11# ` @lockintime/headless `
22
3- Verified npm launcher for the [ Headless agent browser] ( https://github.com/LockInTime/headless ) .
3+ Typed Node.js SDK and verified npm launcher for the
4+ [ Headless agent browser] ( https://github.com/LockInTime/headless ) . Node.js 22 or
5+ newer is required. The SDK has no runtime dependencies and talks directly to
6+ Headless over its private per-user Unix socket. It does not start a network
7+ service or use MCP as an internal transport.
8+
9+ ## CLI launcher
410
511``` sh
612npx @lockintime/headless help
@@ -15,3 +21,70 @@ plus Linux x86_64 and arm64. Windows users should use the published GHCR image.
1521
1622Set ` HEADLESS_NPM_CACHE ` to an absolute directory to move the verified cache.
1723The release download origin is fixed and cannot be overridden.
24+
25+ Because this package distributes both the SDK and verified product launcher,
26+ its version follows Headless product tags. The supported wire and schema
27+ versions remain independent and are pinned in the generated SDK contract.
28+
29+ ## Connect to a shared host
30+
31+ Replace repeated CLI calls with typed methods. Closing this client closes only
32+ its active socket requests. It never stops a shared Headless host.
33+
34+ ``` ts
35+ import { connect } from " @lockintime/headless" ;
36+
37+ // CLI: headless status
38+ await using headless = await connect ();
39+
40+ // CLI: headless visit https://example.com
41+ const page = await headless .visit ({ url: " https://example.com" });
42+ if (page .untrustedContent ) {
43+ console .log (page .value .title );
44+ }
45+ ```
46+
47+ Every page-derived result is returned as ` Untrusted<T> ` . Callers must preserve
48+ that trust marker when sending page content to an agent or another system.
49+
50+ ## Supervised host
51+
52+ Use ` launch() ` when this process must own a new host. It invokes the installed
53+ CLI with ` headless start --background --supervised ` , keeps the ownership pipe
54+ open, verifies that the startup response and socket report the same host PID,
55+ and reaps only that launcher during disposal. It fails rather than claiming an
56+ already-running shared host.
57+
58+ ``` ts
59+ import { launch } from " @lockintime/headless" ;
60+
61+ await using host = await launch ({
62+ allow: [" example.com" ],
63+ installationTimeoutMs: 300_000 ,
64+ startupTimeoutMs: 10_000 ,
65+ });
66+
67+ const session = await host .client .openSession (" research" , { isolated: true });
68+ await using scoped = session ;
69+ const snapshot = await scoped .inspect ({ context: " actions" });
70+ ```
71+
72+ Session helpers expose only session-scoped commands. Host lifecycle and session
73+ creation remain on ` HeadlessClient ` .
74+
75+ ## Cancellation and authentication
76+
77+ Methods accept ` { signal, timeoutMs } ` as their final argument. Cancellation or
78+ timeout before any request byte is written is retry-safe. After a write,
79+ ` OperationOutcomeUnknown ` means the SDK cannot know whether the browser action
80+ completed. Never retry it automatically; inspect browser state first.
81+
82+ Saved-login methods accept only a challenge ID and account alias. There is no
83+ password parameter in the authentication API:
84+
85+ ``` ts
86+ await scoped .authLogin ({
87+ challenge: " 11111111-1111-4111-8111-111111111111" ,
88+ account: " work" ,
89+ });
90+ ```
0 commit comments