@xbrowser/cli 1.19.0 → 1.21.0

package/dist/{chunk-LKJZYVIX.js → chunk-HWWG2ISJ.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-GDKLH7ZY.js";
 import {
   createRuleEngine
-} from "./chunk-H2A5JUK5.js";
+} from "./chunk-75DNUI6M.js";
 import {
   __require
 } from "./chunk-KFQGP6VL.js";
@@ -23,6 +23,25 @@ import { EventEmitter } from "events";
 
 // src/cdp-driver/stealth.ts
 var DEFAULT_STEALTH_CONFIG = {
+  // S191: macOS arm64 + Chrome 151 真实采样（来源：登录桥只读通道）
+  uaChProfile: {
+    brands: [
+      { brand: "Not=A?Brand", version: "99" },
+      { brand: "Google Chrome", version: "151" },
+      { brand: "Chromium", version: "151" }
+    ],
+    platform: "macOS",
+    platformVersion: "26.2.0",
+    architecture: "arm",
+    bitness: "64",
+    model: "",
+    uaFullVersion: "151.0.7922.175",
+    fullVersionList: [
+      { brand: "Not=A?Brand", version: "99.0.0.0" },
+      { brand: "Google Chrome", version: "151.0.7922.175" },
+      { brand: "Chromium", version: "151.0.7922.175" }
+    ]
+  },
   bezierCurvature: [0.35, 0.6],
   noiseAmplitude: 5.5,
   overshootRange: [6, 14],
@@ -129,10 +148,13 @@ Object.assign(KEY_MAP, {
   "@": { key: "@", code: "Digit2", vk: 50, shift: true },
   "_": { key: "_", code: "Minus", vk: 189, shift: true }
 });
-function buildStealthInitScript() {
+function buildStealthInitScript(config = DEFAULT_STEALTH_CONFIG) {
+  const prof = config.uaChProfile;
+  const profJson = prof ? JSON.stringify(prof) : "null";
   return [
     "(function(){",
     '  window.__xbStealthVer="57";',
+    "  window.__xbUaChProf=" + profJson + ";",
     // 1. AEL event proxy
     "  var o=EventTarget.prototype.addEventListener;",
     "  var fc=new InputDeviceCapabilities({firesTouchEvents:false});",
@@ -195,9 +217,65 @@ function buildStealthInitScript() {
     '  Object.defineProperty(Screen.prototype,"height",{get:_gh,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availWidth",{get:_gw,configurable:true});',
     '  Object.defineProperty(Screen.prototype,"availHeight",{get:_gah,configurable:true});',
+    // S174: UA Headless 标记清洗——headless launch 的 UA 含 HeadlessChrome/xxx
+    // （最高频检测面），同步清洗 userAgent/appVersion/userAgentData(brands+高熵值)。
+    // 原型+实例双层覆写（S172 模式）。
+    "  try{",
+    '    var fixUA=function(ua){return String(ua).replace("HeadlessChrome","Chrome");};',
+    '    var fixBrands=function(list){return (list||[]).map(function(b){return (b.brand&&b.brand.indexOf("Headless")!==-1)?Object.assign({},b,{brand:b.brand.replace("HeadlessChrome","Chrome")}):b;});};',
+    '    var _nuad=Object.getOwnPropertyDescriptor(Navigator.prototype,"userAgentData");',
+    "    var wrapUAD=function(uad){",
+    "      if(!uad||uad.__xbUA)return uad;",
+    "      try{",
+    '        Object.defineProperty(uad,"brands",{get:function(){return fixBrands(_nuad.get.call(navigator).brands);},configurable:true});',
+    "        var _ghev=uad.getHighEntropyValues.bind(uad);",
+    "        uad.getHighEntropyValues=function(hints){return _ghev(hints).then(function(v){",
+    '          var o={};for(var k in v){o[k]=(typeof v[k]==="string")?fixUA(v[k]):(Array.isArray(v[k])?fixBrands(v[k]):v[k]);}',
+    "          return o;});};",
+    "        uad.__xbUA=true;",
+    "      }catch(e){}",
+    "      return uad;",
+    "    };",
+    '    var _nua=Object.getOwnPropertyDescriptor(Navigator.prototype,"userAgent");',
+    "    if(_nua&&_nua.get){",
+    "      var _nuag=function(){return fixUA(_nua.get.call(this));};",
+    '      _nuag.toString=function(){return "function get userAgent() { [native code] }";};',
+    '      Object.defineProperty(Navigator.prototype,"userAgent",{get:_nuag,configurable:true});',
+    "    }",
+    '    Object.defineProperty(navigator,"userAgent",{get:function(){return fixUA(_nua?_nua.get.call(this):"");},configurable:true});',
+    "    if(_nuad&&_nuad.get){",
+    "      var _nuadg=function(){return wrapUAD(_nuad.get.call(this));};",
+    '      _nuadg.toString=function(){return "function get userAgentData() { [native code] }";};',
+    '      Object.defineProperty(Navigator.prototype,"userAgentData",{get:_nuadg,configurable:true});',
+    "    }",
+    // S190: userAgentData 垫片——headless Chrome 151 不暴露 UA-CH API，
+    // 缺失本身即 headless 指纹。从 UA 派生 brands/platform 垫片 + getHighEntropyValues。
