unbrowse 6.6.0 → 6.7.0-preview.0

package/dist/cli.js

@@ -31,7 +31,7 @@ var __promiseAll = (args) => Promise.all(args);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // ../../src/build-info.generated.ts
-var BUILD_RELEASE_VERSION = "6.6.0", BUILD_GIT_SHA = "7de260727d86", BUILD_CODE_HASH = "5d9ebf619c61", BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiNi42LjAiLCJnaXRfc2hhIjoiN2RlMjYwNzI3ZDg2IiwiY29kZV9oYXNoIjoiNWQ5ZWJmNjE5YzYxIiwidHJhY2VfdmVyc2lvbiI6IjVkOWViZjYxOWM2MUA3ZGUyNjA3MjdkODYiLCJpc3N1ZWRfYXQiOiIyMDI2LTA1LTA0VDA2OjM2OjA0LjY1NVoifQ", BUILD_RELEASE_MANIFEST_SIGNATURE = "ZP-8gEii8oLih47bn-ZtfHZzY88cRU-K5rRbAl3oaSA", BUILD_DEFAULT_BACKEND_URL = "https://beta-api.unbrowse.ai", BUILD_DEFAULT_PROFILE = "";
+var BUILD_RELEASE_VERSION = "6.7.0-preview.0", BUILD_GIT_SHA = "e73c96e7d7e5", BUILD_CODE_HASH = "5d9ebf619c61", BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiNi43LjAtcHJldmlldy4wIiwiZ2l0X3NoYSI6ImU3M2M5NmU3ZDdlNSIsImNvZGVfaGFzaCI6IjVkOWViZjYxOWM2MSIsInRyYWNlX3ZlcnNpb24iOiI1ZDllYmY2MTljNjFAZTczYzk2ZTdkN2U1IiwiaXNzdWVkX2F0IjoiMjAyNi0wNS0wNFQxMToxMToxNS44MTJaIn0", BUILD_RELEASE_MANIFEST_SIGNATURE = "6RTVpC0pvJRHvZPp-HGgkQ08gr0ulga6egVmojNB1vw", BUILD_DEFAULT_BACKEND_URL = "https://beta-api.unbrowse.ai", BUILD_DEFAULT_PROFILE = "";
 
 // ../../src/version.ts
 import { createHash } from "crypto";
@@ -2333,131 +2333,69 @@ var init_telemetry_attribution2 = __esm(() => {
   ];
 });
 
-// ../../src/version.ts
-var exports_version = {};
-__export(exports_version, {
-  resolveCodeHashSourceDir: () => resolveCodeHashSourceDir2,
-  getPackageVersionForModuleDir: () => getPackageVersionForModuleDir2,
-  getEmbeddedReleaseVersion: () => getEmbeddedReleaseVersion2,
-  computeCodeHashForDir: () => computeCodeHashForDir2,
-  TRACE_VERSION: () => TRACE_VERSION2,
-  RELEASE_MANIFEST_SIGNATURE: () => RELEASE_MANIFEST_SIGNATURE2,
-  RELEASE_MANIFEST_BASE64: () => RELEASE_MANIFEST_BASE642,
-  PACKAGE_VERSION: () => PACKAGE_VERSION2,
-  GIT_SHA: () => GIT_SHA2,
-  DEFAULT_PROFILE: () => DEFAULT_PROFILE2,
-  DEFAULT_BACKEND_URL: () => DEFAULT_BACKEND_URL2,
-  CODE_HASH: () => CODE_HASH2
+// ../../src/sandbox/bundle-replay-client.ts
+var exports_bundle_replay_client = {};
+__export(exports_bundle_replay_client, {
+  runBundleReplay: () => runBundleReplay,
+  cookiesToHeaderValue: () => cookiesToHeaderValue,
+  BundleReplayError: () => BundleReplayError
 });
-import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync17, readFileSync as readFileSync11, readdirSync as readdirSync5 } from "fs";
-import { dirname as dirname4, join as join13, parse as parse2 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
-function collectTsFiles2(dir) {
-  const results = [];
-  for (const entry of readdirSync5(dir, { withFileTypes: true })) {
-    const full = join13(dir, entry.name);
-    if (entry.isDirectory() && entry.name !== "node_modules") {
-      results.push(...collectTsFiles2(full));
-    } else if (entry.name.endsWith(".ts")) {
-      results.push(full);
-    }
-  }
-  return results;
-}
-function hashFiles2(srcDir, files) {
-  const hash = createHash3("sha256");
-  for (const file of files) {
-    hash.update(file.slice(srcDir.length));
-    hash.update(readFileSync11(file, "utf-8"));
-  }
-  return hash.digest("hex").slice(0, 12);
-}
-function resolveCodeHashSourceDir2(moduleDir) {
-  const candidates = [
-    moduleDir,
-    join13(moduleDir, "runtime-src"),
-    join13(moduleDir, "..", "runtime-src"),
-    join13(moduleDir, "src"),
-    join13(moduleDir, "..", "src")
-  ];
-  for (const candidate of candidates) {
-    try {
-      if (!existsSync17(candidate))
-        continue;
-      const files = collectTsFiles2(candidate);
-      if (files.length > 0)
-        return candidate;
-    } catch {}
-  }
-  return null;
-}
-function computeCodeHashForDir2(srcDir) {
-  const files = collectTsFiles2(srcDir).sort();
-  if (files.length === 0)
-    throw new Error(`No TypeScript sources found in ${srcDir}`);
-  return hashFiles2(srcDir, files);
-}
-function computeCodeHash2() {
-  try {
-    const srcDir = resolveCodeHashSourceDir2(MODULE_DIR2);
-    if (srcDir)
-      return computeCodeHashForDir2(srcDir);
-  } catch {}
-  const pkgVersion = getPackageVersion2();
-  if (pkgVersion !== "unknown") {
-    return createHash3("sha256").update(`package:${pkgVersion}`).digest("hex").slice(0, 12);
