@xbrowser/cli 1.12.0 → 1.14.0

package/dist/{browser-XPDMY2NX.js → browser-5A6AL62M.js}

@@ -20,8 +20,8 @@ import {
   saveSessionDiskMeta,
   setActivePage,
   touchSession
-} from "./chunk-KJTABK3Z.js";
-import "./chunk-Z6CUR3VG.js";
+} from "./chunk-ZD4OSYOX.js";
+import "./chunk-UPAWITVM.js";
 import "./chunk-3FWLW7FS.js";
 import "./chunk-TNEN6VQ2.js";
 import "./chunk-GDKLH7ZY.js";

package/dist/{browser-ILXTEWH4.js → browser-DI6UQN6Q.js}

@@ -20,7 +20,7 @@ import {
   saveSessionDiskMeta,
   setActivePage,
   touchSession
-} from "./chunk-OVW2UEWN.js";
+} from "./chunk-BTFKJD7Z.js";
 import "./chunk-TNEN6VQ2.js";
 import "./chunk-GDKLH7ZY.js";
 import "./chunk-KFQGP6VL.js";

package/dist/{browser-3HQKDZQ6.js → browser-KJWBHGHX.js}

@@ -20,8 +20,8 @@ import {
   saveSessionDiskMeta,
   setActivePage,
   touchSession
-} from "./chunk-R6IJ6PIV.js";
-import "./chunk-DKM2JOZL.js";
+} from "./chunk-B753M33E.js";
+import "./chunk-PYQGDBAF.js";
 import "./chunk-TNEN6VQ2.js";
 import "./chunk-GDKLH7ZY.js";
 import "./chunk-A6LPGFAL.js";

package/dist/{cdp-driver-ESH3PDE6.js → cdp-driver-4SFS6GNY.js}

@@ -14,7 +14,7 @@ import {
   scrollIntoView,
   waitForActionable,
   waitForNetworkIdle
-} from "./chunk-Z6CUR3VG.js";
+} from "./chunk-UPAWITVM.js";
 import "./chunk-3FWLW7FS.js";
 import {
   connectToCDP,

package/dist/{cdp-driver-YIKR4BUX.js → cdp-driver-AHKUT57K.js}

@@ -14,7 +14,7 @@ import {
   scrollIntoView,
   waitForActionable,
   waitForNetworkIdle
-} from "./chunk-DKM2JOZL.js";
+} from "./chunk-PYQGDBAF.js";
 import {
   connectToCDP,
   findChrome,

