docpull 5.0.1__tar.gz → 5.5.0__tar.gz

{docpull-5.0.1/src/docpull.egg-info → docpull-5.5.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: docpull
-Version: 5.0.1
-Summary: Convert public web pages into clean Markdown for AI agents and RAG
+Version: 5.5.0
+Summary: Keep AI agents synced with changing public docs and web sources
 Author-email: Zachary Roth <support@raintree.technology>
 Maintainer-email: Raintree Technology <support@raintree.technology>
 License-Expression: MIT
@@ -112,7 +112,7 @@ Dynamic: license-file
 
 # docpull
 
-**Turn public web sources into local Markdown, NDJSON, and agent-ready context packs. Browser-free by default.**
+**Keep AI agents synced with changing public docs. Browser-free by default.**
 
 [![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
 [![PyPI version](https://badge.fury.io/py/docpull.svg)](https://badge.fury.io/py/docpull)
@@ -120,10 +120,15 @@ Dynamic: license-file
 [![GitHub stars](https://img.shields.io/github/stars/raintree-technology/docpull?style=social)](https://github.com/raintree-technology/docpull/stargazers)
 [![License: MIT](https://img.shields.io/github/license/raintree-technology/docpull)](https://github.com/raintree-technology/docpull/blob/main/LICENSE)
 
-docpull is a Python CLI, SDK, and MCP server that fetches public or explicitly
-authorized static/server-rendered web pages and converts them into clean,
-auditable local artifacts for LLMs, retrieval-augmented generation (RAG),
-offline research, and agent workflows.
+DocPull turns public docs and web sources into refreshable, cited, agent-ready
+context packs. Define source sets once, sync them over time, diff what changed,
+and export fresh context for Cursor, Claude, Codex, OpenAI, LlamaIndex,
+LangChain, MCP clients, and RAG pipelines.
+
+The original `docpull URL ...` workflow still works: fetch public or explicitly
+authorized static/server-rendered web pages and write clean Markdown, NDJSON,
+SQLite, or OKF outputs. Project mode adds the persistent evidence lifecycle on
+top: sources, runs, diffs, exports, evals, accounting, and local auditability.
 
 DocPull is local-first: direct fetching, sitemap/link discovery, extraction,
 indexing, pack intelligence, and local `agent-browser` rendering can run with no
@@ -152,6 +157,34 @@ reason unless you explicitly opt into the local `agent-browser` renderer. See
 pip install docpull
 ```
 
+## Project Quickstart
+
+```bash
+docpull init stripe-docs
+docpull add https://docs.stripe.com
+docpull sync
+docpull diff
+docpull export context-pack --target cursor
+```
+
+Example diff after a later sync:
+
+```text
+Project diff: +4 -2 ~18 api=2 pricing=1
+
+Changed pages:
+- /payments/payment-intents
+  likely API behavior change
+- /billing/subscriptions
+  pricing / billing change
+- /webhooks
+  likely API behavior change
+
+0 failed URLs
+0 robots blocked
+0 paid/cloud routes used
+```
+
 Install optional extras as needed:
 
 ```bash
@@ -170,7 +203,11 @@ install. Install an `agent-browser` compatible CLI separately, put it on
 `PATH`, or set `DOCPULL_AGENT_BROWSER_BIN=/path/to/agent-browser`. Verify the
 runtime with `docpull render --check`. Render targets must use HTTPS except for
 localhost/loopback HTTP during local testing, and DocPull keeps renderer action
-permissions locked down to HTML retrieval only.
+permissions locked down to HTML retrieval only. Because the current
+`agent-browser` CLI contract cannot enforce redirect, subresource, or
+connect-time DNS allow-lists, network browser rendering fails closed unless the
+operator sets `DOCPULL_RENDER_TRUSTED_BROWSER_TARGETS=1` for trusted targets.
+For localhost/loopback HTTP tests, set `DOCPULL_RENDER_ALLOW_LOCAL_TARGETS=1`.
 
