feat: integrate camofox-browser anti-detection browser

feat: integrate camofox-browser anti-detection browser

Add camofox-browser (https://github.com/jo-inc/camofox-browser) as an
embedded anti-detection browser server so the orchestrator and analysis
engines (cve_intel, repo_harvester, knowledge_rag, red_team_fuzzer,
bounty_gateway) can browse the live web without being fingerprinted or
blocked by Cloudflare/Google bot detection.

camofox wraps the Camoufox engine - a Firefox fork with fingerprint
spoofing patched at the C++ implementation level - behind a small REST
API designed for AI agents (accessibility snapshots, stable element
refs, per-userId session isolation, cookie import, residential proxy
with auto GeoIP).

Added:
* camofox_client.py - pure-requests Python client + helpers
* CAMOFOX_INTEGRATION.md - architecture, env vars, usage docs
Modified:
* Dockerfile - install @askjo/camofox-browser under
/opt/camofox + X/GTK runtime libs
required by the Camoufox Firefox build
* entrypoint.sh - launch camofox server on 127.0.0.1:9377
alongside the OpenClaude gRPC daemons

Graceful degradation: if the server is unreachable, callers receive
CamofoxUnavailable / {available: False} and can fall back to plain
HTTP fetch - no hard dependency introduced.

CAMOFOX_INTEGRATION.md

@@ -0,0 +1,94 @@
+# Camofox-Browser Integration
+
+Rhodawk now ships with an embedded
+[camofox-browser](https://github.com/jo-inc/camofox-browser) anti-detection
+browser server so the orchestrator and analysis engines can browse the live
+web without being fingerprinted, blocked by Cloudflare, or flagged by
+Google's bot detection.
+
+## Why
+
+Several Rhodawk subsystems already need to fetch real-world web content:
+
+| Subsystem            | Today                       | With camofox-browser                       |
+|----------------------|-----------------------------|--------------------------------------------|
+| `cve_intel.py`       | Plain `requests` to NVD/SSEC | Real-browser fetch with stable element refs |
+| `repo_harvester.py`  | GitHub REST + raw HTML       | Authenticated session reuse, no rate-limit captcha |
+| `knowledge_rag.py`   | Static doc scraping          | JS-rendered docs (Notion, Confluence, etc.) |
+| `red_team_fuzzer.py` | n/a                          | Live target reconnaissance                 |
+| `bounty_gateway.py`  | HackerOne / Bugcrowd REST    | UI fallback when the REST API is down      |
+
+camofox patches Firefox at the **C++ implementation level** —
+`navigator.hardwareConcurrency`, WebGL renderers, AudioContext, screen
+geometry, WebRTC — all spoofed before JavaScript ever sees them. No shims,
+no wrappers, no tells.
+
+## Architecture
+
+```
+┌─────────────────────────────┐         ┌──────────────────────────────┐
+│  app.py / orchestrator      │  HTTP   │  /opt/camofox  (node)        │
+│  cve_intel.py / harvester   │ ──────▶ │  127.0.0.1:9377              │
+│  knowledge_rag.py / …       │         │  camofox-browser server      │
+│                             │         │  ├── Camoufox (Firefox fork) │
+│  camofox_client.py          │         │  ├── Playwright contexts     │
+│  └─ CamofoxClient (REST)    │         │  └── per-userId session jar  │
