@xbrowser/cli 1.20.0 → 1.22.0

package/dist/{cdp-driver-Z2PLAO42.js → cdp-driver-T7D6H2RW.js}

@@ -1,3 +1,11 @@
+import {
+  DEFAULT_STEALTH_CONFIG,
+  bezierTrajectory,
+  buildStealthInitScript,
+  landingOffset,
+  rand,
+  typingDelay
+} from "./chunk-GYB5BOSP.js";
 import {
   connectToCDP,
   errMsg,
@@ -5,13 +13,16 @@ import {
   getCDPTargets,
   killChrome,
   launchChrome
-} from "./chunk-IWVG4XYZ.js";
+} from "./chunk-VCVDILH6.js";
 import {
   __require
 } from "./chunk-3RG5ZIWI.js";
 
 // src/cdp-driver/browser.ts
 import { EventEmitter as EventEmitter3 } from "events";
+import { mkdirSync } from "fs";
+import { join } from "path";
+import { tmpdir } from "os";
 
 // src/cdp-driver/context.ts
 import { EventEmitter as EventEmitter2 } from "events";
@@ -19,488 +30,6 @@ import { EventEmitter as EventEmitter2 } from "events";
 // src/cdp-driver/page.ts
 import { EventEmitter } from "events";
 
-// src/cdp-driver/stealth.ts
-var DEFAULT_STEALTH_CONFIG = {
-  bezierCurvature: [0.35, 0.6],
-  noiseAmplitude: 5.5,
-  overshootRange: [6, 14],
-  aimPause: [80, 280],
-  pressDuration: [60, 140],
-  releaseDrift: [0.8, 2.5],
-  landingOffsetSmall: [0.3, 2.5],
-  landingOffsetLarge: [1.5, 7],
-  smallElementThreshold: 30,
-  typingRhythm: {
-    fastProb: 0.22,
-    fastRange: [25, 60],
-    normalRange: [50, 350],
-    pauseProb: 0.18,
-    pauseRange: [400, 1200]
-  },
-  keyPressDuration: [50, 110],
-  typoProbability: 0.06,
-  wheelPeak: 180,
-  wheelDecayRate: 0.4
-};
-function rand(min, max) {
-  return min + Math.random() * (max - min);
-}
-function cosineEase(t) {
-  return 0.5 - 0.5 * Math.cos(Math.PI * t);
-}
-function bezierTrajectory(x0, y0, x1, y1, config = DEFAULT_STEALTH_CONFIG) {
-  const dist = Math.hypot(x1 - x0, y1 - y0);
-  const n = Math.max(10, Math.min(28, Math.round(dist / 15)));
-  const shortMove = dist < 120;
-  const curvature = shortMove ? rand(2, 6) : Math.max(dist * rand(...config.bezierCurvature), rand(18, 35));
-  const dir = Math.random() < 0.5 ? 1 : -1;
-  const d = dist || 1;
-  const dx = x1 - x0, dy = y1 - y0;
-  const c1x = x0 + dx * 0.3 - dy / d * curvature * 0.5 * dir;
-  const c1y = y0 + dy * 0.3 + dx / d * curvature * 0.5 * dir;
-  const c2x = x0 + dx * 0.7 - dy / d * curvature * 0.8 * dir;
-  const c2y = y0 + dy * 0.7 + dx / d * curvature * 0.8 * dir;
-  const points = [];
-  for (let i = 1; i <= n; i++) {
-    const t = cosineEase(i / n);
-    const mt = 1 - t;
-    let px = mt ** 3 * x0 + 3 * mt ** 2 * t * c1x + 3 * mt * t ** 2 * c2x + t ** 3 * x1;
-    let py = mt ** 3 * y0 + 3 * mt ** 2 * t * c1y + 3 * mt * t ** 2 * c2y + t ** 3 * y1;
-    const amp = shortMove ? Math.min(2, config.noiseAmplitude) : config.noiseAmplitude;
-    px += rand(-amp, amp);
-    py += rand(-amp, amp);
-    points.push({ x: px, y: py, delay: rand(9, 16) });
-  }
-  if (!shortMove) {
-    const over = rand(...config.overshootRange);
-    const ox = x1 + dx / d * over + rand(-2, 2);
-    const oy = y1 + dy / d * over + rand(-2, 2);
-    points.push({ x: ox, y: oy, delay: rand(14, 30) });
-    points.push({
-      x: x1 + dx / d * over * 0.4,
-      y: y1 + dy / d * over * 0.4,
-      delay: rand(14, 30)
-    });
-  }
-  points.push({ x: x1 + rand(-1, 1), y: y1 + rand(-1, 1), delay: rand(14, 30) });
-  return points;
-}
-function landingOffset(width, height, config = DEFAULT_STEALTH_CONFIG) {
-  const isSmall = Math.min(width, height) < config.smallElementThreshold;
-  const range = isSmall ? config.landingOffsetSmall : config.landingOffsetLarge;
-  const dx = rand(...range) * (Math.random() < 0.5 ? -1 : 1);
-  const dy = rand(...range) * (Math.random() < 0.5 ? -1 : 1);
-  return { dx, dy };
-}
-function typingDelay(config = DEFAULT_STEALTH_CONFIG) {
-  const roll = Math.random();
-  const r = config.typingRhythm;
-  if (roll < r.pauseProb) return rand(...r.pauseRange);
-  if (roll < r.pauseProb + r.fastProb) return rand(...r.fastRange);
-  return rand(...r.normalRange);
-}
-var KEY_MAP = {};
-for (let i = 97; i <= 122; i++) {
-  const ch = String.fromCharCode(i);
-  KEY_MAP[ch] = { key: ch, code: "Key" + ch.toUpperCase(), vk: i - 32 };
-}
-for (let i = 65; i <= 90; i++) {
-  const ch = String.fromCharCode(i);
-  KEY_MAP[ch] = { key: ch, code: "Key" + ch, vk: i, shift: true };
-}
-for (let i = 48; i <= 57; i++) {
-  const ch = String.fromCharCode(i);
-  KEY_MAP[ch] = { key: ch, code: "Digit" + ch, vk: i };
-}
-Object.assign(KEY_MAP, {
-  " ": { key: " ", code: "Space", vk: 32 },
-  ".": { key: ".", code: "Period", vk: 190 },
-  "-": { key: "-", code: "Minus", vk: 189 },
-  "@": { key: "@", code: "Digit2", vk: 50, shift: true },
-  "_": { key: "_", code: "Minus", vk: 189, shift: true }
-});
-function buildStealthInitScript() {
-  return [
-    "(function(){",
-    '  window.__xbStealthVer="57";',
-    // 1. AEL event proxy
-    "  var o=EventTarget.prototype.addEventListener;",
-    "  var fc=new InputDeviceCapabilities({firesTouchEvents:false});",
-    "  var _ael=function(t,f){",
-    "    var op=arguments[2];",
-    '    if(typeof f!=="function")return o.call(this,t,f,op);',
