@xbrowser/cli 1.11.0 → 1.13.0

package/dist/{chunk-DWDXEGVK.js → chunk-NKW4A74J.js}

@@ -356,6 +356,11 @@ function getCaptchaConfig() {
     previewPort: parseInt(process.env.XBROWSER_PREVIEW_PORT || "") || config.preview?.port || 9223
   };
 }
+function resolveScreenshotsDir() {
+  const configured = getConfigValue("screenshots.dir");
+  if (typeof configured === "string" && configured.trim()) return configured.trim();
+  return join(tmpdir(), "xbrowser", "screenshots");
+}
 
 // src/utils/shell-escape.ts
 function shellEscape(value) {
@@ -508,9 +513,6 @@ var HumanInteractionManager = class {
 };
 
 export {
-  ScreencastCapturer,
-  CaptchaDetector,
-  WebhookNotifier,
   loadConfig,
   getConfigValue,
   setConfigValue,
@@ -519,5 +521,9 @@ export {
   getMarketplaceUrl,
   resolveNpmPackageWithFallback,
   getCaptchaConfig,
+  resolveScreenshotsDir,
+  ScreencastCapturer,
+  CaptchaDetector,
+  WebhookNotifier,
   HumanInteractionManager
 };

package/dist/{chunk-SQHSZENE.js → chunk-OMU63E6J.js}

@@ -1,6 +1,7 @@
 import {
-  ScreencastCapturer
-} from "./chunk-BNO7OKO4.js";
+  ScreencastCapturer,
+  getCaptchaConfig
+} from "./chunk-HBMEFSTB.js";
 
 // src/human-interaction.ts
 import { execSync } from "child_process";
@@ -137,26 +138,6 @@ var WebhookNotifier = class {
   }
 };
 
-// src/config.ts
-import { homedir, tmpdir } from "os";
-import { join } from "path";
-import { loadConfig as coreLoadConfig, saveConfig as coreSaveConfig } from "@dyyz1993/xcli-core";
-function getConfigSource() {
-  return { configDir: join(homedir() || tmpdir(), ".xbrowser") };
-}
-function loadConfig() {
-  return coreLoadConfig(getConfigSource());
-}
-function getCaptchaConfig() {
-  const config = loadConfig();
-  return {
-    notifyUrl: process.env.XBROWSER_NOTIFY_URL || config.captcha?.notifyUrl,
-    autoOpen: process.env.XBROWSER_AUTO_OPEN === "true" || config.captcha?.autoOpen === true,
-    timeout: parseInt(process.env.XBROWSER_CAPTCHA_TIMEOUT || "") || config.captcha?.timeout || 120,
-    previewPort: parseInt(process.env.XBROWSER_PREVIEW_PORT || "") || config.preview?.port || 9223
-  };
-}
-
 // src/utils/shell-escape.ts
 function shellEscape(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;