+    "    if(!navigator.userAgentData && window.__xbUaChProf){",
+    "      var prof = window.__xbUaChProf;",
+    "      var uad={",
+    '        brands:prof.brands.map(function(b){return {brand:b.brand,version:b.version.split(".")[0]}}),',
+    "        mobile:false,",
+    "        platform:prof.platform,",
+    "        getHighEntropyValues:function(hints){",
+    "          return Promise.resolve().then(function(){",
+    "            var all={brands:uad.brands,mobile:false,platform:prof.platform,",
+    "              platformVersion:prof.platformVersion,architecture:prof.architecture,bitness:prof.bitness,model:prof.model,",
+    "              uaFullVersion:prof.uaFullVersion,",
+    "              fullVersionList:prof.fullVersionList};",
+    "            var out={};",
+    "            (hints||[]).forEach(function(h){if(h in all)out[h]=all[h]});",
+    "            return out;",
+    "          });",
+    "        },",
+    "        toJSON:function(){return{brands:uad.brands,mobile:false,platform:prof.platform}}",
+    "      };",
+    '      Object.defineProperty(navigator,"userAgentData",{get:function(){return uad},configurable:true});',
+    "    }",
+    "  }catch(e){}",
     // hasFocus 与 visibilityState 联动（d29）：恒 true 在 hidden 标签下暴露
     // —— 真实浏览器失焦/后台时 hasFocus=false
-    '  document.hasFocus=function(){return document.visibilityState==="visible";};',
+    // S172: 原型层覆写——实例赋值可被 Document.prototype.hasFocus.call(document) 逃逸
+    '  Document.prototype.hasFocus=function(){return document.visibilityState==="visible";};',
     // 4. Canvas/WebGL fingerprint: per-session stable noise (d20).
     //    Headless software raster differs subtly from Chrome GPU raster —
     //    toDataURL hashes fingerprint the rasterizer. Inject a stable
@@ -260,26 +338,25 @@ function buildStealthInitScript() {
     "  }catch(e){}",
     // 3b. Font metrics + speechSynthesis + battery (d22): headless tells
     "  try{",
-    "    var _mt=CanvasRenderingContext2D.prototype.measureText;",
     '    var _tmw=Object.getOwnPropertyDescriptor(TextMetrics.prototype,"width");',
-    "    CanvasRenderingContext2D.prototype.measureText=function(t){",
-    "      var m=_mt.call(this,t);",
-    '      try{Object.defineProperty(m,"width",{get:function(){return _tmw.get.call(m)+_dx*0.01;},configurable:true});}catch(e){}',
-    "      return m;",
-    "    };",
+    "    if(_tmw&&_tmw.get){",
+    "      // S172: \u539F\u578B\u5C42\u8986\u5199\u2014\u2014\u5B9E\u4F8B(m)\u8986\u5199\u53EF\u88AB TextMetrics.prototype.width getter \u9003\u9038",
+    '      Object.defineProperty(TextMetrics.prototype,"width",{get:function(){return _tmw.get.call(this)+_dx*0.01;},configurable:true});',
+    "    }",
     "  }catch(e){}",
     "  try{",
     '    var _fakeVoices=["Alex","Daniel","Karen","Moira","Ralph","Samantha","Ting-Ting","Mei-Jia","Sinji","Yunda"];',
-    "    var _sv=speechSynthesis.getVoices.bind(speechSynthesis);",
-    "    speechSynthesis.getVoices=function(){",
-    "      var real=_sv();",
+    // S172: 原型层覆写——实例赋值可被 SpeechSynthesis.prototype.getVoices.call() 逃逸
+    "    var _sv=SpeechSynthesis.prototype.getVoices;",
+    "    SpeechSynthesis.prototype.getVoices=function(){",
+    "      var real=_sv.call(this);",
     "      if(real&&real.length>50)return real;",
     // 注意阈值从 0 改 50：iframe 原生约 10 个 —— 原阈值下 iframe 返回原生 10 个
     // 而不是伪装 180（d33 暴露）。>50 = 主文档伪装列表已生效，其余返回伪装。
     '      return _fakeVoices.map(function(n,i){return {name:n,lang:i<2?"en-US":i<6?"en-GB":"zh-TW",localService:true,default:i===0,voiceURI:n};});',
     "    };",
     // d33 修复：iframe 的 speechSynthesis 是独立实例（主文档 hook 不可达）——
-    // 轮询同源 iframe，对其 contentWindow.speechSynthesis 同样 patch
+    // 轮询同源 iframe，对其 contentWindow 的原型同样 patch（S172: 原型层，防逃逸）
     "  try{",
     "    var _piv=function(){",
     '      var frs=document.querySelectorAll("iframe");',
@@ -287,8 +364,8 @@ function buildStealthInitScript() {
     "        var cw=frs[i].contentWindow;",
     "        if(!cw||!cw.speechSynthesis||cw.speechSynthesis.__xbP)continue;",
     "        cw.speechSynthesis.__xbP=true;",
-    "        var _sv2=cw.speechSynthesis.getVoices.bind(cw.speechSynthesis);",
-    "        cw.speechSynthesis.getVoices=function(){var r=_sv2();if(r&&r.length>50)return r;",
