Chip Fetcher (cf)

@@ -136,6 +136,7 @@ Side-effect docs that matter:  ## Critical rules, these always apply +00. **The Adom wiki before any fetch, and again before any thumbnail.** Ladder step 0 is not optional: `adom-wiki discover search --query <MPN>` / `discover find` (verify `component.mpn` or the slug, matches are loose). A component page such as adom/vl53l5cx already ships the datasheet, symbol, footprint, `.lbr`, the manufacturer STEP in Z-up with FoV-on/off and side-etched variants, the outline cache and provenance; `adom-wiki repo clone adom/<slug>` and reuse rather than crawling the vendor again ([`playbooks/wiki-bundle-reuse.md`](playbooks/wiki-bundle-reuse.md)). When you do fetch something new, publish it to that page (wiki-component skill). **Marking rule:** never laser the MPN across the top of a part whose top carries optical windows, a grille or a marking pad (ToF / camera / lensed sensors): the MPN goes on a clear side wall, and the symbol bakes the un-named outline. 0. **Dashboard is the user's home base.** Before any scraping, `chip-fetcher app`: it starts the server and opens the dashboard in a MAXIMIZED pup window (`sessionId: "adom-chip-fetcher-dashboard"`), reusing it when open. Pup is the surface (John, 2026-08-23: test and show the dashboard in pup, not a webview); the Hydrogen dock also opens the same dashboard in its own tab. Never navigate the dashboard window mid-batch. **Scraping prefers the user's REAL signed-in browser via the native-browser bridge** (`nbrowser_*`, the `adom-browser-extension`), open ONE isolated window (`sessionId: "adom-chip-fetcher"`) and manage every vendor site as a TAB inside it, so you never touch the user's other Chrome/Edge windows. The native browser carries their real vendor logins + captcha human-trust and bypasses bot-walls (**DigiKey hard-blocks pup**). **Fall back to pup `sessionId: "adom-chip-fetcher"`** (cold `profile: "adom-chip-fetcher"`) only when the bridge is absent, and tell the user why native is better + point them to https://wiki.adom.inc/adom/adom-browser-extension. The binary auto-detects and announces the surface; full strategy + per-site playbooks in the **`chip-sourcing`** skill. Scraping stays separate from the dashboard. Heartbeat every stage transition via `/api/activity` so the dashboard reflects live state. **Read [`playbooks/dashboard-flow.md`](playbooks/dashboard-flow.md) before any batch fetch**, it has the dual-surface dashboard pattern, the heartbeat protocol, and the canonical stage labels. 1. **Manufacturer-first.** Stay on `<vendor>.com` and exhaust their CAD/Documentation/Resources/Tools tabs before bouncing to a third-party. Don't go to `3dfindit.com`, `snapmagic.com`, `mouser.componentsearchengine.com`, or any aggregator unless the manufacturer's own page links there explicitly. Read [`playbooks/sourcing-ladder.md`](playbooks/sourcing-ladder.md) for the full ladder + escape rules. 2. **Always ask "do you have a login here?"** before showing a vendor signup form. Most EEs already have SnapEDA/CSE/UL/Mouser/DigiKey/NXP/TI/ST/Microchip accounts. Before asking, run `chip-fetcher logins`: if the vendor is in the user's real browser, `chip-fetcher logins --import` seeds pup's vault and `chip-fetcher login <source>` signs in with no typing. **Credentials live ONLY in pup's OS-keychain vault** (`credential_list` / `credential_set` / `pup_login`, the `pup-credentials` skill); chip-fetcher keeps no password file and never builds `user:pass@` URLs (pup applies vault entries to HTTP Basic Auth hosts like `*.componentsearchengine.com` automatically). Read [`playbooks/credentials-and-logins.md`](playbooks/credentials-and-logins.md) for the catalog.