package/dist/{cdp-driver-N2E2ZNSC.js → cdp-driver-QXTXJZH7.js}

@@ -122,10 +122,10 @@ function buildStealthInitScript() {
     "    var op=arguments[2];",
     '    if(typeof f!=="function")return o.call(this,t,f,op);',
     "    var w=function(e){",
-    "      if(!e||e.constructor===FocusEvent||e.constructor===KeyboardEvent)return f.call(this,e);",
+    "      if(!e)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return k.isTrusted;',
+    '        if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
     '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
@@ -144,7 +144,9 @@ function buildStealthInitScript() {
     '  Object.defineProperty(Screen.prototype,"height",{get:_gh,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availWidth",{get:_gw,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availHeight",{get:_gah,configurable:true});',
-    "  document.hasFocus=function(){return true};",
+    // hasFocus 与 visibilityState 联动（d29）：恒 true 在 hidden 标签下暴露
+    // —— 真实浏览器失焦/后台时 hasFocus=false
+    '  document.hasFocus=function(){return document.visibilityState==="visible";};',
     // 4. Canvas/WebGL fingerprint: per-session stable noise (d20).
     //    Headless software raster differs subtly from Chrome GPU raster —
     //    toDataURL hashes fingerprint the rasterizer. Inject a stable
@@ -220,9 +222,32 @@ function buildStealthInitScript() {
     "    var _sv=speechSynthesis.getVoices.bind(speechSynthesis);",
     "    speechSynthesis.getVoices=function(){",
     "      var real=_sv();",
-    "      if(real&&real.length)return real;",
+    "      if(real&&real.length>50)return real;",
+    // 注意阈值从 0 改 50：iframe 原生约 10 个 —— 原阈值下 iframe 返回原生 10 个
+    // 而不是伪装 180（d33 暴露）。>50 = 主文档伪装列表已生效，其余返回伪装。
     '      return _fakeVoices.map(function(n,i){return {name:n,lang:i<2?"en-US":i<6?"en-GB":"zh-TW",localService:true,default:i===0,voiceURI:n};});',
     "    };",
+    // d33 修复：iframe 的 speechSynthesis 是独立实例（主文档 hook 不可达）——
+    // 轮询同源 iframe，对其 contentWindow.speechSynthesis 同样 patch
+    "  try{",
+    "    var _piv=function(){",
+    '      var frs=document.querySelectorAll("iframe");',
+    "      for(var i=0;i<frs.length;i++){try{",
+    "        var cw=frs[i].contentWindow;",
+    "        if(!cw||!cw.speechSynthesis||cw.speechSynthesis.__xbP)continue;",
+    "        cw.speechSynthesis.__xbP=true;",
+    "        var _sv2=cw.speechSynthesis.getVoices.bind(cw.speechSynthesis);",
+    "        cw.speechSynthesis.getVoices=function(){var r=_sv2();if(r&&r.length>50)return r;",
+    '          return _fakeVoices.map(function(n,j){return{name:n,lang:j<2?"en-US":j<6?"en-GB":"zh-TW",localService:true,default:j===0,voiceURI:n};});};',
+    "      }catch(e2){}}",
+    "    };",
+    "    setInterval(_piv,2000);",
+    "    var _mo=new MutationObserver(function(muts){",
+    "      for(var k=0;k<muts.length;k++){var ns=muts[k].addedNodes;",
+    '        for(var q=0;q<ns.length;q++){if(ns[q].tagName==="IFRAME")setTimeout(_piv,20);}}',
+    "    });",
+    "    _mo.observe(document.documentElement,{childList:true,subtree:true});",
+    "  }catch(e){}",
     "  }catch(e){}",
     "  try{",
     "    var _gb=navigator.getBattery.bind(navigator);",
@@ -244,6 +269,14 @@ function buildStealthInitScript() {
     "        return offer;});",
     "    };",
     "  }catch(e){}",
+    // 3d-2. performance.now precision clamp (d34): full-precision timestamps
+    //     (11 decimals) differ from site-isolation-clamped real Chrome (~100μs).
+    "  try{",
+    "    var _pn=performance.now.bind(performance);",
+    "    performance.now=function(){return Math.round(_pn()*10)/10;};",
+    '    var _pto=Object.getOwnPropertyDescriptor(Performance.prototype,"timeOrigin");',
+    '    if(_pto&&_pto.get){Object.defineProperty(performance,"timeOrigin",{get:function(){return _pto.get.call(performance);},configurable:true});}',
+    "  }catch(e){}",
     // 3d. Chrome object depth (d24): automation fakes usually only set
     //     window.chrome = {}; deep checks hit app.run/runtime/csi/loadTimes.
     "  try{",
@@ -282,7 +315,7 @@ function buildStealthInitScript() {
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return k.isTrusted;',
+    '    if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
     '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",
@@ -502,9 +535,22 @@ var XBKeyboardImpl = class {
     await this.dispatchKeyEvent(params);
   }
   async type(text, opts = {}) {
-    const delay = opts.delay ?? 0;
+    const stealth = opts.stealth ?? process.env.XBROWSER_STEALTH !== "off";
+    const fixedDelay = opts.delay ?? 0;
     for (const char of text) {
-      if (delay > 0) await sleep2(delay);
+      if (fixedDelay > 0) {
+        await sleep2(fixedDelay);
+      } else if (stealth) {
+        const roll = Math.random();
+        const cfg = DEFAULT_STEALTH_CONFIG.typingRhythm;
+        if (roll < cfg.pauseProb) {
+          await sleep2(rand(cfg.pauseRange[0], cfg.pauseRange[1]));
+        } else if (roll < cfg.pauseProb + cfg.fastProb) {
+          await sleep2(rand(cfg.fastRange[0], cfg.fastRange[1]));
+        } else {
+          await sleep2(rand(cfg.normalRange[0], cfg.normalRange[1]));
+        }
+      }
       const mapping = resolveKeyMapping(char);
       const downParams = {
         type: "rawKeyDown",

