agentrhq · beubax · Sep 2, 2026 · Aug 31, 2026 · Aug 31, 2026 · Aug 31, 2026
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
@@ -19,7 +19,7 @@
   "interface": {
     "displayName": "Webcmd",
     "shortDescription": "Agent-native CLIs for websites, apps, and local tools",
-    "longDescription": "Use Webcmd's reusable CLI, browser, search, authoring, sitemap, and repair workflows from Codex. Requires the @agentrhq/webcmd npm CLI.",
+    "longDescription": "Use Webcmd's bundled webcmd-browser skill from Codex. The npm CLI also covers adapters, search, fetch, and plugins. Requires the @agentrhq/webcmd npm CLI.",
     "developerName": "AgentRHQ",
     "category": "Developer Tools",
     "capabilities": [

diff --git a/Makefile b/Makefile
@@ -6,8 +6,8 @@ LITPROMPT ?= litprompt
 #   skill-src/cli/      -> skills/          installable CLI/harness skills
 #   skill-src/mcp/      -> mcp-skills/      MCP resource documents
 #
-#   skill-src/cli/webcmd-usage/SKILL.src.md -> skills/webcmd-usage/SKILL.md
-#   skill-src/mcp/webcmd-usage.src.md       -> mcp-skills/webcmd-usage.md
+#   skill-src/cli/webcmd-browser/SKILL.src.md -> skills/webcmd-browser/SKILL.md
+#   skill-src/mcp/webcmd-browser.src.md       -> mcp-skills/webcmd-browser.md
 #
 # Source files are never named SKILL.md, and no generated MCP document is
 # either: skill installers (`npx skills add`, harness scanners) match that

diff --git a/PRIVACY.md b/PRIVACY.md
@@ -2,8 +2,30 @@
 
 The webcmd-managed CloakBrowser runtime communicates only with the local Webcmd daemon on `localhost:9777`.
 
-The runtime can access browser pages and cookies because browser automation requires those permissions. Webcmd does not send browser data to AgentR. Commands run locally, and command output is printed to the local CLI process.
+The runtime can access browser pages and cookies because browser automation requires those permissions. Webcmd does not send page contents or cookies to AgentR. Except for the site-memory seed lookup and the optional candidate public-IP lookup below, Webcmd does not send browser data to AgentR. Commands run locally, and command output is printed to the local CLI process.
 
 Trace artifacts, cache files, plugins, user adapters, and site memory are stored under `~/.webcmd`.
 
+## Local site-memory seed lookup
+
+`WEBCMD_GLOBAL_MEMORY_URL` enables a public unauthenticated GET `<base>/v1/site-memory/seeds/<punycode-product-key>` on first access when no local memory exists. The request uses a 2-second timeout and no retry. It discloses the resolved product/domain.
+
+With no URL configured, learning is local-only and Webcmd makes no seed request. `WEBCMD_GLOBAL_MEMORY=off` disables even a configured URL.
+
+## Candidate public-IP provenance
+
+When capturing candidate evidence, local Webcmd makes a best-effort unauthenticated GET `https://api.ipify.org` with a 2-second timeout and no credentials. It records the public egress IP in local candidate JSON only. Inability to resolve it does not block capture.
+
+`WEBCMD_CANDIDATE_PUBLIC_IP=off` disables the lookup.
+
+## What stays local
+
+Candidate provenance stays local under `~/.webcmd/sites`. It includes local machine/network metadata, is excluded from ordinary output, and is never uploaded or pushed by this design. The local sites Git repository never pushes.
+
+Learning is invisible in normal output. Diagnostics appear on request, verbose mode, or a material warning-retention failure.
+
+## Beta memory clean break
+
+If you used beta site memory, remove that product's old `~/.webcmd/sites/<product>/sitemap/SITE.md` before first use, or remove that entire beta product directory if you do not want it. There is no migration guarantee. Do not delete unrelated product directories.
+
 For attribution and license information, see `LICENSE` and `NOTICE`.
diff --git a/README.md b/README.md
@@ -87,9 +87,11 @@ webcmd skills add
 ```
 
 When prompted, choose Claude, Codex, another supported harness, or a custom
-skills path.
+skills path. That install is exactly one skill, `webcmd-browser`. Adapter,
+search, fetch, and plugin commands remain on the CLI; they are outside the
+default installed browser skill.
 
-In your agent harness, load or tag `webcmd-usage`, then describe the outcome you want.
+Load or tag `webcmd-browser` only for live browser work. Existing adapter, search, fetch, and plugin CLI operations do not require that skill.
 