 For stronger isolation, cloud runtimes are available explicitly:
 `docpull render URL --runtime vercel` uses the Vercel Sandbox CLI and Vercel
@@ -188,17 +225,17 @@ Use `--budget 0` when a run must not make paid-capable provider or cloud calls:
 ```bash
 docpull https://docs.example.com --budget 0 -o ./docs/example
 docpull discover scan https://docs.example.com -o ./packs/discovery
-docpull render https://example.com/app --runtime local --budget 0
+DOCPULL_RENDER_TRUSTED_BROWSER_TARGETS=1 docpull render https://example.com/app --runtime local --budget 0
 docpull providers context-pack "Find official docs" --provider all --dry-run --budget 0 --json
 docpull benchmark quick --zero-dollar --target-set zero-dollar --provider all
 ```
 
 Under a zero budget, local cache, direct HTTP, sitemap/static-link discovery,
 local extraction, local indexing, pack analysis, monitors, and local
-`agent-browser` rendering remain allowed. Live Tavily, Exa, Parallel, Vercel
-Sandbox, and E2B calls are blocked before execution. Runs involving a budget or
-paid-capable route write `run.accounting.json` with non-secret route, cost,
-HTTP/cache, browser, and blocked-action metadata.
+`agent-browser` rendering for trusted targets remain allowed. Live Tavily, Exa,
+Parallel, Vercel Sandbox, and E2B calls are blocked before execution. Runs
+involving a budget or paid-capable route write `run.accounting.json` with
+non-secret route, cost, HTTP/cache, browser, and blocked-action metadata.
 
 Use `docpull discover scan URL` to build a provider-free discovery pack from
 open site hints: `llms.txt`, RSS/Atom feeds, OpenAPI specs, sitemap indexes,
@@ -207,11 +244,11 @@ contract as provider imports and URL/sitemap files, so the next step is still
 `docpull discover select` or `docpull discover fetch`.
 
 When a zero-dollar benchmark or local run is partial, DocPull reports the
-lowest-friction escalation path before spending money: local `--render fallback`
-first, BYOK providers next, and cloud rendering only when local rendering or
-infrastructure is the blocker. Benchmark reports include suggested commands,
-estimated paid request counts, and estimated paid cost guards before any
-provider or cloud call is made.
+lowest-friction escalation path before spending money: trusted-target local
+`--render fallback` first, BYOK providers next, and cloud rendering only when
+local rendering or infrastructure is the blocker. Benchmark reports include
+suggested commands, estimated paid request counts, and estimated paid cost
+guards before any provider or cloud call is made.
 
 The `zero-dollar` benchmark target set is the Phase 2 measurement matrix. It
 keeps the existing docs/provider targets and adds JS-heavy docs, pricing,
@@ -232,6 +269,80 @@ bundled provider billing. The hosted boundary does not change the OSS default:
 no hidden paid calls, no CAPTCHA bypass, no stealth scraping, and no claim of a
 proprietary web-scale index.
 
