@xbrowser/cli 1.18.2 → 1.19.0

package/dist/{browser-BEERPZPB.js → browser-6LH6KJSW.js}

@@ -20,7 +20,7 @@ import {
   saveSessionDiskMeta,
   setActivePage,
   touchSession
-} from "./chunk-7SDM4EA4.js";
+} from "./chunk-KLXLNQI5.js";
 import "./chunk-3KZ34AUC.js";
 import "./chunk-GDKLH7ZY.js";
 import "./chunk-KFQGP6VL.js";

package/dist/{browser-TFFGGXOA.js → browser-TUD2KA5G.js}

@@ -20,8 +20,8 @@ import {
   saveSessionDiskMeta,
   setActivePage,
   touchSession
-} from "./chunk-MTNVT2T7.js";
-import "./chunk-LL37GYPP.js";
+} from "./chunk-2BPZ25RE.js";
+import "./chunk-LKJZYVIX.js";
 import "./chunk-3KZ34AUC.js";
 import "./chunk-GDKLH7ZY.js";
 import "./chunk-A6LPGFAL.js";

package/dist/{browser-AEQS6325.js → browser-Y5SIE6LY.js}

@@ -20,8 +20,8 @@ import {
   saveSessionDiskMeta,
   setActivePage,
   touchSession
-} from "./chunk-NA7IP6PO.js";
-import "./chunk-DVKIL7H6.js";
+} from "./chunk-C6PW3CPA.js";
+import "./chunk-GKYSCHT4.js";
 import "./chunk-3FWLW7FS.js";
 import "./chunk-3KZ34AUC.js";
 import "./chunk-GDKLH7ZY.js";

package/dist/{cdp-driver-KT6HL33W.js → cdp-driver-2EECZW4X.js}

@@ -14,7 +14,7 @@ import {
   scrollIntoView,
   waitForActionable,
   waitForNetworkIdle
-} from "./chunk-LL37GYPP.js";
+} from "./chunk-LKJZYVIX.js";
 import {
   connectToCDP,
   findChrome,

package/dist/{cdp-driver-4UAV56SQ.js → cdp-driver-7HO5SRNN.js}

@@ -14,7 +14,7 @@ import {
   scrollIntoView,
   waitForActionable,
   waitForNetworkIdle
-} from "./chunk-DVKIL7H6.js";
+} from "./chunk-GKYSCHT4.js";
 import "./chunk-3FWLW7FS.js";
 import {
   connectToCDP,

package/dist/{cdp-driver-NNBPNFF2.js → cdp-driver-E7G3VHIB.js}

@@ -133,8 +133,17 @@ function buildStealthInitScript() {
     "      if(!e)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
-    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
+    // S124 修正（d67 攻防）：恒 true 是"过度伪装"——站点自己的合成事件
+    // 也变 true → 直接判定浏览器被篡改（比检测自动化更严重的指纹暴露）。
+    // 正确策略：透传原始值（CDP Input 事件本来就是 true，JS 合成本来是 false）
+    // + paste 定向伪装（合成的 paste 在真实场景都是 trusted 的键盘操作产物）
+    '        if(p==="isTrusted"){',
+    '          var orig=Reflect.get(k,"isTrusted");',
+    "          if(orig===true)return true;",
+    '          if(k.type==="paste")return true;',
+    "          return orig;",
+    "        }",
+    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
     "        }",
@@ -144,6 +153,30 @@ function buildStealthInitScript() {
     "    return o.call(this,t,w,op);",
     "  };",
     "  EventTarget.prototype.addEventListener=_ael;",
+    // window.event isTrusted 伪装（S123）：AEL 参数包装收不到 window.event
+    // （它是原始 Event 对象的隐式引用）。定义 getter 拦截读取。
+    "  try{",
+    '    var _weDesc=Object.getOwnPropertyDescriptor(Window.prototype,"event");',
+    "    if(_weDesc&&_weDesc.get){",
+    "      var _origWeGet=_weDesc.get;",
+    '      Object.defineProperty(Window.prototype,"event",{',
+    "        configurable:true,",
+    "        get:function(){",
+    "          var ev=_origWeGet.call(this);",
+    "          if(!ev)return ev;",
+    "          return new Proxy(ev,{get:function(k,p){",
+    '            if(p==="isTrusted"){',
+    '              var orig=Reflect.get(k,"isTrusted");',
+    "              if(orig===true)return true;",
+    '              if(k.type==="paste")return true;',
+    "              return orig;",
+    "            }",
+    '            var v=Reflect.get(k,p);return typeof v==="function"?v.bind(k):v;',
+    "          }});",
+    "        }",
+    "      });",
+    "    }",
+    "  }catch(e){}",
     // 2. Screen override (prototype-level, not instance-level)
     "  var _gw=function(){return 1728};",
     "  var _gh=function(){return 1117};",
@@ -401,7 +434,12 @@ function buildStealthInitScript() {
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
+    '    if(p==="isTrusted"){',
+    '      var orig=Reflect.get(k,"isTrusted");',
+    "      if(orig===true)return true;",
+    '      if(k.type==="paste")return true;',
+    "      return orig;",
+    "    }",
     '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",

