Add SLAB local browser integration for webcmd

.github/workflows/ci.yml

@@ -203,8 +203,8 @@ jobs:
       - name: Run smoke tests
         run: npx vitest run --project smoke --reporter=verbose
 
-  windows-cloak-smoke:
-    name: Windows real Cloak smoke
+  windows-slab-smoke:
+    name: Windows SLAB smoke
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: windows-latest
     timeout-minutes: 30
@@ -229,8 +229,8 @@ jobs:
         shell: pwsh
         run: ./scripts/collect-ci-diagnostics.ps1 -SelfTest
 
-      - name: Run real Cloak lifecycle smoke
-        run: npx vitest run --project e2e tests/e2e/cloak-runtime.test.ts tests/e2e/cloak-session-concurrency.test.ts
+      - name: Run SLAB lifecycle smoke
+        run: npx vitest run --project e2e tests/e2e/slab-runtime.test.ts tests/e2e/slab-session-concurrency.test.ts
 
       - name: Collect sanitized diagnostics
         if: failure()
@@ -242,5 +242,5 @@ jobs:
       - uses: actions/upload-artifact@v4
         if: failure()
         with:
-          name: windows-cloak-diagnostics
-          path: artifacts/windows-cloak/**
+          name: windows-slab-diagnostics
+          path: artifacts/windows-slab/**

.github/workflows/e2e-headed.yml

@@ -59,7 +59,7 @@ jobs:
         run: |
           xvfb-run --auto-servernum --server-args="-screen 0 1280x720x24" \
             npx vitest run --project e2e-fixed-port --project e2e \
-              tests/e2e/browser-tabs.test.ts tests/e2e/cloak-runtime.test.ts \
+              tests/e2e/browser-tabs.test.ts tests/e2e/slab-runtime.test.ts \
               --reporter=verbose
 
       - name: Run browser e2e tests (macOS)
@@ -68,5 +68,5 @@ jobs:
           WEBCMD_E2E: '0'
         run: |
           npx vitest run --project e2e-fixed-port --project e2e \
-            tests/e2e/browser-tabs.test.ts tests/e2e/cloak-runtime.test.ts \
+            tests/e2e/browser-tabs.test.ts tests/e2e/slab-runtime.test.ts \
             --reporter=verbose

PRIVACY.md

@@ -1,6 +1,6 @@
 # webcmd Privacy
 
-The webcmd-managed CloakBrowser runtime communicates only with the local Webcmd daemon on `localhost:9777`.
+The webcmd-managed SLAB browser runtime communicates only with the local Webcmd daemon on `localhost:9777`.
 
 The runtime can access browser pages and cookies because browser automation requires those permissions. Webcmd does not send browser data to AgentR. Commands run locally, and command output is printed to the local CLI process.
 

TESTING.md

@@ -32,12 +32,12 @@ npx vitest run --project unit src/convention-audit.test.ts src/runtime-copy.test
 npm run test:plugin -- --reporter=verbose
 ```
 
-## Cloak Runtime Smoke
+## SLAB Runtime Smoke
 
 Run:
 
 ```bash
-npx vitest run --project e2e tests/e2e/cloak-runtime.test.ts
+npx vitest run --project e2e tests/e2e/slab-runtime.test.ts
 ```
 
-The first run may download the CloakBrowser Chromium binary. Browser-backed tests no longer require a Chrome extension.
+The live run requires an installed SLAB browser. Browser-backed tests no longer require a Chrome extension.

benchmarks/README.md

@@ -85,9 +85,14 @@ webcmd               ███████████████████
 
 Run a controlled, sequential browser-tool benchmark. Keep task data and local evidence private.
 
+Legacy boundary: this private benchmark harness intentionally keeps its pinned
+CloakBrowser dependency so historical AXI/agent-browser/dev-browser/libretto
+runs remain comparable. It is not the webcmd local runtime and is not part of
+the SLAB browser distribution path.
+
 ## Workflow
 
-1. Confirm `uv`, the selected controller CLI, selected browser tool, and judge authentication are available (`GOOGLE_API_KEY` for `google`, `OPENAI_API_KEY` for `openai`, or a ChatGPT-authenticated `codex login` for `codex`). AXI, agent-browser, and dev-browser runs also require CloakBrowser.
+1. Confirm `uv`, the selected controller CLI, selected browser tool, and judge authentication are available (`GOOGLE_API_KEY` for `google`, `OPENAI_API_KEY` for `openai`, or a ChatGPT-authenticated `codex login` for `codex`). AXI, agent-browser, and dev-browser runs also require the legacy benchmark CloakBrowser package.
 2. Ask the user to choose a controller, model, benchmark, and task selection if any is missing.
 3. Start with one task unless the user explicitly requests a larger or full run.
 4. Run `scripts/run_eval.py` with the explicit choices.
@@ -166,7 +171,7 @@ Its `estimated_api_cost_usd` is an API-equivalent comparison metric, not a
 subscription charge; the manifest records `billing_mode` as
 `chatgpt_subscription`.
 
-For AXI with one dedicated CloakBrowser process and profile per task:
+For AXI with one dedicated legacy benchmark CloakBrowser process and profile per task:
 