-    "    var w=function(e){",
-    "      if(!e)return f.call(this,e);",
-    "      return f.call(this,new Proxy(e,{get:function(k,p){",
-    '        if(p==="sourceCapabilities")return fc;',
-    // S124 修正（d67 攻防）：恒 true 是"过度伪装"——站点自己的合成事件
-    // 也变 true → 直接判定浏览器被篡改（比检测自动化更严重的指纹暴露）。
-    // 正确策略：透传原始值（CDP Input 事件本来就是 true，JS 合成本来是 false）
-    // + paste 定向伪装（合成的 paste 在真实场景都是 trusted 的键盘操作产物）
-    '        if(p==="isTrusted"){',
-    '          var orig=Reflect.get(k,"isTrusted");',
-    "          if(orig===true)return true;",
-    '          if(k.type==="paste")return true;',
-    "          return orig;",
-    "        }",
-    '        if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])){',
-    "          var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;",
-    "          return k[p]+_f;",
-    "        }",
-    '        var v=Reflect.get(k,p);return typeof v==="function"?v.bind(k):v;',
-    "      }}));",
-    "    };",
-    "    return o.call(this,t,w,op);",
-    "  };",
-    "  EventTarget.prototype.addEventListener=_ael;",
-    // window.event isTrusted 伪装（S123）：AEL 参数包装收不到 window.event
-    // （它是原始 Event 对象的隐式引用）。定义 getter 拦截读取。
-    "  try{",
-    '    var _weDesc=Object.getOwnPropertyDescriptor(Window.prototype,"event");',
-    "    if(_weDesc&&_weDesc.get){",
-    "      var _origWeGet=_weDesc.get;",
-    '      Object.defineProperty(Window.prototype,"event",{',
-    "        configurable:true,",
-    "        get:function(){",
-    "          var ev=_origWeGet.call(this);",
-    "          if(!ev)return ev;",
-    "          return new Proxy(ev,{get:function(k,p){",
-    '            if(p==="isTrusted"){',
-    '              var orig=Reflect.get(k,"isTrusted");',
-    "              if(orig===true)return true;",
-    '              if(k.type==="paste")return true;',
-    "              return orig;",
-    "            }",
-    '            var v=Reflect.get(k,p);return typeof v==="function"?v.bind(k):v;',
-    "          }});",
-    "        }",
-    "      });",
-    "    }",
-    "  }catch(e){}",
-    // 2. Screen override (prototype-level, not instance-level)
-    "  var _gw=function(){return 1728};",
-    "  var _gh=function(){return 1117};",
-    "  var _gah=function(){return 1092};",
-    '  Object.defineProperty(Screen.prototype,"width",{get:_gw,configurable:true});',
-    '  Object.defineProperty(Screen.prototype,"height",{get:_gh,configurable:true});',
-    '  Object.defineProperty(Screen.prototype,"availWidth",{get:_gw,configurable:true});',
-    '  Object.defineProperty(Screen.prototype,"availHeight",{get:_gah,configurable:true});',
-    // S174: UA Headless 标记清洗——headless launch 的 UA 含 HeadlessChrome/xxx
-    // （最高频检测面），同步清洗 userAgent/appVersion/userAgentData(brands+高熵值)。
-    // 原型+实例双层覆写（S172 模式）。
-    "  try{",
-    '    var fixUA=function(ua){return String(ua).replace("HeadlessChrome","Chrome");};',
-    '    var fixBrands=function(list){return (list||[]).map(function(b){return (b.brand&&b.brand.indexOf("Headless")!==-1)?Object.assign({},b,{brand:b.brand.replace("HeadlessChrome","Chrome")}):b;});};',
-    '    var _nuad=Object.getOwnPropertyDescriptor(Navigator.prototype,"userAgentData");',
-    "    var wrapUAD=function(uad){",
-    "      if(!uad||uad.__xbUA)return uad;",
-    "      try{",
-    '        Object.defineProperty(uad,"brands",{get:function(){return fixBrands(_nuad.get.call(navigator).brands);},configurable:true});',
-    "        var _ghev=uad.getHighEntropyValues.bind(uad);",
-    "        uad.getHighEntropyValues=function(hints){return _ghev(hints).then(function(v){",
-    '          var o={};for(var k in v){o[k]=(typeof v[k]==="string")?fixUA(v[k]):(Array.isArray(v[k])?fixBrands(v[k]):v[k]);}',
-    "          return o;});};",
-    "        uad.__xbUA=true;",
-    "      }catch(e){}",
-    "      return uad;",
-    "    };",
-    '    var _nua=Object.getOwnPropertyDescriptor(Navigator.prototype,"userAgent");',
-    "    if(_nua&&_nua.get){",
-    "      var _nuag=function(){return fixUA(_nua.get.call(this));};",
-    '      _nuag.toString=function(){return "function get userAgent() { [native code] }";};',
-    '      Object.defineProperty(Navigator.prototype,"userAgent",{get:_nuag,configurable:true});',
-    "    }",
-    '    Object.defineProperty(navigator,"userAgent",{get:function(){return fixUA(_nua?_nua.get.call(this):"");},configurable:true});',
-    "    if(_nuad&&_nuad.get){",
-    "      var _nuadg=function(){return wrapUAD(_nuad.get.call(this));};",
-    '      _nuadg.toString=function(){return "function get userAgentData() { [native code] }";};',
-    '      Object.defineProperty(Navigator.prototype,"userAgentData",{get:_nuadg,configurable:true});',
-    "    }",
-    "  }catch(e){}",
-    // hasFocus 与 visibilityState 联动（d29）：恒 true 在 hidden 标签下暴露
-    // —— 真实浏览器失焦/后台时 hasFocus=false
-    // S172: 原型层覆写——实例赋值可被 Document.prototype.hasFocus.call(document) 逃逸
-    '  Document.prototype.hasFocus=function(){return document.visibilityState==="visible";};',
-    // 4. Canvas/WebGL fingerprint: per-session stable noise (d20).