package/dist/{chunk-R6IJ6PIV.js → chunk-B753M33E.js}

@@ -1,6 +1,6 @@
 import {
   launch
-} from "./chunk-DKM2JOZL.js";
+} from "./chunk-PYQGDBAF.js";
 import {
   errMsg
 } from "./chunk-GDKLH7ZY.js";

package/dist/{chunk-OVW2UEWN.js → chunk-BTFKJD7Z.js}

@@ -127,10 +127,10 @@ function buildStealthInitScript() {
     "    var op=arguments[2];",
     '    if(typeof f!=="function")return o.call(this,t,f,op);',
     "    var w=function(e){",
-    "      if(!e||e.constructor===FocusEvent||e.constructor===KeyboardEvent)return f.call(this,e);",
+    "      if(!e)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return k.isTrusted;',
+    '        if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
     '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
@@ -149,7 +149,9 @@ function buildStealthInitScript() {
     '  Object.defineProperty(Screen.prototype,"height",{get:_gh,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availWidth",{get:_gw,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availHeight",{get:_gah,configurable:true});',
-    "  document.hasFocus=function(){return true};",
+    // hasFocus 与 visibilityState 联动（d29）：恒 true 在 hidden 标签下暴露
+    // —— 真实浏览器失焦/后台时 hasFocus=false
+    '  document.hasFocus=function(){return document.visibilityState==="visible";};',
     // 4. Canvas/WebGL fingerprint: per-session stable noise (d20).
     //    Headless software raster differs subtly from Chrome GPU raster —
     //    toDataURL hashes fingerprint the rasterizer. Inject a stable
@@ -225,9 +227,32 @@ function buildStealthInitScript() {
     "    var _sv=speechSynthesis.getVoices.bind(speechSynthesis);",
     "    speechSynthesis.getVoices=function(){",
     "      var real=_sv();",
-    "      if(real&&real.length)return real;",
+    "      if(real&&real.length>50)return real;",
+    // 注意阈值从 0 改 50：iframe 原生约 10 个 —— 原阈值下 iframe 返回原生 10 个
+    // 而不是伪装 180（d33 暴露）。>50 = 主文档伪装列表已生效，其余返回伪装。
     '      return _fakeVoices.map(function(n,i){return {name:n,lang:i<2?"en-US":i<6?"en-GB":"zh-TW",localService:true,default:i===0,voiceURI:n};});',
     "    };",
+    // d33 修复：iframe 的 speechSynthesis 是独立实例（主文档 hook 不可达）——
+    // 轮询同源 iframe，对其 contentWindow.speechSynthesis 同样 patch
+    "  try{",
+    "    var _piv=function(){",
+    '      var frs=document.querySelectorAll("iframe");',
+    "      for(var i=0;i<frs.length;i++){try{",
+    "        var cw=frs[i].contentWindow;",
+    "        if(!cw||!cw.speechSynthesis||cw.speechSynthesis.__xbP)continue;",
+    "        cw.speechSynthesis.__xbP=true;",
+    "        var _sv2=cw.speechSynthesis.getVoices.bind(cw.speechSynthesis);",
+    "        cw.speechSynthesis.getVoices=function(){var r=_sv2();if(r&&r.length>50)return r;",