+└─────────────────────────────┘         └──────────────────────────────┘
+```
+
+* **Server** is launched by `entrypoint.sh` alongside the OpenClaude gRPC
+  daemons. Listens on `127.0.0.1:9377` (not exposed publicly by default).
+* **Client** is `camofox_client.py` — a thin, dependency-free
+  (`requests`-only) Python wrapper that any module can import.
+* **Sessions** are isolated per `userId` so concurrent research jobs
+  cannot leak cookies into each other.
+
+## Quick Start (Python)
+
+```python
+from camofox_client import get_client, fetch_snapshot
+
+# One-shot: fetch a snapshot of a URL with element refs.
+snap = fetch_snapshot(
+    "https://nvd.nist.gov/vuln/detail/CVE-2024-3094",
+    user_id="cve_intel",
+)
+if snap.get("available"):
+    print(snap["snapshot"][:2000])
+
+# Long-running session:
+client = get_client()
+if client.is_available():
+    tab = client.create_tab("harvester", "https://github.com/torvalds/linux")
+    snap = client.snapshot(tab)
+    client.click(tab, "e1")           # click the first interactive element
+    client.type_text(tab, "e2", "fix") # type into the search box
+    png = client.screenshot(tab, full_page=True)
+    client.close_tab(tab)
+```
+
+If the camofox server is not running, `is_available()` returns `False` and
+`fetch_snapshot()` returns `{"available": False, "reason": "..."}` so callers
+can degrade gracefully to plain `requests`.
+
+## Environment Variables
+
+| Variable                 | Default                        | Purpose                                   |
+|--------------------------|--------------------------------|-------------------------------------------|
+| `CAMOFOX_BASE_URL`       | `http://127.0.0.1:9377`        | Where the Python client looks for the API |
+| `CAMOFOX_PORT`           | `9377`                         | Port the node server binds to             |
+| `CAMOFOX_HOST`           | `127.0.0.1`                    | Host the node server binds to             |
+| `CAMOFOX_HEADLESS`       | `virtual`                      | `virtual` uses xvfb; `true` uses Firefox headless mode |
+| `CAMOFOX_PROFILE_DIR`    | `/data/camofox/profiles`       | Persistent per-user storage state         |
+| `CAMOFOX_COOKIES_DIR`    | `/data/camofox/cookies`        | Drop Netscape cookie files here for import |
+| `CAMOFOX_API_KEY`        | *(unset → cookie writes disabled)* | Bearer token required for `import_cookies` |
+| `PROXY_HOST` / `PROXY_PORT` / `PROXY_USERNAME` / `PROXY_PASSWORD` | *(unset)* | Route browser traffic through a residential proxy. Camoufox's GeoIP then auto-aligns locale + timezone. |
+
+## Files Added
+
+| Path                       | What it is                                  |
+|----------------------------|---------------------------------------------|
+| `camofox_client.py`        | Python REST client + module-level helpers   |
+| `CAMOFOX_INTEGRATION.md`   | This document                               |
+| `Dockerfile` (modified)    | Installs `@askjo/camofox-browser` under `/opt/camofox` and the X/GTK runtime libs Camoufox needs |
+| `entrypoint.sh` (modified) | Launches the camofox server before the OpenClaude daemons |

