@xbrowser/cli 1.18.1 → 1.19.0

package/dist/{chunk-OU335JBI.js → chunk-KLXLNQI5.js}

@@ -146,8 +146,17 @@ function buildStealthInitScript() {
     "      if(!e)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
-    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
+    // S124 修正（d67 攻防）：恒 true 是"过度伪装"——站点自己的合成事件
+    // 也变 true → 直接判定浏览器被篡改（比检测自动化更严重的指纹暴露）。
+    // 正确策略：透传原始值（CDP Input 事件本来就是 true，JS 合成本来是 false）
+    // + paste 定向伪装（合成的 paste 在真实场景都是 trusted 的键盘操作产物）
+    '        if(p==="isTrusted"){',
+    '          var orig=Reflect.get(k,"isTrusted");',
+    "          if(orig===true)return true;",
+    '          if(k.type==="paste")return true;',
+    "          return orig;",
+    "        }",
+    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
     "        }",
@@ -157,6 +166,30 @@ function buildStealthInitScript() {
     "    return o.call(this,t,w,op);",
     "  };",
     "  EventTarget.prototype.addEventListener=_ael;",
+    // window.event isTrusted 伪装（S123）：AEL 参数包装收不到 window.event
+    // （它是原始 Event 对象的隐式引用）。定义 getter 拦截读取。
+    "  try{",
+    '    var _weDesc=Object.getOwnPropertyDescriptor(Window.prototype,"event");',
+    "    if(_weDesc&&_weDesc.get){",
+    "      var _origWeGet=_weDesc.get;",
+    '      Object.defineProperty(Window.prototype,"event",{',
+    "        configurable:true,",
+    "        get:function(){",
+    "          var ev=_origWeGet.call(this);",
+    "          if(!ev)return ev;",
+    "          return new Proxy(ev,{get:function(k,p){",
+    '            if(p==="isTrusted"){',
+    '              var orig=Reflect.get(k,"isTrusted");',
+    "              if(orig===true)return true;",
+    '              if(k.type==="paste")return true;',
+    "              return orig;",
+    "            }",
+    '            var v=Reflect.get(k,p);return typeof v==="function"?v.bind(k):v;',
+    "          }});",
+    "        }",
+    "      });",
+    "    }",
+    "  }catch(e){}",
     // 2. Screen override (prototype-level, not instance-level)
     "  var _gw=function(){return 1728};",
     "  var _gh=function(){return 1117};",
@@ -414,7 +447,12 @@ function buildStealthInitScript() {
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
+    '    if(p==="isTrusted"){',
+    '      var orig=Reflect.get(k,"isTrusted");',
+    "      if(orig===true)return true;",
+    '      if(k.type==="paste")return true;',
+    "      return orig;",
+    "    }",
     '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",
@@ -5373,7 +5411,9 @@ async function resolveCDPEndpoint(raw) {
   }
   if (raw.startsWith("http://") || raw.startsWith("https://")) {
     try {
-      const httpResp = await fetchNoProxy(`${raw}/json/version`);
+      const u = new URL(raw);
+      u.pathname = (u.pathname.replace(/\/+$/, "") || "") + "/json/version";
+      const httpResp = await fetchNoProxy(u.toString());
       const data = await httpResp.json();
       if (!data.webSocketDebuggerUrl) {
         throw new Error(`Could not discover CDP endpoint from ${raw}`);
@@ -5511,9 +5551,17 @@ function discoverChromiumPath() {
   }
   return void 0;
 }
+var _browserPool = /* @__PURE__ */ new Map();
 async function createBrowser(options) {
   if (options?.cdpEndpoint) {
     const realEndpoint = await resolveCDPEndpoint(options.cdpEndpoint);
+    if (!options.intercept) {
+      const pooled = _browserPool.get(realEndpoint);
+      if (pooled && !pooled.disconnected) {
+        return pooled;
+      }
+      if (pooled) _browserPool.delete(realEndpoint);
+    }
     if (options.intercept) {
       const config = typeof options.intercept === "object" ? { ...options.intercept, cdpEndpoint: realEndpoint } : { cdpEndpoint: realEndpoint };
       _sharedCdpProxy = new CDPInterceptorProxy(config);
@@ -5526,6 +5574,7 @@ async function createBrowser(options) {
     await browser2.discoverContexts().catch((err) => {
       console.error(`[browser] discoverContexts failed: ${errMsg(err)}`);
     });
+    if (!options.intercept) _browserPool.set(realEndpoint, browser2);
     return browser2;
   }
   const executablePath = options?.executablePath || process.env.XBROWSER_CHROMIUM_PATH || discoverChromiumPath();
@@ -5912,11 +5961,37 @@ async function createSession(name, url, options) {
     }
     context = contexts[0] || await b.newContext();
     let targetPage = null;
-    if (targetHostname) {
+    const ownedUrls = /* @__PURE__ */ new Set();
+    for (const ssn of sessions.list()) {
+      try {
+        const u = ssn.page?.url();
+        if (u && u !== "about:blank") ownedUrls.add(u);
+      } catch {
+      }
+    }
+    if (url) {
+      for (const ctx of contexts) {
+        for (const p of ctx.pages()) {
+          try {
+            const pUrl = await resolvePageUrl(p);
+            if (ownedUrls.has(pUrl)) continue;
+            if (pUrl === url) {
+              targetPage = p;
+              break;
+            }
+          } catch {
+          }
+        }
+        if (targetPage) break;
+      }
+    }
+    if (!targetPage && targetHostname) {
       for (const ctx of contexts) {
         const pages = ctx.pages();
         for (const p of pages) {
-          const pUrl = await resolvePageUrl(p);
+          const pUrl0 = await resolvePageUrl(p);
+          if (ownedUrls.has(pUrl0)) continue;
+          const pUrl = pUrl0;
           if (isRealPageUrl(pUrl) && pUrl.includes(targetHostname)) {
             targetPage = p;
             break;
@@ -5929,7 +6004,9 @@ async function createSession(name, url, options) {
       for (const ctx of contexts) {
         const pages = ctx.pages();
         for (const p of pages) {
-          const pUrl = await resolvePageUrl(p);
+          const pUrl0 = await resolvePageUrl(p);
+          if (ownedUrls.has(pUrl0)) continue;
+          const pUrl = pUrl0;
           if (isRealPageUrl(pUrl)) {
             targetPage = p;
             break;
@@ -5940,13 +6017,36 @@ async function createSession(name, url, options) {
     }
     if (!targetPage && options?.cdpEndpoint) {
       const targets = await getCDPTargets2(options.cdpEndpoint);
+      const ownedUrlsT = /* @__PURE__ */ new Set();
+      for (const ssn of sessions.list()) {
+        try {
+          const u = ssn.page?.url();
+          if (u && u !== "about:blank") ownedUrlsT.add(u);
+        } catch {
+        }
+      }
       const matchTarget = targets.find(
-        (t) => t.url && t.url !== "about:blank" && !t.url.startsWith("chrome://") && !t.url.startsWith("chrome-untrusted://") && !t.url.startsWith("chrome-error://") && (url ? t.url.includes(new URL(url).hostname) : true)
+        (t) => t.url && t.url !== "about:blank" && !t.url.startsWith("chrome://") && !t.url.startsWith("chrome-untrusted://") && !t.url.startsWith("chrome-error://") && !ownedUrlsT.has(t.url) && (url ? t.url === url || t.url.includes(new URL(url).hostname) : true)
       );
       if (matchTarget && matchTarget.url) {
+        const ownedUrls2 = /* @__PURE__ */ new Set();
+        for (const ssn of sessions.list()) {
+          try {
+            const u = ssn.page?.url();
+            if (u && u !== "about:blank") ownedUrls2.add(u);
+          } catch {
+          }
+        }
+        const isOwned = (p) => {
+          try {
+            return ownedUrls2.has(p.url());
+          } catch {
+            return false;
+          }
+        };
         const existing2 = context.pages().find((p) => {
           try {
-            return p.url() === matchTarget.url;
+            return p.url() === matchTarget.url && !isOwned(p);
           } catch {
             return false;
           }
@@ -5964,7 +6064,10 @@ async function createSession(name, url, options) {
       const pages = context.pages();
       if (pages.length > 1) {
         try {
+          const owned = /* @__PURE__ */ new Set();
+          for (const ssn of sessions.list()) owned.add(ssn.page);
           for (const p of pages) {
+            if (owned.has(p)) continue;
             const vis = await p.evaluate("document.visibilityState").catch(() => "hidden");
             if (vis === "visible") {
               targetPage = p;