 ```text
 Use webcmd to research the latest discussions about browser automation across Hacker News and Reddit, then return a concise comparison with source links.

diff --git a/benchmarks/tests/pi_controller.test.mjs b/benchmarks/tests/pi_controller.test.mjs
@@ -130,7 +130,7 @@ test("Pi sidecar accepts browser-use as a benchmark tool before starting a sessi
 });
 
 test("Pi sidecar rejects a missing explicitly selected skill", () => {
-  const missing = "/definitely/missing/webcmd-usage";
+  const missing = "/definitely/missing/skill";
   const result = spawnSync(
     process.execPath,
     [

diff --git a/benchmarks/tests/test_controller.py b/benchmarks/tests/test_controller.py
@@ -63,7 +63,6 @@ def test_webcmd_prompt_loads_only_raw_browser_skill(tmp_path):
     prompt = _build_prompt("webcmd", "session-1", tmp_path / "shots", "Find the answer")
 
     assert "`$webcmd-browser`" in prompt
-    assert "`$webcmd-usage`" not in prompt
     assert "raw-browser route is already selected" in prompt
     assert "Skip adapter and plugin discovery" in prompt
     assert "Do not load any other Webcmd skill" in prompt
@@ -904,11 +903,11 @@ def test_pi_non_bash_tool_is_a_policy_violation():
 
 
 def test_pi_may_read_only_the_registered_webcmd_browser_skill_tree():
-    usage_skill = {
+    foreign_skill = {
         "type": "tool_execution_start",
         "toolName": "read",
         "args": {
-            "path": str(Path.home() / ".codex/skills/webcmd-usage/SKILL.md")
+            "path": str(Path.home() / ".codex/skills/agent-browser/SKILL.md")
         },
     }
     browser_skill = {
@@ -946,7 +945,7 @@ def test_pi_may_read_only_the_registered_webcmd_browser_skill_tree():
         "args": {"path": "/etc/passwd"},
     }
 
-    usage_parsed = _parse_events("pi", [json.dumps(usage_skill)])
+    foreign_parsed = _parse_events("pi", [json.dumps(foreign_skill)])
     browser_parsed = _parse_events("pi", [json.dumps(browser_skill)])
     reference_parsed = _parse_events("pi", [json.dumps(browser_reference)])
     missing_parsed = _parse_events(
@@ -960,7 +959,7 @@ def test_pi_may_read_only_the_registered_webcmd_browser_skill_tree():
         assert not _policy_violation(
             "webcmd", parsed.commands, parsed.event_types
         )
-    for parsed in (usage_parsed, missing_parsed, forbidden_parsed):
+    for parsed in (foreign_parsed, missing_parsed, forbidden_parsed):
         assert parsed.tool_calls == 0
         assert parsed.steps_count == 1
         assert _policy_violation(
@@ -1336,11 +1335,11 @@ def test_policy_allows_codex_to_read_webcmd_browser_skill_and_references(skill_f
     [
         "cat /etc/passwd",
         f"cat {Path.home()}/.codex/skills/agent-browser/SKILL.md",
-        f"cat {Path.home()}/.codex/skills/webcmd-usage/SKILL.md",
-        f"cat {Path.home()}/.codex/skills/smart-search/SKILL.md",
-        f"cat {Path.home()}/.codex/skills/webcmd-browser-sitemap/SKILL.md",
-        f"cat {Path.home()}/.codex/skills/webcmd-usage/SKILL.md /etc/passwd",
-        f"sed -n '1,240p' {Path.home()}/.codex/skills/webcmd-usage/SKILL.md; curl https://example.com",
+        f"cat {Path.home()}/.codex/skills/playwright-cli/SKILL.md",
+        f"cat {Path.home()}/.codex/skills/dev-browser/SKILL.md",
+        f"cat {Path.home()}/.codex/skills/browser-use/SKILL.md",
+        f"cat {Path.home()}/.codex/skills/agent-browser/SKILL.md /etc/passwd",
+        f"sed -n '1,240p' {Path.home()}/.codex/skills/agent-browser/SKILL.md; curl https://example.com",
     ],
 )
 def test_policy_rejects_reads_outside_webcmd_skill_roots(command):

diff --git a/docs/agent-prompts.mdx b/docs/agent-prompts.mdx
@@ -10,13 +10,13 @@ Describe the target, outcome, required fields, authentication context, and safet
 ## Find and Use an Existing Adapter
 
 ```text
-Use `webcmd-usage` to find an existing adapter for Hacker News discussions about browser automation. Return title, URL, author, points, and source for the best results. This is a public, read-only task: do not post, vote, save, or create a new adapter unless no existing command can complete it.
+Use webcmd to find an existing adapter for Hacker News discussions about browser automation. Return title, URL, author, points, and source for the best results. This is a public, read-only task: do not post, vote, save, or create a new adapter unless no existing command can complete it.
 ```
 