Dockerfile

@@ -22,6 +22,14 @@ ENV DEBIAN_FRONTEND=noninteractive \
 RUN apt-get update && apt-get install -y --no-install-recommends \
         git curl ca-certificates build-essential unzip xz-utils \
         nodejs npm \
+        # ─── camofox-browser runtime deps ────────────────────────────
+        # Camoufox is a Firefox fork; it needs the standard X/GTK
+        # display libraries even when running headless, plus xvfb so
+        # we can attach a virtual display when --headless=virtual.
+        xvfb libgtk-3-0 libdbus-glib-1-2 libxt6 libasound2 \
+        libx11-xcb1 libxcomposite1 libxcursor1 libxdamage1 libxfixes3 \
+        libxi6 libxrandr2 libxss1 libxtst6 libnss3 libpango-1.0-0 \
+        libatk1.0-0 libatk-bridge2.0-0 libcups2 libdrm2 libgbm1 \
     && rm -rf /var/lib/apt/lists/*
 
 # uv (fast Python installer used by sandboxed test runs)
@@ -50,6 +58,18 @@ RUN npm install -g --quiet \
         @modelcontextprotocol/server-sequential-thinking \
         @modelcontextprotocol/server-brave-search
 
+# ─── camofox-browser anti-detection browser server ──────────────────────
+# Anti-detection browser for AI agents (https://github.com/jo-inc/camofox-browser).
+# Installed under /opt/camofox so the orchestrator can launch it via
+# entrypoint.sh on 127.0.0.1:9377.  The Camoufox Firefox-fork binary
+# (~300MB) is fetched lazily on first launch by camoufox-js — keeping
+# the image slim while still giving the orchestrator full access to the
+# REST API exposed by camofox_client.py.
+RUN mkdir -p /opt/camofox && cd /opt/camofox && \
+    npm init -y >/dev/null 2>&1 && \
+    npm install --quiet --omit=dev @askjo/camofox-browser@^1.6.0 || \
+    npm install --quiet --omit=dev camofox-browser
+
 # ─── Stage 3: final runtime image ───────────────────────────────────────
 FROM base AS runtime
 LABEL org.opencontainers.image.title="Rhodawk AI DevSecOps Engine" \
@@ -65,15 +85,25 @@ ENV GRADIO_SERVER_NAME=0.0.0.0 \
     OPENCLAUDE_GRPC_HOST=127.0.0.1 \
     OPENCLAUDE_GRPC_PORT_DO=50051 \
     OPENCLAUDE_GRPC_PORT_OR=50052 \
-    MCP_RUNTIME_CONFIG=/tmp/mcp_runtime.json
+    MCP_RUNTIME_CONFIG=/tmp/mcp_runtime.json \
+    # ─── camofox-browser runtime defaults ────────────────────────────
+    # The orchestrator talks to the local camofox server through
+    # camofox_client.py.  CAMOFOX_API_KEY gates cookie-import — leave
+    # it unset to keep cookie writes disabled (server returns 403).
+    CAMOFOX_BASE_URL=http://127.0.0.1:9377 \
+    CAMOFOX_PORT=9377 \
+    CAMOFOX_HOST=127.0.0.1 \
+    CAMOFOX_HEADLESS=virtual \
+    CAMOFOX_PROFILE_DIR=/data/camofox/profiles \
+    CAMOFOX_COOKIES_DIR=/data/camofox/cookies
 
 # HuggingFace UID 1000 handling (idempotent)
 RUN id -u 1000 >/dev/null 2>&1 && (userdel -r "$(id -un 1000)" || true) || true && \
     useradd -m -u 1000 -s /bin/bash rhodawk
 
-RUN mkdir -p /data /app /opt/openclaude && \
-    chmod 777 /data && \
-    chown -R rhodawk:rhodawk /app /opt/openclaude
+RUN mkdir -p /data /data/camofox/profiles /data/camofox/cookies /app /opt/openclaude && \
+    chmod -R 777 /data && \
+    chown -R rhodawk:rhodawk /app /opt/openclaude /opt/camofox
 
 # Bring the prebuilt OpenClaude bundle in as a vendored artifact.
 COPY --from=openclaude-builder --chown=rhodawk:rhodawk /openclaude /opt/openclaude
@@ -100,6 +130,6 @@ RUN python -m grpc_tools.protoc \
     sed -i 's/^import openclaude_pb2/from . import openclaude_pb2/' \
         openclaude_grpc/openclaude_pb2_grpc.py
 
-EXPOSE 7860 50051 50052
+EXPOSE 7860 9377 50051 50052
 
-ENTRYPOINT ["/app/entrypoint.sh"]
+ENTRYPOINT ["/app/entrypoint.sh"]

