@xbrowser/cli 1.11.0 → 1.13.0

package/dist/{chunk-ABXMBNQ6.js → chunk-H2A5JUK5.js}

@@ -1,6 +1,3 @@
-// src/cdp-interceptor/proxy.ts
-import { WebSocketServer, WebSocket } from "ws";
-
 // src/cdp-interceptor/rules/shared.ts
 var PLAYWRIGHT_INTERNAL_MARKERS = [
   "__commonJS",
@@ -46,22 +43,22 @@ function extractAllStrings(rawArgs) {
 // src/cdp-interceptor/rules/dom-mutation.ts
 var DOM_PATTERNS = [
   // ── P0: Value/Checked (bypasses React onChange) ────────────
-  { pattern: /\.value\s*=\s*(?!["'\s]*$)/, name: ".value =", severity: "danger", action: "block", errorCode: -32001, suggestion: "Use page.fill(selector, value) which dispatches proper input/change events." },
-  { pattern: /\.checked\s*=\s*(?:true|false)/, name: ".checked =", severity: "danger", action: "block", errorCode: -32001, suggestion: "Use page.check(selector) or page.uncheck(selector)." },
-  { pattern: /\.indeterminate\s*=\s*true/, name: ".indeterminate =", severity: "warn", action: "block", errorCode: -32021, suggestion: "No human can set indeterminate state \u2014 remove this call." },
-  { pattern: /\.valueAsDate\s*=/, name: ".valueAsDate =", severity: "warn", action: "block", errorCode: -32022, suggestion: "Use page.fill() with formatted date string instead." },
-  { pattern: /\.valueAsNumber\s*=/, name: ".valueAsNumber =", severity: "warn", action: "block", errorCode: -32022, suggestion: "Use page.fill() with numeric string instead." },
+  { pattern: /\.value\s*=\s*(?!["'\s]*$)/, name: ".value =", severity: "danger", action: "pass", errorCode: -32001, suggestion: "Use page.fill(selector, value) which dispatches proper input/change events." },
+  { pattern: /\.checked\s*=\s*(?:true|false)/, name: ".checked =", severity: "danger", action: "pass", errorCode: -32001, suggestion: "Use page.check(selector) or page.uncheck(selector)." },
+  { pattern: /\.indeterminate\s*=\s*true/, name: ".indeterminate =", severity: "warn", action: "pass", errorCode: -32021, suggestion: "No human can set indeterminate state \u2014 remove this call." },
+  { pattern: /\.valueAsDate\s*=/, name: ".valueAsDate =", severity: "warn", action: "pass", errorCode: -32022, suggestion: "Use page.fill() with formatted date string instead." },
+  { pattern: /\.valueAsNumber\s*=/, name: ".valueAsNumber =", severity: "warn", action: "pass", errorCode: -32022, suggestion: "Use page.fill() with numeric string instead." },
   // ── P1: Select/Option (bypasses React onChange on select) ─
-  { pattern: /\.selectedIndex\s*=\s*\d+/, name: ".selectedIndex =", severity: "danger", action: "block", errorCode: -32003, suggestion: "Use page.selectOption(selector, value)." },
-  { pattern: /(?:options|children)\s*\[[^\]]*\]\s*\.\s*selected\s*=\s*(?:true|false)/, name: "options[N].selected =", severity: "danger", action: "block", errorCode: -32003, suggestion: "Use page.selectOption(selector, value)." },
-  { pattern: /\.value\s*=\s*["'][^"']*["']\s*[;)]?\s*$/, name: "selectElement.value =", severity: "warn", action: "block", errorCode: -32023, suggestion: "For select elements, use page.selectOption(selector, value)." },
+  { pattern: /\.selectedIndex\s*=\s*\d+/, name: ".selectedIndex =", severity: "danger", action: "pass", errorCode: -32003, suggestion: "Use page.selectOption(selector, value)." },
+  { pattern: /(?:options|children)\s*\[[^\]]*\]\s*\.\s*selected\s*=\s*(?:true|false)/, name: "options[N].selected =", severity: "danger", action: "pass", errorCode: -32003, suggestion: "Use page.selectOption(selector, value)." },
+  { pattern: /\.value\s*=\s*["'][^"']*["']\s*[;)]?\s*$/, name: "selectElement.value =", severity: "warn", action: "pass", errorCode: -32023, suggestion: "For select elements, use page.selectOption(selector, value)." },
   // ── P2: Content properties (bypasses virtual DOM diffing) ──
   { pattern: /\.innerHTML\s*=/, name: ".innerHTML =", severity: "info", action: "pass", errorCode: -32007, suggestion: ".innerHTML bypasses React/Vue diffing. Use component state or page.setContent()." },
   { pattern: /\.outerHTML\s*=/, name: ".outerHTML =", severity: "info", action: "pass", errorCode: -32007, suggestion: "outerHTML replacement destroys React fiber tree. Use page.setContent()." },