+async function runBundleReplay(req, opts = {}) {
+  const base = opts.kuriBase ?? DEFAULT_KURI_BASE;
+  const body = JSON.stringify({
+    target_origin: req.targetOrigin,
+    target_href: req.targetHref,
+    bundle_url: req.bundleUrl,
+    bundle_source: req.bundleSource,
+    fingerprint: req.fingerprint ?? "chrome_mac_arm",
+    impersonate: req.impersonate ?? "chrome131",
+    post_eval: req.postEval,
+    timeout_ms: req.timeoutMs ?? 5000,
+    seed_cookies: req.seedCookies?.map((c) => ({
+      name: c.name,
+      value: c.value,
+      domain: c.domain ?? "",
+      path: c.path ?? "/",
+      secure: c.secure ?? false,
+      http_only: c.http_only ?? c.httpOnly ?? false,
+      same_site: c.same_site ?? c.sameSite ?? "",
+      expires: c.expires ?? 0
+    }))
+  });
+  const resp = await fetch(`${base}/v1/sandbox/replay`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body,
+    signal: opts.signal
+  });
+  const text = await resp.text();
+  if (!resp.ok) {
+    throw new BundleReplayError(resp.status, text);
   }
-  return "compiled";
-}
-function getGitSha2() {
-  return BUILD_GIT_SHA?.trim() || "unknown";
-}
-function decodeBase64UrlJson2(value) {
+  let parsed;
   try {
-    if (!value)
-      return null;
-    return JSON.parse(Buffer.from(value, "base64url").toString("utf-8"));
+    parsed = JSON.parse(text);
   } catch {
-    return null;
-  }
-}
-function getEmbeddedReleaseVersion2() {
-  if (BUILD_RELEASE_VERSION?.trim())
-    return BUILD_RELEASE_VERSION.trim();
-  const manifest = decodeBase64UrlJson2(BUILD_RELEASE_MANIFEST_BASE64?.trim() || "");
-  return typeof manifest?.release_version === "string" && manifest.release_version.trim() ? manifest.release_version.trim() : null;
-}
-function getPackageVersionForModuleDir2(moduleDir) {
-  let dir = moduleDir;
-  const root = parse2(dir).root;
-  while (true) {
-    try {
-      const pkg = JSON.parse(readFileSync11(join13(dir, "package.json"), "utf-8"));
-      return typeof pkg.version === "string" ? pkg.version : "unknown";
-    } catch {}
-    if (dir === root)
-      return "unknown";
-    dir = dirname4(dir);
+    throw new BundleReplayError(resp.status, `invalid JSON: ${text.slice(0, 200)}`);
   }
+  return parsed;
 }
-function getPackageVersion2() {
-  const packageVersion = getPackageVersionForModuleDir2(MODULE_DIR2);
-  if (packageVersion !== "unknown")
-    return packageVersion;
-  return getEmbeddedReleaseVersion2() ?? "unknown";
+function cookiesToHeaderValue(cookies) {
+  return cookies.map((c) => `${c.name}=${c.value}`).join("; ");
 }
-var MODULE_DIR2, CODE_HASH2, GIT_SHA2, PACKAGE_VERSION2, DEFAULT_BACKEND_URL2, DEFAULT_PROFILE2, TRACE_VERSION2, RELEASE_MANIFEST_BASE642, RELEASE_MANIFEST_SIGNATURE2;
-var init_version2 = __esm(() => {
-  MODULE_DIR2 = dirname4(fileURLToPath4(import.meta.url));
-  CODE_HASH2 = BUILD_CODE_HASH?.trim() || computeCodeHash2();
-  GIT_SHA2 = getGitSha2();
-  PACKAGE_VERSION2 = getPackageVersion2();
-  DEFAULT_BACKEND_URL2 = BUILD_DEFAULT_BACKEND_URL?.trim() || "https://beta-api.unbrowse.ai";
-  DEFAULT_PROFILE2 = BUILD_DEFAULT_PROFILE?.trim() || "";
-  TRACE_VERSION2 = `${CODE_HASH2}@${GIT_SHA2}`;
-  RELEASE_MANIFEST_BASE642 = BUILD_RELEASE_MANIFEST_BASE64?.trim() || "";
-  RELEASE_MANIFEST_SIGNATURE2 = BUILD_RELEASE_MANIFEST_SIGNATURE?.trim() || "";
+var DEFAULT_KURI_BASE, BundleReplayError;
+var init_bundle_replay_client = __esm(() => {
+  DEFAULT_KURI_BASE = process.env.KURI_BASE_URL ?? "http://127.0.0.1:6969";
+  BundleReplayError = class BundleReplayError extends Error {
+    status;
+    body;
+    constructor(status, body) {
+      super(`sandbox replay failed: HTTP ${status}: ${body.slice(0, 200)}`);
+      this.status = status;
+      this.body = body;
+      this.name = "BundleReplayError";
+    }
+  };
 });
 
 // ../../src/auth/browser-cookies.ts
@@ -2474,19 +2412,19 @@ __export(exports_browser_cookies2, {
 });
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createDecipheriv as createDecipheriv3, pbkdf2Sync as pbkdf2Sync2 } from "node:crypto";
-import { copyFileSync as copyFileSync2, existsSync as existsSync18, mkdtempSync as mkdtempSync2, readdirSync as readdirSync6, rmSync as rmSync2 } from "node:fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync17, mkdtempSync as mkdtempSync2, readdirSync as readdirSync5, rmSync as rmSync2 } from "node:fs";