-    //    Headless software raster differs subtly from Chrome GPU raster —
-    //    toDataURL hashes fingerprint the rasterizer. Inject a stable
-    //    (per-page-load) subpixel shift into fillText so hashes look like a
-    //    distinct-but-consistent real GPU, and hide the HEADLESS tell in
-    //    WebGL renderer strings.
-    "  var _seed=Math.floor(Math.random()*2147483647);",
-    "  var _prng=function(){_seed=(_seed*48271)%2147483647;return _seed/2147483647;};",
-    "  var _dx=(_prng()*0.4-0.2).toFixed(3)*1, _dy=(_prng()*0.4-0.2).toFixed(3)*1;",
-    "  var _fillText=CanvasRenderingContext2D.prototype.fillText;",
-    "  CanvasRenderingContext2D.prototype.fillText=function(t,x,y,m){",
-    "    return _fillText.call(this,t,x+_dx,y+_dy,m);",
-    "  };",
-    "  var _toDataURL=HTMLCanvasElement.prototype.toDataURL;",
-    "  HTMLCanvasElement.prototype.toDataURL=function(){",
-    '    var ctx=this.getContext("2d");',
-    "    if(ctx){var d=ctx.getImageData(0,0,Math.min(this.width,2),Math.min(this.height,2));",
-    "      for(var i=0;i<d.data.length;i+=4){if(d.data[i+3]>0){d.data[i]^=1;break;}}",
-    "      ctx.putImageData(d,0,0);}",
-    "    return _toDataURL.apply(this,arguments);",
-    "  };",
-    "  try{",
-    "    var _gl=HTMLCanvasElement.prototype.getContext;",
-    "    HTMLCanvasElement.prototype.getContext=function(t,o){",
-    "      var c=_gl.call(this,t,o);",
-    '      if(c&&(t==="webgl"||t==="experimental-webgl")&&c.getParameter){',
-    "        var _gp=c.getParameter.bind(c);",
-    "        c.getParameter=function(p){",
-    "          var v=_gp(p);",
-    '          if(typeof v==="string"&&/SwiftShader|Software|Rasterizer|Headless/i.test(v))',
-    '            return "ANGLE (Apple, ANGLE Metal Renderer: Apple M2 Max, Unspecified Version)";',
-    "          return v;};}",
-    "      return c;};",
-    "  }catch(e){}",
-    // 5. AudioContext fingerprint: per-load stable micro-noise on channel
-    //    data (d21). DSP sum differences between headless software audio and
-    //    real hardware audio are a classic fingerprint — add ±1e-7 level
-    //    noise (inaudible, changes the sum hash).
-    "  try{",
-    "    var _gcd=AudioBuffer.prototype.getChannelData;",
-    "    AudioBuffer.prototype.getChannelData=function(ch){",
-    "      var d=_gcd.call(this,ch);",
-    '      var key="__xb_audio_"+ch;',
-    "      if(!this[key]){",
-    "        this[key]=true;",
-    "        for(var i=0;i<d.length;i+=997){d[i]=d[i]+(_prng()-0.5)*2e-7;}",
-    "      }",
-    "      return d;",
-    "    };",
-    "    var _gffd=AnalyserNode.prototype.getFloatFrequencyData;",
-    "    AnalyserNode.prototype.getFloatFrequencyData=function(arr){",
-    "      _gffd.call(this,arr);",
-    "      for(var i=0;i<arr.length;i+=31){arr[i]=arr[i]+(_prng()-0.5)*0.01;}",
-    "    };",
-    "    var _gfbd=AnalyserNode.prototype.getByteFrequencyData;",
-    "    AnalyserNode.prototype.getByteFrequencyData=function(arr){",
-    "      _gfbd.call(this,arr);",
-    "      for(var i=0;i<arr.length;i+=31){arr[i]=(arr[i]+((_prng()*3)|0))&255;}",
-    "    };",
-    "  }catch(e){}",
-    // 3b. Font metrics + speechSynthesis + battery (d22): headless tells
-    "  try{",
-    '    var _tmw=Object.getOwnPropertyDescriptor(TextMetrics.prototype,"width");',
-    "    if(_tmw&&_tmw.get){",
-    "      // S172: \u539F\u578B\u5C42\u8986\u5199\u2014\u2014\u5B9E\u4F8B(m)\u8986\u5199\u53EF\u88AB TextMetrics.prototype.width getter \u9003\u9038",
-    '      Object.defineProperty(TextMetrics.prototype,"width",{get:function(){return _tmw.get.call(this)+_dx*0.01;},configurable:true});',
-    "    }",
-    "  }catch(e){}",
-    "  try{",
-    '    var _fakeVoices=["Alex","Daniel","Karen","Moira","Ralph","Samantha","Ting-Ting","Mei-Jia","Sinji","Yunda"];',
-    // S172: 原型层覆写——实例赋值可被 SpeechSynthesis.prototype.getVoices.call() 逃逸
-    "    var _sv=SpeechSynthesis.prototype.getVoices;",
-    "    SpeechSynthesis.prototype.getVoices=function(){",
-    "      var real=_sv.call(this);",
-    "      if(real&&real.length>50)return real;",
-    // 注意阈值从 0 改 50：iframe 原生约 10 个 —— 原阈值下 iframe 返回原生 10 个
-    // 而不是伪装 180（d33 暴露）。>50 = 主文档伪装列表已生效，其余返回伪装。
-    '      return _fakeVoices.map(function(n,i){return {name:n,lang:i<2?"en-US":i<6?"en-GB":"zh-TW",localService:true,default:i===0,voiceURI:n};});',
-    "    };",
