autobrowse

harden(autobrowse): restrict trace artifacts to owner-only permissions (#139) Autobrowse trace artifacts (trace.json, messages.json, summary.md, and screenshots) can contain cookies, auth headers, bearer tokens, passwords from form POSTs, private URLs, and screenshots of authenticated pages. Previously these were written with fs.writeFileSync / fs.mkdirSync using default permissions, which inherit the process umask (typically 0644 files / 0755 dirs). On a shared host -- CI runners, shared dev boxes, or multi-tenant containers -- that leaves the trace tree readable by other local users and processes. This restricts trace artifacts to the owner: - run dir + screenshots/ created with mode 0700; the run dir is also chmod'd explicitly since mkdirSync's mode only applies to dirs it creates (a pre-existing parent could otherwise stay traversable). - trace.json / messages.json / summary.md written with mode 0600. - lockDownTrace() sweeps the run dir at the end to cover files written by subprocesses (screenshots from the browse CLI, .o11y artifacts) whose creation mode we don't control. Symlinks (the `latest` link) are skipped. 0700/0600 are unaffected by the process umask, so the result is consistent regardless of host configuration. The owner -- the same user the self-improvement loop runs as -- retains full read/write, so the loop is unaffected; only cross-user access is removed. Co-authored-by: Claude Opus 4.8 (1M context)

[STG-2254] chore: bring merged skills up to agent-skills standards (#135) * chore: bring merged skills up to agent-skills standards - Add MIT LICENSE.txt to browser-to-api, company-research, event-prospecting - Normalize autobrowse LICENSE year to 2026 and license frontmatter to MIT - Add license/compatibility/allowed-tools frontmatter where missing (agent-experience, cookie-sync, fetch, functions, safe-browser, search) - README: drop stale site-debugger/bb-usage rows, add agent-experience, autobrowse, browser-to-api, company-research, event-prospecting rows - Remove banned .env.example from autobrowse (update README setup snippet) Co-Authored-By: Claude Fable 5 * fix: drop BROWSERBASE_PROJECT_ID from autobrowse setup line Addresses review feedback from shrey150 --------- Co-authored-by: Claude Fable 5

feat(autobrowse): scripts/codegen.mjs — multi-framework runnable-script generator (#125) * feat(autobrowse): scripts/codegen.mjs — multi-framework runnable-script generator Migrates the script-generation apparatus from browse.sh's sandbox prompt into autobrowse itself, so any caller (browse.sh, a developer using autobrowse standalone, future apps) can convert a converged trace into a runnable script with one CLI invocation. What this PR adds: scripts/codegen.mjs orchestrator (~340 lines) codegen/prompts/playwright.md framework-specific system prompt codegen/prompts/stagehand.md framework-specific system prompt codegen/scaffolds/{fw}/package.json pinned deps, self-contained codegen/scaffolds/{fw}/tsconfig.json standard ESM/strict codegen/runners/{fw}.mjs spawn npx tsx + parse JSON result references/playwright-cdp-bridge.md canonical CDP-attach patterns (moved from browse.sh) Pipeline per framework (see scripts/codegen.mjs header): 1. Build context from task.md + unified-events.jsonl + descriptors.ndjson + strategy.md + the framework's prompt template + the cdp-bridge doc. 2. Cache key over sha256(framework + prompt-version + task + trace + descriptors). Hit short-circuits with $0 cost. 3. Single Anthropic completion → emit . to the output dir. 4. Drop scaffold files (package.json, tsconfig) per framework. 5. If --verify: invoke the framework's runner against a fresh BB session. On failure, feed the error back into a rewrite call up to --max-retries times. 6. Emit one JSON line per framework on stdout. Non-zero exit if any selected framework failed. CLI surface: --task required --workspace default ./autobrowse --run default: newest passing run-NNN --frameworks default: playwright; builtins: playwright,stagehand --verify | --no-verify default: --verify --max-retries N default 2 --cache-dir / --out / --force / --dry-run / --cache-only / --model --prompt-template custom template for --frameworks=custom No new top-level deps (uses the @anthropic-ai/sdk that evaluate.mjs already imports). Smoke-tested with --help, --dry-run, --cache-only error paths. Companion change in browse.sh (separate PR): collapse the §4b `for target in playwright stagehand` bash loop and §5 SCRIPT_FLAGS construction into a single `codegen.mjs --frameworks $SKILL_FRAMEWORKS` call; delete prompts/playwright-cdp-bridge.md and src/lib/agent-runtime/ script-references.ts (the doc + bundling logic both live in autobrowse now); drop the playwright/stagehand/tsx/zod install block and the playwright-best-practices-skill clone from src/lib/dispatch.ts. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(codegen): framework-tagged filenames in --out mode Without this, --out with multiple frameworks selected would have both writing to /.ts and overwriting each other. Fix: - Default (no --out): per-framework subdir, file named after the task (e.g. tasks/acme/playwright/acme.ts) — feels like a standalone project. - --out : flat, framework-named files (/playwright.ts + /stagehand.ts) — for callers like browse.sh that flatten everything into one upload-staging dir. Runners updated to take --script instead of --task (the basename is what codegen.mjs decides per the rule above). No interface change to codegen.mjs's CLI — same flags, same JSON output. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(codegen): teach playwright prompt to use APIRequestContext for HTTP/RPC workflows Empirically across 13 non-browser-method skills tested, the agent's emit behavior is inconsistent: CLI (7/7) skipped codegen entirely — correct (CLI setup guides don't wrap into a script). MCP (5) 2 emitted, 3 skipped. Of the 2 that emitted: - packrift: used @playwright/test + APIRequestContext to drive the MCP JSON-RPC server (no browser). Genuinely valuable conformance test. - hiveround: emitted chromium.connectOverCDP + DOM scrape, ignoring the MCP method label entirely. fetch (8) 6 emitted; all 6 used the browser path even when fetch + cheerio could have done the job in 30 lines vs ~400. api (2) chess.com used Playwright-as-fetch (goto + JSON.parse(body) via residential proxy — correct for Cloudflare bypass). sfgov used a similar pattern. Both kept the browser session because they needed the proxy. The packrift case proves the agent CAN write API-RPC scripts via APIRequestContext — it just doesn't always pick that path. Refine playwright.md with an explicit "approach selection" section at the top that branches between API path and browser path based on: - recommended_method in task.md - whether the trace shows real DOM interaction vs HTTP-only calls - whether the data lives in client-rendered DOM vs HTTP response body API path uses `import { request, type APIRequestContext } from "playwright"` (playwright already in the scaffold; @playwright/test is NOT required — plain throw + Zod handles assertions/validation). Browser path is unchanged. Bump PROMPT_TEMPLATE_VERSION to "2" so the cache key invalidates and existing cached outputs don't shadow the refined prompt. stagehand.md untouched in this commit — Stagehand fundamentally needs a browser, so for HTTP-only workflows the right answer is "don't emit a Stagehand script at all", which needs a separate codegen.mjs change (allow runners to signal "not applicable"). Follow-up. Co-Authored-By: Claude Opus 4.7 (1M context) * Revert "fix(codegen): teach playwright prompt to use APIRequestContext for HTTP/RPC workflows" This reverts commit aac0acc1733f5a2a7cc7b0104a6cf2e1c7474b88. * fix(codegen): address 6 PR #125 review threads Six findings from cursor + shubh24 on the codegen PR: 1. (HIGH / blocker) Rewrite verify uses wrong script name `verify(framework, outDir, TASK)` on the rewrite path passes the bare task slug; `verify()` then resolves it as a missing file basename (TASK lacks the .ts extension that scriptBasename carries). This silently disabled the verify→rewrite loop. Fix: pass scriptBasename on both the initial and retry call sites, matching the variable used to write the file at L375. 2. (MEDIUM) Cache hit allowed one extra rewrite On cache hit, `attempts` stayed at 0 through the first failed verify, so the loop condition `attempts < MAX_RETRIES + 1` allowed MAX_RETRIES+1 rewrites for cached runs vs MAX_RETRIES for uncached. --max-retries was therefore inconsistent. Initialize attempts to 1 on both paths so the bound matches. Update the result-object's `cached` flag accordingly: was `!!cached && attempts === 0` (now never true with the new init), now `!!cached && cost === 0` — same semantic ("no LLM call was made for this output"), now expressed via cost which is the load-bearing signal anyway. 