package/dist/{chunk-MTNVT2T7.js → chunk-2BPZ25RE.js}

@@ -1,6 +1,6 @@
 import {
   launch
-} from "./chunk-LL37GYPP.js";
+} from "./chunk-LKJZYVIX.js";
 import {
   errMsg
 } from "./chunk-GDKLH7ZY.js";
@@ -68,7 +68,9 @@ async function resolveCDPEndpoint(raw) {
   }
   if (raw.startsWith("http://") || raw.startsWith("https://")) {
     try {
-      const httpResp = await fetchNoProxy(`${raw}/json/version`);
+      const u = new URL(raw);
+      u.pathname = (u.pathname.replace(/\/+$/, "") || "") + "/json/version";
+      const httpResp = await fetchNoProxy(u.toString());
       const data = await httpResp.json();
       if (!data.webSocketDebuggerUrl) {
         throw new Error(`Could not discover CDP endpoint from ${raw}`);
@@ -206,9 +208,17 @@ function discoverChromiumPath() {
   }
   return void 0;
 }
+var _browserPool = /* @__PURE__ */ new Map();
 async function createBrowser(options) {
   if (options?.cdpEndpoint) {
     const realEndpoint = await resolveCDPEndpoint(options.cdpEndpoint);
+    if (!options.intercept) {
+      const pooled = _browserPool.get(realEndpoint);
+      if (pooled && !pooled.disconnected) {
+        return pooled;
+      }
+      if (pooled) _browserPool.delete(realEndpoint);
+    }
     if (options.intercept) {
       const config = typeof options.intercept === "object" ? { ...options.intercept, cdpEndpoint: realEndpoint } : { cdpEndpoint: realEndpoint };
       _sharedCdpProxy = new CDPInterceptorProxy(config);
@@ -221,6 +231,7 @@ async function createBrowser(options) {
     await browser2.discoverContexts().catch((err) => {
       console.error(`[browser] discoverContexts failed: ${errMsg(err)}`);
     });
+    if (!options.intercept) _browserPool.set(realEndpoint, browser2);
     return browser2;
   }
   const executablePath = options?.executablePath || process.env.XBROWSER_CHROMIUM_PATH || discoverChromiumPath();