camofox_client.py

@@ -0,0 +1,392 @@
+"""
+camofox_client.py
+─────────────────
+Python client for the embedded camofox-browser anti-detection browser server
+(https://github.com/jo-inc/camofox-browser).
+
+camofox-browser wraps the Camoufox engine — a Firefox fork with fingerprint
+spoofing patched at the C++ implementation level — behind a small REST API
+designed for AI agents:
+
+  * accessibility snapshots with stable element refs (e1, e2, e3 …)
+  * session isolation per userId / sessionKey
+  * Netscape-format cookie import for authenticated browsing
+  * residential-proxy + GeoIP routing
+  * search macros (@google_search, @youtube_search, …)
+  * download capture, DOM image extraction, screenshot snapshots
+
+Inside the Rhodawk container the camofox node server is launched by
+`entrypoint.sh` on 127.0.0.1:9377.  This module is the thin Python
+adapter the orchestrator and other engines (repo_harvester, cve_intel,
+red_team_fuzzer, knowledge_rag, …) use to drive it.
+
+Design goals
+────────────
+1. Zero hard dependency — if the camofox server is not running the
+   client raises ``CamofoxUnavailable`` and the caller can degrade
+   gracefully (e.g. fall back to plain ``requests.get``).
+2. No ``console.print``-style side effects — pure return values + the
+   structured ``audit_logger`` for production observability.
+3. Safe defaults — every browsing call carries a ``userId`` and an
+   optional ``sessionKey`` so different research jobs cannot leak
+   cookies into each other.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import time
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Optional
+
+import requests
+
+log = logging.getLogger("rhodawk.camofox")
+
+# ─── Configuration ─────────────────────────────────────────────────────
+CAMOFOX_BASE_URL = os.environ.get("CAMOFOX_BASE_URL", "http://127.0.0.1:9377").rstrip("/")
+CAMOFOX_API_KEY = os.environ.get("CAMOFOX_API_KEY", "")
+CAMOFOX_DEFAULT_TIMEOUT = float(os.environ.get("CAMOFOX_TIMEOUT", "60"))
+CAMOFOX_HEALTH_TIMEOUT = float(os.environ.get("CAMOFOX_HEALTH_TIMEOUT", "3"))
+
+
+# ─── Errors ────────────────────────────────────────────────────────────
+class CamofoxError(RuntimeError):
+    """Base class for any camofox-browser interaction failure."""
+
+
+class CamofoxUnavailable(CamofoxError):
+    """Raised when the camofox server is not reachable.
+
+    Callers should treat this as a soft failure and fall back to a
+    non-browser code path (e.g. plain HTTP fetch) instead of aborting.
+    """
+
+
+class CamofoxAPIError(CamofoxError):
+    """Raised when the server is reachable but returns a non-2xx response."""
+
+    def __init__(self, status: int, body: str, *, endpoint: str = ""):
+        super().__init__(f"[{endpoint}] HTTP {status}: {body[:512]}")
+        self.status = status
+        self.body = body
+        self.endpoint = endpoint
+
+
+# ─── Session handle ────────────────────────────────────────────────────
+@dataclass
+class CamofoxTab:
+    """Lightweight handle to a single tab inside the camofox server.
+
+    Tabs are owned by ``(userId, sessionKey)``.  Two researchers using
+    different ``userId`` values get fully isolated cookie jars and
+    storage state — important when one job is logged-in to GitHub and
+    the other is performing CVE intel scraping anonymously.
+    """
+    tab_id: str
+    user_id: str
+    session_key: str = "default"
+    url: Optional[str] = None
+    extra: Dict[str, Any] = field(default_factory=dict)
+
+
+# ─── Client ────────────────────────────────────────────────────────────
+class CamofoxClient:
+    """Thin REST wrapper around the local camofox-browser server."""
+
+    def __init__(
+        self,
+        base_url: str = CAMOFOX_BASE_URL,
+        api_key: str = CAMOFOX_API_KEY,
+        timeout: float = CAMOFOX_DEFAULT_TIMEOUT,
+    ) -> None:
+        self.base_url = base_url.rstrip("/")
+        self.api_key = api_key
+        self.timeout = timeout
+        self._session = requests.Session()
+
+    # ── Internal ──────────────────────────────────────────────────────
+    def _headers(self) -> Dict[str, str]:
+        h = {"Content-Type": "application/json"}
+        if self.api_key:
+            h["Authorization"] = f"Bearer {self.api_key}"
+        return h
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        *,
+        json_body: Optional[Dict[str, Any]] = None,
+        params: Optional[Dict[str, Any]] = None,