+## Persistent Projects
+
+Use project mode when a source corpus needs to stay fresh over time. A project
+is a local `docpull.yaml` plus a `.docpull/` state directory containing run
+history, cache, manifests, context-pack exports, eval sets, and a SQLite index.
+
+```bash
+docpull init stripe-docs
+docpull add https://docs.stripe.com
+docpull sync
+docpull diff
+docpull export context-pack --target cursor
+```
+
+Each sync writes a normal local DocPull pack under `.docpull/runs/<run_id>/`,
+including `run.json`, `documents.jsonl`, `chunks.jsonl`, `manifest.json`,
+`documents.ndjson`, `corpus.manifest.json`, `sources.md`,
+`source-health.json`, `local.pack.json`, and accounting metadata.
+
+```bash
+# Inspect the latest project state
+docpull status
+
+# Show run history
+docpull history
+
+# Diff the latest two runs, with deterministic local categories by default
+docpull diff
+
+# Write a review summary for the latest run
+docpull review
+
+# Create a versioned context-pack release
+docpull release context-pack --target cursor --tag stripe-docs-v1
+
+# Generate eval cases from changed or latest documents
+docpull eval-set --limit 25
+
+# One-command project sync, diff, and export for one source
+docpull watch https://docs.stripe.com --export cursor --alert changes
+```
+
+`docpull diff` is hash-based and deterministic locally. Optional BYOK semantic
+summaries are advisory and skip cleanly when no model key is configured.
+Use `docpull add URL --discover` or `docpull sync --update-discovery` to
+refresh and persist discovered source URLs in `docpull.yaml`; sync then uses
+that stored URL set for repeatable exact refreshes.
+
+For authenticated sources, store only environment variable references in
+`docpull.yaml`; DocPull resolves values in memory at sync time and writes only
+masked auth type/readiness to status, manifests, reviews, releases, and
+webhooks:
+
+```yaml
+sources:
+  - name: internal-docs
+    url: https://docs.example.com
+    auth:
+      type: bearer_env
+      env: EXAMPLE_DOCS_TOKEN
+      policy: explicit-private
+```
+
+The commercial control-plane shape is API-led but not API-only: the local CLI
+remains the trust-building engine, while hosted DocPull manages projects, sync
+jobs, diffs, exports, releases, and signed webhooks through `/v1` JSON
+endpoints. The hosted ASGI MVP lives in `docpull.hosted`; `docpull remote ...`
+stores hosted API connection metadata and calls the same project lifecycle
+remotely. Remote bearer tokens are sent only to HTTPS API URLs by default;
+`--allow-insecure-local-http` is limited to localhost/loopback development.
+
+The launch screenshot for this flow lives at
+[`docs/launch-assets/docpull-project-diff-demo.png`](docs/launch-assets/docpull-project-diff-demo.png).
+
 ## 30-Second Usage
 
 ```bash
@@ -417,7 +528,8 @@ For those cases, use browser automation, such as Playwright, then pass rendered
 HTML or exported content into your pipeline. For simple public JS-rendered
 pages, `docpull render` and `--render fallback` provide an explicit local
 fallback without changing the default crawler behavior. The fallback requires
-the optional external `agent-browser` backend.
+the optional external `agent-browser` backend and
+`DOCPULL_RENDER_TRUSTED_BROWSER_TARGETS=1` for trusted network targets.
 
 ## How It Compares
 
@@ -501,7 +613,7 @@ part of the package release contract.
   rendering, authenticated-source checks, and cron-friendly monitors:
   `docpull policy`, `docpull discover`, `docpull refresh`,
   `docpull pack audit`, `docpull answer-pack`, `docpull export`,
-  `docpull serve`, `docpull render`, `docpull auth check`, and
+  `docpull serve`, `docpull share`, `docpull render`, `docpull auth check`, and
   `docpull monitor`.
 - `docpull export` writes local files for OpenAI vector JSONL, LangChain,
   LlamaIndex, DSPy, Sheets CSV/TSV, n8n workflow JSON, Vercel AI SDK JSON,

{docpull-5.0.1 → docpull-5.5.0}/README.md

@@ -1,6 +1,6 @@
 # docpull
 
-**Turn public web sources into local Markdown, NDJSON, and agent-ready context packs. Browser-free by default.**
+**Keep AI agents synced with changing public docs. Browser-free by default.**
 
 [![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
 [![PyPI version](https://badge.fury.io/py/docpull.svg)](https://badge.fury.io/py/docpull)
@@ -8,10 +8,15 @@
 [![GitHub stars](https://img.shields.io/github/stars/raintree-technology/docpull?style=social)](https://github.com/raintree-technology/docpull/stargazers)
 [![License: MIT](https://img.shields.io/github/license/raintree-technology/docpull)](https://github.com/raintree-technology/docpull/blob/main/LICENSE)
 
-docpull is a Python CLI, SDK, and MCP server that fetches public or explicitly
-authorized static/server-rendered web pages and converts them into clean,
-auditable local artifacts for LLMs, retrieval-augmented generation (RAG),
-offline research, and agent workflows.
+DocPull turns public docs and web sources into refreshable, cited, agent-ready
+context packs. Define source sets once, sync them over time, diff what changed,
+and export fresh context for Cursor, Claude, Codex, OpenAI, LlamaIndex,
+LangChain, MCP clients, and RAG pipelines.
+
+The original `docpull URL ...` workflow still works: fetch public or explicitly
+authorized static/server-rendered web pages and write clean Markdown, NDJSON,
+SQLite, or OKF outputs. Project mode adds the persistent evidence lifecycle on
+top: sources, runs, diffs, exports, evals, accounting, and local auditability.
 
 DocPull is local-first: direct fetching, sitemap/link discovery, extraction,
 indexing, pack intelligence, and local `agent-browser` rendering can run with no
@@ -40,6 +45,34 @@ reason unless you explicitly opt into the local `agent-browser` renderer. See
 pip install docpull
 ```
 