-    // d33 修复：iframe 的 speechSynthesis 是独立实例（主文档 hook 不可达）——
-    // 轮询同源 iframe，对其 contentWindow 的原型同样 patch（S172: 原型层，防逃逸）
-    "  try{",
-    "    var _piv=function(){",
-    '      var frs=document.querySelectorAll("iframe");',
-    "      for(var i=0;i<frs.length;i++){try{",
-    "        var cw=frs[i].contentWindow;",
-    "        if(!cw||!cw.speechSynthesis||cw.speechSynthesis.__xbP)continue;",
-    "        cw.speechSynthesis.__xbP=true;",
-    "        var _sv2=cw.SpeechSynthesis.prototype.getVoices;",
-    "        cw.SpeechSynthesis.prototype.getVoices=function(){var r=_sv2.call(this);if(r&&r.length>50)return r;",
-    '          return _fakeVoices.map(function(n,j){return{name:n,lang:j<2?"en-US":j<6?"en-GB":"zh-TW",localService:true,default:j===0,voiceURI:n};});};',
-    "      }catch(e2){}}",
-    "    };",
-    "    setInterval(_piv,2000);",
-    "    var _mo=new MutationObserver(function(muts){",
-    "      for(var k=0;k<muts.length;k++){var ns=muts[k].addedNodes;",
-    '        for(var q=0;q<ns.length;q++){if(ns[q].tagName==="IFRAME")setTimeout(_piv,20);}}',
-    "    });",
-    "    _mo.observe(document.documentElement,{childList:true,subtree:true});",
-    "  }catch(e){}",
-    "  }catch(e){}",
-    "  try{",
-    "    var _gb=navigator.getBattery.bind(navigator);",
-    "    navigator.getBattery=function(){",
-    "      return _gb().then(function(b){",
-    '        Object.defineProperty(b,"charging",{get:function(){return true;},configurable:true});',
-    "        return b;});",
-    "    };",
-    "  }catch(e){}",
-    // 3c. WebRTC local IP leak guard (d23): headless STUN candidates can
-    //     expose host IPs; mDNS-only candidates are the modern Chrome default.
-    "  try{",
-    "    var _oc=RTCPeerConnection.prototype.createOffer;",
-    "    RTCPeerConnection.prototype.createOffer=function(){",
-    "      var p=_oc.apply(this,arguments);",
-    "      var self=this;",
-    "      return p.then(function(offer){",
-    '        offer.sdp=offer.sdp.split(String.fromCharCode(10)).filter(function(l){return l.indexOf("typ host")<0}).join(String.fromCharCode(10));',
-    "        return offer;});",
-    "    };",
-    "  }catch(e){}",
-    // 3d-2. performance.now precision clamp (d34): full-precision timestamps
-    //     (11 decimals) differ from site-isolation-clamped real Chrome (~100μs).
-    "  try{",
-    "    var _pn=Performance.prototype.now;",
-    "    // S172: \u539F\u578B\u5C42\u8986\u5199\u2014\u2014\u5B9E\u4F8B\u8D4B\u503C\u53EF\u88AB Performance.prototype.now.call(performance) \u9003\u9038",
-    "    Performance.prototype.now=function(){return Math.round(_pn.call(this)*10)/10;};",
-    '    var _pto=Object.getOwnPropertyDescriptor(Performance.prototype,"timeOrigin");',
-    "    if(_pto&&_pto.get){",
-    "      // S173: timeOrigin \u771F\u4F2A\u88C5\u2014\u2014\u5360\u4F4D\u5C42\uFF08\u8FD4\u56DE\u771F\u503C\uFF09\u5347\u7EA7\u4E3A\u4F1A\u8BDD\u7EA7\u968F\u673A\u504F\u79FB\u3002",
-    "      // \u9632 cross-page \u5BFC\u822A\u65F6\u523B\u5173\u8054\uFF1A\u4E0D\u540C\u7AD9\u70B9\u7528 timeOrigin \u7CBE\u786E\u5BF9\u9F50\u7528\u6237\u884C\u4E3A\u6863\u6848\u3002",
-    "      // \u504F\u79FB\u7531\u672C\u9875 _seed \u6D3E\u751F\uFF08\u9875\u5185\u81EA\u6D3D\uFF0Cnow()+\u504F\u79FB\u4E00\u81F4\uFF09\uFF0C\u8DE8\u9875\u968F\u673A\uFF08\u4E0D\u53EF\u5173\u8054\uFF09\u3002",
-    "      var _toff=Math.floor((_seed/2147483647)*600000-300000);",
-    "      var _tog=function(){return _pto.get.call(performance)+_toff;};",
-    '      _tog.toString=function(){return "function get timeOrigin() { [native code] }";};',
-    "      // S172 \u5BA1\u8BA1\uFF1A\u5B9E\u4F8B\u8986\u5199\u53EF\u88AB\u539F\u578B getter \u9003\u9038\u2014\u2014\u539F\u578B\u5C42\u8986\u5199",
-    '      Object.defineProperty(Performance.prototype,"timeOrigin",{get:_tog,configurable:true});',
-    '      Object.defineProperty(performance,"timeOrigin",{get:_tog,configurable:true});',
-    "    }",
-    "  }catch(e){}",
-    // 3f. getCoalescedEvents 合成（d47）：真实鼠标 125Hz 采样被浏览器按帧合并，
-    //     快速移动时 pointermove.getCoalescedEvents() 返回 2~6 个事件（群内
-    //     ≈8ms）；CDP Input 逐事件派发不走合并管线，coalesced>1 恒为 0（结构性
-    //     暴露，间隔模拟救不了——实测 Chrome 帧对齐时 CDP 连发事件被直接丢弃
-    //     而非合并）。按 125Hz 物理插值合成 coalesced 群：期望样本数 = dt/8ms-1，
-    //     合成事件用真 PointerEvent 构造 + 实例级 isTrusted/timeStamp 遮蔽。
-    "  try{",