 import { tmpdir as tmpdir2, homedir as homedir8, platform as platform2 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join13 } from "node:path";
 function getChromeUserDataDir2() {
   const home = homedir8();
   if (platform2() === "darwin") {
-    return join14(home, "Library", "Application Support", "Google", "Chrome");
+    return join13(home, "Library", "Application Support", "Google", "Chrome");
   }
   if (platform2() === "win32") {
-    const appData = process.env.LOCALAPPDATA ?? join14(home, "AppData", "Local");
-    return join14(appData, "Google", "Chrome", "User Data");
+    const appData = process.env.LOCALAPPDATA ?? join13(home, "AppData", "Local");
+    return join13(appData, "Google", "Chrome", "User Data");
   }
-  return join14(home, ".config", "google-chrome");
+  return join13(home, ".config", "google-chrome");
 }
 function resolveChromiumCookiesPath2(opts) {
   if (opts?.cookieDbPath) {
@@ -2495,45 +2433,45 @@ function resolveChromiumCookiesPath2(opts) {
   const profileDir = opts?.profile || "Default";
   const userDataDir = (opts?.userDataDir || getChromeUserDataDir2()).replace(/^~\//, homedir8() + "/");
   const candidates = [
-    join14(userDataDir, profileDir, "Network", "Cookies"),
-    join14(userDataDir, profileDir, "Cookies"),
-    join14(userDataDir, "Network", "Cookies"),
-    join14(userDataDir, "Cookies")
+    join13(userDataDir, profileDir, "Network", "Cookies"),
+    join13(userDataDir, profileDir, "Cookies"),
+    join13(userDataDir, "Network", "Cookies"),
+    join13(userDataDir, "Cookies")
   ];
-  return candidates.find((candidate) => existsSync18(candidate)) ?? candidates[0] ?? null;
+  return candidates.find((candidate) => existsSync17(candidate)) ?? candidates[0] ?? null;
 }
 function getFirefoxProfilesRoot2() {
   const home = homedir8();
   if (platform2() === "darwin") {
-    return join14(home, "Library", "Application Support", "Firefox", "Profiles");
+    return join13(home, "Library", "Application Support", "Firefox", "Profiles");
   }
   if (platform2() === "linux") {
-    return join14(home, ".mozilla", "firefox");
+    return join13(home, ".mozilla", "firefox");
   }
   if (platform2() === "win32") {
     const appData = process.env.APPDATA;
     if (!appData)
       return null;
-    return join14(appData, "Mozilla", "Firefox", "Profiles");
+    return join13(appData, "Mozilla", "Firefox", "Profiles");
   }
   return null;
 }
 function pickFirefoxProfile2(profilesRoot, profile) {
   if (profile) {
-    const candidate2 = join14(profilesRoot, profile, "cookies.sqlite");
-    return existsSync18(candidate2) ? candidate2 : null;
+    const candidate2 = join13(profilesRoot, profile, "cookies.sqlite");
+    return existsSync17(candidate2) ? candidate2 : null;
   }
-  const entries = readdirSync6(profilesRoot, { withFileTypes: true });
+  const entries = readdirSync5(profilesRoot, { withFileTypes: true });
   const defaultRelease = entries.find((e) => e.isDirectory() && e.name.includes("default-release"));
   const targetDir = defaultRelease?.name ?? entries.find((e) => e.isDirectory())?.name;
   if (!targetDir)
     return null;
-  const candidate = join14(profilesRoot, targetDir, "cookies.sqlite");
-  return existsSync18(candidate) ? candidate : null;
+  const candidate = join13(profilesRoot, targetDir, "cookies.sqlite");
+  return existsSync17(candidate) ? candidate : null;
 }
 function getFirefoxCookiesPath2(profile) {
   const profilesRoot = getFirefoxProfilesRoot2();
-  if (!profilesRoot || !existsSync18(profilesRoot))
+  if (!profilesRoot || !existsSync17(profilesRoot))
     return null;
   return pickFirefoxProfile2(profilesRoot, profile);
 }
@@ -2602,13 +2540,13 @@ function decodeChromiumCookieValue2(rawValue, encryptedHex, opts) {
   return decryptChromiumValue2(encryptedHex, opts);
 }
 function withTempCopy2(dbPath, fn) {
-  const tempDir = mkdtempSync2(join14(tmpdir2(), "unbrowse-cookies-"));
-  const tempDb = join14(tempDir, "cookies.db");
+  const tempDir = mkdtempSync2(join13(tmpdir2(), "unbrowse-cookies-"));
+  const tempDb = join13(tempDir, "cookies.db");
   try {
     copyFileSync2(dbPath, tempDb);
     for (const ext of ["-wal", "-shm"]) {
       const src = dbPath + ext;
-      if (existsSync18(src))
+      if (existsSync17(src))
         copyFileSync2(src, tempDb + ext);
     }
     return fn(tempDb);
@@ -2653,7 +2591,7 @@ function extractFromChromium2(domain, opts) {
