RlX2hhc2giOiIxNDg4ZmMxZDkyYjciLCJ0cmFjZV92ZXJzaW9uIjoiMTQ4OGZjMWQ5MmI3QGVmNDM0MTcxYmJjOCIsImlzc3VlZF9hdCI6IjIwMjYtMDQtMDZUMDI6NTQ6MTAuMjU3WiJ9";
+var BUILD_RELEASE_MANIFEST_SIGNATURE = "TWn8YbnQaAVxkiuNsLHcxl8-9saAN2wWFxDFtz9Xc0c";
 var BUILD_DEFAULT_BACKEND_URL = "https://unbrowse-backend-experiments.lewis-6d8.workers.dev";
 
 // ../../src/version.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbrowse",
-  "version": "3.1.0-experiments.e503b7d",
+  "version": "3.1.0-experiments.ef43417",
   "description": "Reverse-engineer any website into reusable API skills. Zero-dep single binary with embedded browser engine.",
   "type": "module",
   "bin": {

package/runtime-src/api/browse-index.ts

@@ -169,6 +169,10 @@ export async function cacheBrowseRequests(params: {
   // so serverFetch can replay them. Use registrable domain for vault key
   // so ads.x.com and ads-api.x.com share the same session.
   const capturedAuthHeaders = extractAuthHeaders(requests);
+  // Filter out [REDACTED] placeholders from cookie-inferred auth headers
+  for (const [k, v] of Object.entries(capturedAuthHeaders)) {
+    if (v === "[REDACTED]") delete capturedAuthHeaders[k];
+  }
   if (Object.keys(capturedAuthHeaders).length > 0) {
     const sessionKey = `${getRegistrableDomain(domain)}-session`;
     await storeCredential(sessionKey, JSON.stringify({ headers: capturedAuthHeaders })).catch(() => {});

package/runtime-src/api/routes.ts

@@ -1178,9 +1178,17 @@ export async function registerRoutes(app: FastifyInstance) {
 
   async function restartBrowseCapture(session: BrowseSession): Promise<void> {
     const broker = brokerForSession(session);
-    // Start HAR + interceptor regardless of page load state — the page will load
-    // and HAR records all traffic from the moment it starts.
-    await broker.waitForLoad(session.tabId, 2_000).catch(() => null);
+    // Ensure Kuri is actually responding before starting HAR.
+    // Cold starts on packaged CLI can have ConnectionRefused retries —
+    // if we start HAR during instability, it gets lost on restart.
+    for (let attempt = 0; attempt < 5; attempt++) {
+      try {
+        await broker.waitForLoad(session.tabId, 2_000);
+        break;
+      } catch {
+        if (attempt < 4) await new Promise((r) => setTimeout(r, 1_000));
+      }
+    }
     await broker.networkEnable(session.tabId).catch(() => {});
     await broker.harStart(session.tabId).catch(() => {});
     await broker.scriptInject(session.tabId, INTERCEPTOR_SCRIPT).catch(() => {});

package/runtime-src/build-info.generated.ts

@@ -1,6 +1,6 @@
-export const BUILD_RELEASE_VERSION = "3.1.0-experiments.e503b7d";
-export const BUILD_GIT_SHA = "e503b7d2167b";
+export const BUILD_RELEASE_VERSION = "3.1.0-experiments.ef43417";
+export const BUILD_GIT_SHA = "ef434171bbc8";
 export const BUILD_CODE_HASH = "1488fc1d92b7";
-export const BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiMy4xLjAtZXhwZXJpbWVudHMuZTUwM2I3ZCIsImdpdF9zaGEiOiJlNTAzYjdkMjE2N2IiLCJjb2RlX2hhc2giOiIxNDg4ZmMxZDkyYjciLCJ0cmFjZV92ZXJzaW9uIjoiMTQ4OGZjMWQ5MmI3QGU1MDNiN2QyMTY3YiIsImlzc3VlZF9hdCI6IjIwMjYtMDQtMDZUMDA6MzQ6MjIuMTg3WiJ9";
-export const BUILD_RELEASE_MANIFEST_SIGNATURE = "36eJ8u5UlMxjTqUP6YRiW3XcKkrqc77k0lsCcdLzCZw";
+export const BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiMy4xLjAtZXhwZXJpbWVudHMuZWY0MzQxNyIsImdpdF9zaGEiOiJlZjQzNDE3MWJiYzgiLCJjb2RlX2hhc2giOiIxNDg4ZmMxZDkyYjciLCJ0cmFjZV92ZXJzaW9uIjoiMTQ4OGZjMWQ5MmI3QGVmNDM0MTcxYmJjOCIsImlzc3VlZF9hdCI6IjIwMjYtMDQtMDZUMDI6NTQ6MTAuMjU3WiJ9";
+export const BUILD_RELEASE_MANIFEST_SIGNATURE = "TWn8YbnQaAVxkiuNsLHcxl8-9saAN2wWFxDFtz9Xc0c";
 export const BUILD_DEFAULT_BACKEND_URL = "https://unbrowse-backend-experiments.lewis-6d8.workers.dev";

package/runtime-src/execution/index.ts

@@ -2022,7 +2022,7 @@ export async function executeEndpoint(
     try {
       const { resolveAuthTokens } = await import("./token-resolver.js");
       const resolved = await resolveAuthTokens(endpoint, cookies, authHeaders);
-      log("exec", `token resolver returned ${Object.keys(resolved).length} headers: ${Object.keys(resolved).join(",") || "none"}`);
+      log("exec", `token resolver returned ${Object.keys(resolved).length} headers: ${Object.keys(resolved).join(",") || "none"} auth=${(resolved.authorization || "").substring(0, 40)}`);
       Object.assign(authHeaders, resolved);
     } catch (e) { log("exec", `token resolver failed: ${e}`); }
   }
@@ -2241,7 +2241,7 @@ export async function executeEndpoint(
 