package/dist/{chunk-LL37GYPP.js → chunk-LKJZYVIX.js}

@@ -143,8 +143,17 @@ function buildStealthInitScript() {
     "      if(!e)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
-    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
+    // S124 修正（d67 攻防）：恒 true 是"过度伪装"——站点自己的合成事件
+    // 也变 true → 直接判定浏览器被篡改（比检测自动化更严重的指纹暴露）。
+    // 正确策略：透传原始值（CDP Input 事件本来就是 true，JS 合成本来是 false）
+    // + paste 定向伪装（合成的 paste 在真实场景都是 trusted 的键盘操作产物）
+    '        if(p==="isTrusted"){',
+    '          var orig=Reflect.get(k,"isTrusted");',
+    "          if(orig===true)return true;",
+    '          if(k.type==="paste")return true;',
+    "          return orig;",
+    "        }",
+    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
     "        }",
@@ -154,6 +163,30 @@ function buildStealthInitScript() {
     "    return o.call(this,t,w,op);",
     "  };",
     "  EventTarget.prototype.addEventListener=_ael;",
+    // window.event isTrusted 伪装（S123）：AEL 参数包装收不到 window.event
+    // （它是原始 Event 对象的隐式引用）。定义 getter 拦截读取。
+    "  try{",
+    '    var _weDesc=Object.getOwnPropertyDescriptor(Window.prototype,"event");',
+    "    if(_weDesc&&_weDesc.get){",
+    "      var _origWeGet=_weDesc.get;",
+    '      Object.defineProperty(Window.prototype,"event",{',
+    "        configurable:true,",
+    "        get:function(){",
+    "          var ev=_origWeGet.call(this);",
+    "          if(!ev)return ev;",
+    "          return new Proxy(ev,{get:function(k,p){",
+    '            if(p==="isTrusted"){',
+    '              var orig=Reflect.get(k,"isTrusted");',
+    "              if(orig===true)return true;",
+    '              if(k.type==="paste")return true;',
+    "              return orig;",
+    "            }",
+    '            var v=Reflect.get(k,p);return typeof v==="function"?v.bind(k):v;',
+    "          }});",
+    "        }",
+    "      });",
+    "    }",
+    "  }catch(e){}",
     // 2. Screen override (prototype-level, not instance-level)
     "  var _gw=function(){return 1728};",
     "  var _gh=function(){return 1117};",
@@ -411,7 +444,12 @@ function buildStealthInitScript() {
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
+    '    if(p==="isTrusted"){',
+    '      var orig=Reflect.get(k,"isTrusted");',
+    "      if(orig===true)return true;",
+    '      if(k.type==="paste")return true;',
+    "      return orig;",
+    "    }",
     '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",