-  { pattern: /\.innerText\s*=/, name: ".innerText =", severity: "warn", action: "block", errorCode: -32024, suggestion: "Framework components should be updated via state, not innerText." },
-  { pattern: /\.textContent\s*=/, name: ".textContent =", severity: "warn", action: "block", errorCode: -32024, suggestion: "textContent bypasses React/Vue diffing. Use component state instead." },
-  { pattern: /\.outerText\s*=/, name: ".outerText =", severity: "warn", action: "block", errorCode: -32024, suggestion: "Non-standard property \u2014 use proper framework update methods." },
-  { pattern: /nodeValue\s*=/, name: "node.nodeValue =", severity: "info", action: "block", errorCode: -32025, suggestion: "Direct text node mutation. Use textContent instead if needed." },
+  { pattern: /\.innerText\s*=/, name: ".innerText =", severity: "warn", action: "pass", errorCode: -32024, suggestion: "Framework components should be updated via state, not innerText." },
+  { pattern: /\.textContent\s*=/, name: ".textContent =", severity: "warn", action: "pass", errorCode: -32024, suggestion: "textContent bypasses React/Vue diffing. Use component state instead." },
+  { pattern: /\.outerText\s*=/, name: ".outerText =", severity: "warn", action: "pass", errorCode: -32024, suggestion: "Non-standard property \u2014 use proper framework update methods." },
+  { pattern: /nodeValue\s*=/, name: "node.nodeValue =", severity: "info", action: "pass", errorCode: -32025, suggestion: "Direct text node mutation. Use textContent instead if needed." },
   // ── P3: Style properties ──────────────────────────────────
   { pattern: /\.style\s*=\s*["']/, name: ".style = (string override)", severity: "info", action: "pass", errorCode: -32008, suggestion: 'Setting style as a string overwrites CSSStyleDeclaration. Use element.style.prop = "value".' },
   { pattern: /\.style\.cssText\s*=/, name: ".style.cssText =", severity: "info", action: "pass", errorCode: -32008, suggestion: "style.cssText replacement destroys inline styles \u2014 use individual property set." },
@@ -109,7 +106,7 @@ var DOM_PATTERNS = [
   { pattern: /\.scrollBy\s*\(/, name: ".scrollBy()", severity: "info", action: "pass", errorCode: -32015, suggestion: "ScrollBy without user gesture." },
   { pattern: /\.scrollIntoView\s*\(/, name: ".scrollIntoView()", severity: "info", action: "pass", errorCode: -32015, suggestion: "scrollIntoView is a common bot pattern. Let Playwright handle scrolling." },
   // ── P11: Shadow DOM ───────────────────────────────────────
-  { pattern: /\.shadowRoot\s*=/, name: ".shadowRoot = (override)", severity: "info", action: "block", errorCode: -32036, suggestion: "ShadowRoot is read-only \u2014 this set attempt is detectable." },
+  { pattern: /\.shadowRoot\s*=/, name: ".shadowRoot = (override)", severity: "info", action: "pass", errorCode: -32036, suggestion: "ShadowRoot is read-only \u2014 this set attempt is detectable." },
   // ── P12: Force reflow / layout thrashing ──────────────────
   { pattern: /\.offsetHeight\b(?!\s*===?\s*)/, name: ".offsetHeight read (forced reflow)", severity: "warn", action: "pass", errorCode: -32016, suggestion: "Reading offsetHeight triggers forced reflow \u2014 anti-crawlers detect this as layout probing." },
   { pattern: /\.offsetWidth\b(?!\s*===?\s*)/, name: ".offsetWidth read (forced reflow)", severity: "warn", action: "pass", errorCode: -32016, suggestion: "Reading offsetWidth triggers forced reflow \u2014 detectable." },
@@ -222,7 +219,7 @@ function analyzeTrajectory(samples) {
   const stopY = samples[samples.length - 1].y;
   return {
     ruleId: "mouse-trajectory",
-    action: "block",
+    action: "pass",
     severity: "danger",
     reason: `Suspicious mouse trajectory: ${issues.join("; ")}`,
     suggestion: `This mouse movement appears automated (straight line A\u2192B, no natural variation).
@@ -364,7 +361,7 @@ function analyzeKeyTiming(samples) {
   if (allIdentical) {
     return {
       ruleId: "input-keystroke",
-      action: "block",
+      action: "pass",
       severity: "danger",
       reason: `All ${intervals.length} keystroke intervals are exactly ${intervals[0]}ms \u2014 impossible for human typing.`,
       suggestion: `Use page.fill(selector, text) instead of page.type() with delay.