+    '          return _fakeVoices.map(function(n,j){return{name:n,lang:j<2?"en-US":j<6?"en-GB":"zh-TW",localService:true,default:j===0,voiceURI:n};});};',
+    "      }catch(e2){}}",
+    "    };",
+    "    setInterval(_piv,2000);",
+    "    var _mo=new MutationObserver(function(muts){",
+    "      for(var k=0;k<muts.length;k++){var ns=muts[k].addedNodes;",
+    '        for(var q=0;q<ns.length;q++){if(ns[q].tagName==="IFRAME")setTimeout(_piv,20);}}',
+    "    });",
+    "    _mo.observe(document.documentElement,{childList:true,subtree:true});",
+    "  }catch(e){}",
     "  }catch(e){}",
     "  try{",
     "    var _gb=navigator.getBattery.bind(navigator);",
@@ -249,6 +274,14 @@ function buildStealthInitScript() {
     "        return offer;});",
     "    };",
     "  }catch(e){}",
+    // 3d-2. performance.now precision clamp (d34): full-precision timestamps
+    //     (11 decimals) differ from site-isolation-clamped real Chrome (~100μs).
+    "  try{",
+    "    var _pn=performance.now.bind(performance);",
+    "    performance.now=function(){return Math.round(_pn()*10)/10;};",
+    '    var _pto=Object.getOwnPropertyDescriptor(Performance.prototype,"timeOrigin");',
+    '    if(_pto&&_pto.get){Object.defineProperty(performance,"timeOrigin",{get:function(){return _pto.get.call(performance);},configurable:true});}',
+    "  }catch(e){}",
     // 3d. Chrome object depth (d24): automation fakes usually only set
     //     window.chrome = {}; deep checks hit app.run/runtime/csi/loadTimes.
     "  try{",
@@ -287,7 +320,7 @@ function buildStealthInitScript() {
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return k.isTrusted;',
+    '    if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
     '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",
@@ -507,9 +540,22 @@ var XBKeyboardImpl = class {
     await this.dispatchKeyEvent(params);
   }
   async type(text, opts = {}) {
-    const delay = opts.delay ?? 0;
+    const stealth = opts.stealth ?? process.env.XBROWSER_STEALTH !== "off";
+    const fixedDelay = opts.delay ?? 0;
     for (const char of text) {
-      if (delay > 0) await sleep2(delay);
+      if (fixedDelay > 0) {
+        await sleep2(fixedDelay);
+      } else if (stealth) {
+        const roll = Math.random();
+        const cfg = DEFAULT_STEALTH_CONFIG.typingRhythm;
+        if (roll < cfg.pauseProb) {
+          await sleep2(rand(cfg.pauseRange[0], cfg.pauseRange[1]));
+        } else if (roll < cfg.pauseProb + cfg.fastProb) {
+          await sleep2(rand(cfg.fastRange[0], cfg.fastRange[1]));
+        } else {
+          await sleep2(rand(cfg.normalRange[0], cfg.normalRange[1]));
+        }
+      }
       const mapping = resolveKeyMapping(char);
       const downParams = {
         type: "rawKeyDown",