package/dist/{chunk-7OFM755Z.js → chunk-R2POF2GP.js}

@@ -5,6 +5,9 @@ import {
 import {
   errMsg
 } from "./chunk-GDKLH7ZY.js";
+import {
+  createRuleEngine
+} from "./chunk-H2A5JUK5.js";
 import {
   __require
 } from "./chunk-KFQGP6VL.js";
@@ -124,8 +127,8 @@ function buildStealthInitScript() {
     "      if(!e||e.constructor===FocusEvent||e.constructor===KeyboardEvent)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return true;',
-    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isFinite(k[p])){',
+    '        if(p==="isTrusted")return k.isTrusted;',
+    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
     "        }",
@@ -143,7 +146,160 @@ function buildStealthInitScript() {
     '  Object.defineProperty(Screen.prototype,"height",{get:_gh,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availWidth",{get:_gw,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availHeight",{get:_gah,configurable:true});',
-    "  document.hasFocus=function(){return true};",
+    // hasFocus 与 visibilityState 联动（d29）：恒 true 在 hidden 标签下暴露
+    // —— 真实浏览器失焦/后台时 hasFocus=false
+    '  document.hasFocus=function(){return document.visibilityState==="visible";};',
+    // 4. Canvas/WebGL fingerprint: per-session stable noise (d20).
+    //    Headless software raster differs subtly from Chrome GPU raster —
+    //    toDataURL hashes fingerprint the rasterizer. Inject a stable
+    //    (per-page-load) subpixel shift into fillText so hashes look like a
+    //    distinct-but-consistent real GPU, and hide the HEADLESS tell in
+    //    WebGL renderer strings.
+    "  var _seed=Math.floor(Math.random()*2147483647);",
+    "  var _prng=function(){_seed=(_seed*48271)%2147483647;return _seed/2147483647;};",
+    "  var _dx=(_prng()*0.4-0.2).toFixed(3)*1, _dy=(_prng()*0.4-0.2).toFixed(3)*1;",
+    "  var _fillText=CanvasRenderingContext2D.prototype.fillText;",
+    "  CanvasRenderingContext2D.prototype.fillText=function(t,x,y,m){",
+    "    return _fillText.call(this,t,x+_dx,y+_dy,m);",
+    "  };",
+    "  var _toDataURL=HTMLCanvasElement.prototype.toDataURL;",
+    "  HTMLCanvasElement.prototype.toDataURL=function(){",
+    '    var ctx=this.getContext("2d");',
+    "    if(ctx){var d=ctx.getImageData(0,0,Math.min(this.width,2),Math.min(this.height,2));",
+    "      for(var i=0;i<d.data.length;i+=4){if(d.data[i+3]>0){d.data[i]^=1;break;}}",
+    "      ctx.putImageData(d,0,0);}",
+    "    return _toDataURL.apply(this,arguments);",
+    "  };",
+    "  try{",
+    "    var _gl=HTMLCanvasElement.prototype.getContext;",
+    "    HTMLCanvasElement.prototype.getContext=function(t,o){",
+    "      var c=_gl.call(this,t,o);",
+    '      if(c&&(t==="webgl"||t==="experimental-webgl")&&c.getParameter){',
+    "        var _gp=c.getParameter.bind(c);",
+    "        c.getParameter=function(p){",
+    "          var v=_gp(p);",
+    '          if(typeof v==="string"&&/SwiftShader|Software|Rasterizer|Headless/i.test(v))',
+    '            return "ANGLE (Apple, ANGLE Metal Renderer: Apple M2 Max, Unspecified Version)";',
+    "          return v;};}",
+    "      return c;};",
+    "  }catch(e){}",
+    // 5. AudioContext fingerprint: per-load stable micro-noise on channel
+    //    data (d21). DSP sum differences between headless software audio and
+    //    real hardware audio are a classic fingerprint — add ±1e-7 level
+    //    noise (inaudible, changes the sum hash).
+    "  try{",
+    "    var _gcd=AudioBuffer.prototype.getChannelData;",
+    "    AudioBuffer.prototype.getChannelData=function(ch){",
+    "      var d=_gcd.call(this,ch);",
+    '      var key="__xb_audio_"+ch;',
+    "      if(!this[key]){",
+    "        this[key]=true;",
+    "        for(var i=0;i<d.length;i+=997){d[i]=d[i]+(_prng()-0.5)*2e-7;}",
+    "      }",
+    "      return d;",
+    "    };",
+    "    var _gffd=AnalyserNode.prototype.getFloatFrequencyData;",
+    "    AnalyserNode.prototype.getFloatFrequencyData=function(arr){",
+    "      _gffd.call(this,arr);",
+    "      for(var i=0;i<arr.length;i+=31){arr[i]=arr[i]+(_prng()-0.5)*0.01;}",
+    "    };",
+    "    var _gfbd=AnalyserNode.prototype.getByteFrequencyData;",
+    "    AnalyserNode.prototype.getByteFrequencyData=function(arr){",
+    "      _gfbd.call(this,arr);",
+    "      for(var i=0;i<arr.length;i+=31){arr[i]=(arr[i]+((_prng()*3)|0))&255;}",
+    "    };",
+    "  }catch(e){}",
+    // 3b. Font metrics + speechSynthesis + battery (d22): headless tells