@@ -376,7 +373,7 @@ Or add random variation: page.type(selector, text, {delay: 50 + Math.random() *
   if (cv < 0.08) {
     return {
       ruleId: "input-keystroke",
-      action: "block",
+      action: "pass",
       severity: "warn",
       reason: `Unnatural keystroke timing (CV=${cv.toFixed(3)}). Human typing has CV > 0.2 on average.`,
       suggestion: `Add random variation to your typing delay: page.type(selector, text, {delay: 50 + Math.random() * 80}).`,
@@ -472,7 +469,7 @@ function makeDecision(p, context) {
   const suggestion = p.suggestionOverride ?? `Detected: "${p.name}" \u2014 an automation tool marker that anti-crawler systems immediately flag. Remove this pattern from your code.`;
   return {
     ruleId: "automation-signals",
-    action: "block",
+    action: "pass",
     severity: p.severity,
     reason: `Automation marker detected: "${p.name}". Context: "${context}..."`,
     suggestion,
@@ -547,7 +544,7 @@ var fingerprintingRule = {
       if (p.pattern.test(userCode)) {
         return {
           ruleId: "fingerprinting",
-          action: "block",
+          action: "pass",
           severity: p.severity,
           reason: `Browser fingerprinting API accessed: "${p.name}". Anti-crawler systems use this to identify your browser.`,
           suggestion: p.suggestion,
@@ -564,7 +561,7 @@ var fingerprintingRule = {
 var EVENT_PATTERNS = [
   // ── Direct method calls (all isTrusted=false) ─────────
   { pattern: /\.click\s*\(\s*\)/, name: "el.click()", severity: "danger", errorCode: -32070, suggestion: "el.click() fires isTrusted=false events. Use page.click(selector) which uses Input.dispatchMouseEvent (isTrusted=true)." },
-  { pattern: /\.focus\s*\(\s*\)/, name: "el.focus()", severity: "danger", errorCode: -32071, suggestion: "el.focus() without user interaction is detectable. Use page.click(selector) which naturally focuses." },
+  { pattern: /\.focus\s*\(\s*\)/, name: "el.focus()", severity: "warn", errorCode: -32071, suggestion: "el.focus() without user interaction is detectable. Use page.click(selector) which naturally focuses." },
   { pattern: /\.blur\s*\(\s*\)/, name: "el.blur()", severity: "danger", errorCode: -32071, suggestion: "el.blur() without user interaction. Avoid in automation scripts." },
   { pattern: /\.submit\s*\(\s*\)/, name: "el.submit()", severity: "danger", errorCode: -32072, suggestion: `form.submit() bypasses onSubmit handlers. Click the submit button: page.click('button[type="submit"]').` },
   { pattern: /\.reset\s*\(\s*\)/, name: "el.reset()", severity: "danger", errorCode: -32072, suggestion: "form.reset() without user action. Let the user clear fields manually." },
@@ -579,7 +576,7 @@ var EVENT_PATTERNS = [
   { pattern: /\.showPicker\s*\(\s*\)/, name: "HTMLInputElement.showPicker()", severity: "info", errorCode: -32076, suggestion: "Date/color picker shown without click \u2014 detectable." },
   { pattern: /\.reportValidity\s*\(\s*\)/, name: "el.reportValidity()", severity: "info", errorCode: -32076, suggestion: "Validity reporting without form submission attempt." },
   // ── dispatchEvent with synthetic events (isTrusted=false) ──
-  { pattern: /dispatchEvent\s*\(\s*new\s+(?:Event|CustomEvent)\s*\(/, name: "dispatchEvent(new Event/CustomEvent)", severity: "danger", errorCode: -32077, suggestion: "Synthetic events have isTrusted=false. Use Input.dispatch* CDP methods for trusted events." },
+  { pattern: /dispatchEvent\s*\(\s*new\s+(?:Event|CustomEvent)\s*\(/, name: "dispatchEvent(new Event/CustomEvent)", severity: "warn", errorCode: -32077, suggestion: "Synthetic events have isTrusted=false. Use Input.dispatch* CDP methods for trusted events." },
   { pattern: /dispatchEvent\s*\(\s*new\s+MouseEvent\s*\(/, name: "dispatchEvent(new MouseEvent)", severity: "danger", errorCode: -32077, suggestion: "Synthetic mouse events (isTrusted=false). Use Input.dispatchMouseEvent CDP method." },
   { pattern: /dispatchEvent\s*\(\s*new\s+KeyboardEvent\s*\(/, name: "dispatchEvent(new KeyboardEvent)", severity: "danger", errorCode: -32077, suggestion: "Synthetic keyboard events (isTrusted=false). Use Input.dispatchKeyEvent CDP method." },
   { pattern: /dispatchEvent\s*\(\s*new\s+FocusEvent\s*\(/, name: "dispatchEvent(new FocusEvent)", severity: "warn", errorCode: -32078, suggestion: "Synthetic focus events bypass user interaction." },
@@ -608,7 +605,9 @@ var eventSimulationRule = {
       if (p.pattern.test(userCode)) {
         return {
           ruleId: "event-simulation",
-          action: "block",
+          // danger 级硬拦（el.click 等 100% 暴露的模式）；
+          // warning 级放行+提示（dispatchEvent 在部分合法场景如 DataTransfer paste 使用）
+          action: p.severity === "danger" ? "block" : "pass",
           severity: p.severity,
           reason: `Event simulation detected: "${p.name}". Synthetic events have isTrusted=false and are 100% detectable.`,
           suggestion: p.suggestion,
@@ -667,7 +666,7 @@ var emulationOverrideRule = {