+## Project Quickstart
+
+```bash
+docpull init stripe-docs
+docpull add https://docs.stripe.com
+docpull sync
+docpull diff
+docpull export context-pack --target cursor
+```
+
+Example diff after a later sync:
+
+```text
+Project diff: +4 -2 ~18 api=2 pricing=1
+
+Changed pages:
+- /payments/payment-intents
+  likely API behavior change
+- /billing/subscriptions
+  pricing / billing change
+- /webhooks
+  likely API behavior change
+
+0 failed URLs
+0 robots blocked
+0 paid/cloud routes used
+```
+
 Install optional extras as needed:
 
 ```bash
@@ -58,7 +91,11 @@ install. Install an `agent-browser` compatible CLI separately, put it on
 `PATH`, or set `DOCPULL_AGENT_BROWSER_BIN=/path/to/agent-browser`. Verify the
 runtime with `docpull render --check`. Render targets must use HTTPS except for
 localhost/loopback HTTP during local testing, and DocPull keeps renderer action
-permissions locked down to HTML retrieval only.
+permissions locked down to HTML retrieval only. Because the current
+`agent-browser` CLI contract cannot enforce redirect, subresource, or
+connect-time DNS allow-lists, network browser rendering fails closed unless the
+operator sets `DOCPULL_RENDER_TRUSTED_BROWSER_TARGETS=1` for trusted targets.
+For localhost/loopback HTTP tests, set `DOCPULL_RENDER_ALLOW_LOCAL_TARGETS=1`.
 
 For stronger isolation, cloud runtimes are available explicitly:
 `docpull render URL --runtime vercel` uses the Vercel Sandbox CLI and Vercel
@@ -76,17 +113,17 @@ Use `--budget 0` when a run must not make paid-capable provider or cloud calls:
 ```bash
 docpull https://docs.example.com --budget 0 -o ./docs/example
 docpull discover scan https://docs.example.com -o ./packs/discovery
-docpull render https://example.com/app --runtime local --budget 0
+DOCPULL_RENDER_TRUSTED_BROWSER_TARGETS=1 docpull render https://example.com/app --runtime local --budget 0
 docpull providers context-pack "Find official docs" --provider all --dry-run --budget 0 --json
 docpull benchmark quick --zero-dollar --target-set zero-dollar --provider all
 ```
 
 Under a zero budget, local cache, direct HTTP, sitemap/static-link discovery,
 local extraction, local indexing, pack analysis, monitors, and local
-`agent-browser` rendering remain allowed. Live Tavily, Exa, Parallel, Vercel
-Sandbox, and E2B calls are blocked before execution. Runs involving a budget or
-paid-capable route write `run.accounting.json` with non-secret route, cost,
-HTTP/cache, browser, and blocked-action metadata.
+`agent-browser` rendering for trusted targets remain allowed. Live Tavily, Exa,
+Parallel, Vercel Sandbox, and E2B calls are blocked before execution. Runs
+involving a budget or paid-capable route write `run.accounting.json` with
+non-secret route, cost, HTTP/cache, browser, and blocked-action metadata.
 
 Use `docpull discover scan URL` to build a provider-free discovery pack from
 open site hints: `llms.txt`, RSS/Atom feeds, OpenAPI specs, sitemap indexes,
@@ -95,11 +132,11 @@ contract as provider imports and URL/sitemap files, so the next step is still
 `docpull discover select` or `docpull discover fetch`.
 
 When a zero-dollar benchmark or local run is partial, DocPull reports the
-lowest-friction escalation path before spending money: local `--render fallback`
-first, BYOK providers next, and cloud rendering only when local rendering or
-infrastructure is the blocker. Benchmark reports include suggested commands,
-estimated paid request counts, and estimated paid cost guards before any
-provider or cloud call is made.