+        timeout: Optional[float] = None,
+    ) -> Dict[str, Any]:
+        url = f"{self.base_url}{path}"
+        try:
+            resp = self._session.request(
+                method,
+                url,
+                json=json_body,
+                params=params,
+                headers=self._headers(),
+                timeout=timeout or self.timeout,
+            )
+        except requests.exceptions.ConnectionError as exc:
+            raise CamofoxUnavailable(
+                f"camofox server not reachable at {self.base_url}: {exc}"
+            ) from exc
+        except requests.exceptions.Timeout as exc:
+            raise CamofoxError(f"camofox request timed out: {exc}") from exc
+
+        if resp.status_code >= 400:
+            raise CamofoxAPIError(resp.status_code, resp.text, endpoint=path)
+
+        if not resp.content:
+            return {}
+        ct = resp.headers.get("content-type", "")
+        if "application/json" not in ct:
+            return {"raw": resp.text}
+        try:
+            return resp.json()
+        except json.JSONDecodeError as exc:
+            raise CamofoxError(f"invalid JSON from {path}: {exc}") from exc
+
+    # ── Health ────────────────────────────────────────────────────────
+    def is_available(self) -> bool:
+        """Return True if the camofox server is up.  Never raises."""
+        try:
+            self._request("GET", "/health", timeout=CAMOFOX_HEALTH_TIMEOUT)
+            return True
+        except CamofoxError:
+            return False
+
+    def wait_ready(self, max_wait: float = 30.0, poll_interval: float = 0.5) -> bool:
+        """Block until the server responds to /health or ``max_wait`` elapses."""
+        deadline = time.time() + max_wait
+        while time.time() < deadline:
+            if self.is_available():
+                return True
+            time.sleep(poll_interval)
+        return False
+
+    # ── Tab lifecycle ────────────────────────────────────────────────
+    def create_tab(
+        self,
+        user_id: str,
+        url: str,
+        *,
+        session_key: str = "default",
+        wait_until: str = "domcontentloaded",
+    ) -> CamofoxTab:
+        body = {
+            "userId": user_id,
+            "sessionKey": session_key,
+            "url": url,
+            "waitUntil": wait_until,
+        }
+        out = self._request("POST", "/tabs", json_body=body)
+        tab_id = out.get("tabId") or out.get("id")
+        if not tab_id:
+            raise CamofoxError(f"create_tab returned no tabId: {out}")
+        return CamofoxTab(
+            tab_id=tab_id,
+            user_id=user_id,
+            session_key=session_key,
+            url=out.get("url", url),
+            extra={k: v for k, v in out.items() if k not in {"tabId", "id", "url"}},
+        )
+
+    def list_tabs(self, user_id: str) -> List[Dict[str, Any]]:
+        out = self._request("GET", "/tabs", params={"userId": user_id})
+        return out.get("tabs", []) if isinstance(out, dict) else []
+
+    def close_tab(self, tab: CamofoxTab) -> None:
+        self._request(
+            "DELETE",
+            f"/tabs/{tab.tab_id}",
+            params={"userId": tab.user_id},
+        )
+
+    # ── Snapshot / interaction ───────────────────────────────────────
+    def snapshot(
+        self,
+        tab: CamofoxTab,
+        *,
+        include_screenshot: bool = False,
+        offset: int = 0,
+        limit: Optional[int] = None,
+    ) -> Dict[str, Any]:
+        """Accessibility snapshot — ~90% smaller than raw HTML,
+        annotated with stable element refs (e1, e2, …)."""
+        params: Dict[str, Any] = {"userId": tab.user_id}
+        if include_screenshot:
+            params["screenshot"] = "true"
+        if offset:
+            params["offset"] = offset
+        if limit is not None:
+            params["limit"] = limit
+        return self._request("GET", f"/tabs/{tab.tab_id}/snapshot", params=params)
+
+    def click(self, tab: CamofoxTab, ref: str) -> Dict[str, Any]:
+        return self._request(
+            "POST",
+            f"/tabs/{tab.tab_id}/click",
+            json_body={"userId": tab.user_id, "ref": ref},
+        )
+
+    def type_text(
+        self,
+        tab: CamofoxTab,
+        ref: str,
+        text: str,
+        *,
+        press_enter: bool = False,
+    ) -> Dict[str, Any]:
+        return self._request(
+            "POST",
+            f"/tabs/{tab.tab_id}/type",