       if (ctx.method !== p.method) continue;
       return {
         ruleId: "emulation-override",
-        action: "block",
+        action: "pass",
         severity: p.severity,
         reason: `CDP emulation/override detected: "${p.name}". This creates detectable inconsistencies between the JS environment and real browser state.`,
         suggestion: p.suggestion,
@@ -697,7 +696,7 @@ var networkAnomalyRule = {
           if (!headerStr.includes("sec-ch-ua")) {
             return {
               ruleId: "network-anomaly",
-              action: "block",
+              action: "pass",
               severity: "warn",
               reason: "Network.setExtraHTTPHeaders called without Sec-CH-UA client hints \u2014 browser normally sends these.",
               suggestion: "Modern browsers send Sec-CH-UA headers automatically. Adding custom headers without them creates detectable inconsistency.",
@@ -711,7 +710,7 @@ var networkAnomalyRule = {
       case "Network.clearBrowserCache": {
         return {
           ruleId: "network-anomaly",
-          action: "block",
+          action: "pass",
           severity: "warn",
           reason: "Network.clearBrowserCache called \u2014 cache clearing mid-session is unnatural for real users.",
           suggestion: "Avoid cache clearing during sessions. Start with a fresh profile if needed.",
@@ -722,7 +721,7 @@ var networkAnomalyRule = {
       case "Network.clearBrowserCookies": {
         return {
           ruleId: "network-anomaly",
-          action: "block",
+          action: "pass",
           severity: "warn",
           reason: "Network.clearBrowserCookies called \u2014 wiping cookies mid-session is a scraper optimization.",
           suggestion: "Cookies should only be cleared via normal browser flow (expiration, user action).",
@@ -733,7 +732,7 @@ var networkAnomalyRule = {
       case "Network.setBlockedURLs": {
         return {
           ruleId: "network-anomaly",
-          action: "block",
+          action: "pass",
           severity: "warn",
           reason: "Network.setBlockedURLs blocks resource loading \u2014 this changes the page behavior and is detectable.",
           suggestion: "Blocking images/fonts/etc creates measurable differences in performance and page rendering.",
@@ -755,7 +754,7 @@ var networkAnomalyRule = {
       case "Fetch.enable": {
         return {
           ruleId: "network-anomaly",
-          action: "block",
+          action: "pass",
           severity: "warn",
           reason: "Fetch.enable intercepts all network requests \u2014 a man-in-the-middle approach used by scrapers.",
           suggestion: "Do not use Fetch domain for network interception if avoiding detection.",
@@ -795,7 +794,7 @@ var pageLifecycleRule = {
           if (interval < 100) {
             return {
               ruleId: "page-lifecycle",
-              action: "block",
+              action: "pass",
               severity: "warn",
               reason: `Multiple Page.navigate calls within ${interval}ms of each other \u2014 unnatural rapid navigation.`,
               suggestion: "Add proper waits between navigations: wait for page load before navigating again.",
@@ -812,7 +811,7 @@ var pageLifecycleRule = {
         if (state.lastNavTime > 0 && now - state.lastNavTime < 500) {
           return {
             ruleId: "page-lifecycle",
-            action: "block",
+            action: "pass",
             severity: "danger",
             reason: "Page.captureScreenshot called within 500ms of navigation \u2014 content extraction pattern.",
             suggestion: "Wait for the page to fully render before taking screenshots: wait for load/networkidle.",
@@ -823,7 +822,7 @@ var pageLifecycleRule = {
         if (state.screenshots > 3 && state.navigations.length < 2) {
           return {
             ruleId: "page-lifecycle",
-            action: "block",
+            action: "pass",
             severity: "warn",
             reason: "Multiple screenshots on a single page without navigation \u2014 suspicious extraction behavior.",
             suggestion: "Consider if all screenshots are necessary.",
@@ -836,7 +835,7 @@ var pageLifecycleRule = {
       case "Page.printToPDF": {
         return {
           ruleId: "page-lifecycle",
-          action: "block",
+          action: "pass",
           severity: "danger",
           reason: "Page.printToPDF called \u2014 this is a telltale scraper pattern that gives away automation intent.",
           suggestion: "Avoid PDF generation. If you must, add significant delays and user-like interaction first.",
@@ -848,7 +847,7 @@ var pageLifecycleRule = {
         if (state.lastNavTime > 0 && now - state.lastNavTime < 1e3) {
           return {
             ruleId: "page-lifecycle",
-            action: "block",
+            action: "pass",
             severity: "warn",
             reason: "Page.reload called immediately after navigate \u2014 unnatural fast-reload pattern.",
