unbrowse

Unbrowse — one intent, one result

Unbrowse is a web harness, not a browser command catalog. The agent states the outcome; the harness chooses the cheapest trustworthy path and returns either the result or one executable recovery step.

Agent contract

1. For any web read, search, list, or retrieval, run unbrowse "<task>" --url <url>.

2. If next_step begins with unbrowse, run that command once, then retry step 1 once. A typed ask or deny gate is not a command: surface it to the user and stop. Without either field, use only the matching fallback: unbrowse auth <login_url> for auth, or unbrowse capture --url <url> --intent "<task>" for a genuine miss.

3. If that retry fails, stop and report the blocker. Do not invent another route.

For mutations, act only when the user explicitly requested the change. Dry-run first and require an independently issued host approval before unsafe execution. An invoking agent cannot approve its own request:

unbrowse execute --skill ID --endpoint ID --dry-run
# then surface the typed approval gate to the host/user

Invisible harness lifecycle

Runtime status: passive capture, DAG compilation, local replay, durable route state, independent-replay promotion, lifecycle-issued publish permits, and a central fail-closed remote transport boundary are implemented. The canonical bare/get/MCP resolver persists browser evidence, bypasses browser-derived snapshots for validation, and stays API-only after promotion. Legacy operator/background paths that do not yet produce lifecycle proof remain local/fail-closed. The index queue now uses interruption-safe typed durable jobs; capture, validation, publish-job adoption and full SDK/operator convergence continue.

resolve → browse → observe → compile DAG → replay-validate → promote → publish → reuse

These are runtime stages, not steps for the agent to hand-drive:

• Cold run: when no trustworthy route exists, the capture engine drives the real site (Obscura where supported, browser fallback otherwise). First-party XHR/fetch traffic is observed passively while the requested interaction proceeds.
• Compile: useful requests become a typed operation DAG: endpoint semantics, dependencies, holes, response shapes, auth requirements, and side-effect class. Assets, secrets, raw payloads, and incidental traffic are excluded.
• Validation run: a captured route is replayed and checked against browser/page truth, the requested intent, schema/cardinality, safety, freshness, and policy. A capture alone is not publication proof.
• Promotion: after successful replay, the local API route becomes the preferred path. Later matching calls use the API instead of reopening the browser; drift or failed parity demotes the route and reopens discovery.
• Publication: a validated, reusable closure of the DAG is converted to the remote skill format and published for other agents only after sanitization and contribution-policy gates. Private, sensitive, PII-bearing, destructive, or origin-forbidden routes stay local.