+    "  try{",
+    "    var _mt=CanvasRenderingContext2D.prototype.measureText;",
+    '    var _tmw=Object.getOwnPropertyDescriptor(TextMetrics.prototype,"width");',
+    "    CanvasRenderingContext2D.prototype.measureText=function(t){",
+    "      var m=_mt.call(this,t);",
+    '      try{Object.defineProperty(m,"width",{get:function(){return _tmw.get.call(m)+_dx*0.01;},configurable:true});}catch(e){}',
+    "      return m;",
+    "    };",
+    "  }catch(e){}",
+    "  try{",
+    '    var _fakeVoices=["Alex","Daniel","Karen","Moira","Ralph","Samantha","Ting-Ting","Mei-Jia","Sinji","Yunda"];',
+    "    var _sv=speechSynthesis.getVoices.bind(speechSynthesis);",
+    "    speechSynthesis.getVoices=function(){",
+    "      var real=_sv();",
+    "      if(real&&real.length>50)return real;",
+    // 注意阈值从 0 改 50：iframe 原生约 10 个 —— 原阈值下 iframe 返回原生 10 个
+    // 而不是伪装 180（d33 暴露）。>50 = 主文档伪装列表已生效，其余返回伪装。
+    '      return _fakeVoices.map(function(n,i){return {name:n,lang:i<2?"en-US":i<6?"en-GB":"zh-TW",localService:true,default:i===0,voiceURI:n};});',
+    "    };",
+    // d33 修复：iframe 的 speechSynthesis 是独立实例（主文档 hook 不可达）——
+    // 轮询同源 iframe，对其 contentWindow.speechSynthesis 同样 patch
+    "  try{",
+    "    var _piv=function(){",
+    '      var frs=document.querySelectorAll("iframe");',
+    "      for(var i=0;i<frs.length;i++){try{",
+    "        var cw=frs[i].contentWindow;",
+    "        if(!cw||!cw.speechSynthesis||cw.speechSynthesis.__xbP)continue;",
+    "        cw.speechSynthesis.__xbP=true;",
+    "        var _sv2=cw.speechSynthesis.getVoices.bind(cw.speechSynthesis);",
+    "        cw.speechSynthesis.getVoices=function(){var r=_sv2();if(r&&r.length>50)return r;",
+    '          return _fakeVoices.map(function(n,j){return{name:n,lang:j<2?"en-US":j<6?"en-GB":"zh-TW",localService:true,default:j===0,voiceURI:n};});};',
+    "      }catch(e2){}}",
+    "    };",
+    "    setInterval(_piv,2000);",
+    "    var _mo=new MutationObserver(function(muts){",
+    "      for(var k=0;k<muts.length;k++){var ns=muts[k].addedNodes;",
+    '        for(var q=0;q<ns.length;q++){if(ns[q].tagName==="IFRAME")setTimeout(_piv,20);}}',
+    "    });",
+    "    _mo.observe(document.documentElement,{childList:true,subtree:true});",
+    "  }catch(e){}",
+    "  }catch(e){}",
+    "  try{",
+    "    var _gb=navigator.getBattery.bind(navigator);",
+    "    navigator.getBattery=function(){",
+    "      return _gb().then(function(b){",
+    '        Object.defineProperty(b,"charging",{get:function(){return true;},configurable:true});',
+    "        return b;});",
+    "    };",
+    "  }catch(e){}",
+    // 3c. WebRTC local IP leak guard (d23): headless STUN candidates can
+    //     expose host IPs; mDNS-only candidates are the modern Chrome default.
+    "  try{",
+    "    var _oc=RTCPeerConnection.prototype.createOffer;",
+    "    RTCPeerConnection.prototype.createOffer=function(){",
+    "      var p=_oc.apply(this,arguments);",
+    "      var self=this;",
+    "      return p.then(function(offer){",
+    '        offer.sdp=offer.sdp.split(String.fromCharCode(10)).filter(function(l){return l.indexOf("typ host")<0}).join(String.fromCharCode(10));',
+    "        return offer;});",
+    "    };",
+    "  }catch(e){}",
+    // 3d-2. performance.now precision clamp (d34): full-precision timestamps
+    //     (11 decimals) differ from site-isolation-clamped real Chrome (~100μs).
+    "  try{",
+    "    var _pn=performance.now.bind(performance);",
+    "    performance.now=function(){return Math.round(_pn()*10)/10;};",
+    '    var _pto=Object.getOwnPropertyDescriptor(Performance.prototype,"timeOrigin");',
+    '    if(_pto&&_pto.get){Object.defineProperty(performance,"timeOrigin",{get:function(){return _pto.get.call(performance);},configurable:true});}',
+    "  }catch(e){}",
+    // 3d. Chrome object depth (d24): automation fakes usually only set
+    //     window.chrome = {}; deep checks hit app.run/runtime/csi/loadTimes.
+    "  try{",
+    "    if(window.chrome){",
+    '      if(!window.chrome.app||!window.chrome.app.run)window.chrome.app={run:function(){},load:function(){},getDetails:function(){return null},InstallState:{DISABLED:"disabled",INSTALLED:"installed",NOT_INSTALLED:"not_installed"},RunningState:{CANNOT_RUN:"cannot_run",READY_TO_RUN:"ready_to_run",RUNNING:"running"}};',