             suggestion: "Introduce delays between navigation and reload to simulate human behavior.",
@@ -862,7 +861,7 @@ var pageLifecycleRule = {
         if (state.navigations.length < 2) {
           return {
             ruleId: "page-lifecycle",
-            action: "block",
+            action: "pass",
             severity: "info",
             reason: "Page.close called after minimal interaction \u2014 zombie pages common in automation.",
             suggestion: "Ensure meaningful interaction before closing pages.",
@@ -878,7 +877,7 @@ var pageLifecycleRule = {
         if (state.evaluateCount > 50 && state.navigations.length === 0) {
           return {
             ruleId: "page-lifecycle",
-            action: "block",
+            action: "pass",
             severity: "info",
             reason: "50+ evaluate calls without any Page.navigate \u2014 data extraction without real browsing.",
             suggestion: "Navigate to a real page first. Evaluate on about:blank is suspicious.",
@@ -940,432 +939,6 @@ function createRuleEngine(customRules) {
   };
 }
 
-// src/cdp-interceptor/logger.ts
-function createLogger(config) {
-  const buffer = [];
-  const MAX_BUFFER = 2e3;
-  return {
-    info(message, meta) {
-      if (!config.enableLogging) return;
-      const ts = (/* @__PURE__ */ new Date()).toISOString();
-      if (meta) {
-        console.log(`[CDPInterceptor ${ts}] ${message}`, JSON.stringify(meta));
-      } else {
-        console.log(`[CDPInterceptor ${ts}] ${message}`);
-      }
-    },
-    log(method, direction, sessionId, payload, decision) {
-      const entry = {
-        timestamp: Date.now(),
-        direction,
-        sessionId,
-        method,
-        payload: sanitizePayload(payload),
-        decision: decision ?? void 0
-      };
-      if (config.enableLogging) {
-        buffer.push(entry);
-        if (buffer.length > MAX_BUFFER) buffer.shift();
-        const tag = decision ? decision.action === "block" ? "\u{1F6AB}BLOCK" : decision.action === "transform" ? "\u{1F504}XFMR" : "\u2705" : "  ";
-        const reason = decision ? ` [${decision.severity}] ${decision.reason}` : "";
-        console.log(`[CDP] ${tag} ${direction} ${method}${reason}`);
-      }
-      return entry;
-    },
-    getRecent(count) {
-      return buffer.slice(-count);
-    },
-    flush() {
-      buffer.length = 0;
-    }
-  };
-}
-function sanitizePayload(payload) {
-  if (typeof payload !== "object" || payload === null) return { raw: String(payload) };
-  const obj = payload;
-  const cleaned = {};
-  for (const [key, value] of Object.entries(obj)) {
-    if (key === "data" && typeof value === "string" && value.length > 200) {
-      cleaned[key] = `<binary: ${value.length} chars>`;
-    } else if (key === "expression" && typeof value === "string" && value.length > 500) {
-      cleaned[key] = value.substring(0, 500) + "...";
-    } else {
-      cleaned[key] = value;
-    }
-  }
-  return cleaned;
-}
-
-// src/cdp-interceptor/advisor.ts
-function formatBlockMessage(decision, method) {
-  const adv = advise(decision, method);
-  const lines = [
-    `[CDP-FIREWALL-BLOCK] rule=${decision.ruleId}`,
-    `method=${method}`,
-    `reason=${decision.reason}`,
-    `suggestion=${decision.suggestion ?? adv.detail}`
-  ];
-  if (adv.codeExample) {
-    lines.push(`code-example=`);
-    lines.push(adv.codeExample);
-  }
-  return lines.join("\n");
-}
-function advise(decision, originalMethod) {
-  const baseAdvice = getBaseAdvice(decision, originalMethod);
-  return {
-    ruleId: decision.ruleId,
-    title: baseAdvice.title,
-    detail: decision.suggestion ?? baseAdvice.detail,
-    codeExample: baseAdvice.codeExample
-  };
-}
-function getBaseAdvice(decision, method) {
-  switch (decision.ruleId) {
-    case "dom-mutation":
-      return {
-        title: "Direct DOM property mutation blocked",
-        detail: `Your ${method} call tried to set a DOM property directly. In React/Vue/Angular, this bypasses the framework's virtual DOM completely meaning onChange/onInput never fires. The website CAN detect this mismatch as automation.`,
-        codeExample: [
-          "# \u274C BLOCKED \u2014 what you tried to do:",
-          `page.evaluate(\`el.value = 'hello'\`)  # triggers isTrusted=false`,
-          "",
-          "# \u2705 USE INSTEAD \u2014 proper CDP input dispatch:",
-          "page.fill('#selector', 'hello')           # Playwright: dispatches input+change events",
-          "page.type('#selector', 'hello', {delay})  # Playwright: real keystrokes",
-          "page.locator('#selector').fill('hello')   # Playwright: recommended API"
-        ].join("\n")
-      };
-    case "mouse-trajectory":
-      return {
-        title: "Unnatural mouse trajectory blocked",
-        detail: `Your ${method} sequence formed a perfectly linear path. Human hands have micro-tremors (1-3px variation at any point along the arc), acceleration curves, and never draw straight lines between distant points.`,