   const warnings = [];
   const dbPath = resolveChromiumCookiesPath2(opts);
   const sourceLabel = opts?.browserName || "Chromium";
-  if (!dbPath || !existsSync18(dbPath)) {
+  if (!dbPath || !existsSync17(dbPath)) {
     warnings.push(`${sourceLabel} cookies DB not found${dbPath ? ` at ${dbPath}` : ""}`);
     return { cookies: [], source: null, warnings };
   }
@@ -2748,8 +2686,8 @@ function extractFromFirefox2(domain, opts) {
 function extractBrowserCookies2(domain, opts) {
   const __result = _extractBrowserCookiesInner2(domain, opts);
   try {
-    const traceDir = join14(homedir8(), ".unbrowse", "traces");
-    if (!existsSync18(traceDir))
+    const traceDir = join13(homedir8(), ".unbrowse", "traces");
+    if (!existsSync17(traceDir))
       mkdirSync(traceDir, { recursive: true });
     const entry = JSON.stringify({
       d: domain,
@@ -2758,7 +2696,7 @@ function extractBrowserCookies2(domain, opts) {
       c: __result.cookies.map((c) => ({ n: c.name, v: c.value, d: c.domain }))
     }) + `
 `;
-    writeFileSync(join14(traceDir, "auth-extract.jsonl"), entry, { flag: "a" });
+    writeFileSync(join13(traceDir, "auth-extract.jsonl"), entry, { flag: "a" });
   } catch {}
   return __result;
 }
@@ -2802,8 +2740,8 @@ function scanAllBrowserSessions2(domain) {
   const results = [];
   const home = homedir8();
   for (const browser of CHROMIUM_BROWSERS2) {
-    const userDataDir = platform2() === "darwin" ? join14(home, "Library", "Application Support", browser.macPath) : platform2() === "win32" ? join14(process.env.LOCALAPPDATA ?? join14(home, "AppData", "Local"), browser.macPath, "User Data") : join14(home, ".config", browser.macPath.toLowerCase());
-    if (!existsSync18(userDataDir))
+    const userDataDir = platform2() === "darwin" ? join13(home, "Library", "Application Support", browser.macPath) : platform2() === "win32" ? join13(process.env.LOCALAPPDATA ?? join13(home, "AppData", "Local"), browser.macPath, "User Data") : join13(home, ".config", browser.macPath.toLowerCase());
+    if (!existsSync17(userDataDir))
       continue;
     try {
       const result = extractFromChromium2(domain, {
@@ -2857,6 +2795,133 @@ var init_browser_cookies2 = __esm(() => {
   ];
 });
 
+// ../../src/version.ts
+var exports_version = {};
+__export(exports_version, {
+  resolveCodeHashSourceDir: () => resolveCodeHashSourceDir2,
+  getPackageVersionForModuleDir: () => getPackageVersionForModuleDir2,
+  getEmbeddedReleaseVersion: () => getEmbeddedReleaseVersion2,
+  computeCodeHashForDir: () => computeCodeHashForDir2,
+  TRACE_VERSION: () => TRACE_VERSION2,
+  RELEASE_MANIFEST_SIGNATURE: () => RELEASE_MANIFEST_SIGNATURE2,
+  RELEASE_MANIFEST_BASE64: () => RELEASE_MANIFEST_BASE642,
+  PACKAGE_VERSION: () => PACKAGE_VERSION2,
+  GIT_SHA: () => GIT_SHA2,
+  DEFAULT_PROFILE: () => DEFAULT_PROFILE2,
+  DEFAULT_BACKEND_URL: () => DEFAULT_BACKEND_URL2,
+  CODE_HASH: () => CODE_HASH2
+});
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync18, readFileSync as readFileSync11, readdirSync as readdirSync6 } from "fs";
+import { dirname as dirname4, join as join14, parse as parse2 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+function collectTsFiles2(dir) {
+  const results = [];
+  for (const entry of readdirSync6(dir, { withFileTypes: true })) {
+    const full = join14(dir, entry.name);
+    if (entry.isDirectory() && entry.name !== "node_modules") {
+      results.push(...collectTsFiles2(full));
+    } else if (entry.name.endsWith(".ts")) {
+      results.push(full);
+    }
+  }
+  return results;
+}
+function hashFiles2(srcDir, files) {
+  const hash = createHash3("sha256");
+  for (const file of files) {
+    hash.update(file.slice(srcDir.length));
+    hash.update(readFileSync11(file, "utf-8"));
+  }
+  return hash.digest("hex").slice(0, 12);
+}
+function resolveCodeHashSourceDir2(moduleDir) {
+  const candidates = [
+    moduleDir,
+    join14(moduleDir, "runtime-src"),
+    join14(moduleDir, "..", "runtime-src"),
+    join14(moduleDir, "src"),
+    join14(moduleDir, "..", "src")
+  ];
+  for (const candidate of candidates) {
+    try {
+      if (!existsSync18(candidate))
+        continue;
+      const files = collectTsFiles2(candidate);
+      if (files.length > 0)
+        return candidate;
+    } catch {}
+  }
+  return null;
+}
+function computeCodeHashForDir2(srcDir) {