+lowest-friction escalation path before spending money: trusted-target local
+`--render fallback` first, BYOK providers next, and cloud rendering only when
+local rendering or infrastructure is the blocker. Benchmark reports include
+suggested commands, estimated paid request counts, and estimated paid cost
+guards before any provider or cloud call is made.
 
 The `zero-dollar` benchmark target set is the Phase 2 measurement matrix. It
 keeps the existing docs/provider targets and adds JS-heavy docs, pricing,
@@ -120,6 +157,80 @@ bundled provider billing. The hosted boundary does not change the OSS default:
 no hidden paid calls, no CAPTCHA bypass, no stealth scraping, and no claim of a
 proprietary web-scale index.
 
+## Persistent Projects
+
+Use project mode when a source corpus needs to stay fresh over time. A project
+is a local `docpull.yaml` plus a `.docpull/` state directory containing run
+history, cache, manifests, context-pack exports, eval sets, and a SQLite index.
+
+```bash
+docpull init stripe-docs
+docpull add https://docs.stripe.com
+docpull sync
+docpull diff
+docpull export context-pack --target cursor
+```
+
+Each sync writes a normal local DocPull pack under `.docpull/runs/<run_id>/`,
+including `run.json`, `documents.jsonl`, `chunks.jsonl`, `manifest.json`,
+`documents.ndjson`, `corpus.manifest.json`, `sources.md`,
+`source-health.json`, `local.pack.json`, and accounting metadata.
+
+```bash
+# Inspect the latest project state
+docpull status
+
+# Show run history
+docpull history
+
+# Diff the latest two runs, with deterministic local categories by default
+docpull diff
+
+# Write a review summary for the latest run
+docpull review
+
+# Create a versioned context-pack release
+docpull release context-pack --target cursor --tag stripe-docs-v1
+
+# Generate eval cases from changed or latest documents
+docpull eval-set --limit 25
+
+# One-command project sync, diff, and export for one source
+docpull watch https://docs.stripe.com --export cursor --alert changes
+```
+
+`docpull diff` is hash-based and deterministic locally. Optional BYOK semantic
+summaries are advisory and skip cleanly when no model key is configured.
+Use `docpull add URL --discover` or `docpull sync --update-discovery` to
+refresh and persist discovered source URLs in `docpull.yaml`; sync then uses
+that stored URL set for repeatable exact refreshes.
+
+For authenticated sources, store only environment variable references in
+`docpull.yaml`; DocPull resolves values in memory at sync time and writes only
+masked auth type/readiness to status, manifests, reviews, releases, and
+webhooks:
+
+```yaml
+sources:
+  - name: internal-docs
+    url: https://docs.example.com
+    auth:
+      type: bearer_env
+      env: EXAMPLE_DOCS_TOKEN
+      policy: explicit-private
+```
+
+The commercial control-plane shape is API-led but not API-only: the local CLI
+remains the trust-building engine, while hosted DocPull manages projects, sync
+jobs, diffs, exports, releases, and signed webhooks through `/v1` JSON
+endpoints. The hosted ASGI MVP lives in `docpull.hosted`; `docpull remote ...`
+stores hosted API connection metadata and calls the same project lifecycle
+remotely. Remote bearer tokens are sent only to HTTPS API URLs by default;
+`--allow-insecure-local-http` is limited to localhost/loopback development.
+
+The launch screenshot for this flow lives at
+[`docs/launch-assets/docpull-project-diff-demo.png`](docs/launch-assets/docpull-project-diff-demo.png).
+
 ## 30-Second Usage
 