+            json_body={
+                "userId": tab.user_id,
+                "ref": ref,
+                "text": text,
+                "pressEnter": press_enter,
+            },
+        )
+
+    def navigate(
+        self,
+        tab: CamofoxTab,
+        url: str,
+        *,
+        wait_until: str = "domcontentloaded",
+    ) -> Dict[str, Any]:
+        return self._request(
+            "POST",
+            f"/tabs/{tab.tab_id}/navigate",
+            json_body={
+                "userId": tab.user_id,
+                "url": url,
+                "waitUntil": wait_until,
+            },
+        )
+
+    def scroll(
+        self,
+        tab: CamofoxTab,
+        *,
+        direction: str = "down",
+        amount: int = 1,
+    ) -> Dict[str, Any]:
+        return self._request(
+            "POST",
+            f"/tabs/{tab.tab_id}/scroll",
+            json_body={
+                "userId": tab.user_id,
+                "direction": direction,
+                "amount": amount,
+            },
+        )
+
+    def screenshot(
+        self,
+        tab: CamofoxTab,
+        *,
+        full_page: bool = False,
+    ) -> bytes:
+        """Return raw PNG bytes for ``tab``."""
+        url = f"{self.base_url}/tabs/{tab.tab_id}/screenshot"
+        try:
+            resp = self._session.get(
+                url,
+                params={"userId": tab.user_id, "fullPage": str(full_page).lower()},
+                headers={k: v for k, v in self._headers().items() if k != "Content-Type"},
+                timeout=self.timeout,
+            )
+        except requests.exceptions.ConnectionError as exc:
+            raise CamofoxUnavailable(str(exc)) from exc
+        if resp.status_code >= 400:
+            raise CamofoxAPIError(resp.status_code, resp.text, endpoint="/screenshot")
+        return resp.content
+
+    # ── Cookies / auth ───────────────────────────────────────────────
+    def import_cookies(
+        self,
+        user_id: str,
+        cookies: List[Dict[str, Any]],
+    ) -> Dict[str, Any]:
+        """Inject pre-exported cookies into a session.
+
+        Requires ``CAMOFOX_API_KEY`` to be set; without it the camofox
+        server rejects cookie writes with 403 by design.
+        """
+        if not self.api_key:
+            raise CamofoxError(
+                "CAMOFOX_API_KEY env var is required for cookie import"
+            )
+        return self._request(
+            "POST",
+            f"/sessions/{user_id}/cookies",
+            json_body={"cookies": cookies},
+        )
+
+    # ── YouTube transcript (optional, ships with camofox) ────────────
+    def youtube_transcript(self, video_url: str) -> Dict[str, Any]:
+        return self._request(
+            "POST",
+            "/youtube/transcript",
+            json_body={"url": video_url},
+        )
+
+
+# ─── Module-level convenience singleton ────────────────────────────────
+_default_client: Optional[CamofoxClient] = None
+
+
+def get_client() -> CamofoxClient:
+    """Lazy module-wide singleton — most callers just want this."""
+    global _default_client
+    if _default_client is None:
+        _default_client = CamofoxClient()
+    return _default_client
+
+
+def fetch_snapshot(
+    url: str,
+    *,
+    user_id: str = "rhodawk",
+    session_key: str = "default",
+    include_screenshot: bool = False,
+    close_when_done: bool = True,
+) -> Dict[str, Any]:
+    """One-shot helper: open ``url`` in a fresh tab, return its snapshot,
+    then close the tab.  Returns ``{"available": False}`` if the camofox
+    server is not running so the caller can fall back gracefully.
+    """
+    client = get_client()
+    if not client.is_available():
+        return {"available": False, "reason": "camofox server not reachable"}
+    tab = client.create_tab(user_id, url, session_key=session_key)
+    try:
+        snap = client.snapshot(tab, include_screenshot=include_screenshot)
+        snap["available"] = True
+        snap["tabId"] = tab.tab_id
+        return snap
+    finally:
+        if close_when_done:
+            try:
+                client.close_tab(tab)
+            except CamofoxError as exc:
+                log.warning("close_tab failed for %s: %s", tab.tab_id, exc)
+
+
+__all__ = [
+    "CamofoxClient",
+    "CamofoxTab",
+    "CamofoxError",
+    "CamofoxUnavailable",
+    "CamofoxAPIError",
+    "get_client",
+    "fetch_snapshot",
+]