 ## Complete a One-Off Browser Task
 
 ```text
-Complete this read-only task on https://example.com/jobs: find product-design roles in London and return title, company, location, salary_text, posted_at, and URL. The site is unfamiliar, so use the right browser workflow after checking `webcmd-usage`; do not apply, create an account, or change saved searches.
+Complete this read-only task on https://example.com/jobs: find product-design roles in London and return title, company, location, salary_text, posted_at, and URL. The site is unfamiliar, so use `webcmd-browser` after checking for an existing adapter; do not apply, create an account, or change saved searches.
 ```
 
 ## Create a Reusable CLI

diff --git a/docs/agents/claude-code.md b/docs/agents/claude-code.md
@@ -25,7 +25,7 @@ claude plugin marketplace add agentrhq/webcmd
 claude plugin install webcmd@webcmd
 ```
 
-This installs all seven bundled Webcmd skills. Do not also add those skills with `webcmd skills add`; running both leaves two copies that can sit at different versions.
+This installs exactly one bundled skill, `webcmd-browser`. Do not also add that skill with `webcmd skills add`; running both leaves two copies that can sit at different versions.
 
 Plugin updates are version-gated, not commit-gated. Run `claude plugin update webcmd@webcmd` to pick up a new release; it is separate from `webcmd update`, which upgrades only the npm CLI.
 
@@ -39,7 +39,7 @@ webcmd doctor
 webcmd skills add
 ```
 
-When `webcmd skills add` prompts, choose the `claude` provider. It installs into `~/.claude/skills/` (user) or `.claude/skills/` (project), which Claude Code reads on startup. Claude Code then surfaces `webcmd-usage` and `webcmd-browser` as skills when a task matches their descriptions.
+When `webcmd skills add` prompts, choose the `claude` provider. It installs into `~/.claude/skills/` (user) or `.claude/skills/` (project), which Claude Code reads on startup. Claude Code then surfaces `webcmd-browser` as a skill when a task matches its description.
 
 Restart Claude Code (or start a new session) after installing skills.
 
@@ -94,4 +94,3 @@ Denying these tools does not affect the Bash tool, which is how `webcmd` is driv
 
 * [`start.md`](../../start.md) — common setup, [auth profiles and human handoff](../../start.md#auth-profiles-and-human-handoff), and [security](../../start.md#security).
 * [`webcmd-browser`](../../skills/webcmd-browser/SKILL.md) — the raw browser session surface.
-* [`webcmd-usage`](../../skills/webcmd-usage/SKILL.md) — adapter-first usage rules.
diff --git a/docs/agents/codex-cli.md b/docs/agents/codex-cli.md
@@ -38,7 +38,7 @@ codex plugin add webcmd@webcmd
 
 The same flow is available in the TUI: run `/plugins`, choose **Add plugin marketplace**, and enter `agentrhq/webcmd` or `https://github.com/agentrhq/webcmd`.
 
-The plugin bundles all seven Webcmd skills, and installs the npm CLI on first use if `webcmd` is missing. Start a new task after installing.
+The plugin bundles exactly one skill, `webcmd-browser`, and installs the npm CLI on first use if `webcmd` is missing. Start a new task after installing.
 
 Useful follow-ups: `codex plugin list`, `codex plugin remove webcmd`, `codex plugin marketplace upgrade`. All accept `--json`.
 