-    "    if(window.PointerEvent&&PointerEvent.prototype.getCoalescedEvents){",
-    "      var _gce=PointerEvent.prototype.getCoalescedEvents;",
-    "      var _lm=null;",
-    "      var _gceH=function(){",
-    "        var list=_gce.call(this);",
-    '        if(this.type!=="pointermove"||!this.isTrusted)return list;',
-    "        var cur={x:this.clientX,y:this.clientY,ts:this.timeStamp};",
-    "        var out=null;",
-    "        if((!list||list.length<2)&&_lm){",
-    "          var dt=cur.ts-_lm.ts,dx=cur.x-_lm.x,dy=cur.y-_lm.y;",
-    // dt 长（帧丢弃后）不代表群覆盖整个 dt —— 真实 coalesced 群只覆盖
-    // 最后一帧窗口（≤16.7ms，群内 ≈8ms=125Hz）。合成群从自身往回推 8ms
-    // 链，位移取末端占比（span/dt，dt 远大于 span 时位移趋零=丢弃后实况）。
-    "          var expN=Math.floor(dt/8)-1;",
-    // dt<12ms（不足一帧+采样周期）时真实浏览器不会产生合并群 ——
-    // 单采样帧 coalesced=1，强行合成会出现 ~2ms 的超物理群内间隔。
-    "          if(expN>0&&dt>=12&&Math.random()>0.15){",
-    "            var n=Math.min(4,expN+(Math.random()<0.3?1:0));",
-    "            var span=Math.min(dt,n*8.3);",
-    "            var frac=Math.min(1,span/Math.max(dt,1));",
-    "            out=[];",
-    "            for(var i=1;i<=n;i++){",
-    // k=距自身的步数（含自身共 n+1 个事件，相邻恒 ≈8.3ms=125Hz 周期）
-    "              var k=n+1-i;",
-    '              var ev=new PointerEvent("pointermove",{',
-    '                pointerId:this.pointerId,pointerType:"mouse",isPrimary:this.isPrimary,',
-    "                clientX:cur.x-dx*frac*(k/(n+1))+(Math.random()-0.5)*1.5,",
-    "                clientY:cur.y-dy*frac*(k/(n+1))+(Math.random()-0.5)*1.5,",
-    "                screenX:this.screenX,screenY:this.screenY,",
-    "                buttons:this.buttons,button:this.button,",
-    "                bubbles:true,cancelable:true,composed:true,",
-    "                width:this.width,height:this.height,pressure:this.pressure,",
-    "                tiltX:this.tiltX,tiltY:this.tiltY,twist:this.twist});",
-    "              var tsV=cur.ts-k*8.3-Math.random()*1.2;",
-    // isTrusted/timeStamp 是实例不可配置属性（defineProperty 抛
-    // "Cannot redefine"），改 Proxy 包装：getPrototypeOf/ownKeys 透传，
-    // instanceof 与属性枚举行为与真事件一致。IIFE 捕获本次循环的 tsV
-    // 快照 —— var 提升会让所有 Proxy 闭包共享最后一次赋值（实测四个
-    // 合成事件同时间戳、群内间隔塌到 ~2ms）。
-    "              out.push((function(e2,t2){return new Proxy(e2,{get:function(t,p){",
-    '                if(p==="isTrusted")return true;',
-    '                if(p==="timeStamp")return t2;',
-    '                var v=Reflect.get(t,p);return typeof v==="function"?v.bind(t):v;',
-    "              }});})(ev,tsV));",
-    "            }",
-    "            out.push(this);",
-    "          }",
-    "        }",
-    "        _lm=cur;",
-    "        return out||list;",
-    "      };",
-    "      PointerEvent.prototype.getCoalescedEvents=_gceH;",
-    // name 反查伪装：var _gceH=fn 的具名推断会暴露 hook（原生 name 是
-    // "getCoalescedEvents"）——toString 白名单管不到 name 属性。
-    '      try{Object.defineProperty(_gceH,"name",{value:"getCoalescedEvents"});}catch(e){}',
-    "    }",
-    "  }catch(e){}",
-    // 3d. Chrome object depth (d24): automation fakes usually only set
-    //     window.chrome = {}; deep checks hit app.run/runtime/csi/loadTimes.
-    "  try{",
-    "    if(window.chrome){",
-    '      if(!window.chrome.app||!window.chrome.app.run)window.chrome.app={run:function(){},load:function(){},getDetails:function(){return null},InstallState:{DISABLED:"disabled",INSTALLED:"installed",NOT_INSTALLED:"not_installed"},RunningState:{CANNOT_RUN:"cannot_run",READY_TO_RUN:"ready_to_run",RUNNING:"running"}};',
-    '      if(!window.chrome.runtime)window.chrome.runtime={OnInstalledReason:{CHROME_UPDATE:"chrome_update",INSTALL:"install",UPDATE:"update"},PlatformOs:{ANDROID:"android",CROS:"cros",LINUX:"linux",MAC:"mac",OPENBSD:"openbsd",WIN:"win"},connect:function(){},sendMessage:function(){},id:undefined};',
-    "      if(!window.chrome.csi)window.chrome.csi=function(){return{};}",
-    "      if(!window.chrome.loadTimes)window.chrome.loadTimes=function(){return{};}",
-    "    }",
-    "  }catch(e){}",
-    // 3e. Font availability patch (d25): headless Chromium misses some system
-    //     fonts (e.g. Menlo on macOS) that real Chrome has. Register a FontFace
-    //     aliasing the missing font to a local() equivalent so offsetWidth-based
-    //     font probing sees the same availability as the faked environment.