 ```bash
 uv run python benchmarks/scripts/run_eval.py \
@@ -178,7 +183,7 @@ uv run python benchmarks/scripts/run_eval.py \
   --tools chrome-devtools-axi
 ```
 
-For agent-browser with one dedicated CloakBrowser process and profile per task:
+For agent-browser with one dedicated legacy benchmark CloakBrowser process and profile per task:
 
 ```bash
 uv run python benchmarks/scripts/run_eval.py \
@@ -190,7 +195,7 @@ uv run python benchmarks/scripts/run_eval.py \
   --tools agent-browser
 ```
 
-For dev-browser with one dedicated CloakBrowser process and profile per task:
+For dev-browser with one dedicated legacy benchmark CloakBrowser process and profile per task:
 
 ```bash
 npm install -g dev-browser
@@ -212,10 +217,10 @@ its `bash` and `read` tools.
 `dev-browser install` is required because it installs the daemon's Playwright
 and QuickJS dependencies. It may also download dev-browser's Chromium, but the
 benchmark does not use that browser: the task-private shim always connects
-dev-browser to the task's dedicated CloakBrowser CDP endpoint.
+dev-browser to the task's dedicated legacy benchmark CloakBrowser CDP endpoint.
 
-For Libretto Browser Tools with Codex or Pi and one dedicated CloakBrowser per
-task:
+For Libretto Browser Tools with Codex or Pi and one dedicated legacy benchmark
+CloakBrowser per task:
 
 ```bash
 npm ci
@@ -234,7 +239,7 @@ Pi, it registers the equivalent native Pi custom tools directly; use
 `--controller pi --model openai-codex/gpt-5.6-sol`. Both expose only `browser_open`,
 `browser_exec`, `browser_snapshot`, `browser_status`, and `browser_close`.
 `browser_connect` is disabled so the agent cannot leave the task's dedicated
-CloakBrowser.
+legacy benchmark CloakBrowser.
 
 Use `--stealth-view official` only with `Stealth_Bench_V1`. Never add a parallel flag or publish `results/`.
 

benchmarks/scripts/axi_runtime.py

@@ -16,13 +16,14 @@
 
 
 def find_cloak_package() -> Path:
+    """Locate the private benchmark harness's legacy CloakBrowser package."""
     override = os.environ.get("BROWSER_BENCH_CLOAK_PACKAGE")
     if override:
         candidates = [Path(override).expanduser()]
     else:
         npm = shutil.which("npm")
         if not npm:
-            raise RuntimeError("npm is required to locate CloakBrowser")
+            raise RuntimeError("npm is required to locate the legacy benchmark CloakBrowser")
         result = subprocess.run(
             [npm, "root", "-g"],
             text=True,
@@ -47,7 +48,7 @@ def find_cloak_package() -> Path:
         if package.get("name") == "cloakbrowser":
             return candidate.resolve()
     raise RuntimeError(
-        "CloakBrowser was not found. Install it globally, keep Webcmd installed, "
+        "Legacy benchmark CloakBrowser was not found. Install it globally, keep Webcmd installed, "
         "or set BROWSER_BENCH_CLOAK_PACKAGE to its package directory."
     )
 
@@ -82,13 +83,13 @@ async def _launch_options(profile_dir: Path, env: dict[str, str]) -> dict:
     except asyncio.TimeoutError:
         process.kill()
         await process.wait()
-        raise RuntimeError("timed out resolving CloakBrowser launch options")
+        raise RuntimeError("timed out resolving legacy benchmark CloakBrowser launch options")
     if process.returncode:
-        raise RuntimeError(f"CloakBrowser launch configuration failed: {stderr.decode(errors='replace').strip()}")
+        raise RuntimeError(f"Legacy benchmark CloakBrowser launch configuration failed: {stderr.decode(errors='replace').strip()}")
     try:
         return json.loads(stdout)
     except json.JSONDecodeError as error:
-        raise RuntimeError("CloakBrowser returned invalid launch configuration") from error
+        raise RuntimeError("Legacy benchmark CloakBrowser returned invalid launch configuration") from error
 
 
 async def _wait_for_devtools_port(profile_dir: Path) -> int:
@@ -102,14 +103,14 @@ async def _wait_for_devtools_port(profile_dir: Path) -> int:
         except (FileNotFoundError, IndexError, ValueError):
             pass
         await asyncio.sleep(0.05)
-    raise RuntimeError("timed out waiting for CloakBrowser's CDP endpoint")
+    raise RuntimeError("timed out waiting for legacy benchmark CloakBrowser's CDP endpoint")
 
 
 async def _launch_cloak(profile_dir: Path, env: dict[str, str]) -> int:
     options = await _launch_options(profile_dir, env)
     executable = Path(str(options.get("executablePath") or ""))
     if not executable.is_file():
-        raise RuntimeError(f"CloakBrowser executable is missing: {executable}")
+        raise RuntimeError(f"Legacy benchmark CloakBrowser executable is missing: {executable}")
     arguments = [
         *map(str, options.get("args") or []),
         "--password-store=basic",
@@ -123,7 +124,7 @@ async def _launch_cloak(profile_dir: Path, env: dict[str, str]) -> int:
         marker = "/Contents/MacOS/"
         executable_text = str(executable)
         if marker not in executable_text:
-            raise RuntimeError("CloakBrowser executable is not inside a macOS app bundle")
+            raise RuntimeError("Legacy benchmark CloakBrowser executable is not inside a macOS app bundle")
         app_path = executable_text.split(marker, 1)[0]
         command = ["/usr/bin/open", "-g", "-n", app_path, "--args", *arguments]
     else:
@@ -137,7 +138,7 @@ async def _launch_cloak(profile_dir: Path, env: dict[str, str]) -> int:
     )
     _, stderr = await process.communicate()
     if process.returncode:
-        raise RuntimeError(f"CloakBrowser failed to launch: {stderr.decode(errors='replace').strip()}")
+        raise RuntimeError(f"Legacy benchmark CloakBrowser failed to launch: {stderr.decode(errors='replace').strip()}")
     return await _wait_for_devtools_port(profile_dir)
 
 

benchmarks/scripts/run_controller.py

@@ -242,28 +242,28 @@ def _build_prompt(tool: Tool, session: str, shots_dir: Path, task: str) -> str:
 - Every shell command must begin with exactly `npx -y chrome-devtools-axi`; use no substitutions, redirections, pipes, or other executables.
 - Do not use Web search, browser MCPs, Playwright, Puppeteer, curl, wget, raw HTTP, or any non-AXI automation tool.
 - Use the `$chrome-devtools-axi` skill for AXI usage guidance.
-- The AXI session and its dedicated CloakBrowser connection are already configured in the environment; do not start another browser."""
+- The AXI session and its dedicated legacy benchmark CloakBrowser connection are already configured in the environment; do not start another browser."""
     elif tool == "agent-browser":
         tool_rules = """- Use only `agent-browser` for browser interaction.
 - Use one `agent-browser` command per shell invocation; use no substitutions, redirections, pipes, or other executables.
 - Do not use `batch`, `close`, connection/profile flags, or multiple agent-browser commands in one shell invocation.
-- Never pass a URL to `agent-browser read`; use `agent-browser open URL` and then `agent-browser read` so all page traffic stays inside CloakBrowser.
+- Never pass a URL to `agent-browser read`; use `agent-browser open URL` and then `agent-browser read` so all page traffic stays inside the legacy benchmark CloakBrowser.
 - Do not use Web search, browser MCPs, Playwright, Puppeteer, curl, wget, raw HTTP, or any non-agent-browser automation tool.
 - Use the `$agent-browser` skill for agent-browser usage guidance.
-- The agent-browser session and its dedicated CloakBrowser connection are already configured in the environment; do not start, connect, configure, or close another browser."""
+- The agent-browser session and its dedicated legacy benchmark CloakBrowser connection are already configured in the environment; do not start, connect, configure, or close another browser."""
     elif tool == "dev-browser":
         tool_rules = f"""- Use only `dev-browser` for browser interaction.