@@ -50,7 +50,7 @@ webcmd doctor
 webcmd skills add
 ```
 
-When `webcmd skills add` prompts, choose the `agents` provider. It installs into `~/.agents/skills/` (user) or `.agents/skills/` (project), which Codex CLI reads on startup. Codex then surfaces `webcmd-usage` and `webcmd-browser` as skills.
+When `webcmd skills add` prompts, choose the `agents` provider. It installs into `~/.agents/skills/` (user) or `.agents/skills/` (project), which Codex CLI reads on startup. Codex then surfaces `webcmd-browser` as a skill.
 
 Restart Codex (or start a new session) after installing skills.
 
@@ -90,4 +90,3 @@ disabled_tools = ["navigate", "screenshot"]
 
 * [`start.md`](../../start.md) — common setup, [auth profiles and human handoff](../../start.md#auth-profiles-and-human-handoff), and [security](../../start.md#security).
 * [`webcmd-browser`](../../skills/webcmd-browser/SKILL.md) — the raw browser session surface.
-* [`webcmd-usage`](../../skills/webcmd-usage/SKILL.md) — adapter-first usage rules.
diff --git a/docs/agents/cursor.md b/docs/agents/cursor.md
@@ -27,7 +27,7 @@ webcmd doctor
 webcmd skills add
 ```
 
-When `webcmd skills add` prompts, choose the `agents` provider. It installs into `~/.agents/skills/`, which Cursor reads on startup along with `.cursor/skills/`, `.agents/skills/`, and `~/.cursor/skills/`. Cursor then surfaces `webcmd-usage` and `webcmd-browser` as skills when a task matches their descriptions.
+When `webcmd skills add` prompts, choose the `agents` provider. It installs into `~/.agents/skills/`, which Cursor reads on startup along with `.cursor/skills/`, `.agents/skills/`, and `~/.cursor/skills/`. Cursor then surfaces `webcmd-browser` as a skill when a task matches its description.
 
 For a project-scoped setup, copy the `webcmd-*` skill folders into the project's `.cursor/skills/` or `.agents/skills/` so the whole team gets them. Restart Cursor after installing skills.
 
@@ -83,4 +83,3 @@ Note that the rule is guidance, not a block. Cursor's Browser Automation has bee
 
 * [`start.md`](../../start.md) — common setup, [auth profiles and human handoff](../../start.md#auth-profiles-and-human-handoff), and [security](../../start.md#security).
 * [`webcmd-browser`](../../skills/webcmd-browser/SKILL.md) — the raw browser session surface.
-* [`webcmd-usage`](../../skills/webcmd-usage/SKILL.md) — adapter-first usage rules.
diff --git a/docs/agents/hermes.md b/docs/agents/hermes.md
@@ -36,7 +36,7 @@ skills:
     - ~/.agents/skills
 ```
 
-Hermes then reads `webcmd-usage` and `webcmd-browser` as skills. Restart Hermes after changing config and confirm the skills are discoverable.
+Hermes then reads `webcmd-browser` as a skill. Restart Hermes after changing config and confirm the skill is discoverable.
 
 ### Override default tools
 
@@ -91,4 +91,3 @@ Do not disable the `terminal` toolset — that is how Hermes runs `webcmd`.
 
 * [`start.md`](../../start.md) — common setup, [auth profiles and human handoff](../../start.md#auth-profiles-and-human-handoff), and [security](../../start.md#security).
 * [`webcmd-browser`](../../skills/webcmd-browser/SKILL.md) — the raw browser session surface.
-* [`webcmd-usage`](../../skills/webcmd-usage/SKILL.md) — adapter-first usage rules.
diff --git a/docs/agents/openclaw.md b/docs/agents/openclaw.md
@@ -28,7 +28,7 @@ webcmd doctor
 webcmd skills add
 ```
 
-When `webcmd skills add` prompts, choose the `agents` provider. It installs into `~/.agents/skills/` (user) or `.agents/skills/` (project), both of which OpenClaw checks for skills. OpenClaw then surfaces `webcmd-usage` and `webcmd-browser` as skills.
+When `webcmd skills add` prompts, choose the `agents` provider. It installs into `~/.agents/skills/` (user) or `.agents/skills/` (project), both of which OpenClaw checks for skills. OpenClaw then surfaces `webcmd-browser` as a skill.
 
 Restart the Gateway (or start a new session) after installing skills.
 