package/dist/{chunk-DKM2JOZL.js → chunk-PYQGDBAF.js}

@@ -124,10 +124,10 @@ function buildStealthInitScript() {
     "    var op=arguments[2];",
     '    if(typeof f!=="function")return o.call(this,t,f,op);',
     "    var w=function(e){",
-    "      if(!e||e.constructor===FocusEvent||e.constructor===KeyboardEvent)return f.call(this,e);",
+    "      if(!e)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return k.isTrusted;',
+    '        if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
     '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
@@ -146,7 +146,9 @@ function buildStealthInitScript() {
     '  Object.defineProperty(Screen.prototype,"height",{get:_gh,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availWidth",{get:_gw,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availHeight",{get:_gah,configurable:true});',
-    "  document.hasFocus=function(){return true};",
+    // hasFocus 与 visibilityState 联动（d29）：恒 true 在 hidden 标签下暴露
+    // —— 真实浏览器失焦/后台时 hasFocus=false
+    '  document.hasFocus=function(){return document.visibilityState==="visible";};',
     // 4. Canvas/WebGL fingerprint: per-session stable noise (d20).
     //    Headless software raster differs subtly from Chrome GPU raster —
     //    toDataURL hashes fingerprint the rasterizer. Inject a stable
@@ -222,9 +224,32 @@ function buildStealthInitScript() {
     "    var _sv=speechSynthesis.getVoices.bind(speechSynthesis);",
     "    speechSynthesis.getVoices=function(){",
     "      var real=_sv();",
-    "      if(real&&real.length)return real;",
+    "      if(real&&real.length>50)return real;",
+    // 注意阈值从 0 改 50：iframe 原生约 10 个 —— 原阈值下 iframe 返回原生 10 个
+    // 而不是伪装 180（d33 暴露）。>50 = 主文档伪装列表已生效，其余返回伪装。
     '      return _fakeVoices.map(function(n,i){return {name:n,lang:i<2?"en-US":i<6?"en-GB":"zh-TW",localService:true,default:i===0,voiceURI:n};});',
     "    };",
+    // d33 修复：iframe 的 speechSynthesis 是独立实例（主文档 hook 不可达）——
+    // 轮询同源 iframe，对其 contentWindow.speechSynthesis 同样 patch
+    "  try{",
+    "    var _piv=function(){",
+    '      var frs=document.querySelectorAll("iframe");',
+    "      for(var i=0;i<frs.length;i++){try{",
+    "        var cw=frs[i].contentWindow;",
+    "        if(!cw||!cw.speechSynthesis||cw.speechSynthesis.__xbP)continue;",
+    "        cw.speechSynthesis.__xbP=true;",
+    "        var _sv2=cw.speechSynthesis.getVoices.bind(cw.speechSynthesis);",
+    "        cw.speechSynthesis.getVoices=function(){var r=_sv2();if(r&&r.length>50)return r;",
+    '          return _fakeVoices.map(function(n,j){return{name:n,lang:j<2?"en-US":j<6?"en-GB":"zh-TW",localService:true,default:j===0,voiceURI:n};});};',
+    "      }catch(e2){}}",
+    "    };",
+    "    setInterval(_piv,2000);",
+    "    var _mo=new MutationObserver(function(muts){",
+    "      for(var k=0;k<muts.length;k++){var ns=muts[k].addedNodes;",
+    '        for(var q=0;q<ns.length;q++){if(ns[q].tagName==="IFRAME")setTimeout(_piv,20);}}',
+    "    });",
+    "    _mo.observe(document.documentElement,{childList:true,subtree:true});",
+    "  }catch(e){}",
     "  }catch(e){}",
     "  try{",
     "    var _gb=navigator.getBattery.bind(navigator);",
@@ -246,6 +271,14 @@ function buildStealthInitScript() {
     "        return offer;});",
     "    };",
     "  }catch(e){}",
+    // 3d-2. performance.now precision clamp (d34): full-precision timestamps
+    //     (11 decimals) differ from site-isolation-clamped real Chrome (~100μs).
+    "  try{",
+    "    var _pn=performance.now.bind(performance);",
+    "    performance.now=function(){return Math.round(_pn()*10)/10;};",
+    '    var _pto=Object.getOwnPropertyDescriptor(Performance.prototype,"timeOrigin");',
+    '    if(_pto&&_pto.get){Object.defineProperty(performance,"timeOrigin",{get:function(){return _pto.get.call(performance);},configurable:true});}',
+    "  }catch(e){}",
     // 3d. Chrome object depth (d24): automation fakes usually only set
     //     window.chrome = {}; deep checks hit app.run/runtime/csi/loadTimes.
     "  try{",
@@ -284,7 +317,7 @@ function buildStealthInitScript() {
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return k.isTrusted;',
+    '    if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
     '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",
@@ -504,9 +537,22 @@ var XBKeyboardImpl = class {
     await this.dispatchKeyEvent(params);
   }
   async type(text, opts = {}) {
-    const delay = opts.delay ?? 0;
+    const stealth = opts.stealth ?? process.env.XBROWSER_STEALTH !== "off";
+    const fixedDelay = opts.delay ?? 0;
     for (const char of text) {
-      if (delay > 0) await sleep2(delay);
+      if (fixedDelay > 0) {
+        await sleep2(fixedDelay);
+      } else if (stealth) {
+        const roll = Math.random();
+        const cfg = DEFAULT_STEALTH_CONFIG.typingRhythm;
+        if (roll < cfg.pauseProb) {
+          await sleep2(rand(cfg.pauseRange[0], cfg.pauseRange[1]));
+        } else if (roll < cfg.pauseProb + cfg.fastProb) {
+          await sleep2(rand(cfg.fastRange[0], cfg.fastRange[1]));
+        } else {
+          await sleep2(rand(cfg.normalRange[0], cfg.normalRange[1]));
+        }
+      }
       const mapping = resolveKeyMapping(char);
       const downParams = {
         type: "rawKeyDown",