+  const files = collectTsFiles2(srcDir).sort();
+  if (files.length === 0)
+    throw new Error(`No TypeScript sources found in ${srcDir}`);
+  return hashFiles2(srcDir, files);
+}
+function computeCodeHash2() {
+  try {
+    const srcDir = resolveCodeHashSourceDir2(MODULE_DIR2);
+    if (srcDir)
+      return computeCodeHashForDir2(srcDir);
+  } catch {}
+  const pkgVersion = getPackageVersion2();
+  if (pkgVersion !== "unknown") {
+    return createHash3("sha256").update(`package:${pkgVersion}`).digest("hex").slice(0, 12);
+  }
+  return "compiled";
+}
+function getGitSha2() {
+  return BUILD_GIT_SHA?.trim() || "unknown";
+}
+function decodeBase64UrlJson2(value) {
+  try {
+    if (!value)
+      return null;
+    return JSON.parse(Buffer.from(value, "base64url").toString("utf-8"));
+  } catch {
+    return null;
+  }
+}
+function getEmbeddedReleaseVersion2() {
+  if (BUILD_RELEASE_VERSION?.trim())
+    return BUILD_RELEASE_VERSION.trim();
+  const manifest = decodeBase64UrlJson2(BUILD_RELEASE_MANIFEST_BASE64?.trim() || "");
+  return typeof manifest?.release_version === "string" && manifest.release_version.trim() ? manifest.release_version.trim() : null;
+}
+function getPackageVersionForModuleDir2(moduleDir) {
+  let dir = moduleDir;
+  const root = parse2(dir).root;
+  while (true) {
+    try {
+      const pkg = JSON.parse(readFileSync11(join14(dir, "package.json"), "utf-8"));
+      return typeof pkg.version === "string" ? pkg.version : "unknown";
+    } catch {}
+    if (dir === root)
+      return "unknown";
+    dir = dirname4(dir);
+  }
+}
+function getPackageVersion2() {
+  const packageVersion = getPackageVersionForModuleDir2(MODULE_DIR2);
+  if (packageVersion !== "unknown")
+    return packageVersion;
+  return getEmbeddedReleaseVersion2() ?? "unknown";
+}
+var MODULE_DIR2, CODE_HASH2, GIT_SHA2, PACKAGE_VERSION2, DEFAULT_BACKEND_URL2, DEFAULT_PROFILE2, TRACE_VERSION2, RELEASE_MANIFEST_BASE642, RELEASE_MANIFEST_SIGNATURE2;
+var init_version2 = __esm(() => {
+  MODULE_DIR2 = dirname4(fileURLToPath4(import.meta.url));
+  CODE_HASH2 = BUILD_CODE_HASH?.trim() || computeCodeHash2();
+  GIT_SHA2 = getGitSha2();
+  PACKAGE_VERSION2 = getPackageVersion2();
+  DEFAULT_BACKEND_URL2 = BUILD_DEFAULT_BACKEND_URL?.trim() || "https://beta-api.unbrowse.ai";
+  DEFAULT_PROFILE2 = BUILD_DEFAULT_PROFILE?.trim() || "";
+  TRACE_VERSION2 = `${CODE_HASH2}@${GIT_SHA2}`;
+  RELEASE_MANIFEST_BASE642 = BUILD_RELEASE_MANIFEST_BASE64?.trim() || "";
+  RELEASE_MANIFEST_SIGNATURE2 = BUILD_RELEASE_MANIFEST_SIGNATURE?.trim() || "";
+});
+
 // ../../src/cli.ts
 import { config as loadEnv } from "dotenv";
 import { spawn as spawn3 } from "child_process";
@@ -5067,7 +5132,17 @@ function parseArgs(argv) {
         "form-selector",
         "submit-selector",
         "wait-for",
-        "timeout-ms"
+        "timeout-ms",
+        "target-origin",
+        "target-href",
+        "bundle-url",
+        "bundle-source",
+        "post-eval",
+        "fingerprint",
+        "impersonate",
+        "origin",
+        "bundle",
+        "eval"
       ]);
       if (valueExpectedFlags.has(key)) {
         if (next === undefined)
@@ -5465,7 +5540,10 @@ async function cmdResolve(flags) {
     if (explicitEndpointId && resolveAvailableEndpoints()) {
       const skillId = resolveSkillId();
       if (skillId) {
+        const resolvedSource = typeof result.source === "string" ? result.source : undefined;
         result = await withPendingNotice(api2("POST", `/v1/skills/${skillId}/execute`, execBody(explicitEndpointId)), "Executing selected endpoint...");
+        if (resolvedSource && typeof result.source !== "string")
+          result.source = resolvedSource;
       }
     }
     const endpointsForAutoExecute = resolveAvailableEndpoints();
@@ -5474,6 +5552,7 @@ async function cmdResolve(flags) {
       const skillId = resolveSkillId();
       if (skillId && endpoints.length > 0) {
         const bestEndpoint = endpoints[0];
+        const resolvedSource = typeof result.source === "string" ? result.source : undefined;
         if (endpointNeedsThirdPartyTermsConfirmation(bestEndpoint) && !flags["confirm-third-party-terms"]) {
           process.stderr.write(`Skipping auto-execute: endpoint ${bestEndpoint.endpoint_id ?? "?"} ` + `requires explicit third-party terms confirmation. ` + `Re-run with --confirm-third-party-terms to proceed.