entrypoint.sh

@@ -2,19 +2,52 @@
 # ─────────────────────────────────────────────────────────────────────
 # Rhodawk runtime bootstrap.
 #
-# 1. Launch the OpenClaude headless gRPC daemon for the DigitalOcean
+# 1. Launch the camofox-browser anti-detection browser server on
+#    127.0.0.1:9377 (used by the orchestrator via camofox_client.py).
+# 2. Launch the OpenClaude headless gRPC daemon for the DigitalOcean
 #    Inference provider on :50051 (PRIMARY).
-# 2. Launch the OpenClaude headless gRPC daemon for OpenRouter on
+# 3. Launch the OpenClaude headless gRPC daemon for OpenRouter on
 #    :50052 (FALLBACK) — only if OPENROUTER_API_KEY is present.
-# 3. Wait briefly for both to bind, then hand control to app.py which
-#    talks to them over gRPC.
+# 4. Wait briefly for everything to bind, then hand control to app.py
+#    which talks to them over gRPC + HTTP.
 # ─────────────────────────────────────────────────────────────────────
 set -eo pipefail
 
 OC_DIR=/opt/openclaude
+CAMOFOX_DIR=/opt/camofox
 LOG_DIR="${LOG_DIR:-/tmp}"
 mkdir -p "${LOG_DIR}"
 
+# ─── camofox-browser ─────────────────────────────────────────────────
+# Anti-detection Firefox-fork browser server.  Lazily downloads the
+# Camoufox engine (~300MB) on first launch into the user's home dir,
+# so the first start may take a minute.  Subsequent starts are fast.
+start_camofox() {
+    local entry="${CAMOFOX_DIR}/node_modules/@askjo/camofox-browser/server.js"
+    [[ -f "${entry}" ]] || entry="${CAMOFOX_DIR}/node_modules/camofox-browser/server.js"
+    if [[ ! -f "${entry}" ]]; then
+        echo "[entrypoint] camofox-browser not installed — skipping"
+        return 0
+    fi
+    echo "[entrypoint] starting camofox-browser on ${CAMOFOX_HOST:-127.0.0.1}:${CAMOFOX_PORT:-9377}"
+    (
+        cd "${CAMOFOX_DIR}"
+        PORT="${CAMOFOX_PORT:-9377}" \
+        HOST="${CAMOFOX_HOST:-127.0.0.1}" \
+        CAMOFOX_HEADLESS="${CAMOFOX_HEADLESS:-virtual}" \
+        CAMOFOX_PROFILE_DIR="${CAMOFOX_PROFILE_DIR:-/data/camofox/profiles}" \
+        CAMOFOX_COOKIES_DIR="${CAMOFOX_COOKIES_DIR:-/data/camofox/cookies}" \
+        CAMOFOX_API_KEY="${CAMOFOX_API_KEY:-}" \
+        PROXY_HOST="${PROXY_HOST:-}" \
+        PROXY_PORT="${PROXY_PORT:-}" \
+        PROXY_USERNAME="${PROXY_USERNAME:-}" \
+        PROXY_PASSWORD="${PROXY_PASSWORD:-}" \
+            node "${entry}" \
+                > "${LOG_DIR}/camofox.log" 2>&1 &
+        echo $! > "${LOG_DIR}/camofox.pid"
+    )
+}
+
 start_daemon() {
     local label=$1 port=$2 base_url=$3 api_key=$4 model=$5
     if [[ -z "${api_key}" ]]; then
@@ -38,6 +71,9 @@ start_daemon() {
     )
 }
 
+# camofox first — slowest to bind because of the lazy engine download.
+start_camofox
+
 # DigitalOcean Inference (PRIMARY)
 DO_BASE="${DO_INFERENCE_BASE_URL:-https://inference.do-ai.run/v1}"
 DO_MODEL="${DO_INFERENCE_MODEL:-llama3.3-70b-instruct}"