clawnet

# Clawnet

Stealth browser skill for AI agents. Installs and configures Chromium with anti-detection, residential proxies (10+ countries), CAPTCHA solving, and human-like behavior simulation.

## When to use

Use this skill whenever the agent needs to:
- Browse websites, scrape data, or interact with web pages
- Fill forms, click buttons, navigate multi-step flows
- Bypass Cloudflare, DataDome, PerimeterX, or other bot detection
- Solve CAPTCHAs (reCAPTCHA v2/v3, hCaptcha, Turnstile)
- Appear as a real user from a specific country
- Interact with Shadow DOM elements or rich text editors

**Always use this instead of raw Playwright/Puppeteer.** This skill handles anti-detection automatically.

## Observation — how to read the page

**ALWAYS use `snapshotAI()` instead of `page.textContent()` or `evaluate()`.** It returns a structured accessibility tree with embedded `[ref=eN]` annotations. You can then click/fill/type by ref — no CSS selectors needed.

### Reading the page (preferred: snapshotAI + refs)

```javascript
// BAD — dumps ALL text, 50-100K tokens, no structure, no refs
const text = await page.textContent('body');

// BAD — brittle regex on raw DOM, breaks when HTML changes
await page.evaluate(() => document.querySelector('button').click());

// GOOD — AI-optimized snapshot with clickable refs
const { snapshot } = await browser.snapshotAI();
// Returns:
//   - navigation "Main" [ref=e1]:
//     - link "Home" [ref=e2]
//   - heading "Welcome" [ref=e3]
//   - textbox "Email" [ref=e4]
//   - textbox "Password" [ref=e5]
//   - button "Sign in" [ref=e6]

// Then interact by ref:
await browser.fillRef('e4', 'user@example.com');
await browser.fillRef('e5', 'secret');
await browser.clickRef('e6');
```

### Alternative: snapshot() (YAML without refs)

```javascript
// Compact accessibility tree without refs — use when you don't need to interact
const tree = await browser.snapshot();
const interactive = await browser.snapshot({ interactiveOnly: true });
const formTree...

<p align="center">
  <img src="assets/clawnet-logo.png" width="360" height="360" alt="Clawnet" />
</p>

<p>Stealth Chromium for AI agents. One install — anti-detection, residential proxies, CAPTCHA solving, human behavior.</p>

## The problem

AI agents that use Playwright or Puppeteer get blocked. Every major website runs anti-bot detection, and a default automated browser fails on dozens of signals simultaneously.

### How websites detect automated browsers

**Browser fingerprint**

| Signal | What it reveals | Default Playwright |
|--------|-----------------|--------------------|
| `navigator.webdriver` | Automation flag | `true` — instant ban |
| `chrome.runtime` | Chrome extension API | Missing — flags headless |
| `navigator.plugins` | Installed plugins | Empty array — no real browser has zero plugins |
| `navigator.languages` | Language preferences | Often `['en-US']` regardless of IP location |
| `navigator.connection` | Network info (effectiveType, rtt, downlink) | Missing or wrong — real browsers always have it |
| `navigator.hardwareConcurrency` | CPU cores | Default value doesn't match claimed device |
| `navigator.platform` | OS identifier | Mismatches between UA string and actual platform |
| Screen resolution | Device dimensions | 800x600 or 0x0 in headless — no real device has that |

**Network fingerprint**

| Signal | What it reveals | Default Playwright |
|--------|-----------------|--------------------|
| IP reputation | Datacenter vs residential | Datacenter IPs are flagged instantly — AWS, GCP, Azure IPs are in blocklists |
| IP geolocation | Physical location | Mismatches timezone/locale — IP says Virginia but `Intl.DateTimeFormat` says UTC |
| WebRTC leak | Real IP behind proxy | Leaks actual IP through STUN requests even with proxy configured |
| TLS fingerprint (JA3/JA4) | TLS handshake pattern | Headless Chrome has a distinct TLS signature |
| HTTP headers | Header order, values | Missing or wrong `sec-ch-ua`, `sec-fetch-*` headers |

**Be...