-    "  try{",
-    '    var _fontAliases=[["Menlo","Courier New"],["SF Mono","Menlo"],["Segoe UI","Helvetica"]];',
-    "    _fontAliases.forEach(function(pa){",
-    '      try{var ff=new FontFace(pa[0],"local("+JSON.stringify(pa[1])+")");',
-    "        document.fonts.add(ff);ff.load();}catch(e2){}",
-    "    });",
-    "  }catch(e){}",
-    // 3g. Notification.requestPermission 延迟（d62）：headless 无原生横幅，
-    //     request 瞬回 denied —— 真机 request 会 pending 在横幅上数秒到分钟。
-    //     延迟 2-6s 再 resolve，模拟横幅期（用户"看了下然后拒绝"）。
-    "  try{",
-    "    if(window.Notification&&Notification.requestPermission){",
-    "      var _nrp=Notification.requestPermission.bind(Notification);",
-    "      Notification.requestPermission=function(cb){",
-    "        return new Promise(function(res){",
-    "          setTimeout(function(){_nrp().then(function(r){if(cb)try{cb(r)}catch(e){}res(r);});},2000+Math.random()*4000);",
-    "        });",
-    "      };",
-    "    }",
-    "  }catch(e){}",
-    // 3. toString disguise (name-list based)
-    "  var _ts=Function.prototype.toString;",
-    "  var _hf=document.hasFocus;",
-    "  Function.prototype.toString=function(){",
-    '    if(this===_ael)return"function addEventListener(type, callback) { [native code] }";',
-    '    if(this===_hf)return"function hasFocus() { [native code] }";',
-    '    if(this===_gw)return"function get width() { [native code] }";',
-    '    if(this===_gh)return"function get height() { [native code] }";',
-    '    if(this===_gah)return"function get availHeight() { [native code] }";',
-    '    if(this===CanvasRenderingContext2D.prototype.fillText)return"function fillText() { [native code] }";',
-    '    if(this===HTMLCanvasElement.prototype.toDataURL)return"function toDataURL() { [native code] }";',
-    '    if(this===AnalyserNode.prototype.getFloatFrequencyData)return"function getFloatFrequencyData() { [native code] }";',
-    '    if(this===AudioBuffer.prototype.getChannelData)return"function getChannelData() { [native code] }";',
-    '    if(this===_gceH)return"function getCoalescedEvents() { [native code] }";',
-    '    if(this===Document.prototype.hasFocus)return"function hasFocus() { [native code] }";',
-    '    if(this===Performance.prototype.now)return"function now() { [native code] }";',
-    '    if(this===SpeechSynthesis.prototype.getVoices)return"function getVoices() { [native code] }";',
-    "    return _ts.call(this);",
-    "  };",
-    // 4. onclick prototype hijack (dual-stream consistency)
-    "  var _ba=function(k,p){",
-    '    if(p==="isTrusted"){',
-    '      var orig=Reflect.get(k,"isTrusted");',
-    "      if(orig===true)return true;",
-    '      if(k.type==="paste")return true;',
-    "      return orig;",
-    "    }",
-    '    if((p==="clientX"||p==="clientY")&&k.type==="click"&&Number.isInteger(k[p])&&k.isTrusted===true){',
-    "      var _f=((k.timeStamp||Date.now())%89)/89*0.7+0.15;return k[p]+_f;",
-    "    }",
-    '    var v=Reflect.get(k,p);return typeof v==="function"?v.bind(k):v;',
-    "  };",
-    '  Object.defineProperty(Document.prototype,"onclick",{',
-    "    configurable:true,",
-    "    get:function(){var raw=this.__ocRaw||null;if(!raw)return null;var self=this;",
-    "      return function(e){return raw.call(self,new Proxy(e,{get:function(k,p){return _ba(k,p)}}))}},",
-    "    set:function(fn){this.__ocRaw=fn}",
-    "  });",
-    "})()"
-  ].join("\n");
-}
-
 // src/cdp-driver/mouse.ts
 var XBMouseImpl = class {
   conn;
@@ -552,7 +81,7 @@ var XBMouseImpl = class {
     } else {
       await this.move(tx, ty);
     }
-    await this.down({ button });
+    await this.down({ button, clickCount: opts.clickCount ?? 1 });
     await sleep(stealth ? rand(...DEFAULT_STEALTH_CONFIG.pressDuration) : opts.delay ?? 0);
     const rx = stealth ? this._x + rand(...DEFAULT_STEALTH_CONFIG.releaseDrift) * (Math.random() < 0.5 ? -1 : 1) : this._x;
     const ry = stealth ? this._y + rand(...DEFAULT_STEALTH_CONFIG.releaseDrift) * (Math.random() < 0.5 ? -1 : 1) : this._y;
@@ -576,7 +105,9 @@ var XBMouseImpl = class {
       x: this._x,
       y: this._y,
       button,
-      clickCount: 1
+      // r23: press 必须与 release 声明同一 clickCount——Chrome 按序列计数
+      // 合成 click/dblclick，press 缺声明会把计数器重置（dblclick 永不合成）
+      clickCount: opts.clickCount ?? 1
     });
   }
   async up(opts = {}) {
@@ -587,7 +118,7 @@ var XBMouseImpl = class {
       x: this._x,
       y: this._y,
       button,
-      clickCount: 1
+      clickCount: opts.clickCount ?? 1
     });
   }
   async move(x, y, opts = {}) {
@@ -763,7 +294,7 @@ var XBKeyboardImpl = class {
         if (wrong && wrong !== char) {
           await this.dispatchKeySequence(resolveKeyMapping(wrong), stealth);
           await sleep2(rand(120, 420));
-          await this.dispatchKeySequence(KEY_MAP2.Backspace, stealth);
+          await this.dispatchKeySequence(KEY_MAP.Backspace, stealth);
         }
       }
       await this.dispatchKeySequence(resolveKeyMapping(char), stealth);
@@ -866,7 +397,7 @@ var XBKeyboardImpl = class {
   }
 };
 function resolveKeyMapping(key) {
-  if (KEY_MAP2[key]) return KEY_MAP2[key];
+  if (KEY_MAP[key]) return KEY_MAP[key];
   if (key.length === 1) {
     const lower = key.toLowerCase();
     if (lower >= "a" && lower <= "z") {
@@ -883,7 +414,7 @@ function resolveKeyMapping(key) {
   }
   return { key, code: key };
 }
-var KEY_MAP2 = {
+var KEY_MAP = {
   Enter: { key: "Enter", code: "Enter", text: "\r", keyCode: 13 },
   Tab: { key: "Tab", code: "Tab", text: "	", keyCode: 9 },
   Escape: { key: "Escape", code: "Escape", keyCode: 27 },
@@ -1244,6 +775,14 @@ var XBLocatorImpl = class _XBLocatorImpl {
     await waitForActionable(this.page, this.selector, opts);
     await scrollIntoView(this.page, this.selector);
     await this.click({ ...opts });
+    await this.page.evaluate(`