+    '      if(!window.chrome.runtime)window.chrome.runtime={OnInstalledReason:{CHROME_UPDATE:"chrome_update",INSTALL:"install",UPDATE:"update"},PlatformOs:{ANDROID:"android",CROS:"cros",LINUX:"linux",MAC:"mac",OPENBSD:"openbsd",WIN:"win"},connect:function(){},sendMessage:function(){},id:undefined};',
+    "      if(!window.chrome.csi)window.chrome.csi=function(){return{};}",
+    "      if(!window.chrome.loadTimes)window.chrome.loadTimes=function(){return{};}",
+    "    }",
+    "  }catch(e){}",
+    // 3e. Font availability patch (d25): headless Chromium misses some system
+    //     fonts (e.g. Menlo on macOS) that real Chrome has. Register a FontFace
+    //     aliasing the missing font to a local() equivalent so offsetWidth-based
+    //     font probing sees the same availability as the faked environment.
+    "  try{",
+    '    var _fontAliases=[["Menlo","Courier New"],["SF Mono","Menlo"],["Segoe UI","Helvetica"]];',
+    "    _fontAliases.forEach(function(pa){",
+    '      try{var ff=new FontFace(pa[0],"local("+JSON.stringify(pa[1])+")");',
+    "        document.fonts.add(ff);ff.load();}catch(e2){}",
+    "    });",
+    "  }catch(e){}",
     // 3. toString disguise (name-list based)
     "  var _ts=Function.prototype.toString;",
     "  var _hf=document.hasFocus;",
@@ -153,12 +309,16 @@ function buildStealthInitScript() {
     '    if(this===_gw)return"function get width() { [native code] }";',
     '    if(this===_gh)return"function get height() { [native code] }";',
     '    if(this===_gah)return"function get availHeight() { [native code] }";',
+    '    if(this===CanvasRenderingContext2D.prototype.fillText)return"function fillText() { [native code] }";',
+    '    if(this===HTMLCanvasElement.prototype.toDataURL)return"function toDataURL() { [native code] }";',
+    '    if(this===AnalyserNode.prototype.getFloatFrequencyData)return"function getFloatFrequencyData() { [native code] }";',
+    '    if(this===AudioBuffer.prototype.getChannelData)return"function getChannelData() { [native code] }";',
     "    return _ts.call(this);",
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return true;',
-    '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isFinite(k[p])){',
+    '    if(p==="isTrusted")return k.isTrusted;',
+    '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",
     '    var v=Reflect.get(k,p);return typeof v==="function"?v.bind(k):v;',
@@ -194,7 +354,7 @@ var XBMouseImpl = class {
   }
   async click(x, y, opts = {}) {
     const button = opts.button ?? "left";
-    const stealth = opts.stealth ?? true;
+    const stealth = opts.stealth ?? process.env.XBROWSER_STEALTH !== "off";
     let tx = x, ty = y;
     if (stealth && opts.elementWidth !== void 0 && opts.elementHeight !== void 0) {
       const off = landingOffset(opts.elementWidth, opts.elementHeight);
@@ -203,12 +363,23 @@ var XBMouseImpl = class {
     }
     if (stealth) {
       const traj = bezierTrajectory(this._x, this._y, tx, ty);
+      const _tb = Date.now();
+      let _truncated = false;
       for (const p of traj) {
+        if (Date.now() - _tb > 5e3) {
+          _truncated = true;
+          break;
+        }
         await this.send("Input.dispatchMouseEvent", { type: "mouseMoved", x: p.x, y: p.y, button: this._button });
         this._x = p.x;
         this._y = p.y;
         await sleep(p.delay);
       }
+      this._x = tx;
+      this._y = ty;
+      if (_truncated) {
+        await this.send("Input.dispatchMouseEvent", { type: "mouseMoved", x: tx, y: ty, button: this._button });
+      }
       await sleep(rand(...DEFAULT_STEALTH_CONFIG.aimPause));
     } else {
       await this.move(tx, ty);
@@ -313,12 +484,20 @@ var XBKeyboardImpl = class {
     }
     await this.dispatchKeyEvent(downParams);
     if (mapping.text) {
+      if (process.env.XBROWSER_STEALTH !== "off") {
+        await sleep2(rand(...DEFAULT_STEALTH_CONFIG.keyPressDuration));
+      }
       await this.dispatchKeyEvent({
         type: "char",
         text: mapping.text
       });
     }
     if (delay > 0) await sleep2(delay);
+    else {
+      if (process.env.XBROWSER_STEALTH !== "off") {
+        await sleep2(rand(...DEFAULT_STEALTH_CONFIG.keyPressDuration));
+      }
+    }
     const upParams = {
       type: "keyUp",
       key: mapping.key,
@@ -2028,6 +2207,10 @@ Last error: ${lastError.message}` : "";
       this.sessionId
     );
   }
+  /** 覆盖 User-Agent（headless 环境对抗 UA 检测的标配能力） */
+  async setUserAgent(userAgent) {
+    await this._setUserAgent(userAgent);