-        codeExample: [
-          "# \u274C BLOCKED \u2014 linear interpolation:",
-          "for i in range(20):",
-          "    page.mouse.move(x0 + (x1-x0)*(i/20), y0 + (y1-y0)*(i/20))",
-          "",
-          "# \u2705 USE INSTEAD \u2014 Bezier curves with overshoot:",
-          '# Use "ghost-cursor" or similar library',
-          "from ghost_cursor import path_to",
-          "path_to(page, (x1, y1))"
-        ].join("\n")
-      };
-    case "input-keystroke":
-      if (method === "Input.insertText") {
-        return {
-          title: "Input.insertText detected (logged, not blocked)",
-          detail: "Input.insertText bypasses native keyDown\u2192keyPress\u2192input\u2192keyUp events. Playwright uses this internally for page.fill(). Logged for observability."
-        };
-      }
-      return {
-        title: "Unnatural keystroke timing blocked",
-        detail: `Your ${method} calls have unnaturally constant timing (e.g., exact 50ms intervals). Human typing always has variation (CV > 0.2).`,
-        codeExample: [
-          "# \u274C BLOCKED \u2014 exact constant delay:",
-          "page.type('#input', 'hello', {delay: 50})  # every keystroke exactly 50ms apart",
-          "",
-          "# \u2705 USE INSTEAD \u2014 variable delay (human-like):",
-          "page.fill('#input', 'hello')               # recommended, dispatches events properly",
-          "# OR: type with randomized delay",
-          "page.type('#input', 'hello', {delay: 50 + Math.floor(Math.random() * 80)})"
-        ].join("\n")
-      };
-    case "automation-signals":
-      return {
-        title: "Browser automation marker detected",
-        detail: `Your ${method} call accessed a property/marker that anti-crawler systems check to detect automation. These markers (navigator.webdriver, window.__playwright, etc.) are the #1 detection vector.`,
-        codeExample: [
-          "# \u274C BLOCKED \u2014 don't check for automation markers:",
-          "navigator.webdriver      # NEVER check this",
-          "window.__playwright      # NEVER check this",
-          "chrome.runtime           # NEVER check this",
-          "",
-          "# \u2705 Just go about your business normally.",
-          "# Anti-detection is handled by the CDP firewall automatically."
-        ].join("\n")
-      };
-    case "fingerprinting":
-      return {
-        title: "Browser fingerprinting API access blocked",
-        detail: `Your ${method} call accessed a known fingerprinting API. These APIs (canvas.toDataURL, WebGL getParameter, AudioContext, etc.) are used by anti-crawler systems to build a unique device fingerprint.`,
-        codeExample: [
-          "# \u274C BLOCKED \u2014 fingerprinting vector:",
-          "canvas.toDataURL()                        # returns unique browser hash",
-          'gl.getParameter(gl.VENDOR)                # returns "SwiftShader" in headless',
-          "screen.availWidth - screen.availHeight    # no OS chrome in headless",
-          "",
-          "# \u2705 Avoid accessing these APIs. They are only used for fingerprinting."
-        ].join("\n")
-      };
-    case "event-simulation":
-      return {
-        title: "Synthetic event simulation blocked",
-        detail: `Your ${method} call simulated user interaction via el.click() or dispatchEvent(new Event(...)). These produce isTrusted=false events, which are 100% detectable by any anti-crawler that checks isTrusted on critical events.`,
-        codeExample: [
-          "# \u274C BLOCKED \u2014 synthetic events (isTrusted=false):",
-          "el.click()                                 # isTrusted=false",
-          'el.dispatchEvent(new Event("click"))       # isTrusted=false',
-          "el.focus()                                 # isTrusted=false",
-          "",
-          "# \u2705 USE INSTEAD \u2014 CDP-level input dispatch (isTrusted=true):",
-          "page.click(selector)                       # uses Input.dispatchMouseEvent",
-          "page.fill(selector, value)                 # dispatches real input events"
-        ].join("\n")
-      };
-    case "emulation-override":
-      return {
-        title: "CDP emulation override blocked",
-        detail: `Your ${method} call overrides browser behavior in a way that creates detectable inconsistencies. Anti-crawler systems cross-check multiple sources (e.g., navigator.userAgent vs HTTP User-Agent header) to catch these mismatches.`,
-        codeExample: [
-          "# \u274C BLOCKED \u2014 detectable emulation override:",
-          "Emulation.setUserAgentOverride(...)        # JS vs HTTP header mismatch",
-          "Emulation.setGeolocationOverride(...)       # IP geo vs overridden geo mismatch",
-          "Emulation.setDeviceMetricsOverride(...)     # matchMedia vs actual viewport",
-          "",
-          "# \u2705 These are handled automatically by the CDP firewall.",
-          "# Do NOT call them manually."