+    "        var _sv2=cw.SpeechSynthesis.prototype.getVoices;",
+    "        cw.SpeechSynthesis.prototype.getVoices=function(){var r=_sv2.call(this);if(r&&r.length>50)return r;",
     '          return _fakeVoices.map(function(n,j){return{name:n,lang:j<2?"en-US":j<6?"en-GB":"zh-TW",localService:true,default:j===0,voiceURI:n};});};',
     "      }catch(e2){}}",
     "    };",
@@ -323,10 +400,21 @@ function buildStealthInitScript() {
     // 3d-2. performance.now precision clamp (d34): full-precision timestamps
     //     (11 decimals) differ from site-isolation-clamped real Chrome (~100μs).
     "  try{",
-    "    var _pn=performance.now.bind(performance);",
-    "    performance.now=function(){return Math.round(_pn()*10)/10;};",
+    "    var _pn=Performance.prototype.now;",
+    "    // S172: \u539F\u578B\u5C42\u8986\u5199\u2014\u2014\u5B9E\u4F8B\u8D4B\u503C\u53EF\u88AB Performance.prototype.now.call(performance) \u9003\u9038",
+    "    Performance.prototype.now=function(){return Math.round(_pn.call(this)*10)/10;};",
     '    var _pto=Object.getOwnPropertyDescriptor(Performance.prototype,"timeOrigin");',
-    '    if(_pto&&_pto.get){Object.defineProperty(performance,"timeOrigin",{get:function(){return _pto.get.call(performance);},configurable:true});}',
+    "    if(_pto&&_pto.get){",
+    "      // S173: timeOrigin \u771F\u4F2A\u88C5\u2014\u2014\u5360\u4F4D\u5C42\uFF08\u8FD4\u56DE\u771F\u503C\uFF09\u5347\u7EA7\u4E3A\u4F1A\u8BDD\u7EA7\u968F\u673A\u504F\u79FB\u3002",
+    "      // \u9632 cross-page \u5BFC\u822A\u65F6\u523B\u5173\u8054\uFF1A\u4E0D\u540C\u7AD9\u70B9\u7528 timeOrigin \u7CBE\u786E\u5BF9\u9F50\u7528\u6237\u884C\u4E3A\u6863\u6848\u3002",
+    "      // \u504F\u79FB\u7531\u672C\u9875 _seed \u6D3E\u751F\uFF08\u9875\u5185\u81EA\u6D3D\uFF0Cnow()+\u504F\u79FB\u4E00\u81F4\uFF09\uFF0C\u8DE8\u9875\u968F\u673A\uFF08\u4E0D\u53EF\u5173\u8054\uFF09\u3002",
+    "      var _toff=Math.floor((_seed/2147483647)*600000-300000);",
+    "      var _tog=function(){return _pto.get.call(performance)+_toff;};",
+    '      _tog.toString=function(){return "function get timeOrigin() { [native code] }";};',
+    "      // S172 \u5BA1\u8BA1\uFF1A\u5B9E\u4F8B\u8986\u5199\u53EF\u88AB\u539F\u578B getter \u9003\u9038\u2014\u2014\u539F\u578B\u5C42\u8986\u5199",
+    '      Object.defineProperty(Performance.prototype,"timeOrigin",{get:_tog,configurable:true});',
+    '      Object.defineProperty(performance,"timeOrigin",{get:_tog,configurable:true});',
+    "    }",
     "  }catch(e){}",
     // 3f. getCoalescedEvents 合成（d47）：真实鼠标 125Hz 采样被浏览器按帧合并，
     //     快速移动时 pointermove.getCoalescedEvents() 返回 2~6 个事件（群内
@@ -440,6 +528,9 @@ function buildStealthInitScript() {
     '    if(this===AnalyserNode.prototype.getFloatFrequencyData)return"function getFloatFrequencyData() { [native code] }";',
     '    if(this===AudioBuffer.prototype.getChannelData)return"function getChannelData() { [native code] }";',
     '    if(this===_gceH)return"function getCoalescedEvents() { [native code] }";',
+    '    if(this===Document.prototype.hasFocus)return"function hasFocus() { [native code] }";',
+    '    if(this===Performance.prototype.now)return"function now() { [native code] }";',
+    '    if(this===SpeechSynthesis.prototype.getVoices)return"function getVoices() { [native code] }";',
     "    return _ts.call(this);",
     "  };",
     // 4. onclick prototype hijack (dual-stream consistency)
@@ -1994,7 +2085,7 @@ var XBPageImpl = class _XBPageImpl {
       try {
         await this.conn.send(
           "Page.addScriptToEvaluateOnNewDocument",
-          { source: buildStealthInitScript() },
+          { source: buildStealthInitScript({ ...DEFAULT_STEALTH_CONFIG, ...this._contextImpl.stealthConfig ?? {} }) },
           this.sessionId
         );
       } catch {
@@ -3251,6 +3342,10 @@ var XBContextImpl = class {
     this.options = opts;
     this.setupAutoAttach();
   }
+  /** S194: 任务 tab 的 stealth 配置（UA-CH 档案等）经 context 传给 page 层 */
+  get stealthConfig() {
+    return this.options.stealthConfig;
+  }
   async newPage() {
     if (this.closed) throw new Error("Context is closed");
     const { targetId } = await this._browser._createTarget(this.contextId);
@@ -3417,20 +3512,8 @@ var XBContextImpl = class {
 
