Replace chrome-launcher + CDP with cloakbrowser + Playwright (v2.0.0)

[yfe404]

Summary

Swaps the browser automation stack from chrome-launcher + raw CDP + chrome-devtools-mcp sidecar to cloakbrowser (stealth-patched Chromium) driven via Playwright. Source-level C++ fingerprint patches replace the hand-rolled JS stealth script; humanize: true replaces the custom CDP input engine at the dispatch layer (our timing profiles still layer on top). Net change: +790 / −3366 lines.

Breaking changes (→ v2.0.0)

• Tools renamed: every interceptor_chrome_* → interceptor_browser_*. The 14 interceptor_chrome_devtools_* tools collapse onto 9 Playwright-driven equivalents.
• Tools removed: interceptor_chrome_cdp_info, interceptor_chrome_devtools_{pull_sidecar,attach,detach,navigate,list_network}. There is no CDP surface and no session-binding step — tools take target_id directly. Network listing is now sourced from MITM proxy capture (always on, strictly more complete than the old CDP Network view).
• Resources renamed: proxy://chrome/primary → proxy://browser/primary, proxy://chrome/targets → proxy://browser/targets. proxy://chrome/devtools/sessions and proxy://chrome/{target_id}/cdp template removed.
• Tool count: 77 → 71.
• Node: ≥ 20 (cloakbrowser requirement).

Key wins

• Locator-based humanizer_click — accepts selector | role + name | text | label | x,y and auto-waits for visible + enabled + stable + in-view. Replaces the flaky Runtime.evaluate + getBoundingClientRect coord math that broke on iframes, shadow DOM, and offscreen elements.
• Source-level stealth — cloakbrowser ships 48+ C++ patches so navigator.webdriver, sec-ch-ua*, canvas/WebGL/audio fingerprints, and ja3n/ja4 match real Chrome natively. No JS injection, no double-patching concerns.
• ARIA YAML snapshots — interceptor_browser_snapshot returns a role/name/text tree (not a11y JSON) via Playwright locator.ariaSnapshot; supports mode: "ai" for ref-tagged snapshots and selector for scoped subtrees.
• Kept untouched (orthogonal to swap): src/tls-spoof.ts, src/browser-presets.ts, src/tools/tls.ts — impit-based outbound re-origination + MITM fingerprint capture continue to work for curl/Android/Docker clients.

Dependencies

• Added: cloakbrowser@^0.3.24, playwright-core@^1.59
• Removed: chrome-launcher, chrome-devtools-mcp (dynamic)

Migration notes

• Replace interceptor_chrome_launch(..., stealthMode: true) with interceptor_browser_launch(...). The stealthMode param is gone — cloakbrowser is always stealth.
• Replace the attach → call → detach sidecar flow with direct target_id parameters on each tool call.
• CDP fields in target details (port, cdpHttpUrl, browserWebSocketDebuggerUrl, etc.) are gone; targets now expose url, headless, humanize, etc.

Test plan

• npm run build — tsc clean, 0 errors
• npm run test:unit — 74/74 pass
• npm run test:integration — 18/20 pass (2 pre-existing failures unrelated to swap: checks fingerprint runtime preflight + imports HAR and replays entries — same on main)
• Real-site smoke against bot.sannysoft.com — navigator.webdriver = false, UA Chrome/146, platform Win32, JA4 t13d1516h2_8daaf6152771_d8a2da3f94cd
• Full recon against barnesandnoble.com (Akamai-protected) — homepage → fiction → sci-fi category → PDP all returned 200 with no 403 challenge; 21 exchanges captured with JA3/JA4; _abck + bm_* cookies issued and accepted
• Locator click verified on live DuckDuckGo input[name="q"] — waitFor({ state: "visible" }) returned without coord math
• Hard-target replay from project_hard_target_evaluation.md (5-site suite incl. Kasada) — deferred, not blocking

Follow-ups (not in this PR)

• Tag v2.0.0 and npm publish after merge.
• Update dependent skills (intel-agent, web-scraper) to the new tool names — intel-agent update is drafted in a parallel working tree.

See CHANGELOG.md for the full migration table.

[yfe404]

Approved