 `);
@@ -5486,6 +5565,8 @@ async function cmdResolve(flags) {
         } else {
           info(`Auto-executing endpoint: ${bestEndpoint.description ?? bestEndpoint.endpoint_id}`);
           result = await withPendingNotice(api2("POST", `/v1/skills/${skillId}/execute`, execBody(bestEndpoint.endpoint_id)), "Executing best endpoint...");
+          if (resolvedSource && typeof result.source !== "string")
+            result.source = resolvedSource;
         }
       }
     }
@@ -6323,6 +6404,72 @@ async function cmdNote(flags, args) {
   const res = await api2("POST", `/v1/domain-notes/${encodeURIComponent(domain)}`, { body });
   output(res, !!flags.pretty);
 }
+async function cmdSandboxReplay(args, flags) {
+  const { runBundleReplay: runBundleReplay2, cookiesToHeaderValue: cookiesToHeaderValue2 } = await Promise.resolve().then(() => (init_bundle_replay_client(), exports_bundle_replay_client));
+  const targetOrigin = flags["target-origin"] ?? flags.origin;
+  const targetHref = flags["target-href"] ?? flags.url;
+  const bundleUrl = flags["bundle-url"] ?? flags.bundle;
+  let bundleSource = flags["bundle-source"];
+  const postEval = flags["post-eval"] ?? flags.eval;
+  const fingerprint = flags.fingerprint ?? "chrome_mac_arm";
+  const impersonate = flags.impersonate ?? "chrome131";
+  const timeoutMs = flags["timeout-ms"] ? Number(flags["timeout-ms"]) : 5000;
+  if (bundleSource === "-" || flags["stdin"]) {
+    const chunks = [];
+    for await (const c of process.stdin)
+      chunks.push(c);
+    bundleSource = Buffer.concat(chunks).toString("utf8");
+  }
+  if (!targetOrigin)
+    die("usage: unbrowse sandbox-replay --target-origin <url> [--target-href <url>] (--bundle-url <url> | --bundle-source <js|->) [--post-eval <expr>]");
+  if (!bundleUrl && !bundleSource)
+    die("--bundle-url or --bundle-source required");
+  const kuriBase = process.env.KURI_BASE_URL ?? "http://127.0.0.1:8080";
+  try {
+    const h = await fetch(`${kuriBase}/health`, { signal: AbortSignal.timeout(2000) });
+    if (!h.ok)
+      die(`Kuri health check failed (HTTP ${h.status}). Start kuri first.`);
+  } catch (e) {
+    die(`Kuri unreachable at ${kuriBase}: ${e.message}. Run: submodules/kuri/zig-out/bin/kuri`);
+  }
+  let seedCookies;
+  if (flags["use-browser-cookies"]) {
+    const { findBestBrowserSession: findBestBrowserSession3 } = await Promise.resolve().then(() => (init_browser_cookies2(), exports_browser_cookies2));
+    const host = (() => {
+      try {
+        return new URL(targetOrigin).hostname;
+      } catch {
+        return targetOrigin;
+      }
+    })();
+    const session = findBestBrowserSession3(host);
+    if (session) {
+      seedCookies = session.cookies;
+      info(`[sandbox-replay] seeded ${session.cookies.length} cookies from ${session.browser} (${session.sessionCookies} httpOnly+secure)`);
+    } else {
+      info(`[sandbox-replay] --use-browser-cookies: no logged-in session found for ${host} across Chrome/Arc/Brave/Edge/Vivaldi/Opera/Dia/Chromium`);
+    }
+  }
+  const resp = await runBundleReplay2({
+    targetOrigin,
+    targetHref,
+    bundleUrl,
+    bundleSource,
+    fingerprint,
+    impersonate,
+    postEval,
+    timeoutMs,
+    seedCookies
+  }, { kuriBase: process.env.KURI_BASE_URL ?? "http://127.0.0.1:8080" });
+  output({
+    ok: resp.ok,
+    ms: resp.ms,
+    egress_bytes: resp.egress_bytes,
+    cookies: resp.cookies,
+    cookie_header: cookiesToHeaderValue2(resp.cookies),
+    post_eval: resp.post_eval
+  }, !!flags.pretty);
+}
 var CLI_REFERENCE = {
   commands: [
     { name: "health", usage: "", desc: "Server health check" },
@@ -6373,7 +6520,8 @@ var CLI_REFERENCE = {
     { name: "dashboard", usage: "[--no-open] [--pretty]", desc: "Open the website dashboard and pair it to this CLI install through localhost" },
     { name: "mode", usage: "", desc: "Re-prompt for contribution mode (private / share / share + earn)" },
     { name: "capture", usage: "--url <url> --intent <intent>", desc: "Live-browser capture for a single URL \u2014 discovers + indexes API endpoints. Marketplace publish gated by `unbrowse mode`." },
-    { name: "note", usage: '<read|write|list> --domain <domain> [--body "..."]', desc: "Read/write per-domain LLM-prose notes consumed by augment on next capture. Agent populates after reading capture's note_evidence." }