 - Invoke `dev-browser` with one quoted heredoc per shell command. The heredoc body must contain only the sandboxed JavaScript described by the `$dev-browser` skill.
 - You may add only `--timeout SECONDS`; do not use `--browser`, `--connect`, `--headless`, `run`, `stop`, or any other subcommand or connection option.
 - Use no substitutions, pipes, extra redirections, or other executables.
 - Do not use Web search, browser MCPs, external Playwright, Puppeteer, curl, wget, raw HTTP, or any non-dev-browser automation tool.
 - Use the `$dev-browser` skill for dev-browser usage guidance.
-- The dev-browser command is already pinned to this task's dedicated CloakBrowser connection; do not start, connect, configure, or close another browser.
+- The dev-browser command is already pinned to this task's dedicated legacy benchmark CloakBrowser connection; do not start, connect, configure, or close another browser.
 - Save screenshots with `await saveScreenshot(await page.screenshot(), "{session}-step_001.png")`, then `{session}-step_002.png`, and so on."""
     elif tool == "libretto":
         tool_rules = """- Use only the Libretto MCP tools `browser_open`, `browser_exec`, `browser_snapshot`, `browser_status`, and `browser_close` for browser interaction.
 - Do not use shell commands, Web Search, other MCP servers or tools, Playwright outside `browser_exec`, Puppeteer, curl, wget, or raw HTTP.
-- The Libretto provider is already pinned to this task's dedicated CloakBrowser; open it with `browser_open` and do not configure another browser.
+- The Libretto provider is already pinned to this task's dedicated legacy benchmark CloakBrowser; open it with `browser_open` and do not configure another browser.
 - Reuse the session ID returned by `browser_open` and close it with `browser_close` when the task is complete."""
     else:
         tool_rules = f"""- Use only `webcmd` raw-browser commands for task execution. Do not use Web Search, browser MCPs, external Playwright, Puppeteer, curl, wget, raw HTTP, adapters, fetch commands, plugins, or any non-Webcmd automation tool.

benchmarks/tests/test_controller.py

@@ -355,7 +355,7 @@ def test_agent_browser_prompt_uses_installed_skill_and_dedicated_cloak(tmp_path)
 
     assert "`$agent-browser` skill" in prompt
     assert "only `agent-browser`" in prompt
-    assert "dedicated CloakBrowser" in prompt
+    assert "dedicated legacy benchmark CloakBrowser" in prompt
     assert "Do not use `batch`" in prompt
     assert "one `agent-browser` command per shell invocation" in prompt
     assert "Never pass a URL to `agent-browser read`" in prompt
@@ -374,7 +374,7 @@ def test_dev_browser_prompt_uses_installed_skill_quoted_heredoc_and_task_screens
     assert "`$dev-browser` skill" in prompt
     assert "only `dev-browser`" in prompt
     assert "quoted heredoc" in prompt
-    assert "dedicated CloakBrowser" in prompt
+    assert "dedicated legacy benchmark CloakBrowser" in prompt
     assert "saveScreenshot" in prompt
     assert "session-1-step_001.png" in prompt
     assert "Webcmd" not in prompt
@@ -395,7 +395,7 @@ def test_libretto_prompt_uses_only_native_tools_on_dedicated_cloak(tmp_path):
     ):
         assert f"`{tool}`" in prompt
     assert "browser_connect" not in prompt
-    assert "dedicated CloakBrowser" in prompt
+    assert "dedicated legacy benchmark CloakBrowser" in prompt
     assert "screenshot: true" in prompt
     assert "shell commands" in prompt
     assert "$libretto" not in prompt

docs/cli-reference.mdx

@@ -71,7 +71,7 @@ webcmd --profile work session close \
   session_7d8f2c10-4a11-4f3e-9c22-1b6de0a91f45
 ```
 
-Local browser commands use Cloak. Hosted browser commands use Webcmd Cloud and Browser Use; `web fetch` still runs locally.
+Local browser commands use SLAB. Hosted browser commands use Webcmd Cloud and Browser Use; `web fetch` still runs locally.
 
 ## Browser Programs