-        ].join("\n")
-      };
-    case "network-anomaly":
-      return {
-        title: "Network anomaly detected",
-        detail: `Your ${method} call triggered a network pattern that is characteristic of scrapers: blocking URLs, clearing caches, or intercepting requests.`,
-        codeExample: [
-          "# \u274C BLOCKED \u2014 scraper optimization:",
-          "Network.clearBrowserCache()                # natural users never do this",
-          'Network.setBlockedURLs(["*fonts*"])        # blocking resources is detectable',
-          "Fetch.enable()                             # MITM-style interception",
-          "",
-          "# \u2705 Let the browser manage its own cache and network normally."
-        ].join("\n")
-      };
-    case "page-lifecycle":
-      return {
-        title: "Suspicious page lifecycle pattern blocked",
-        detail: `Your ${method} call reveals an unnatural page interaction sequence: navigating too fast, taking screenshots before the page renders, or generating PDFs (a telltale scraper giveaway).`,
-        codeExample: [
-          "# \u274C BLOCKED \u2014 unnatural lifecycle:",
-          "page.goto(url); page.pdf()                 # PDF = scraper giveaway",
-          "page.goto(url); page.screenshot() <500ms   # screenshot before render",
-          "page.goto(url) 3x in <100ms               # rapid navigation barrage",
-          "",
-          "# \u2705 Add proper waits between actions:",
-          'page.goto(url, {waitUntil: "networkidle"})',
-          'page.waitForSelector("body")',
-          "page.screenshot()                          # after rendering"
-        ].join("\n")
-      };
-    default:
-      return {
-        title: decision.reason,
-        detail: decision.suggestion ?? `The CDP call "${method}" was blocked by rule "${decision.ruleId}".`
-      };
-  }
-}
-
-// src/cdp-interceptor/proxy.ts
-function makeCompoundId(cdpSessionId, rawSessionId) {
-  return `${cdpSessionId ?? "nil"}::${rawSessionId ?? "nil"}`;
-}
-var CDPInterceptorProxy = class {
-  wss = null;
-  engine;
-  config;
-  logger;
-  started = false;
-  stats = {
-    totalMessages: 0,
-    blockedMessages: 0,
-    transformedMessages: 0,
-    passedMessages: 0,
-    byRule: {}
-  };
-  constructor(config) {
-    this.config = config;
-    this.engine = createRuleEngine(config.rules);
-    this.logger = createLogger({
-      enableLogging: config.enableLogging ?? true,
-      logDir: config.logDir
-    });
-  }
-  /** The port the proxy is listening on (only valid after start()) */
-  get port() {
-    const addr = this.wss?.address();
-    if (addr && typeof addr === "object") return addr.port;
-    return 0;
-  }
-  /** Start the proxy server */
-  async start() {
-    if (this.started) return this.port;
-    return new Promise((resolve, reject) => {
-      this.wss = new WebSocketServer({ port: this.config.listenPort ?? 0 }, () => {
-        const port = this.port;
-        this.engine.start();
-        this.started = true;
-        this.logger.info("CDP interceptor proxy started", { port, endpoint: this.config.cdpEndpoint });
-        resolve(port);
-      });
-      this.wss.on("error", reject);
-      this.wss.on("connection", (clientWs, _req) => {
-        this.handleConnection(clientWs);
-      });
-    });
-  }
-  /** Stop the proxy server */
-  async stop() {
-    this.engine.stop();
-    this.logger.flush();
-    this.started = false;
-    return new Promise((resolve) => {
-      if (!this.wss) return resolve();
-      this.wss.close(() => resolve());
-      this.wss = null;
-    });
-  }
-  /** Get accumulated statistics */
-  getStats() {
-    return { ...this.stats };
-  }
-  /** Get recent log entries (for inspection) */
-  getRecentLogs(count = 50) {
-    return this.logger.getRecent(count);
-  }
-  // ── Connection handling ──────────────────────────────────────
-  handleConnection(clientWs) {
-    let browserWs = null;
-    let isAlive = true;
-    const pendingMessages = [];
-    browserWs = new WebSocket(this.config.cdpEndpoint);
-    clientWs.on("message", (raw) => {
-      if (browserWs && browserWs.readyState === WebSocket.OPEN) {
-        this.handleClientMessage(clientWs, browserWs, raw);
-      } else {