+      (function() {
+        const el = ${this._q(this.selector)};
+        if (!el) return;
+        if (document.activeElement !== el) el.focus();
+        if ((el.value || el.textContent || '') !== '') document.execCommand('selectAll');
+      })()
+    `);
     if (process.env.XBROWSER_STEALTH !== "off" && value.length >= 40 && process.env.XBROWSER_FILL_TYPE !== "type") {
       try {
         const { pasteViaClipboard, syntheticPaste } = await import("./clipboard-XRP54ENE.js");
@@ -1999,6 +1538,189 @@ var XBPageImpl = class _XBPageImpl {
     await this.conn.send("Network.enable", void 0, this.sessionId);
     await this.conn.send("DOM.enable", void 0, this.sessionId).catch(() => {
     });
+    if (this._contextImpl.ignoreHTTPSErrors) {
+      await this.conn.send("Security.enable", void 0, this.sessionId).catch(() => {
+      });
+      await this.conn.send("Security.setIgnoreCertificateErrors", { ignore: true }, this.sessionId).catch(() => {
+      });
+    }
+    if (this._contextImpl.httpCredentials) {
+      await this.conn.send("Fetch.enable", {
+        patterns: [{ urlPattern: "*", requestStage: "Request" }],
+        handleAuthRequests: true
+      }, this.sessionId).catch(() => {
+      });
+      this._subscriptions.push(
+        this.conn.subscribe("Fetch.requestPaused", this.sessionId, (params) => {
+          if (this._interceptionEnabled) return;
+          const p = params;
+          this.conn.send("Fetch.continueRequest", { requestId: p.requestId }, this.sessionId).catch(() => {
+          });
+        })
+      );
+      this._subscriptions.push(
+        this.conn.subscribe("Fetch.authRequired", this.sessionId, (params) => {
+          const p = params;
+          const creds = this._contextImpl.httpCredentials;
+          this.conn.send("Fetch.continueWithAuth", {
+            requestId: p.requestId,
+            authChallengeResponse: creds ? { response: "ProvideCredentials", username: creds.username, password: creds.password } : { response: "CancelAuth" }
+          }, this.sessionId).catch(() => {
+          });
+        })
+      );
+    }
+    await this.conn.send("Page.addScriptToEvaluateOnNewDocument", {
+      source: [
+        "try { window.print = function() {}; window.__xb_print_suppressed = true; } catch (e) {}",
+        "try {",
+        "  if (window.showOpenFilePicker) {",
+        "    var __xb_mkHandle = function(name, content) {",
+        '      var file = new File([content], name, { type: "text/plain" });',
+        "      return {",
+        '        kind: "file", name: name,',
+        "        getFile: function() { return Promise.resolve(file); },",
+        "        createWritable: function() { return Promise.resolve({ write: function() { return Promise.resolve(); }, close: function() { return Promise.resolve(); } }); },",
+        "        isSameEntry: function() { return Promise.resolve(false); },",
+        '        queryPermission: function() { return Promise.resolve("granted"); },',
+        '        requestPermission: function() { return Promise.resolve("granted"); },',
+        "      };",
+        "    };",
+        "    window.showOpenFilePicker = function() {",
+        '      return Promise.resolve([__xb_mkHandle("xbrowser-stub.txt", "xbrowser fs access stub")]);',
+        "    };",
+        "    window.showSaveFilePicker = function() {",
+        '      return Promise.resolve(__xb_mkHandle("xbrowser-stub-save.txt", ""));',
+        "    };",
+        "    window.showDirectoryPicker = function() {",
+        "      var emptyIter = function() { return [][Symbol.iterator](); };",
+        "      return Promise.resolve({",
+        '        kind: "directory", name: "xbrowser-stub-dir",',
+        "        values: emptyIter, entries: emptyIter, keys: emptyIter,",
+        '        getDirectoryHandle: function() { return Promise.reject(new Error("stub empty dir")); },',
+        '        getFileHandle: function() { return Promise.reject(new Error("stub empty dir")); },',
+        "        isSameEntry: function() { return Promise.resolve(false); },",
+        '        queryPermission: function() { return Promise.resolve("granted"); },',
+        '        requestPermission: function() { return Promise.resolve("granted"); },',
+        "      });",
+        "    };",
+        "    window.__xb_fs_stub_installed = true;",
+        "  }",
+        "} catch (e) {}",
+        // sup-s7: 右键菜单压制——headful 下 CDP 右键弹浏览器原生菜单（CDP
+        // 无法关闭浏览器 UI）。document 捕获阶段 preventDefault 抑制原生
+        // 菜单；不阻断传播，录制 contextmenu 事件与页面自定义菜单不受影响。
+        "try {",
+        '  document.addEventListener("contextmenu", function(e) { e.preventDefault(); }, true);',
+        "  window.__xb_ctxmenu_suppressed = true;",
+        "} catch (e) {}",
+        // sup-s10: Notification 守卫——new Notification() 弹 OS 级系统横幅
+        // （headful 污染屏幕，等待通知交互的流程挂起）。no-op 包装但保
+        // API 形状：permission/granted、requestPermission→granted、实例
+        // title/close 可用——页面通知流程无感继续。
+        "try {",
+        "  var XBN = function Notification(title, options) {",
+        "    this.title = title;",
+        '    this.body = (options && options.body) || "";',
+        '    this.tag = (options && options.tag) || "";',
+        "    this.onclick = null; this.onshow = null; this.onerror = null; this.onclose = null;",
+        "  };",
+        "  XBN.prototype.close = function() {};",
+        '  XBN.permission = "granted";',
+        '  XBN.requestPermission = function() { return Promise.resolve("granted"); };',
+        "  XBN.maxActions = (window.Notification && window.Notification.maxActions) || 2;",
+        "  window.Notification = XBN;",
+        "  window.__xb_notification_suppressed = true;",
+        "} catch (e) {}",
+        // sup-W1: WebAPI 选择器/配对框家族 stub（1/7 Serial）——
+        // navigator.serial.requestPort() 弹浏览器原生串口选择器（CDP 无法