 // src/cdp-driver/browser.ts
 var XBBrowserImpl = class {
-  conn;
-  _emitter = new EventEmitter3();
-  _contexts = /* @__PURE__ */ new Map();
-  _disconnected = false;
-  childProcess = null;
-  tmpDir;
-  _exitHandler = null;
-  /**
-   * Original CDP endpoint (HTTP or ws URL) used to construct this browser.
-   * Used by discoverContexts() as a fallback to HTTP /json/list when
-   * Target.getTargets doesn't return page-type targets (e.g. cdp-tunnel proxy).
-   */
-  cdpEndpoint;
-  constructor(conn, childProcess, tmpDir, cdpEndpoint) {
+  constructor(conn, childProcess, tmpDir, cdpEndpoint, launchOpts) {
+    this.launchOpts = launchOpts;
     this.conn = conn;
     this.childProcess = childProcess ?? null;
     this.tmpDir = tmpDir;
@@ -3458,6 +3541,20 @@ var XBBrowserImpl = class {
       process.on("exit", this._exitHandler);
     }
   }
+  launchOpts;
+  conn;
+  _emitter = new EventEmitter3();
+  _contexts = /* @__PURE__ */ new Map();
+  _disconnected = false;
+  childProcess = null;
+  tmpDir;
+  _exitHandler = null;
+  /**
+   * Original CDP endpoint (HTTP or ws URL) used to construct this browser.
+   * Used by discoverContexts() as a fallback to HTTP /json/list when
+   * Target.getTargets doesn't return page-type targets (e.g. cdp-tunnel proxy).
+   */
+  cdpEndpoint;
   get disconnected() {
     return this._disconnected;
   }
@@ -3485,6 +3582,9 @@ var XBBrowserImpl = class {
     this._emitter.emit("disconnected");
   }
   async newContext(opts = {}) {
+    if (this.launchOpts?.stealthConfig && !opts.stealthConfig) {
+      opts = { ...opts, stealthConfig: this.launchOpts.stealthConfig };
+    }
     if (this._disconnected) {
       throw new Error("Browser is disconnected");
     }
@@ -4038,7 +4138,13 @@ async function launch(options = {}) {
   const conn = new CDPConnection(wsEndpoint);
   await conn.ready();
   const httpEndpoint = options.cdpEndpoint && !options.cdpEndpoint.startsWith("ws") ? options.cdpEndpoint : void 0;
-  const browser = new XBBrowserImpl(conn, childProcess, tmpDir, httpEndpoint);
+  const browser = new XBBrowserImpl(
+    conn,
+    childProcess,
+    tmpDir,
+    httpEndpoint,
+    options.stealthConfig ? { stealthConfig: options.stealthConfig } : void 0
+  );
   return { browser, wsEndpoint };
 }
 