 ```bash
@@ -305,7 +416,8 @@ For those cases, use browser automation, such as Playwright, then pass rendered
 HTML or exported content into your pipeline. For simple public JS-rendered
 pages, `docpull render` and `--render fallback` provide an explicit local
 fallback without changing the default crawler behavior. The fallback requires
-the optional external `agent-browser` backend.
+the optional external `agent-browser` backend and
+`DOCPULL_RENDER_TRUSTED_BROWSER_TARGETS=1` for trusted network targets.
 
 ## How It Compares
 
@@ -389,7 +501,7 @@ part of the package release contract.
   rendering, authenticated-source checks, and cron-friendly monitors:
   `docpull policy`, `docpull discover`, `docpull refresh`,
   `docpull pack audit`, `docpull answer-pack`, `docpull export`,
-  `docpull serve`, `docpull render`, `docpull auth check`, and
+  `docpull serve`, `docpull share`, `docpull render`, `docpull auth check`, and
   `docpull monitor`.
 - `docpull export` writes local files for OpenAI vector JSONL, LangChain,
   LlamaIndex, DSPy, Sheets CSV/TSV, n8n workflow JSON, Vercel AI SDK JSON,

{docpull-5.0.1 → docpull-5.5.0}/pyproject.toml

@@ -4,9 +4,9 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "docpull"
-version = "5.0.1"
+version = "5.5.0"
 dynamic = []
-description = "Convert public web pages into clean Markdown for AI agents and RAG"
+description = "Keep AI agents synced with changing public docs and web sources"
 readme = {file = "README.md", content-type = "text/markdown"}
 requires-python = ">=3.10"
 license = "MIT"

{docpull-5.0.1 → docpull-5.5.0}/src/docpull/__init__.py

@@ -14,9 +14,18 @@ Usage:
             print(event)
 """
 
-__version__ = "5.0.1"
+__version__ = "5.5.0"
 
 from .cache import CacheManager, StreamingDeduplicator
+from .context_packs import (
+    build_brand_pack,
+    build_image_pack,
+    build_product_pack,
+    build_search_pack,
+    build_styleguide_pack,
+    capture_screenshot_pack,
+    extract_schema,
+)
 from .conversion.chunking import Chunk, TokenCounter, chunk_markdown
 from .core.fetcher import Fetcher, fetch_blocking, fetch_one
 from .exports import ExportResult, export_pack
@@ -94,6 +103,7 @@ from .scraper import (
     scrape_site,
 )
 from .server import PackASGIApp, PackServerError, create_pack_app
+from .share import ReportHTTPServer, ShareError, create_report_server, render_report_document
 
 __all__ = [
     "__version__",
@@ -103,6 +113,13 @@ __all__ = [
     "refresh_pack",
     "audit_pack",
     "answer_pack",
+    "build_brand_pack",
+    "build_styleguide_pack",
+    "build_product_pack",
+    "extract_schema",
+    "build_image_pack",
+    "capture_screenshot_pack",
+    "build_search_pack",
     "extract_pack",
     "map_sources",
     "crawl_pack",
@@ -134,6 +151,10 @@ __all__ = [
     "create_pack_app",
     "PackASGIApp",
     "PackServerError",
+    "create_report_server",
+    "render_report_document",
+    "ReportHTTPServer",
+    "ShareError",
     "ScrapeResult",
     "ScrapeRunResult",
     "Scraper",

{docpull-5.0.1 → docpull-5.5.0}/src/docpull/cli.py

@@ -191,6 +191,17 @@ Examples:
   docpull https://example.com --include-paths "/api/*" --exclude-paths "/changelog/*"
 
 Subcommands:
+  init         Create a persistent DocPull project
+  add          Add a source to a project
+  sync         Sync configured project sources
+  diff         Diff project runs
+  status       Show project status
+  history      Show project run history
+  review       Write a source-health/diff review for a run
+  release      Create versioned context-pack release artifacts
+  remote       Call a hosted DocPull API control plane
+  eval-set     Generate local eval cases from project runs
+  watch        Sync, diff, and export one source
   render       Render one public URL or check the optional agent-browser backend
   discover     Build/select/fetch provider-neutral discovery packs
   extract-pack Extract known URLs into a provider-neutral local pack
@@ -198,6 +209,13 @@ Subcommands:
   crawl-pack   Select mapped candidates and fetch a local pack
   research-pack Produce cited local research results from a pack
   entities-pack Build local entity/list packs from existing evidence
+  brand-pack   Build an evidence-backed local brand profile
+  styleguide-pack Extract local design tokens from a public site
+  product-pack Normalize product and pricing evidence
+  extract-schema Extract a JSON shape from local evidence
+  image-pack    Build a local visual asset manifest
+  screenshot-pack Capture an explicit browser-rendered screenshot
+  search-pack  Build a local-first search result pack
   policy       Validate or explain source policy files
   auth         Check authenticated source access without writing content
   refresh      Refresh an existing local pack and write change reports
@@ -206,6 +224,7 @@ Subcommands:
   answer-pack  Answer from local pack evidence with citations
   export       Export a pack for agent or RAG tools
   serve        Serve a local pack over localhost JSON routes
+  share        Serve a Markdown or HTML report at a local URL
   monitor      Run cron-friendly local pack monitors
   parallel     Build optional Parallel-backed context packs
   provider     Check provider keys and run provider-backed context packs
@@ -1253,6 +1272,7 @@ def _run_render_doctor_cli() -> int:
             exit_code = 1
     console.print()
     console.print("Cloud runtimes execute the same agent-browser JSON contract inside a sandbox/template.")
+    console.print("Set DOCPULL_RENDER_TRUSTED_BROWSER_TARGETS=1 only for trusted render targets.")
     console.print("Use `docpull render init e2b` or `docpull render init vercel` for template recipes.")
     return exit_code
 