3. (MEDIUM) Forced --run path unchecked `pickRun` returned any --run value without checking that `traces//` exists. Codegen would then proceed with empty trace/events/descriptors while logs reported the forced run id as if it were a real input. Add an fs.existsSync gate on FORCED_RUN and a distinct error message when the named dir is missing. 4. (LOW) `ranner_missing` typo Producer (L301) and consumer (L385) shared the misspelling, so the break-on-missing-runner path worked, but it was fragile — fix one without the other and the retry loop would silently stop stopping. Renamed both to `runner_missing`. 5. (DRY) Stagehand runner was 95% identical to Playwright runner Factored the shared spawn-tsx-and-parse-JSON logic into codegen/runners/lib/tsx-runner.mjs (runTsxTarget({label, extraEnv, installEnv, preflight})). The per-framework runners now hold only their genuine differences: - playwright.mjs: PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 for install+run - stagehand.mjs: ANTHROPIC_API_KEY preflight check Net: ~120 lines collapsed to ~25 each + ~110 in the shared lib. 6. (REGRESSION fix) Scaffold versions had no env override browse.sh's old dispatch.ts used resolveVersion('PLAYWRIGHT_VERSION', …) / 'STAGEHAND_VERSION' / 'TSX_VERSION' / 'ZOD_VERSION' so a deployment could canary a new framework version without a code change. Moving the pins into autobrowse's scaffold/package.json as literals dropped that. Restore the knob: codegen.mjs now reads {PLAYWRIGHT,STAGEHAND,TSX,ZOD,DOTENV}_VERSION env vars (with a semver guard) and interpolates them into the scaffold via the existing template-interpolation pass. Defaults match the previous literals. Bump PROMPT_TEMPLATE_VERSION to "2" so any cached outputs from the buggy verify-loop path get re-emitted. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(codegen): make scaffold `npm start` use generated script name When --out is set, emitted scripts are named .ts but scaffolded package.json hardcoded `tsx {{TASK}}.ts`, so standalone `npm start` in the out dir targeted a nonexistent file. Thread {{SCRIPT}} through dropScaffold and update both scaffolds to `tsx {{SCRIPT}}`. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(codegen): merge package.json deps across frameworks in shared --out dir When --out is set and multiple frameworks share one outDir (browse.sh passes --frameworks playwright,stagehand --out ), framework #1 wrote package.json with its deps and verify ran npm install. Framework #2's dropScaffold hit `if exists(dst) continue` and silently skipped its package.json, so @browserbasehq/stagehand was never declared or installed. The runner's `skip install if node_modules exists` gate then skipped re-install, and verify died at `Cannot find package '@browserbasehq/stagehand'` before any browser work — burning all MAX_RETRIES on an unfixable error. Fix: - dropScaffold: when package.json already exists, deep-merge the scaffold's dependencies/devDependencies in instead of skipping. - tsx-runner: replace `!exists(node_modules)` gate with a sha256 stamp of package.json written under node_modules/.codegen-pkg-hash, so framework #2's merged deps trigger a re-install. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(codegen): correct Stagehand prompt for the v3 API The Stagehand codegen prompt described the old connectOverCDP/attach pattern, so generated scripts failed verify against @browserbasehq/stagehand 3.4.0: - passed the Anthropic key as the top-level `apiKey` (which is the Browserbase key in v3), so session lookup 404'd with "Session not found" - bare `modelName: "claude-opus-4-5"` — v3 wants `model: { modelName: "anthropic/", apiKey }` (provider-prefixed) - `stagehand.page` / `page.extract()` — v3 uses `stagehand.context.pages()[0]` and `stagehand.extract(instruction, schema)` on the instance - REQUEST_RELEASE teardown — v3 owns the session, so use `stagehand.close()` Rewrite the prompt to teach the v3 own-session pattern. BROWSERBASE_API_KEY alone is sufficient (the project is inferred from the key; no projectId). Verified end-to-end: `codegen --frameworks playwright,stagehand --out --verify` now passes both frameworks on the first attempt against live Browserbase sessions (google-news task). Co-Authored-By: Claude Opus 4.8 (1M context) * fix(codegen): --cache-only must also short-circuit the rewrite loop Previously --cache-only only blocked generation on a cache miss; a cached script that failed verify would still enter the rewrite loop and call the Anthropic API, contradicting the documented "no LLM call" CI semantics. Bail out of the rewrite loop when CACHE_ONLY is set. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(codegen): raise verify() timeout above runner worst case verify() spawned the runner with a 5min cap, but tsx-runner internally allows up to 3min for npm install + 5min for the tsx run (8min worst case). The parent could SIGTERM a healthy runner mid-script, leaving verify with no {passed:boolean} JSON line — codegen then treated the script as broken and burned a retry. Bump verify's cap to 10min so the parent always exceeds the child's bounded internals. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(codegen): always set PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD on install In shared --out mode, framework #2 (e.g. stagehand) inherits playwright in its merged package.json via dropScaffold, so stagehand's install would trigger playwright's postinstall and try to fetch ~hundreds of MB of chromium — almost always blowing the 3min install budget and failing verify on a healthy script. Set PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 unconditionally in the install env (we always connectOverCDP, never need local browsers). Per-runner installEnv still wins via the spread order. Co-Authored-By: Claude Opus 4.7 (1M context) --------- Co-authored-by: Claude Opus 4.7 (1M context) Co-authored-by: shubh24

autobrowse: add opt-in --browser-trace integration (#121) * autobrowse: add opt-in --browser-trace integration Wire the sibling browser-trace skill into the autobrowse loop behind a default-off --browser-trace flag. When set, each iteration pre-creates a Browserbase --keep-alive session, attaches bb-capture as a passive CDP observer, and runs evaluate.mjs with --connect-url so every inner browse call is rewritten to attach via --cdp $connectUrl --session autobrowse-main. browse stop is suppressed under trace mode so the named daemon survives the iteration. The --cdp attach mode is the key: --remote routes Network.*/Console.* events only to the driving client, so the trace observer sees nothing useful. --cdp gives the observer the full per-page firehose, matching the canonical pattern documented in browser-trace's SKILL.md. Default path is unchanged; --browser-trace implies --env remote. Co-Authored-By: Claude Opus 4.7 (1M context) * autobrowse: preflight browser-trace + teach cross-trace hypothesis - Add a fail-fast preflight in the traced-path block: if ${CLAUDE_SKILL_DIR}/../browser-trace/scripts/bb-capture.mjs is missing, bail with an install hint pointing at github.com/browserbase/skills. Prevents the harness from blowing up halfway through with "no such file or directory" on bb-capture.mjs. - Make explicit in "Read the trace" + "Form one hypothesis" that under --browser-trace there are now TWO complementary traces: trace.json (what the agent did, per turn) and cdp/summary.json (what the browser did, per page). Document the cross-reference pattern: find the failing page in cdp/summary.json, then jump back to trace.json for the turn whose command produced it. Hypotheses should cite both — "the click went through but /api/checkout returned 403" beats "the click failed." Co-Authored-By: Claude Opus 4.7 (1M context) * autobrowse: thread --browser-trace through multi-task sub-agents Closes the gap flagged in PR #121 review: /autobrowse --tasks a,b --browser-trace would silently fall back to the untraced path inside each spawned sub-agent because the sub-agent prompt template said only "Use --env " without mentioning --browser-trace. The sub-agent prompt now explicitly requires the traced-path loop block (pre-create session, bb-capture, --connect-url to evaluate.mjs, stop+ bisect, release) when the parent invocation passed --browser-trace. Co-Authored-By: Claude Opus 4.7 (1M context) * autobrowse: unified event log as primary --browser-trace artifact Per design feedback (Derek): the two-trace cross-reference UX from the prior commits puts friction on the outer agent. Replace it with a single time-ordered NDJSON stream that joins the agent's turn log (trace.json) and the browser-trace CDP firehose (cdp/raw.ndjson) into one source-tagged file the outer agent reads first each iteration. New: skills/autobrowse/scripts/unify-trace.mjs - Joins trace.json + cdp/raw.ndjson by wall-clock timestamp - Reuses bisect-cdp.mjs's monotonic→wall-clock conversion logic (anchor on first monotonic CDP timestamp + manifest.started_at) - Filters out noisy/redundant CDP methods (dataReceived, ExtraInfo, frame Started/Stopped Loading, executionContextCreated, ...) so the unified log stays scannable - Inline summary fields per browser-event family (url+status+mime for Network.