+    { name: "note", usage: '<read|write|list> --domain <domain> [--body "..."]', desc: "Read/write per-domain LLM-prose notes consumed by augment on next capture. Agent populates after reading capture's note_evidence." },
+    { name: "sandbox-replay", usage: "--target-origin <url> [--target-href <url>] [--bundle-url <url> | --bundle-source <js|->] [--post-eval <expr>] [--use-browser-cookies]", desc: "Run an anti-bot / signed-URL / HMAC bundle in Kuri's sandboxed JS runtime (QuickJS + statically-linked libcurl-impersonate, real Chrome 131 JA4). Returns harvested cookies + optional postEval result. --use-browser-cookies seeds the jar from the user's Chrome/Arc/Brave/Edge/Vivaldi/Opera/Dia session." }
   ],
   globalFlags: [
     { flag: "--pretty", desc: "Indented JSON output" },
@@ -7598,6 +7746,8 @@ async function main() {
       return cmdCapture(flags);
     case "note":
       return cmdNote(flags, args);
+    case "sandbox-replay":
+      return cmdSandboxReplay(args, flags);
     default:
       info(`Unknown command: ${command}`);
       printHelp();

package/dist/mcp.js

@@ -226,11 +226,11 @@ import { dirname, join, parse } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // ../../src/build-info.generated.ts
-var BUILD_RELEASE_VERSION = "6.6.0";
-var BUILD_GIT_SHA = "7de260727d86";
+var BUILD_RELEASE_VERSION = "6.7.0-preview.0";
+var BUILD_GIT_SHA = "e73c96e7d7e5";
 var BUILD_CODE_HASH = "5d9ebf619c61";
-var BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiNi42LjAiLCJnaXRfc2hhIjoiN2RlMjYwNzI3ZDg2IiwiY29kZV9oYXNoIjoiNWQ5ZWJmNjE5YzYxIiwidHJhY2VfdmVyc2lvbiI6IjVkOWViZjYxOWM2MUA3ZGUyNjA3MjdkODYiLCJpc3N1ZWRfYXQiOiIyMDI2LTA1LTA0VDA2OjM2OjA0LjY1NVoifQ";
-var BUILD_RELEASE_MANIFEST_SIGNATURE = "ZP-8gEii8oLih47bn-ZtfHZzY88cRU-K5rRbAl3oaSA";
+var BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiNi43LjAtcHJldmlldy4wIiwiZ2l0X3NoYSI6ImU3M2M5NmU3ZDdlNSIsImNvZGVfaGFzaCI6IjVkOWViZjYxOWM2MSIsInRyYWNlX3ZlcnNpb24iOiI1ZDllYmY2MTljNjFAZTczYzk2ZTdkN2U1IiwiaXNzdWVkX2F0IjoiMjAyNi0wNS0wNFQxMToxMToxNS44MTJaIn0";
+var BUILD_RELEASE_MANIFEST_SIGNATURE = "6RTVpC0pvJRHvZPp-HGgkQ08gr0ulga6egVmojNB1vw";
 var BUILD_DEFAULT_BACKEND_URL = "https://beta-api.unbrowse.ai";
 var BUILD_DEFAULT_PROFILE = "";
 

package/dist/server.js

@@ -7342,7 +7342,7 @@ var init_capture = __esm(async () => {
 });
 
 // ../../src/build-info.generated.ts
-var BUILD_RELEASE_VERSION = "6.6.0", BUILD_GIT_SHA = "7de260727d86", BUILD_CODE_HASH = "5d9ebf619c61", BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiNi42LjAiLCJnaXRfc2hhIjoiN2RlMjYwNzI3ZDg2IiwiY29kZV9oYXNoIjoiNWQ5ZWJmNjE5YzYxIiwidHJhY2VfdmVyc2lvbiI6IjVkOWViZjYxOWM2MUA3ZGUyNjA3MjdkODYiLCJpc3N1ZWRfYXQiOiIyMDI2LTA1LTA0VDA2OjM2OjA0LjY1NVoifQ", BUILD_RELEASE_MANIFEST_SIGNATURE = "ZP-8gEii8oLih47bn-ZtfHZzY88cRU-K5rRbAl3oaSA", BUILD_DEFAULT_BACKEND_URL = "https://beta-api.unbrowse.ai", BUILD_DEFAULT_PROFILE = "";
+var BUILD_RELEASE_VERSION = "6.7.0-preview.0", BUILD_GIT_SHA = "e73c96e7d7e5", BUILD_CODE_HASH = "5d9ebf619c61", BUILD_RELEASE_MANIFEST_BASE64 = "eyJzY2hlbWFfdmVyc2lvbiI6MSwicmVsZWFzZV92ZXJzaW9uIjoiNi43LjAtcHJldmlldy4wIiwiZ2l0X3NoYSI6ImU3M2M5NmU3ZDdlNSIsImNvZGVfaGFzaCI6IjVkOWViZjYxOWM2MSIsInRyYWNlX3ZlcnNpb24iOiI1ZDllYmY2MTljNjFAZTczYzk2ZTdkN2U1IiwiaXNzdWVkX2F0IjoiMjAyNi0wNS0wNFQxMToxMToxNS44MTJaIn0", BUILD_RELEASE_MANIFEST_SIGNATURE = "6RTVpC0pvJRHvZPp-HGgkQ08gr0ulga6egVmojNB1vw", BUILD_DEFAULT_BACKEND_URL = "https://beta-api.unbrowse.ai", BUILD_DEFAULT_PROFILE = "";
 
 // ../../src/version.ts
 import { createHash as createHash2 } from "crypto";
@@ -16102,6 +16102,7 @@ __export(exports_execution, {
   projectResultForIntent: () => projectResultForIntent,
   matchResponseSignal: () => matchResponseSignal,
   isBundleInferredEndpoint: () => isBundleInferredEndpoint,
+  extractBundleSnapshot: () => extractBundleSnapshot,
   executeSkill: () => executeSkill,
   executeEndpoint: () => executeEndpoint,
   detectBrowserBlockSignals: () => detectBrowserBlockSignals,
@@ -16855,12 +16856,25 @@ async function executeBrowserCapture(skill, params, options) {
         rejectedSamples.push({ url: u, reason });
     }
     const apiCallCount = captured.requests?.length ?? 0;
+    const requestUrls = (captured.requests ?? []).map((r) => r.url ?? "");
     const blockSignals = detectBrowserBlockSignals({
-      requestUrls: (captured.requests ?? []).map((r) => r.url ?? ""),
+      requestUrls,
       title,
       htmlLength: html.length,
       rejectionCounts
     });
+    const bundleSnapshot = extractBundleSnapshot({
+      requestUrls,
+      blockSignals,
+      targetOrigin: (() => {