package/dist/{chunk-A6LPGFAL.js → chunk-WYETQ5C7.js}

@@ -1,6 +1,6 @@
 import {
   createRuleEngine
-} from "./chunk-H2A5JUK5.js";
+} from "./chunk-75DNUI6M.js";
 
 // src/cdp-interceptor/proxy.ts
 import { WebSocketServer, WebSocket } from "ws";

package/dist/{chunk-2BPZ25RE.js → chunk-Z5RTK4GW.js}

@@ -1,12 +1,12 @@
 import {
   launch
-} from "./chunk-LKJZYVIX.js";
+} from "./chunk-HWWG2ISJ.js";
 import {
   errMsg
 } from "./chunk-GDKLH7ZY.js";
 import {
   CDPInterceptorProxy
-} from "./chunk-A6LPGFAL.js";
+} from "./chunk-WYETQ5C7.js";
 
 // src/browser.ts
 import { randomUUID } from "crypto";

package/dist/cli.js

@@ -72,7 +72,7 @@ import {
   setActivePage,
   sleep,
   wheelDelta
-} from "./chunk-KLXLNQI5.js";
+} from "./chunk-ESJYANQO.js";
 import "./chunk-3KZ34AUC.js";
 import {
   errMsg
@@ -8248,7 +8248,7 @@ async function executeCommand(commandName, params, sessionName = "default", extr
   }
   let targetPageOverride = null;
   if (_target && extraOpts?.cdpEndpoint) {
-    const { findTargetPage } = await import("./browser-6LH6KJSW.js");
+    const { findTargetPage } = await import("./browser-CNBSH53B.js");
     targetPageOverride = await findTargetPage(extraOpts.cdpEndpoint, _target);
     if (!targetPageOverride) {
       return errorResult(`Target "${_target}" not found. Use 'xbrowser targets --cdp ${extraOpts.cdpEndpoint}' to list available pages.`);
@@ -14433,7 +14433,7 @@ Run "xbrowser ${command} ${subCommand} --help" to see available parameters.`
               const targetPage = pages[cmdTabIndex];
               await targetPage.bringToFront().catch(() => {
               });
-              const { setActivePage: setActivePage2 } = await import("./browser-6LH6KJSW.js");
+              const { setActivePage: setActivePage2 } = await import("./browser-CNBSH53B.js");
               setActivePage2(session, targetPage);
             }
           }
@@ -14709,7 +14709,7 @@ async function main() {
     const command = process.argv[2];
     const isLongRunning = command === "preview" || command === "serve";
     if (!isLongRunning) {
-      const { ensureProcessCanExit } = await import("./browser-6LH6KJSW.js");
+      const { ensureProcessCanExit } = await import("./browser-CNBSH53B.js");
       await ensureProcessCanExit().catch(() => {
       });
       process.exit(process.exitCode || exitCode);