*, level+text for Console.*, name for Page.lifecycle, etc.); full payloads remain in the cdp/ drill-down files - Annotates each browser row with page_id, derived by walking top-level Page.frameNavigated events in the same order bisect-cdp uses SKILL.md changes: - Traced-path block now invokes unify-trace.mjs after bisect-cdp - "Read the trace" section rewritten: unified-events.jsonl is the primary path; structured files (cdp/summary.json, trace.json, cdp/network/failed.jsonl, etc.) are documented as agent-consumable drill-downs for queries the stream doesn't naturally answer - "Form one hypothesis" updated: hypothesis must cite a specific line/timestamp in unified-events.jsonl or name the drill-down file Verified end-to-end on news.ycombinator.com → first story's article: 6 turns, $0.31, 126-event unified log (113 browser + 13 agent), strictly time-ordered, no leaked sessions. No changes to evaluate.mjs or browser-trace. Default path (no --browser-trace) is unchanged — no unify step runs. Co-Authored-By: Claude Opus 4.7 (1M context) * autobrowse: unique daemon name per session + MAX_TURNS env override Two small fixes surfaced by v3.1 verification: 1. Static bug: --browser-trace hardcoded the local browse-daemon name as "autobrowse-main". Two parallel evaluate.mjs invocations (SKILL.md Step-3 multi-task sub-agents) would collide on that socket. Derive a per-process daemon name from a sha1 hash of the connectUrl (autobrowse-) so each Browserbase session gets its own local daemon. Deterministic, no deps beyond node:crypto. 2. QOL: MAX_TURNS is now overridable via the MAX_TURNS env var (default 30). Useful for testing failure-first recovery without patching source. No effect on default invocations. Verification (v3.1, /tmp/autobrowse-eval-v2): - Part 1: joiner's page_id walk matches bisect-cdp exactly (no drift). - Part 2: SKIP_METHODS audit — Network.dataReceived + *ExtraInfo etc. are filtered correctly; ExtraInfo headers remain accessible via drill-down (cdp/raw.ndjson, query.mjs). Known limitation: header-based hypotheses need drill-down today. - Part 3: parallel-daemon contention fixed (this commit). Unit-level verified: different connectUrls → different daemon names. - Part 4: failure-first single-arm on httpbin-form-incomplete - iter 1 (MAX_TURNS=15, --browser-trace): max_turns failure at $0.38; agent burned 4 turns on verification checks (turns 11-14) before submit clicked at turn 15. POST went through (200 OK in unified log) but agent ran out of turns before reading response. - Manual outer-agent step: read unified-events.jsonl, cited specific events (POST line + 4 verification turns), wrote evidence-grounded strategy.md update telling iter 2 to skip the verification loop. - iter 2: 12 turns, $0.27, status=completed, echoed_custname matches. - Net: unified-log evidence drove a real recovery on a failure-first task. ~$0.65 total v3.1 spend. Co-Authored-By: Claude Opus 4.7 (1M context) * autobrowse: export O11Y_RUN_ID so browse CLI can emit descriptors Pair to the descriptor-capture change landing in the browse CLI: every page-driving browse call (click/fill/select/goto/wait/etc.) now side-channels a rich node descriptor to $O11Y_ROOT/$O11Y_RUN_ID/cdp/descriptors.ndjson when both env vars are set. The CLI was already gated on O11Y_ROOT — adding O11Y_RUN_ID lets it know which run subdirectory to write into without inferring from the most-recently-modified dir. Two lines change in the traced-path loop block: - export O11Y_RUN_ID="$RUN_ID" alongside O11Y_ROOT - documentation note on what descriptors.ndjson is and that the outer agent should skip it when reading the trace (it feeds downstream codegen, not hypothesis formation) No effect when --browser-trace is unset or when the CLI doesn't yet have the descriptor-capture utility — the new env var is harmless. Co-Authored-By: Claude Opus 4.7 (1M context) --------- Co-authored-by: Claude Opus 4.7 (1M context) Co-authored-by: ziruihao

Update skills to use verified Browserbase sessions (#106)