+  }
   /** Internal: set extra HTTP headers */
   async _setExtraHTTPHeaders(headers) {
     await this.setExtraHTTPHeaders(headers);
@@ -3157,9 +3340,28 @@ var XBBrowserImpl = class {
 // src/cdp-driver/connection.ts
 import { EventEmitter as EventEmitter4 } from "events";
 import { WebSocket } from "ws";
-var CDPConnection = class extends EventEmitter4 {
+var CDPConnection = class _CDPConnection extends EventEmitter4 {
   ws;
   nextId = 1;
+  /** CDP Guard：全部出站命令过规则引擎（env XBROWSER_CDP_GUARD=off 关闭）。
+   *  173 条规则 / 9 模块：合成事件 block、指纹暴露警告、自动化信号拦截。 */
+  static __guard;
+  get guard() {
+    if (_CDPConnection.__guard === void 0) {
+      if (process.env.XBROWSER_CDP_GUARD === "off") {
+        _CDPConnection.__guard = null;
+      } else {
+        try {
+          const g = createRuleEngine();
+          g.start();
+          _CDPConnection.__guard = g;
+        } catch {
+          _CDPConnection.__guard = null;
+        }
+      }
+    }
+    return _CDPConnection.__guard;
+  }
   pending = /* @__PURE__ */ new Map();
   closed = false;
   closeReason = null;
@@ -3183,6 +3385,8 @@ var CDPConnection = class extends EventEmitter4 {
    *  ping, the connection is considered dead and forcibly closed. */
   keepaliveTimer = null;
   pongTimer = null;
+  /** 最近一次收到任何 WS 消息的时间——有数据流动即证明连接存活 */
+  lastIncomingAt = Date.now();
   startKeepalive() {
     this.ws.on("pong", () => {
       if (this.pongTimer) {
@@ -3194,9 +3398,14 @@ var CDPConnection = class extends EventEmitter4 {
       if (this.ws.readyState === WebSocket.OPEN) {
         if (!this.pongTimer) {
           this.pongTimer = setTimeout(() => {
+            const recentlyActive = Date.now() - this.lastIncomingAt < 3e4;
+            if (recentlyActive) {
+              this.pongTimer = null;
+              return;
+            }
             if (!this.closed) {
               this.closed = true;
-              this.closeReason = "keepalive timeout (no pong in 10s)";
+              this.closeReason = "keepalive timeout (no pong and idle >30s)";
               try {
                 this.ws.terminate();
               } catch {
@@ -3208,7 +3417,7 @@ var CDPConnection = class extends EventEmitter4 {
               this.pending.clear();
               this.emit("disconnect");
             }
-          }, 1e4);
+          }, 6e4);
         }
         this.ws.ping?.();
       } else if (this.closed) {
@@ -3246,10 +3455,23 @@ var CDPConnection = class extends EventEmitter4 {
    * @param method — CDP domain.method (e.g. "Page.navigate")
    * @param params — method parameters
    * @param sessionId — optional flat session ID for sub-targets
-   * @param timeoutMs — response timeout (default: 30s)
+   * @param timeoutMs — response timeout (default: 30s；重 SPA 加载期间主线程忙，
+   *   evaluate 可排队 >30s——Runtime.evaluate 单独放宽到 90s)
    * @returns the `result` field from the CDP response
    */
-  async send(method, params, sessionId, timeoutMs = 3e4) {
+  async send(method, params, sessionId, timeoutMs) {
+    const effectiveTimeout = timeoutMs ?? (method === "Runtime.evaluate" ? 9e4 : 3e4);
+    if (this.guard) {
+      const decision = this.guard.evaluate({
+        method,
+        params: params ?? {},
+        sessionId: sessionId ?? this.defaultSessionId ?? "",
+        direction: "client\u2192browser"
+      });
+      if (decision && decision.action === "block") {
+        throw new Error(`[CDP-Guard] ${decision.reason}${decision.suggestion ? " | \u66FF\u4EE3: " + decision.suggestion : ""} [${decision.ruleId}]`);
+      }
+    }
     if (this.closed) {
       throw new Error(`CDP connection closed: ${this.closeReason ?? "unknown"}`);
     }
@@ -3264,8 +3486,8 @@ var CDPConnection = class extends EventEmitter4 {
     return new Promise((resolve, reject) => {
       const timeout = setTimeout(() => {
         this.pending.delete(id);
-        reject(new Error(`CDP timeout: ${method} (${timeoutMs}ms)`));
-      }, timeoutMs);
+        reject(new Error(`CDP timeout: ${method} (${effectiveTimeout}ms)`));
+      }, effectiveTimeout);
       this.pending.set(id, {
         resolve: (v) => {
           clearTimeout(timeout);
@@ -3348,6 +3570,7 @@ var CDPConnection = class extends EventEmitter4 {
   // ── Private ─────────────────────────────────────────────────
   bindWebSocket() {
     this.ws.on("message", (raw) => {
+      this.lastIncomingAt = Date.now();
       let msg;
       try {
         msg = JSON.parse(raw.toString());