package/dist/daemon-main.js

@@ -34,13 +34,13 @@ import {
   resolveLaunchOpts,
   saveSessionDiskMeta,
   setActivePage
-} from "./chunk-C6PW3CPA.js";
+} from "./chunk-AVSTNODR.js";
 import {
   createRuleEngine,
   rand,
   sleep,
   wheelDelta
-} from "./chunk-GKYSCHT4.js";
+} from "./chunk-CLYZPSDR.js";
 import {
   queryJS
 } from "./chunk-3FWLW7FS.js";
@@ -7766,7 +7766,7 @@ async function executeCommand(commandName, params, sessionName = "default", extr
   }
   let targetPageOverride = null;
   if (_target && extraOpts?.cdpEndpoint) {
-    const { findTargetPage } = await import("./browser-Y5SIE6LY.js");
+    const { findTargetPage } = await import("./browser-C2VEOJC2.js");
     targetPageOverride = await findTargetPage(extraOpts.cdpEndpoint, _target);
     if (!targetPageOverride) {
       return errorResult(`Target "${_target}" not found. Use 'xbrowser targets --cdp ${extraOpts.cdpEndpoint}' to list available pages.`);
@@ -9588,7 +9588,7 @@ function createRPCHandler() {
     if (isNewFormat) {
       try {
         const replayErrors = [];
-        const { SessionReplayer } = await import("./session-replayer-RODZYHM3.js");
+        const { SessionReplayer } = await import("./session-replayer-EVD4HZBB.js");
         const replayer = new SessionReplayer({
           page: session.page,
           stepDelay: slowMo * 500,

package/dist/index.d.ts

@@ -6,6 +6,103 @@ import { ZodType, ZodTypeDef, z } from 'zod';
 
 declare const version: any;
 