docs: rename bb/browse-cli references to unified browse CLI (#111) * docs: rename bb/browse-cli references to unified browse CLI The `@browserbasehq/cli` (bb) and `@browserbasehq/browse-cli` packages were merged into a single `browse` package (`npm install -g browse`). Update all skill docs, scripts, and examples to use the new command surface: - `bb fetch|search|sessions|projects|contexts|extensions` → `browse cloud ...` - `bb functions ...` → `browse functions ...` - `bb templates ...` → `browse templates ...` - `bb skills install` → `browse skills install` - `bb browse ` → top-level `browse ` (open, get, click, …) - `pnpm bb dev|publish` → `browse functions dev|publish` - `# bb call N/TOTAL` enforcement comments → `# browse call N/TOTAL` - `bbFetch`/`bbBrowseMarkdown` helpers in extract_page.mjs renamed and reworked to call the new `browse cloud fetch` / `browse get markdown` surface. - bb-capture.mjs / bb-finalize.mjs shell out to `browse cloud sessions ...` SDK variable names (`const bb = new Browserbase()`) and the `x-bb-api-key` HTTP header are untouched. Co-Authored-By: Claude Opus 4.7 (1M context) * fix: align browse command examples with 0.6 * docs: note deprecated context upload refresh * docs: clarify cdp flag usage in trace example * docs: rely on cdp daemon persistence in trace example * docs(browser-trace): drop redundant target flags on follow-up commands The browse daemon caches the target after the first command, so commands that follow `browse open --cdp 9222` (or `--remote --session "$SID"`) don't need to repeat the target flag. Addresses PR #111 review comments about `--cdp` repetition in EXAMPLES.md. Co-Authored-By: Claude Opus 4.7 (1M context) * docs: clarify cdp daemon behavior * fix(extract_page): drop redundant --local --headless on `browse get` The browse daemon caches the target after `browse open --local --headless`, so the follow-up `browse get markdown` call shouldn't repeat the mode flags. Matches the convention from skills/browser/SKILL.md ("put --local, --remote, --auto-connect, or --cdp on the first browser command") and the same fix Shrey applied to browser-trace in 5468e0e. Addresses the Cursor Bugbot finding on PR #111. Co-Authored-By: Claude Opus 4.7 (1M context) * docs: align browse lifecycle examples * docs: remove stale fill flag reference * docs: tighten browse skill migration wording * docs: clarify browse stop mode switching * docs: verify browse command caveats --------- Co-authored-by: Claude Opus 4.7 (1M context) Co-authored-by: Shrey Pandya

docs(autobrowse): replace slusa-payment with amazon-add-to-cart in examples (#74) Co-authored-by: Claude Opus 4.7 (1M context)

feat: autobrowse skill — self-improving browser automation (#71) * feat: add autobrowse skill — self-improving browser automation Auto-research loop for building reliable browser navigation skills. Inner agent browses the site, outer agent reads the trace and improves strategy.md. Repeat until it passes consistently. - SKILL.md: /autobrowse skill (single + parallel task modes via sub-agents) - scripts/evaluate.ts: inner agent harness (Anthropic API + browse CLI) - references/: example-task.md and example-skill.md templates - README, EXAMPLES, REFERENCE docs Co-Authored-By: Claude Sonnet 4.6 (1M context) * docs: replace example-skill.md with real graduated SF 311 skill 17 iterations, 3/3 consecutive passes, remote env. Shows real site-specific gotchas: named Browserbase sessions, ESRI map location, Verint form patterns, XPath vs ref tradeoffs. Co-Authored-By: Claude Sonnet 4.6 (1M context) * feat: sync SKILL.md with latest improvements - structured skill.md graduation template (not just copying strategy.md) - graduate at max iterations too, not just on pass rate - persistent session reports in reports/ with per-iteration cost table - richer sub-agent prompt with key learnings output - cost column in multi-task report table Co-Authored-By: Claude Sonnet 4.6 (1M context) * docs: sync example-skill.md with latest sf-311 skill - remove --session flags (skills must be portable, not session-coupled) - add Known Failure Point section (turn budget exhaustion pattern) - correct wait syntax docs (browse wait load / browse wait timeout N) - 22 iterations, updated gotchas order Co-Authored-By: Claude Sonnet 4.6 (1M context) * fix: address all 5 bugbot findings - [high] block shell metacharacters (;|&|`$()) to prevent injection bypass - [medium] fix npm evaluate script path: evaluate.ts → scripts/evaluate.ts - [low] fix tsconfig include: *.ts → scripts/**/*.ts - [low] lastAssistantText += (accumulate, not overwrite) - [low] remove unused deps: @browserbasehq/stagehand, zod Co-Authored-By: Claude Sonnet 4.6 (1M context) * fix autobrowse bugbot findings * fix autobrowse pricing and symlink handling * feat: add demo-video skill — Remotion launch video learnings Captures full pipeline from storytelling to render: - IDEA ENGINE narrative structure - Remotion gotchas (extrapolateLeft, staticFile, durationInFrames) - Browserbase brand colors and typography - UI mocking patterns with real reference video analysis - Audio production (background, SFX, ffmpeg generation) - Content authenticity (real failures vs invented ones) - Render quality settings (CRF 8 for Twitter masters) Co-Authored-By: Claude Sonnet 4.6 (1M context) * Revert "feat: add demo-video skill — Remotion launch video learnings" This reverts commit 07e7794e3252aec4ee9ce1ac16de81e2e373c2f6. * refactor(autobrowse): convert evaluate.ts to .mjs, follow agentskills.io conventions - Converted scripts/evaluate.ts → scripts/evaluate.mjs (plain ESM JavaScript) - Removed tsx, typescript, @types/node devDependencies - Removed tsconfig.json (no longer needed) - Added --help flag with full usage documentation - Moved diagnostics to stderr, structured JSON result to stdout - Added license field to SKILL.md frontmatter - Updated all references from tsx/evaluate.ts to node/evaluate.mjs Co-Authored-By: Claude Opus 4.6 (1M context) * feat(autobrowse): graduate skills to ~/.claude/skills/ instead of git Graduated skills now install as Claude Code slash commands at ~/.claude/skills//SKILL.md instead of committing a local skill.md file. Removed all git commit references from the loop — the working directory (tasks/, traces/, strategy.md) doesn't need to be a git repo. Co-Authored-By: Claude Opus 4.6 (1M context) * fix(autobrowse): correct ref format, add workspace flag, fail-fast on missing key Three fixes surfaced while running the google-flights task from an empty strategy baseline: 1. Ref format: the inner agent was told to click by @ref (e.g. @0-5), but browse snapshot emits refs as [X-Y] (e.g. [0-5], [2-147]). The agent hallucinated @-refs which the CLI silently accepted as no-ops, burning 30 turns without useful interaction. Updated both the TOOLS description and the system prompt to document [X-Y] format with examples, and added a "never invent refs" rule. 2. Ref counter: the live stderr log and summary writer counted @ chars in snapshot output, which always returned 0 for real snapshots. Switched to /\[\d+-\d+\]/g so outer agents can see the real ref count. 3. Workspace + key UX: added --workspace flag (default ./autobrowse) so tasks/, traces/, and reports/ land in CWD instead of under ~/.claude/skills/autobrowse/. This avoids the permission friction of writing inside Claude's home dir during training. Added ensureApiKey() that fails fast with a clear setup message when ANTHROPIC_API_KEY is missing — no more outer-agent key-hunting paths. SKILL.md updated to document natural-language invocation (URL drops and free-form goals, not just --task ), the new CWD-based workspace flow, and the new ref format / wait semantics. Verified on google-flights: empty-strategy baseline now sees 1157 real refs and drives the form correctly (previously 0 refs, total blindness). With a 9-line strategy, completes in 5 turns / \$0.16. Co-Authored-By: Claude Opus 4.7 (1M context) * fix(autobrowse): address bugbot findings on evaluate.mjs and SKILL.md - Guard lastAssistantText overwrite: only update when the turn produced text, so a final tool_use-only response doesn't wipe prior output (bugbot 3061376570). - Drop redundant reasoningText; the two variables held identical values (bugbot 3061376573). - Reorder tool-result branches: check error before isSnapshot/isScreenshot in both live log and summary writer, so a failed snapshot reports as error, not as "0 refs" (bugbot 3061606988). - Track completion via explicit flag set on end_turn / no-tool-use, not via `turn < MAX_TURNS`: a clean finish on turn 30 was misreported as max_turns (bugbot 3065604864). - Replace personal home path with generic placeholder in the sub-agent prompt template (bugbot 3118916022). Co-Authored-By: Claude Opus 4.7 (1M context) * fix(autobrowse): align wait guidance with browse cli * fix(autobrowse): mark truncated runs incomplete --------- Co-authored-by: Claude Sonnet 4.6 (1M context) Co-authored-by: Shrey Pandya