package/dist/{chunk-Z6CUR3VG.js → chunk-UPAWITVM.js}

@@ -125,10 +125,10 @@ function buildStealthInitScript() {
     "    var op=arguments[2];",
     '    if(typeof f!=="function")return o.call(this,t,f,op);',
     "    var w=function(e){",
-    "      if(!e||e.constructor===FocusEvent||e.constructor===KeyboardEvent)return f.call(this,e);",
+    "      if(!e)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return k.isTrusted;',
+    '        if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
     '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
@@ -147,7 +147,9 @@ function buildStealthInitScript() {
     '  Object.defineProperty(Screen.prototype,"height",{get:_gh,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availWidth",{get:_gw,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availHeight",{get:_gah,configurable:true});',
-    "  document.hasFocus=function(){return true};",
+    // hasFocus 与 visibilityState 联动（d29）：恒 true 在 hidden 标签下暴露
+    // —— 真实浏览器失焦/后台时 hasFocus=false
+    '  document.hasFocus=function(){return document.visibilityState==="visible";};',
     // 4. Canvas/WebGL fingerprint: per-session stable noise (d20).
     //    Headless software raster differs subtly from Chrome GPU raster —
     //    toDataURL hashes fingerprint the rasterizer. Inject a stable
@@ -223,9 +225,32 @@ function buildStealthInitScript() {
     "    var _sv=speechSynthesis.getVoices.bind(speechSynthesis);",
     "    speechSynthesis.getVoices=function(){",
     "      var real=_sv();",
-    "      if(real&&real.length)return real;",
+    "      if(real&&real.length>50)return real;",
+    // 注意阈值从 0 改 50：iframe 原生约 10 个 —— 原阈值下 iframe 返回原生 10 个
+    // 而不是伪装 180（d33 暴露）。>50 = 主文档伪装列表已生效，其余返回伪装。
     '      return _fakeVoices.map(function(n,i){return {name:n,lang:i<2?"en-US":i<6?"en-GB":"zh-TW",localService:true,default:i===0,voiceURI:n};});',
     "    };",
+    // d33 修复：iframe 的 speechSynthesis 是独立实例（主文档 hook 不可达）——
+    // 轮询同源 iframe，对其 contentWindow.speechSynthesis 同样 patch
+    "  try{",
+    "    var _piv=function(){",
+    '      var frs=document.querySelectorAll("iframe");',
+    "      for(var i=0;i<frs.length;i++){try{",
+    "        var cw=frs[i].contentWindow;",
+    "        if(!cw||!cw.speechSynthesis||cw.speechSynthesis.__xbP)continue;",
+    "        cw.speechSynthesis.__xbP=true;",
+    "        var _sv2=cw.speechSynthesis.getVoices.bind(cw.speechSynthesis);",
+    "        cw.speechSynthesis.getVoices=function(){var r=_sv2();if(r&&r.length>50)return r;",
+    '          return _fakeVoices.map(function(n,j){return{name:n,lang:j<2?"en-US":j<6?"en-GB":"zh-TW",localService:true,default:j===0,voiceURI:n};});};',
+    "      }catch(e2){}}",
+    "    };",
+    "    setInterval(_piv,2000);",
+    "    var _mo=new MutationObserver(function(muts){",
+    "      for(var k=0;k<muts.length;k++){var ns=muts[k].addedNodes;",
+    '        for(var q=0;q<ns.length;q++){if(ns[q].tagName==="IFRAME")setTimeout(_piv,20);}}',
+    "    });",
+    "    _mo.observe(document.documentElement,{childList:true,subtree:true});",
+    "  }catch(e){}",
     "  }catch(e){}",
     "  try{",
     "    var _gb=navigator.getBattery.bind(navigator);",
@@ -247,6 +272,14 @@ function buildStealthInitScript() {
     "        return offer;});",
     "    };",
     "  }catch(e){}",
+    // 3d-2. performance.now precision clamp (d34): full-precision timestamps
+    //     (11 decimals) differ from site-isolation-clamped real Chrome (~100μs).
+    "  try{",
+    "    var _pn=performance.now.bind(performance);",
+    "    performance.now=function(){return Math.round(_pn()*10)/10;};",
+    '    var _pto=Object.getOwnPropertyDescriptor(Performance.prototype,"timeOrigin");',
+    '    if(_pto&&_pto.get){Object.defineProperty(performance,"timeOrigin",{get:function(){return _pto.get.call(performance);},configurable:true});}',
+    "  }catch(e){}",
     // 3d. Chrome object depth (d24): automation fakes usually only set
     //     window.chrome = {}; deep checks hit app.run/runtime/csi/loadTimes.
     "  try{",
@@ -285,7 +318,7 @@ function buildStealthInitScript() {
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return k.isTrusted;',
+    '    if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
     '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",
@@ -505,9 +538,22 @@ var XBKeyboardImpl = class {
     await this.dispatchKeyEvent(params);
   }
   async type(text, opts = {}) {
-    const delay = opts.delay ?? 0;
+    const stealth = opts.stealth ?? process.env.XBROWSER_STEALTH !== "off";
+    const fixedDelay = opts.delay ?? 0;
     for (const char of text) {
-      if (delay > 0) await sleep2(delay);
+      if (fixedDelay > 0) {
+        await sleep2(fixedDelay);
+      } else if (stealth) {
+        const roll = Math.random();
+        const cfg = DEFAULT_STEALTH_CONFIG.typingRhythm;
+        if (roll < cfg.pauseProb) {
+          await sleep2(rand(cfg.pauseRange[0], cfg.pauseRange[1]));
+        } else if (roll < cfg.pauseProb + cfg.fastProb) {
+          await sleep2(rand(cfg.fastRange[0], cfg.fastRange[1]));
+        } else {
+          await sleep2(rand(cfg.normalRange[0], cfg.normalRange[1]));
+        }
+      }
       const mapping = resolveKeyMapping(char);
       const downParams = {
         type: "rawKeyDown",