-        pendingMessages.push(raw);
-      }
-    });
-    browserWs.on("open", () => {
-      for (const buf of pendingMessages) {
-        this.handleClientMessage(clientWs, browserWs, buf);
-      }
-      pendingMessages.length = 0;
-    });
-    browserWs.on("error", (err) => {
-      this.logger.info("Browser WebSocket error", { error: String(err) });
-    });
-    browserWs.on("close", (code, reason) => {
-      if (isAlive && clientWs.readyState === WebSocket.OPEN) {
-        this.logger.info("Browser WS closed, closing client", { code, reason: String(reason) });
-        clientWs.close();
-      }
-    });
-    browserWs.on("message", (raw) => {
-      this.handleBrowserMessage(clientWs, browserWs, raw);
-    });
-    const cleanup = () => {
-      isAlive = false;
-      if (browserWs && browserWs.readyState === WebSocket.OPEN) {
-        browserWs.close();
-      }
-    };
-    clientWs.on("close", cleanup);
-    clientWs.on("error", cleanup);
-    browserWs.on("close", () => {
-      if (isAlive && clientWs.readyState === WebSocket.OPEN) {
-        clientWs.close();
-      }
-    });
-    browserWs.on("error", cleanup);
-  }
-  // ── Message processing ───────────────────────────────────────
-  handleClientMessage(clientWs, browserWs, raw) {
-    const msg = this.parseMessage(raw);
-    if (!msg) return;
-    this.stats.totalMessages++;
-    if (!("method" in msg)) {
-      browserWs.send(raw.toString());
-      return;
-    }
-    const request = msg;
-    const ctx = {
-      method: request.method,
-      params: request.params ?? {},
-      sessionId: makeCompoundId("_cdpSession" in browserWs ? browserWs._cdpSession : void 0, request.sessionId),
-      direction: "client\u2192browser"
-    };
-    const decision = this.engine.evaluate(ctx);
-    this.logger.log(ctx.method, "client\u2192browser", ctx.sessionId, { method: ctx.method, params: ctx.params }, decision);
-    if (decision) {
-      this.recordDecision(decision);
-    }
-    if (decision?.action === "block") {
-      const blockMsg = formatBlockMessage(decision, ctx.method);
-      const errorResponse = {
-        id: request.id,
-        error: {
-          code: decision.errorCode ?? -32e3,
-          message: blockMsg
-        },
-        sessionId: request.sessionId
-      };
-      this.stats.blockedMessages++;
-      console.error(`
-${blockMsg}
-`);
-      clientWs.send(JSON.stringify(errorResponse));
-      return;
-    }
-    if (decision?.action === "transform" && decision.transformedParams) {
-      const transformed = { ...request, params: decision.transformedParams };
-      this.stats.transformedMessages++;
-      browserWs.send(JSON.stringify(transformed));
-      return;
-    }
-    this.stats.passedMessages++;
-    browserWs.send(raw.toString());
-  }
-  handleBrowserMessage(clientWs, _browserWs, raw) {
-    const msg = this.parseMessage(raw);
-    if (!msg) {
-      clientWs.send(raw.toString());
-      return;
-    }
-    if ("method" in msg) {
-      const event = msg;
-      const ctx = {
-        method: event.method,
-        params: event.params ?? {},
-        sessionId: event.sessionId ?? "browser",
-        direction: "browser\u2192client"
-      };
-      const decision = this.engine.evaluate(ctx);
-      if (decision?.action === "block") {
-        return;
-      }
-    }
-    clientWs.send(raw.toString());
-  }
-  // ── Utilities ────────────────────────────────────────────────
-  parseMessage(raw) {
-    try {
-      return JSON.parse(raw.toString());
-    } catch {
-      return null;
-    }
-  }
-  recordDecision(decision) {
-    if (!this.stats.byRule[decision.ruleId]) {
-      this.stats.byRule[decision.ruleId] = { matched: 0, blocked: 0, transformed: 0 };
-    }
-    this.stats.byRule[decision.ruleId].matched++;
-    if (decision.action === "block") {
-      this.stats.byRule[decision.ruleId].blocked++;
-    } else if (decision.action === "transform") {
-      this.stats.byRule[decision.ruleId].transformed++;
-    }
-  }
-};
-
 export {
   domMutationRule,
   mouseTrajectoryRule,
@@ -1376,7 +949,5 @@ export {
   emulationOverrideRule,
   networkAnomalyRule,
   pageLifecycleRule,
-  createRuleEngine,
-  advise,
-  CDPInterceptorProxy
+  createRuleEngine
 };