@@ -1286,10 +1306,13 @@ agent-browser install
 
 # Then render through the same DocPull contract:
 export E2B_API_KEY=<your-e2b-api-key>
+export DOCPULL_RENDER_TRUSTED_BROWSER_TARGETS=1
 docpull render https://example.com --runtime e2b --template {template}
 
 # For smoke tests that may consume provider quota:
-DOCPULL_LIVE_CLOUD_RENDER=1 .venv/bin/python -m pytest tests/test_rendering.py -q
+DOCPULL_RENDER_TRUSTED_BROWSER_TARGETS=1 \\
+  DOCPULL_LIVE_CLOUD_RENDER=1 \\
+  .venv/bin/python -m pytest tests/test_rendering.py -q
 """
 
 
@@ -1302,6 +1325,7 @@ npm install -g agent-browser
 agent-browser install
 
 # Then render through the same DocPull contract:
+export DOCPULL_RENDER_TRUSTED_BROWSER_TARGETS=1
 docpull render https://example.com --runtime vercel --cloud-agent-browser-install skip
 
 # If you intentionally want a cold runtime install and npm is available:
@@ -1349,6 +1373,50 @@ def main(argv: list[str] | None = None) -> int:
     raw_argv = list(argv) if argv is not None else sys.argv[1:]
     if raw_argv and raw_argv[0] == "render":
         return run_render_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "init":
+        from .project import run_init_cli
+
+        return run_init_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "add":
+        from .project import run_add_cli
+
+        return run_add_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "sync":
+        from .project import run_sync_cli
+
+        return run_sync_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "diff":
+        from .project import run_diff_cli
+
+        return run_diff_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "status":
+        from .project import run_status_cli
+
+        return run_status_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "history":
+        from .project import run_history_cli
+
+        return run_history_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "review":
+        from .project import run_review_cli
+
+        return run_review_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "release":
+        from .project import run_release_cli
+
+        return run_release_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "remote":
+        from .project import run_remote_cli
+
+        return run_remote_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "eval-set":
+        from .project import run_eval_set_cli
+
+        return run_eval_set_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "watch":
+        from .project import run_watch_cli
+
+        return run_watch_cli(raw_argv[1:])
     if raw_argv and raw_argv[0] == "mcp":
         from .mcp.server import run_mcp_server
 
@@ -1369,7 +1437,15 @@ def main(argv: list[str] | None = None) -> int:
         from .server import run_serve_cli
 
         return run_serve_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "share":
+        from .share import run_share_cli
+
+        return run_share_cli(raw_argv[1:])
     if raw_argv and raw_argv[0] == "export":
+        if len(raw_argv) > 1 and raw_argv[1] == "context-pack":
+            from .project import run_project_export_cli
+
+            return run_project_export_cli(raw_argv[2:])
         from .exports import run_export_cli
 
         return run_export_cli(raw_argv[1:])
@@ -1425,6 +1501,34 @@ def main(argv: list[str] | None = None) -> int:
         from .parity_cli import run_entities_pack_cli
 
         return run_entities_pack_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "brand-pack":
+        from .context_packs.cli import run_brand_pack_cli
+
+        return run_brand_pack_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "styleguide-pack":
+        from .context_packs.cli import run_styleguide_pack_cli
+
+        return run_styleguide_pack_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "product-pack":
+        from .context_packs.cli import run_product_pack_cli
+
+        return run_product_pack_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "extract-schema":
+        from .context_packs.cli import run_extract_schema_cli
+
+        return run_extract_schema_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "image-pack":
+        from .context_packs.cli import run_image_pack_cli
+
+        return run_image_pack_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "screenshot-pack":
+        from .context_packs.cli import run_screenshot_pack_cli
+
+        return run_screenshot_pack_cli(raw_argv[1:])
+    if raw_argv and raw_argv[0] == "search-pack":
+        from .context_packs.cli import run_search_pack_cli
+
+        return run_search_pack_cli(raw_argv[1:])
     if raw_argv and raw_argv[0] in {"provider", "providers"}:
         from .provider_cli import run_provider_cli