package/dist/{chunk-KJTABK3Z.js → chunk-ZD4OSYOX.js}

@@ -1,7 +1,7 @@
 import {
   createRuleEngine,
   launch
-} from "./chunk-Z6CUR3VG.js";
+} from "./chunk-UPAWITVM.js";
 import {
   errMsg
 } from "./chunk-GDKLH7ZY.js";

package/dist/cli.js

@@ -59,7 +59,7 @@ import {
   resolveLaunchOpts,
   saveSessionDiskMeta,
   setActivePage
-} from "./chunk-OVW2UEWN.js";
+} from "./chunk-BTFKJD7Z.js";
 import "./chunk-TNEN6VQ2.js";
 import {
   errMsg
@@ -7523,7 +7523,7 @@ async function executeCommand(commandName, params, sessionName = "default", extr
   }
   let targetPageOverride = null;
   if (_target && extraOpts?.cdpEndpoint) {
-    const { findTargetPage } = await import("./browser-ILXTEWH4.js");
+    const { findTargetPage } = await import("./browser-DI6UQN6Q.js");
     targetPageOverride = await findTargetPage(extraOpts.cdpEndpoint, _target);
     if (!targetPageOverride) {
       return errorResult(`Target "${_target}" not found. Use 'xbrowser targets --cdp ${extraOpts.cdpEndpoint}' to list available pages.`);
@@ -13663,7 +13663,7 @@ Run "xbrowser ${command} ${subCommand} --help" to see available parameters.`
               const targetPage = pages[cmdTabIndex];
               await targetPage.bringToFront().catch(() => {
               });
-              const { setActivePage: setActivePage2 } = await import("./browser-ILXTEWH4.js");
+              const { setActivePage: setActivePage2 } = await import("./browser-DI6UQN6Q.js");
               setActivePage2(session, targetPage);
             }
           }
@@ -13939,7 +13939,7 @@ async function main() {
     const command = process.argv[2];
     const isLongRunning = command === "preview" || command === "serve";
     if (!isLongRunning) {
-      const { ensureProcessCanExit } = await import("./browser-ILXTEWH4.js");
+      const { ensureProcessCanExit } = await import("./browser-DI6UQN6Q.js");
       await ensureProcessCanExit().catch(() => {
       });
       process.exit(process.exitCode || exitCode);