package/dist/{chunk-NA7IP6PO.js → chunk-C6PW3CPA.js}

@@ -1,7 +1,7 @@
 import {
   createRuleEngine,
   launch
-} from "./chunk-DVKIL7H6.js";
+} from "./chunk-GKYSCHT4.js";
 import {
   errMsg
 } from "./chunk-GDKLH7ZY.js";
@@ -495,7 +495,9 @@ async function resolveCDPEndpoint(raw) {
   }
   if (raw.startsWith("http://") || raw.startsWith("https://")) {
     try {
-      const httpResp = await fetchNoProxy(`${raw}/json/version`);
+      const u = new URL(raw);
+      u.pathname = (u.pathname.replace(/\/+$/, "") || "") + "/json/version";
+      const httpResp = await fetchNoProxy(u.toString());
       const data = await httpResp.json();
       if (!data.webSocketDebuggerUrl) {
         throw new Error(`Could not discover CDP endpoint from ${raw}`);
@@ -633,9 +635,17 @@ function discoverChromiumPath() {
   }
   return void 0;
 }
+var _browserPool = /* @__PURE__ */ new Map();
 async function createBrowser(options) {
   if (options?.cdpEndpoint) {
     const realEndpoint = await resolveCDPEndpoint(options.cdpEndpoint);
+    if (!options.intercept) {
+      const pooled = _browserPool.get(realEndpoint);
+      if (pooled && !pooled.disconnected) {
+        return pooled;
+      }
+      if (pooled) _browserPool.delete(realEndpoint);
+    }
     if (options.intercept) {
       const config = typeof options.intercept === "object" ? { ...options.intercept, cdpEndpoint: realEndpoint } : { cdpEndpoint: realEndpoint };
       _sharedCdpProxy = new CDPInterceptorProxy(config);
@@ -648,6 +658,7 @@ async function createBrowser(options) {
     await browser2.discoverContexts().catch((err) => {
       console.error(`[browser] discoverContexts failed: ${errMsg(err)}`);
     });
+    if (!options.intercept) _browserPool.set(realEndpoint, browser2);
     return browser2;
   }
   const executablePath = options?.executablePath || process.env.XBROWSER_CHROMIUM_PATH || discoverChromiumPath();

package/dist/{chunk-DVKIL7H6.js → chunk-GKYSCHT4.js}

@@ -144,8 +144,17 @@ function buildStealthInitScript() {
     "      if(!e)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
-    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
+    // S124 修正（d67 攻防）：恒 true 是"过度伪装"——站点自己的合成事件
+    // 也变 true → 直接判定浏览器被篡改（比检测自动化更严重的指纹暴露）。
+    // 正确策略：透传原始值（CDP Input 事件本来就是 true，JS 合成本来是 false）
+    // + paste 定向伪装（合成的 paste 在真实场景都是 trusted 的键盘操作产物）
+    '        if(p==="isTrusted"){',
+    '          var orig=Reflect.get(k,"isTrusted");',
+    "          if(orig===true)return true;",
+    '          if(k.type==="paste")return true;',
+    "          return orig;",
+    "        }",
+    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
     "        }",
@@ -155,6 +164,30 @@ function buildStealthInitScript() {
     "    return o.call(this,t,w,op);",
     "  };",
     "  EventTarget.prototype.addEventListener=_ael;",
+    // window.event isTrusted 伪装（S123）：AEL 参数包装收不到 window.event
+    // （它是原始 Event 对象的隐式引用）。定义 getter 拦截读取。
+    "  try{",
+    '    var _weDesc=Object.getOwnPropertyDescriptor(Window.prototype,"event");',
+    "    if(_weDesc&&_weDesc.get){",
+    "      var _origWeGet=_weDesc.get;",
+    '      Object.defineProperty(Window.prototype,"event",{',
+    "        configurable:true,",
+    "        get:function(){",
+    "          var ev=_origWeGet.call(this);",
+    "          if(!ev)return ev;",
+    "          return new Proxy(ev,{get:function(k,p){",
+    '            if(p==="isTrusted"){',
+    '              var orig=Reflect.get(k,"isTrusted");',
+    "              if(orig===true)return true;",
+    '              if(k.type==="paste")return true;',
+    "              return orig;",
+    "            }",
+    '            var v=Reflect.get(k,p);return typeof v==="function"?v.bind(k):v;',
+    "          }});",
+    "        }",
+    "      });",
+    "    }",
+    "  }catch(e){}",
     // 2. Screen override (prototype-level, not instance-level)
     "  var _gw=function(){return 1728};",
     "  var _gh=function(){return 1117};",
@@ -412,7 +445,12 @@ function buildStealthInitScript() {
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
+    '    if(p==="isTrusted"){',
+    '      var orig=Reflect.get(k,"isTrusted");',
+    "      if(orig===true)return true;",
+    '      if(k.type==="paste")return true;',
+    "      return orig;",
+    "    }",
     '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",

