Your agent codes in a browser it cannot see. cdpx gives it eyes — and gives you proof.

The WebProfiler has had the answer all along, but it lives in a browser: nobody clicks through nine panels on every iteration, and an agent can't read it at all.

$ cdpx profiler http://127.0.0.1:8000/product/42 --panels db,cache
{"token_present":true,"status":200,"panels":{"db":{"available":true,"queries":6,"statements":2,"duplicates":4,"time_ms":1.76,…},"cache":{"available":true,"calls":4,"hits":3,"misses":1,…}}}
$ cdpx profiler http://127.0.0.1:8000/product/42 --panels db | jq -e '.panels.db.duplicates == 0' || echo "N+1 detected"
N+1 detected

What changes: 6 queries including 4 duplicates — the N+1 is a number, not a hunch. The same one-liner, dropped into CI, prevents the next one (see family 06).

Lab tools measure a cold URL's load; your INP plays out on the "Add to cart" click. And the LCP regression turns up in Search Console, three weeks too late.

$ cdpx vitals http://127.0.0.1:8899/vitals.html --click "#inp-button" --settle 1.0
{"url":"http://127.0.0.1:8899/vitals.html","lcp":16,"cls":0,"inp":24,"_cdpx":{…}}
$ cdpx coverage http://127.0.0.1:8899/coverage.html
{"url":"http://127.0.0.1:8899/coverage.html","files":[{"url":"http://127.0.0.1:8899/coverage.js","functions":3,"used_ranges":2,"total_bytes":163,"used_bytes":107,"unused_bytes":56,"coverage_percent":65.6}],"count":1,"js":{"total_bytes":163,"used_bytes":107,"unused_bytes":56},"css":{"rules":1,"used":1,"unused":0},"_cdpx":{…}}

What changes: the 24 ms INP comes from a real click dispatched via the Input domain, not an estimate. LCP, CLS, INP and dead bytes get measured on your machine, on every branch.

Recorded demo — real Chrome, repository reference site (cast source): vitals on a real click, JS/CSS coverage, perf budget in one line.

Canonicals and hreflang break silently during a redesign, and the agency audit arrives after the traffic drop.

$ cdpx seo https://staging.example.test/product-42 > staging.json
$ cdpx seo https://www.example.test/product-42 > prod.json
$ diff <(jq -S '{title,canonical,h1,robots}' staging.json) <(jq -S '{title,canonical,h1,robots}' prod.json)
<   "canonical": null,
>   "canonical": "https://www.example.test/product-42",
$ jq .findings staging.json
["2 image(s) without alt"]

What changes: the SEO contract is a version-controlled JSON, compared before and after release — a vanishing canonical shows up in the PR, not in Search Console.

An SPA, a selected variant, an open cart: the state that matters sometimes has no URL. cdpx seo with no argument audits the page currently displayed, whatever the path that led there.

$ cdpx goto http://shop.localhost/collection/robes
$ cdpx click "#size-variant-38"
$ cdpx seo
# audits the rendered DOM of the current state — title, canonical, JSON-LD after client-side routing

What changes: the intermediate states of an e-commerce journey get audited like pages — that's where SPA SEO bugs live.

The error fallback is never tested because "we're not going to turn off the API just to check." An interception rule simulates the outage, and the page reveals its real behavior.

$ cdpx intercept --rule "*api* => 503" --settle 1 -- goto http://127.0.0.1:8899/intercept.html
{"url":"http://127.0.0.1:8899/intercept.html","rules":["*api* => 503"],"hits":[{"url":"http://127.0.0.1:8899/intercept.html","action":"continue"},{"url":"http://127.0.0.1:8899/api/json","action":"503"},{"url":"http://127.0.0.1:8899/api/status/500","action":"503"},…],"count":5,"settle":1.0,"_cdpx":{…}}
$ cdpx text "#intercept-result"
{"selector":"#intercept-result","text":"/api/json:503|/api/status/500:503|/api/slow?ms=120:503|/api/echo:503","_cdpx":{…}}

What changes: outage behavior reads from the DOM, in one command, without touching the infra. The rule accepts continue, block or a status — enough to script degradations.

The mobile viewport, the slow network and the throttled CPU change the page's real behavior. emulate applies a profile for the duration of one action, then everything returns to normal.