package/dist/daemon-main.js

@@ -30,10 +30,10 @@ import {
   resolveLaunchOpts,
   saveSessionDiskMeta,
   setActivePage
-} from "./chunk-KJTABK3Z.js";
+} from "./chunk-ZD4OSYOX.js";
 import {
   createRuleEngine
-} from "./chunk-Z6CUR3VG.js";
+} from "./chunk-UPAWITVM.js";
 import {
   queryJS
 } from "./chunk-3FWLW7FS.js";
@@ -7041,7 +7041,7 @@ async function executeCommand(commandName, params, sessionName = "default", extr
   }
   let targetPageOverride = null;
   if (_target && extraOpts?.cdpEndpoint) {
-    const { findTargetPage } = await import("./browser-XPDMY2NX.js");
+    const { findTargetPage } = await import("./browser-5A6AL62M.js");
     targetPageOverride = await findTargetPage(extraOpts.cdpEndpoint, _target);
     if (!targetPageOverride) {
       return errorResult(`Target "${_target}" not found. Use 'xbrowser targets --cdp ${extraOpts.cdpEndpoint}' to list available pages.`);
@@ -8857,7 +8857,7 @@ function createRPCHandler() {
     if (isNewFormat) {
       try {
         const replayErrors = [];
-        const { SessionReplayer } = await import("./session-replayer-K4A6OI4M.js");
+        const { SessionReplayer } = await import("./session-replayer-I3PJFO3H.js");
         const replayer = new SessionReplayer({
           page: session.page,
           stepDelay: slowMo * 500,

package/dist/index.js

@@ -92,8 +92,8 @@ import {
   resolveLaunchOpts,
   saveSessionDiskMeta,
   setActivePage
-} from "./chunk-R6IJ6PIV.js";
-import "./chunk-DKM2JOZL.js";
+} from "./chunk-B753M33E.js";
+import "./chunk-PYQGDBAF.js";
 import "./chunk-TNEN6VQ2.js";
 import {
   errMsg
@@ -7873,7 +7873,7 @@ async function executeCommand(commandName, params, sessionName = "default", extr
   }
   let targetPageOverride = null;
   if (_target && extraOpts?.cdpEndpoint) {
-    const { findTargetPage } = await import("./browser-3HQKDZQ6.js");
+    const { findTargetPage } = await import("./browser-KJWBHGHX.js");
     targetPageOverride = await findTargetPage(extraOpts.cdpEndpoint, _target);
     if (!targetPageOverride) {
       return errorResult(`Target "${_target}" not found. Use 'xbrowser targets --cdp ${extraOpts.cdpEndpoint}' to list available pages.`);
@@ -14051,7 +14051,7 @@ Run "xbrowser ${command} ${subCommand} --help" to see available parameters.`
               const targetPage = pages[cmdTabIndex];
               await targetPage.bringToFront().catch(() => {
               });
-              const { setActivePage: setActivePage2 } = await import("./browser-3HQKDZQ6.js");
+              const { setActivePage: setActivePage2 } = await import("./browser-KJWBHGHX.js");
               setActivePage2(session, targetPage);
             }
           }
@@ -17224,7 +17224,7 @@ var DataCollector = class {
     return results;
   }
   async createBrowserContext() {
-    const { launch } = await import("./cdp-driver-YIKR4BUX.js");
+    const { launch } = await import("./cdp-driver-AHKUT57K.js");
     const { browser } = await launch({
       headless: true,
       args: ["--no-sandbox", "--disable-setuid-sandbox"]

package/dist/{session-replayer-K4A6OI4M.js → session-replayer-I3PJFO3H.js}

@@ -34,7 +34,7 @@ var SessionReplayer = class {
     if (this.opts.page) {
       this.page = this.opts.page;
     } else if (this.opts.cdpUrl) {
-      const { launch } = await import("./cdp-driver-ESH3PDE6.js");
+      const { launch } = await import("./cdp-driver-4SFS6GNY.js");
       const { browser } = await launch({ cdpEndpoint: this.opts.cdpUrl });
       let contexts = browser.contexts();
       for (let i = 0; i < 10 && contexts.length === 0; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xbrowser/cli",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "description": "Browser automation CLI for web scraping, headless browsing, SEO analysis, and AI agent workflows. A command-line alternative to Playwright, Puppeteer, and Selenium.",
   "type": "module",
   "bin": {