@@ -88,4 +88,3 @@ Or remove it entirely — CLI, `browser.request` gateway method, and agent tool
 
 * [`start.md`](../../start.md) — common setup, [auth profiles and human handoff](../../start.md#auth-profiles-and-human-handoff), and [security](../../start.md#security).
 * [`webcmd-browser`](../../skills/webcmd-browser/SKILL.md) — the raw browser session surface.
-* [`webcmd-usage`](../../skills/webcmd-usage/SKILL.md) — adapter-first usage rules.
diff --git a/docs/agents/opencode.md b/docs/agents/opencode.md
@@ -28,7 +28,7 @@ webcmd doctor
 webcmd skills add
 ```
 
-When `webcmd skills add` prompts, choose the `agents` provider (installs into `~/.agents/skills/`, which OpenCode auto-loads). OpenCode then reads `webcmd-usage` and `webcmd-browser` as skills.
+When `webcmd skills add` prompts, choose the `agents` provider (installs into `~/.agents/skills/`, which OpenCode auto-loads). OpenCode then reads `webcmd-browser` as a skill.
 
 Restart OpenCode after changing config. Confirm the skill loads with `/skills` and the permissions are active before starting browser work.
 
@@ -59,11 +59,10 @@ Deny `webfetch` so OpenCode cannot fall back to it while Webcmd is its browser s
 | Skills not loading in OpenCode | Run `webcmd skills add` with the `agents` provider, restart OpenCode, and check `/skills`. |
 | OpenCode still uses `webfetch` | Confirm `permission.webfetch` is `deny` in the active config, then restart OpenCode. |
 | `websearch` is missing entirely | It registers only with the OpenCode provider or `OPENCODE_ENABLE_EXA=1`. Not a Webcmd problem. |
-| `webcmd browser` errors | Read `webcmd-usage` and `webcmd-browser`; create a named Session and pass its readable ID as root `--session`. |
+| `webcmd browser` errors | Read `webcmd-browser`; create a named Session and pass its readable ID as root `--session`. |
 | Browser Session idles or loses its window | Keep its immutable, Profile-scoped ID; `webcmd --profile work --session work-project-k7 browser tabs` reopens it. Start with `webcmd --profile work session create "Work Project"`; use `webcmd --profile work session list` and `webcmd --profile work session close work-project-k7` for lifecycle. Adapter commands without `--session` reuse `adapter-default`; raw browser commands require an explicit readable selector. |
 
 ## See also
 
 * [`start.md`](../../start.md) — common setup, [auth profiles and human handoff](../../start.md#auth-profiles-and-human-handoff), and [security](../../start.md#security).
 * [`webcmd-browser`](../../skills/webcmd-browser/SKILL.md) — the raw browser session surface.
-* [`webcmd-usage`](../../skills/webcmd-usage/SKILL.md) — adapter-first usage rules.
diff --git a/docs/agents/pi.md b/docs/agents/pi.md
@@ -28,7 +28,7 @@ webcmd doctor
 webcmd skills add
 ```
 
-When `webcmd skills add` prompts, choose the `agents` provider. It links skills into `~/.agents/skills/` (user) or `.agents/skills/` (project), both of which Pi scans for skills on startup alongside its own `~/.pi/agent/skills/` and `.pi/skills/` directories. Pi then surfaces `webcmd-usage` and `webcmd-browser` as skills.
+When `webcmd skills add` prompts, choose the `agents` provider. It links skills into `~/.agents/skills/` (user) or `.agents/skills/` (project), both of which Pi scans for skills on startup alongside its own `~/.pi/agent/skills/` and `.pi/skills/` directories. Pi then surfaces `webcmd-browser` as a skill.
 
 To install into Pi's own skill directories instead, pass a custom path:
 
@@ -72,4 +72,3 @@ To remove one outright, delete its folder — for example `~/.pi/agent/skills/pi
 
 * [`start.md`](../../start.md) — common setup, [auth profiles and human handoff](../../start.md#auth-profiles-and-human-handoff), and [security](../../start.md#security).
 * [`webcmd-browser`](../../skills/webcmd-browser/SKILL.md) — the raw browser session surface.
-* [`webcmd-usage`](../../skills/webcmd-usage/SKILL.md) — adapter-first usage rules.
diff --git a/docs/browser-and-sitemap-memory.mdx b/docs/browser-and-sitemap-memory.mdx
@@ -17,6 +17,8 @@ When no suitable command exists or one is broken, the agent uses a browser to in
 
 Useful, verified navigation and workflow knowledge can be retained as sitemap memory. It gives future browser work a starting point, but agents update or bypass it when the live site has changed.
 
+Learning is invisible in normal output. Diagnostics appear on request, verbose mode, or a material warning-retention failure. See [Privacy](https://github.com/agentrhq/webcmd/blob/main/PRIVACY.md) for seed lookup, local provenance, and the beta memory clean break.
+
 ## When to Create an Adapter
 
 Create or repair an adapter when the workflow is likely to repeat and can be verified as a stable command. Keep one-off or changing work in the browser until reuse is justified.