     for (const replayUrl of replayUrls) {
       const replayHeaders = buildStructuredReplayHeaders(url, replayUrl, headers);
-      log("exec", `server-fetch: ${endpoint.method} ${replayUrl.substring(0, 80)} csrf=${replayHeaders["x-csrf-token"]?.substring(0, 10)}... cookies=${(replayHeaders["cookie"]?.length ?? 0)}chars`);
+      log("exec", `server-fetch: ${endpoint.method} ${replayUrl.substring(0, 80)} auth=${(replayHeaders["authorization"] || "none").substring(0, 50)} csrf=${replayHeaders["x-csrf-token"]?.substring(0, 10)}... cookies=${(replayHeaders["cookie"]?.length ?? 0)}chars`);
       const res = await fetch(replayUrl, {
         method: endpoint.method,
         headers: replayHeaders,
@@ -3165,6 +3165,7 @@ export function rankEndpoints(endpoints: EndpointDescriptor[], intent?: string,
       }
     }
     score += ep.reliability_score * 5;
+    if (ep.verification_status === "verified") score += 15;
     if (ep.method === "WS" && ep.response_schema) score += 3;
 
     // === Domain affinity ===

package/runtime-src/execution/token-resolver.ts

@@ -54,7 +54,14 @@ export async function resolveAuthTokens(
       }
 
       for (const binding of headerBindings) {
-        const value = await resolveBinding(binding, html, cookies);
+        let value = await resolveBinding(binding, html, cookies);
+
+        // If stored sources didn't resolve (e.g. bearer in a different bundle),
+        // scan all loaded script resources via Performance API
+        if (!value && binding.sources.some((s) => s.kind === "js-bundle")) {
+          value = await scanAllScriptResources(tabId, binding);
+        }
+
         if (value) {
           resolved[binding.param_name] = binding.param_name.toLowerCase() === "authorization"
             ? (value.startsWith("Bearer ") ? value : `Bearer ${value}`)
@@ -133,3 +140,35 @@ async function waitForLoad(tabId: string): Promise<void> {
     await new Promise((r) => setTimeout(r, 500));
   }
 }
+
+/**
+ * Scan all script resources loaded by the page via Performance API.
+ * Fetches each bundle and searches for a token matching the binding pattern.
+ * This handles cases where the enrichment captured the wrong bundle URLs.
+ */
+async function scanAllScriptResources(tabId: string, binding: AuthTokenBinding): Promise<string | undefined> {
+  try {
+    const raw = await kuri.evaluate(tabId, `
+      JSON.stringify(
+        performance.getEntriesByType('resource')
+          .filter(function(e) { return e.initiatorType === 'script'; })
+          .map(function(e) { return e.name; })
+      )
+    `);
+    if (typeof raw !== "string" || !raw.startsWith("[")) return undefined;
+    const urls: string[] = JSON.parse(raw);
+
+    const tokenPattern = /AAAAAAAAAAAAAAAAAAA[A-Za-z0-9+/=_%-]{20,}/;
+
+    for (const url of urls) {
+      try {
+        const resp = await fetch(url);
+        if (!resp.ok) continue;
+        const body = await resp.text();
+        const m = body.match(tokenPattern);
+        if (m && m[0].length >= 20) return m[0];
+      } catch { /* fetch failed, try next */ }
+    }
+  } catch { /* evaluate failed */ }
+  return undefined;
+}

package/vendor/kuri/manifest.json

@@ -2,24 +2,24 @@
   "repo_url": "https://github.com/justrach/kuri.git",
   "branch": "adding-extensions",
   "source_sha": "eadfaa5f921f7152e1762aed5ed64b3a4fbefbf3",
-  "built_at": "2026-04-06T00:34:22.236Z",
+  "built_at": "2026-04-06T02:54:10.305Z",
   "binaries": {
     "darwin-arm64": {
       "zig_target": "aarch64-macos",
-      "sha256": "e230b49c36db62c3a5c9cf62e316b637ffff7452335211f63c390aab1a13e250",
+      "sha256": "1796501e393403016723c6b69266b834e2db04ba2559f51c84c957bd85c3927b",
       "source": "prebuilt"
     },
     "darwin-x64": {
       "zig_target": "x86_64-macos",
-      "sha256": "5ce0dced30e64cb4c580495974f11a136d106d70004683b72300f27bd9d3c0b1"
+      "sha256": "82db8a0f3596d1f9335785eca8009e257bf379197e725f29aaedd6f9c2456267"
     },
     "linux-arm64": {
       "zig_target": "aarch64-linux",
-      "sha256": "adc3bdfb7642f0e7e21c249dc570da9d30403703837aa072bc1c2bf5bb88f950"
+      "sha256": "8b53f4944274cb8930488ef822b0052f121e824424501863c399f251d827386b"
     },
     "linux-x64": {
       "zig_target": "x86_64-linux",
-      "sha256": "8e033bdf050019e700801a5a6bf5298c2ad54914d7620385bfa8fd14fe77c4da"
+      "sha256": "ac00c41f2a8c706de9f0dcce1087fcdccb53484303c05f101bb461f7b9dceb48"
     }
   }
 }