+/**
+ * stealth.ts — Behavioral stealth layer for CDP driver
+ *
+ * Enhances mouse/keyboard with human-like patterns:
+ *   • Bezier trajectory with cosine easing + noise + overshoot correction
+ *   • Landing offset from element center (no dead-center clicks)
+ *   • Press/release drift (finger micro-movement)
+ *   • Three-tier typing rhythm with random pauses
+ *   • Typo + backspace correction
+ *   • Wheel exponential decay (momentum)
+ *
+ * Also provides init script for page-level stealth hooks:
+ *
+ * ── 维护红线（S183 站点观测实证）────────────────────────────
+ *   1. 永不覆写 navigator.webdriver —— 原生 false 即最佳伪装。
+ *      掘金等站点以 ~5s/次轮询 Navigator.prototype.webdriver 的
+ *      descriptor（getter native + 实例无覆写 = 正常），任何覆写
+ *      都会在 descriptor 检测下露馅。
+ *   2. 实例覆写必须原型层同步（S172）—— 实例 defineProperty 可被
+ *      X.prototype.p.call(target) 一行逃逸，见 stealth-audit.test.ts。
+ *   3. 覆写函数必须进 toString native 伪装名单（S172b 审计规则 R2）。
+ *   ────────────────────────────────────────────────────────
+ * Also provides init script for page-level stealth hooks:
+ *   • AEL event proxy (sourceCapabilities / isTrusted / coordinate floatification)
+ *   • onclick prototype hijack (dual-stream consistency)
+ *   • Screen/hasFocus override + toString disguise
+ *
+ * 124 rounds of attack-defense validated (output/cdp-duel-s5/)
+ */
+
+interface UaChProfile {
+    /** GREASE brands 形状，例：Not=A?Brand:99（从真实环境采样） */
+    brands: Array<{
+        brand: string;
+        version: string;
+    }>;
+    /** 平台（macOS / Windows / Linux） */
+    platform: string;
+    /** 平台版本（高熵） */
+    platformVersion: string;
+    /** 架构（arm / x86） */
+    architecture: string;
+    /** 位宽（64 / 32） */
+    bitness: string;
+    /** 设备型号（桌面端通常空） */
+    model: string;
+    /** 完整版本号（uaFullVersion，例：151.0.7922.175） */
+    uaFullVersion: string;
+    /** 完整版本列表（fullVersionList，与 brands 同形状+全版本） */
+    fullVersionList: Array<{
+        brand: string;
+        version: string;
+    }>;
+}
+interface StealthConfig {
+    /**
+     * S191: UA-CH 真实档案——垫片在 navigator.userAgentData 缺失时
+     * 以此生成 API 表面（值来自真实有头 Chrome 采样，形状一致）。
+     * 未提供时从 UA 字符串派生兜底值。
+     */
+    uaChProfile?: UaChProfile;
+    /** Bezier curvature range [min, max] as fraction of distance */
+    bezierCurvature: [number, number];
+    /** Trajectory noise amplitude ±px */
+    noiseAmplitude: number;
+    /** Overshoot distance range [min, max] px */
+    overshootRange: [number, number];
+    /** Aim pause before click [min, max] ms */
+    aimPause: [number, number];
+    /** Press duration [min, max] ms */
+    pressDuration: [number, number];
+    /** Release coordinate drift [min, max] px */
+    releaseDrift: [number, number];
+    /** Landing offset for small elements [min, max] px */
+    landingOffsetSmall: [number, number];
+    /** Landing offset for large elements [min, max] px */
+    landingOffsetLarge: [number, number];
+    /** Elements smaller than this (px) use small offset */
+    smallElementThreshold: number;
+    /** Typing rhythm probabilities */
+    typingRhythm: {
+        fastProb: number;
+        fastRange: [number, number];
+        normalRange: [number, number];
+        pauseProb: number;
+        pauseRange: [number, number];
+    };
+    /** Key press duration [min, max] ms */
+    keyPressDuration: [number, number];
+    /** Typo probability per field (0-1) */
+    typoProbability: number;
+    /** Wheel peak delta */
+    wheelPeak: number;
+    /** Wheel decay rate */
+    wheelDecayRate: number;
+}
+
 /**
  * XBrowser CDP Driver — Abstract Interface Types
  *
@@ -38,6 +135,8 @@ interface XBContextOptions {
     userAgent?: string;
     extraHTTPHeaders?: Record<string, string>;
     ignoreHTTPSErrors?: boolean;
+    /** S194: stealth 伪装配置（UA-CH 档案等）——经 context 传至 page 的注入层 */
+    stealthConfig?: Partial<StealthConfig>;
 }
 interface XBContext {
     newPage(): Promise<XBPage>;