package/dist/{chunk-7SDM4EA4.js → chunk-KLXLNQI5.js}

@@ -146,8 +146,17 @@ function buildStealthInitScript() {
     "      if(!e)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
-    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
+    // S124 修正（d67 攻防）：恒 true 是"过度伪装"——站点自己的合成事件
+    // 也变 true → 直接判定浏览器被篡改（比检测自动化更严重的指纹暴露）。
+    // 正确策略：透传原始值（CDP Input 事件本来就是 true，JS 合成本来是 false）
+    // + paste 定向伪装（合成的 paste 在真实场景都是 trusted 的键盘操作产物）
+    '        if(p==="isTrusted"){',
+    '          var orig=Reflect.get(k,"isTrusted");',
+    "          if(orig===true)return true;",
+    '          if(k.type==="paste")return true;',
+    "          return orig;",
+    "        }",
+    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
     "        }",
@@ -157,6 +166,30 @@ function buildStealthInitScript() {
     "    return o.call(this,t,w,op);",
     "  };",
     "  EventTarget.prototype.addEventListener=_ael;",
+    // window.event isTrusted 伪装（S123）：AEL 参数包装收不到 window.event
+    // （它是原始 Event 对象的隐式引用）。定义 getter 拦截读取。
+    "  try{",
+    '    var _weDesc=Object.getOwnPropertyDescriptor(Window.prototype,"event");',
+    "    if(_weDesc&&_weDesc.get){",
+    "      var _origWeGet=_weDesc.get;",
+    '      Object.defineProperty(Window.prototype,"event",{',
+    "        configurable:true,",
+    "        get:function(){",
+    "          var ev=_origWeGet.call(this);",
+    "          if(!ev)return ev;",
+    "          return new Proxy(ev,{get:function(k,p){",
+    '            if(p==="isTrusted"){',
+    '              var orig=Reflect.get(k,"isTrusted");',
+    "              if(orig===true)return true;",
+    '              if(k.type==="paste")return true;',
+    "              return orig;",
+    "            }",
+    '            var v=Reflect.get(k,p);return typeof v==="function"?v.bind(k):v;',
+    "          }});",
+    "        }",
+    "      });",
+    "    }",
+    "  }catch(e){}",
     // 2. Screen override (prototype-level, not instance-level)
     "  var _gw=function(){return 1728};",
     "  var _gh=function(){return 1117};",
@@ -414,7 +447,12 @@ function buildStealthInitScript() {
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
+    '    if(p==="isTrusted"){',
+    '      var orig=Reflect.get(k,"isTrusted");',
+    "      if(orig===true)return true;",
+    '      if(k.type==="paste")return true;',
+    "      return orig;",
+    "    }",
     '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",
@@ -5373,7 +5411,9 @@ async function resolveCDPEndpoint(raw) {
   }
   if (raw.startsWith("http://") || raw.startsWith("https://")) {
     try {
-      const httpResp = await fetchNoProxy(`${raw}/json/version`);
+      const u = new URL(raw);
+      u.pathname = (u.pathname.replace(/\/+$/, "") || "") + "/json/version";
+      const httpResp = await fetchNoProxy(u.toString());
       const data = await httpResp.json();
       if (!data.webSocketDebuggerUrl) {
         throw new Error(`Could not discover CDP endpoint from ${raw}`);
@@ -5511,9 +5551,17 @@ function discoverChromiumPath() {
   }
   return void 0;
 }
+var _browserPool = /* @__PURE__ */ new Map();
 async function createBrowser(options) {
   if (options?.cdpEndpoint) {
     const realEndpoint = await resolveCDPEndpoint(options.cdpEndpoint);
+    if (!options.intercept) {
+      const pooled = _browserPool.get(realEndpoint);
+      if (pooled && !pooled.disconnected) {
+        return pooled;
+      }
+      if (pooled) _browserPool.delete(realEndpoint);
+    }
     if (options.intercept) {
       const config = typeof options.intercept === "object" ? { ...options.intercept, cdpEndpoint: realEndpoint } : { cdpEndpoint: realEndpoint };
       _sharedCdpProxy = new CDPInterceptorProxy(config);
@@ -5526,6 +5574,7 @@ async function createBrowser(options) {
     await browser2.discoverContexts().catch((err) => {
       console.error(`[browser] discoverContexts failed: ${errMsg(err)}`);
     });
+    if (!options.intercept) _browserPool.set(realEndpoint, browser2);
     return browser2;
   }
   const executablePath = options?.executablePath || process.env.XBROWSER_CHROMIUM_PATH || discoverChromiumPath();