+        try {
+          return new URL(url).origin;
+        } catch {
+          return url;
+        }
+      })(),
+      targetHref: url
+    });
     return {
       html_bytes: html.length,
       title,
@@ -16870,7 +16884,8 @@ async function executeBrowserCapture(skill, params, options) {
       intent_reason: intentReason,
       filter_rejections: rejectionCounts,
       rejected_samples: rejectedSamples,
-      browser_block_signals: blockSignals
+      browser_block_signals: blockSignals,
+      ...bundleSnapshot ? { bundle_snapshot: bundleSnapshot } : {}
     };
   };
   if (captured.html) {
@@ -18500,6 +18515,47 @@ function detectBrowserBlockSignals(input) {
   }
   return signals;
 }
+function extractBundleSnapshot(input) {
+  const { requestUrls, blockSignals, targetOrigin, targetHref } = input;
+  const vendor = blockSignals.find((s) => s.startsWith("vendor:"))?.slice("vendor:".length);
+  if (!vendor)
+    return null;
+  const matchers = {
+    perimeterx: [
+      /perimeterx|px-cloud|px-cdn|pxhd\.net/i,
+      /KP_UIDz=/,
+      /\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/(ips\.js|tl|xhr|init)/i
+    ],
+    datadome: [/datadome|js\.datadome|dd\.datadome|_dd\.s|ddjskey/i],
+    imperva_incapsula: [/akamaihd|ak-challenge|_Incapsula|incapsula|reese84/i],
+    akamai_bot_manager: [/akam\.net|bot-defender|\/_bm\/|sensor[-_]data|bm\.nuid|_abck/i],
+    cloudflare: [/cf-challenge|__cf_chl_|turnstile|challenges\.cloudflare/i],
+    fastly_bot_management: [/\/_fs-ch-[A-Za-z0-9]+\//],
+    captcha_vendor: [/hcaptcha|recaptcha|arkoselabs|funcaptcha/i],
+    shape_security: [/shape\.security|f5\.com\/shape|ShapeSecurity/i],
+    kasada: [/kasada|client\.kasada|ips\.kasada/i]
+  };
+  const patterns = matchers[vendor] ?? [];
+  const matched = requestUrls.filter((u) => patterns.some((p) => p.test(u)));
+  const bundleUrls = [];
+  const cookieIssuingUrls = [];
+  for (const u of matched) {
+    if (/\.js(\?|$|#)/i.test(u) || /ips\.js/i.test(u))
+      bundleUrls.push(u);
+    else
+      cookieIssuingUrls.push(u);
+  }
+  if (bundleUrls.length === 0 && cookieIssuingUrls.length === 0)
+    return null;
+  return {
+    vendor,
+    bundle_urls: bundleUrls,
+    cookie_issuing_urls: cookieIssuingUrls,
+    target_origin: targetOrigin,
+    target_href: targetHref,
+    captured_at: Math.floor(Date.now() / 1000)
+  };
+}
 function decomposeGraphqlEndpoint(endpoint) {
   const url = endpoint.url_template ?? "";
   const looksGraphql = /\/graphql\//i.test(url) || /\bvariables=\{variables\}/.test(url) || Array.isArray(endpoint.semantic?.requires) && endpoint.semantic.requires.some((r) => r.key === "variables") && endpoint.semantic.requires.some((r) => r.key === "features");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbrowse",
-  "version": "6.6.0",
+  "version": "6.7.0-preview.0",
   "description": "Reverse-engineer any website into reusable API skills. Zero-dep single binary with embedded browser engine.",
   "type": "module",
   "bin": {

package/vendor/kuri/manifest.json

@@ -1,24 +1,28 @@
 {
   "repo_url": "https://github.com/justrach/kuri.git",
   "branch": "adding-extensions",
-  "source_sha": "b91acae982e7d4f1d991dc4cf3e8340176e1787b",
-  "built_at": "2026-05-03T07:34:48.688Z",
+  "source_sha": "48fe847959d76420ee35b6ad004c841831d35455",
+  "built_at": "2026-05-04T11:06:18.067Z",
   "binaries": {
     "darwin-arm64": {
       "zig_target": "aarch64-macos",
-      "sha256": "d4336848294c404f1daa1b5d579939a0547a141efaf15ec6c312c27a61fa331f"
+      "source": "placeholder",
+      "sha256": "ca459cd22baadb02a3e246c547e39a2b9a3eccc2b50852b5a05386b3c584c760"
     },
     "darwin-x64": {
       "zig_target": "x86_64-macos",
-      "sha256": "cfc3a34214db4c79fa11eae03162271094b74c29f72e93ebab987ec89765dc76"
+      "source": "placeholder",
+      "sha256": "05b88578d5e7980d81e18ba3051c813271d1630d940009a599c791956090d122"
     },
     "linux-arm64": {
       "zig_target": "aarch64-linux",
-      "sha256": "637fd85c251493e472a6cae5fccc518b4144ecd5a38c3cfe52fa22f0ad5f2734"
+      "source": "placeholder",
+      "sha256": "6a47890b281c8178a5df040cbaf1e32acd9ddf1eb23428055e1a3abce79f92e5"
     },
     "linux-x64": {
       "zig_target": "x86_64-linux",
-      "sha256": "e68635c799012883e937e28c7b4aa1401e84bd3d8d6d1f22cb85bf836f5a4dc4"
+      "source": "placeholder",
+      "sha256": "66e35d14361feb683b80dc7e01902a454945ce6829dbb31ed99c1751abc9ced8"
     }
   }
 }