package/dist/index.js

@@ -18,7 +18,7 @@ import {
   resolveLaunchOpts,
   saveSessionDiskMeta,
   setActivePage
-} from "./chunk-2BPZ25RE.js";
+} from "./chunk-Z5RTK4GW.js";
 import {
   detectAntiBot,
   formatDetectionMessage
@@ -86,7 +86,7 @@ import {
   rand,
   sleep,
   wheelDelta
-} from "./chunk-LKJZYVIX.js";
+} from "./chunk-HWWG2ISJ.js";
 import "./chunk-3KZ34AUC.js";
 import {
   errMsg
@@ -94,7 +94,7 @@ import {
 import {
   CDPInterceptorProxy,
   advise
-} from "./chunk-A6LPGFAL.js";
+} from "./chunk-WYETQ5C7.js";
 import {
   automationSignalsRule,
   createRuleEngine,
@@ -106,7 +106,7 @@ import {
   mouseTrajectoryRule,
   networkAnomalyRule,
   pageLifecycleRule
-} from "./chunk-H2A5JUK5.js";
+} from "./chunk-75DNUI6M.js";
 import {
   SessionRecorder
 } from "./chunk-NODRQGOK.js";
@@ -8599,7 +8599,7 @@ async function executeCommand(commandName, params, sessionName = "default", extr
   }
   let targetPageOverride = null;
   if (_target && extraOpts?.cdpEndpoint) {
-    const { findTargetPage } = await import("./browser-TUD2KA5G.js");
+    const { findTargetPage } = await import("./browser-VZOOFLAH.js");
     targetPageOverride = await findTargetPage(extraOpts.cdpEndpoint, _target);
     if (!targetPageOverride) {
       return errorResult(`Target "${_target}" not found. Use 'xbrowser targets --cdp ${extraOpts.cdpEndpoint}' to list available pages.`);
@@ -14822,7 +14822,7 @@ Run "xbrowser ${command} ${subCommand} --help" to see available parameters.`
               const targetPage = pages[cmdTabIndex];
               await targetPage.bringToFront().catch(() => {
               });
-              const { setActivePage: setActivePage2 } = await import("./browser-TUD2KA5G.js");
+              const { setActivePage: setActivePage2 } = await import("./browser-VZOOFLAH.js");
               setActivePage2(session, targetPage);
             }
           }
@@ -17995,7 +17995,7 @@ var DataCollector = class {
     return results;
   }
   async createBrowserContext() {
-    const { launch } = await import("./cdp-driver-2EECZW4X.js");
+    const { launch } = await import("./cdp-driver-26LGCHXV.js");
     const { browser } = await launch({
       headless: true,
       args: ["--no-sandbox", "--disable-setuid-sandbox"]
@@ -18035,7 +18035,7 @@ var DataCollector = class {
 
 // src/cdp-interceptor/index.ts
 async function createCDPInterceptor(config) {
-  const { CDPInterceptorProxy: CDPInterceptorProxy2 } = await import("./proxy-LUR4U5YF.js");
+  const { CDPInterceptorProxy: CDPInterceptorProxy2 } = await import("./proxy-NKCYE76M.js");
   const proxy = new CDPInterceptorProxy2(config);
   await proxy.start();
   return proxy;

package/dist/{proxy-LUR4U5YF.js → proxy-NKCYE76M.js}

@@ -1,7 +1,7 @@
 import {
   CDPInterceptorProxy
-} from "./chunk-A6LPGFAL.js";
-import "./chunk-H2A5JUK5.js";
+} from "./chunk-WYETQ5C7.js";
+import "./chunk-75DNUI6M.js";
 import "./chunk-KFQGP6VL.js";
 export {
   CDPInterceptorProxy

package/dist/{session-replayer-RODZYHM3.js → session-replayer-EVD4HZBB.js}

@@ -34,7 +34,7 @@ var SessionReplayer = class {
     if (this.opts.page) {
       this.page = this.opts.page;
     } else if (this.opts.cdpUrl) {
-      const { launch } = await import("./cdp-driver-7HO5SRNN.js");
+      const { launch } = await import("./cdp-driver-KFX4A6WR.js");
       const { browser } = await launch({ cdpEndpoint: this.opts.cdpUrl });
       let contexts = browser.contexts();
       for (let i = 0; i < 10 && contexts.length === 0; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xbrowser/cli",
-  "version": "1.19.0",
+  "version": "1.21.0",
   "description": "Browser automation CLI for web scraping, headless browsing, SEO analysis, and AI agent workflows. A command-line alternative to Playwright, Puppeteer, and Selenium.",
   "type": "module",
   "bin": {
@@ -75,6 +75,7 @@
     "lint": "eslint src/ bin/ --ext .ts",
     "lint:plugin-contract": "node lint-scripts/check-plugin-contract.mjs && node lint-scripts/check-plugin-status.mjs",
     "lint:plugin-status": "node lint-scripts/check-plugin-status.mjs --update",
+    "stealth:check": "vitest run tests/cdp-driver/stealth-health.test.ts tests/cdp-driver/stealth-audit.test.ts tests/cdp-driver/stealth-probe.test.ts",
     "lint:docs": "node lint-scripts/check-docs-consistency.mjs",
     "typecheck": "tsc --noEmit",
     "start": "node dist/cli.js",