$ cdpx emulate mobile -- goto http://127.0.0.1:8899/index.html
{"preset":"mobile","applied":true,"action":{"argv":["goto","http://127.0.0.1:8899/index.html"],"result":{"url":"http://127.0.0.1:8899/index.html","errorText":null,"waited":"load","ok":true,"elapsed_ms":11.8}},"_cdpx":{…}}

What changes: "on mobile" becomes a named, replayable preset — combine it with screenshot, vitals or dom-diff to turn the anecdote into a finding.

Consent given, cart filled, session logged in: realistic scenarios require state. cdpx reads and prepares it — cookies and storage — with redaction by default, because an agent copies its outputs around.

$ cdpx storage
{"kind":"local","entries":{"cdpx-key":"***"},"count":1,"values_masked":true,"_cdpx":{…}}
$ cdpx cookies set --name consent --value-env CONSENT_VALUE --url http://127.0.0.1:8899/
# the value comes from the environment, never from argv or a log

What changes: state is prepared in a script instead of recreated by hand — and values stay redacted by default, --show-values being an explicit choice.

Recorded demo — real Chrome, repository reference site (cast source): storage and cookies redacted by default, cookie set from the environment, cleanup.

After every change, someone re-clicks through checkout by hand — or nobody does. The log of a recorded journey gets replayed, and the first divergence stops everything with exit 1.

$ cdpx record -o journey.ndjson -- goto http://demo.test/product-42
$ cdpx record -o journey.ndjson -- click "#buy"
$ cdpx --max-actions 20 replay journey.ndjson
{"path":"journey.ndjson","events":3,"played":3,"ok":true}
# … cart template redesign …
$ cdpx --max-actions 20 replay journey.ndjson
{"path":"journey.ndjson","events":3,"played":1,"ok":false,"divergence":"event 1: selector not found after 10.0s: #buy"}

What changes: exploration leaves behind a replayable log, validated in full before the first action; secrets live in it by reference (@env:NAME), never by value.

A critical journey deserves more than a sequence of commands: a versioned YAML scenario composes reusable local step fragments, sets its assertions and archives its proof — a capture per step, console errors counted.

$ cdpx scenario run checkout_guest_add_to_cart.yml
{"name":"checkout_guest_add_to_cart","verdict":"pass","findings":[],"steps":[{"index":0,"label":"product_page","verb":"goto","ok":true},…],"assertions":[{"name":"no_console_errors","expected":true,"ok":true,"actual":0}],"artifacts":[{"type":"screenshot","label":"product_page",…}],…}

What changes: use cdpx scenario validate FILE without Chrome to inspect expanded labels, authority and dependency hashes. Reviewing an agent's PR means reading a structured verdict and its proof — the cdpx repository applies the rule to itself, too, with a proof cockpit generated by ./dev proof where every test attaches captures, logs and casts.

A perf budget on a wiki page has never blocked a regression. A budget in jq -e inside the Makefile has: exit 1, the PR waits.

flowchart LR
  PR["Pull request"] --> S["disposable cdpx session
+ branch app"]
  S --> G1["vitals ≤ budget"]
  S --> G2["db.duplicates == 0"]
  S --> G3["SEO contract diff"]
  S --> G4["journey replay"]
  G1 --> V{"all exit 0?"}
  G2 --> V
  G3 --> V
  G4 --> V
  V -->|yes| M["merge"]
  V -->|no| B["blocked
+ JSON evidence"]

What changes: the regression is paid for at its cheapest moment — before the merge — and the refusal arrives with its own JSON evidence, not with "it seems slower".

Between two deploys, nobody re-tests checkout or watches the canonical. An ephemeral cron session replays critical scenarios and measures key pages — divergence or budget overrun = alert.

flowchart LR
  C["cron / scheduler"] --> S["cdpx session start
disposable profile, short TTL"]
  S --> R["scenario run
critical journeys"]
  S --> V["vitals + seo
key pages"]
  R --> J["JSON + exit codes"]
  V --> J
  J -->|"exit 1"| A["alert / issue
with the JSON evidence"]
  J -->|"exit 0"| Z["session stop
nothing to report"]

# every 30 minutes, on a monitoring machine
$ eval "$(cdpx session start --run-id monitor --authority interaction --origins "https://www.example.test" --ttl 300 --export)"
$ trap 'cdpx session stop' EXIT
$ cdpx scenario run checkout_guest.yml | jq -e '.verdict == "pass"' || alert "checkout broken"
$ cdpx vitals https://www.example.test/ | jq -e '.lcp < 2500' || alert "LCP degraded"

What changes: functional or perf regressions get detected within minutes, with the exact JSON evidence in the alert — and the disposable session leaves neither profile nor cookie behind.