package/dist/{chunk-WHPBNUKB.js → chunk-SH6OTPXN.js}

@@ -68,22 +68,48 @@ async function ensureDaemonRunning() {
 }
 async function rpcCall(method, params = {}, timeoutMs = 1e4) {
   await ensureDaemonRunning();
-  const resp = await fetch(`${DAEMON_BASE}/rpc`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ method, params }),
-    signal: AbortSignal.timeout(timeoutMs)
+  return new Promise((resolve, reject) => {
+    const body = JSON.stringify({ method, params });
+    const req = httpRequest(
+      {
+        hostname: "127.0.0.1",
+        port: DAEMON_PORT,
+        path: "/rpc",
+        method: "POST",
+        headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) }
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(c));
+        res.on("end", () => {
+          try {
+            const code = res.statusCode ?? 200;
+            if (code >= 400) {
+              let detail = `HTTP ${code}`;
+              try {
+                const body2 = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                if (body2?.error) detail = body2.error;
+              } catch {
+              }
+              reject(new Error(`Daemon error: ${detail}`));
+              return;
+            }
+            const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+            if (parsed && typeof parsed.error === "string" && Object.keys(parsed).length === 1) {
+              reject(new Error(`Daemon error: ${parsed.error}`));
+            } else {
+              resolve(parsed);
+            }
+          } catch (e) {
+            reject(e instanceof Error ? e : new Error(String(e)));
+          }
+        });
+      }
+    );
+    req.setTimeout(timeoutMs, () => req.destroy(new Error(`RPC ${method} timeout after ${timeoutMs}ms`)));
+    req.on("error", reject);
+    req.end(body);
   });
-  if (!resp.ok) {
-    let detail = resp.statusText;
-    try {
-      const body = await resp.json();
-      if (body?.error) detail = body.error;
-    } catch {
-    }
-    throw new Error(`Daemon error: ${detail}`);
-  }
-  return resp.json();
 }
 async function isDaemonRunning() {
   try {
@@ -211,37 +237,7 @@ async function forwardReplay(file, session, slowMo) {
   return longRpcCall("replay", { file, session, slowMo }, 20 * 6e4);
 }
 function longRpcCall(method, params, timeoutMs) {
-  return new Promise((resolve, reject) => {
-    const body = JSON.stringify({ method, params });
-    const req = httpRequest(
-      {
-        hostname: "127.0.0.1",
-        port: DAEMON_PORT,
-        path: "/rpc",
-        method: "POST",
-        headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) }
-      },
-      (res) => {
-        const chunks = [];
-        res.on("data", (c) => chunks.push(c));
-        res.on("end", () => {
-          try {
-            const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-            if (parsed && typeof parsed.error === "string" && Object.keys(parsed).length === 1) {
-              reject(new Error(`Daemon error: ${parsed.error}`));
-            } else {
-              resolve(parsed);
-            }
-          } catch (e) {
-            reject(e instanceof Error ? e : new Error(String(e)));
-          }
-        });
-      }
-    );
-    req.setTimeout(timeoutMs, () => req.destroy(new Error(`replay RPC timeout after ${timeoutMs}ms`)));
-    req.on("error", reject);
-    req.end(body);
-  });
+  return rpcCall(method, params, timeoutMs);
 }
 async function forwardRecordCheckpoint(session, type, hint, selector) {
   return rpcCall("record:checkpoint", { session, type, hint, selector }, 1e4);