package/dist/{chunk-LL37GYPP.js → chunk-LKJZYVIX.js}

@@ -143,8 +143,17 @@ function buildStealthInitScript() {
     "      if(!e)return f.call(this,e);",
     "      return f.call(this,new Proxy(e,{get:function(k,p){",
     '        if(p==="sourceCapabilities")return fc;',
-    '        if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
-    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
+    // S124 修正（d67 攻防）：恒 true 是"过度伪装"——站点自己的合成事件
+    // 也变 true → 直接判定浏览器被篡改（比检测自动化更严重的指纹暴露）。
+    // 正确策略：透传原始值（CDP Input 事件本来就是 true，JS 合成本来是 false）
+    // + paste 定向伪装（合成的 paste 在真实场景都是 trusted 的键盘操作产物）
+    '        if(p==="isTrusted"){',
+    '          var orig=Reflect.get(k,"isTrusted");',
+    "          if(orig===true)return true;",
+    '          if(k.type==="paste")return true;',
+    "          return orig;",
+    "        }",
+    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])){',
     "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
     "          return k[p]+_f;",
     "        }",
@@ -154,6 +163,30 @@ function buildStealthInitScript() {
     "    return o.call(this,t,w,op);",
     "  };",
     "  EventTarget.prototype.addEventListener=_ael;",
+    // window.event isTrusted 伪装（S123）：AEL 参数包装收不到 window.event
+    // （它是原始 Event 对象的隐式引用）。定义 getter 拦截读取。
+    "  try{",
+    '    var _weDesc=Object.getOwnPropertyDescriptor(Window.prototype,"event");',
+    "    if(_weDesc&&_weDesc.get){",
+    "      var _origWeGet=_weDesc.get;",
+    '      Object.defineProperty(Window.prototype,"event",{',
+    "        configurable:true,",
+    "        get:function(){",
+    "          var ev=_origWeGet.call(this);",
+    "          if(!ev)return ev;",
+    "          return new Proxy(ev,{get:function(k,p){",
+    '            if(p==="isTrusted"){',
+    '              var orig=Reflect.get(k,"isTrusted");',
+    "              if(orig===true)return true;",
+    '              if(k.type==="paste")return true;',
+    "              return orig;",
+    "            }",
+    '            var v=Reflect.get(k,p);return typeof v==="function"?v.bind(k):v;',
+    "          }});",
+    "        }",
+    "      });",
+    "    }",
+    "  }catch(e){}",
     // 2. Screen override (prototype-level, not instance-level)
     "  var _gw=function(){return 1728};",
     "  var _gh=function(){return 1117};",
@@ -411,7 +444,12 @@ function buildStealthInitScript() {
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
     "  var _ba=function(k,p){",
-    '    if(p==="isTrusted")return Reflect.get(k,"isTrusted");',
+    '    if(p==="isTrusted"){',
+    '      var orig=Reflect.get(k,"isTrusted");',
+    "      if(orig===true)return true;",
+    '      if(k.type==="paste")return true;',
+    "      return orig;",
+    "    }",
     '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
     "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
     "    }",