+        // 拦截），headless 下 promise 挂起。stub 返回 rejected Promise
+        // （NotFoundError），页面 catch 分支接管、流程继续。
+        "try {",
+        "  if (navigator.serial) {",
+        "    navigator.serial.requestPort = function() {",
+        '      return Promise.reject(new DOMException("xbrowser serial stub", "NotFoundError"));',
+        "    };",
+        "    window.__xb_serial_stubbed = true;",
+        "  }",
+        "} catch (e) {}",
+        // sup-W2: WebAPI stub（2/7 USB）——requestDevice 弹原生设备配对框，
+        // 同 Serial pattern：rejected Promise（NotFoundError），catch 接管。
+        "try {",
+        "  if (navigator.usb) {",
+        "    navigator.usb.requestDevice = function() {",
+        '      return Promise.reject(new DOMException("xbrowser usb stub", "NotFoundError"));',
+        "    };",
+        "    window.__xb_usb_stubbed = true;",
+        "  }",
+        "} catch (e) {}",
+        // sup-W3: WebAPI stub（3/7 Bluetooth）——requestDevice 弹原生蓝牙
+        // 配对框，同 Serial/USB pattern：rejected Promise（NotFoundError）。
+        // CI linux headless 下 navigator.bluetooth 原生不存在——缺失时合成
+        // 对象再包装，保证跨平台语义一致（requestDevice 恒 rejected）。
+        "try {",
+        "  if (!navigator.bluetooth) {",
+        '    try { Object.defineProperty(navigator, "bluetooth", { value: {}, configurable: true }); } catch (e) {}',
+        "  }",
+        "  if (navigator.bluetooth) {",
+        "    navigator.bluetooth.requestDevice = function() {",
+        '      return Promise.reject(new DOMException("xbrowser ble stub", "NotFoundError"));',
+        "    };",
+        "    window.__xb_ble_stubbed = true;",
+        "  }",
+        "} catch (e) {}",
+        // sup-W4: WebAPI stub（4/7 HID）——requestDevices 弹原生 HID 设备
+        // 选择器，同家族 pattern：rejected Promise（NotFoundError）。
+        "try {",
+        "  if (navigator.hid) {",
+        "    navigator.hid.requestDevices = function() {",
+        '      return Promise.reject(new DOMException("xbrowser hid stub", "NotFoundError"));',
+        "    };",
+        "    window.__xb_hid_stubbed = true;",
+        "  }",
+        "} catch (e) {}",
+        // sup-W5: WebAPI stub（5/7 WakeLock）——request('screen') 在无用户
+        // 激活/权限时挂起或拒绝，等待 wake 事件的流程死锁。stub 返回合成
+        // sentinel（release 可用，不真实持锁）。
+        "try {",
+        "  if (navigator.wakeLock) {",
+        "    navigator.wakeLock.request = function() {",
+        "      return Promise.resolve({",
+        "        released: false,",
+        '        type: "screen",',
+        "        release: function() { this.released = true; return Promise.resolve(); },",
+        "        addEventListener: function() {},",
+        "        removeEventListener: function() {},",
+        "      });",
+        "    };",
+        "    window.__xb_wakelock_stubbed = true;",
+        "  }",
+        "} catch (e) {}",
+        // sup-W6: WebAPI stub（6/7 IdleDetector）——start() 需权限气泡授权
+        // 才能继续，headless 下挂起。stub 返回 rejected（NotAllowedError），
+        // 页面 catch 分支接管。
+        "try {",
+        "  if (window.IdleDetector) {",
+        "    IdleDetector.start = function() {",
+        '      return Promise.reject(new DOMException("xbrowser idle stub", "NotAllowedError"));',
+        "    };",
+        "    window.__xb_idle_stubbed = true;",
+        "  }",
+        "} catch (e) {}",
+        // sup-W7: WebAPI stub（7/7 PaymentRequest）——show() 弹浏览器支付
+        // 面板（无用户交互不关闭），headless 下 promise 挂起。stub 返回
+        // rejected（NotAllowedError），页面 catch 分支接管。
+        "try {",
+        "  if (window.PaymentRequest) {",
+        "    PaymentRequest.prototype.show = function() {",
+        '      return Promise.reject(new DOMException("xbrowser pay stub", "NotAllowedError"));',
+        "    };",
+        "    window.__xb_pay_stubbed = true;",
+        "  }",
+        "} catch (e) {}"
+      ].join("\n")
+    }, this.sessionId).catch(() => {
+    });
     this.setupPageEvents();
     this.setupNetworkEvents();
     this.setupConsoleEvents();
@@ -2030,7 +1752,7 @@ var XBPageImpl = class _XBPageImpl {
       try {
         await this.conn.send(
           "Page.addScriptToEvaluateOnNewDocument",
-          { source: buildStealthInitScript() },
+          { source: buildStealthInitScript({ ...DEFAULT_STEALTH_CONFIG, ...this._contextImpl.stealthConfig ?? {} }) },
           this.sessionId
         );
       } catch {
@@ -2439,7 +2161,9 @@ Last error: ${lastError.message}` : "";
     await this.locator(selector).click(opts);
   }
   async dblclick(selector, opts = {}) {
-    await this.locator(selector).click({ ...opts, clickCount: 2 });
+    const locator = this.locator(selector);
+    await locator.click({ ...opts, clickCount: 1 });
+    await locator.click({ ...opts, clickCount: 2 });
   }
   async fill(selector, value, opts = {}) {
     await this.locator(selector).fill(value, opts);
@@ -2556,6 +2280,26 @@ Last error: ${lastError.message}` : "";
     );
     this._viewportSize = size;
   }
+  /**
+   * env-E2: 缩放变异——deviceScaleFactor 切换（CSS 像素坐标空间不变，
+   * 物理像素翻倍）。保留当前 CSS 视口尺寸，只换 DSF。
+   */
+  async setDeviceScaleFactor(dsf) {
+    const size = this._viewportSize ?? await this.evaluate(
+      "({ width: window.innerWidth, height: window.innerHeight })"
+    );
+    await this.conn.send(
+      "Emulation.setDeviceMetricsOverride",
+      {
+        width: size.width,
+        height: size.height,
+        deviceScaleFactor: dsf,
+        mobile: false
+      },
+      this.sessionId
+    );
+    this._viewportSize = size;
+  }
   // ── Scripts ─────────────────────────────────────────────────
   async addInitScript(script) {
     await this.conn.send(
@@ -2779,6 +2523,12 @@ Last error: ${lastError.message}` : "";
   async _cdpSend(method, params) {
     return this.conn.send(method, params, this.sessionId);
   }
+  /** sup-s11: beforeunload 自动应答语义——'accept'（默认，离开页面，与录制
+   * 意图一致）或 'dismiss'（取消导航留守原页，尽力而为：此构建上 CDP
+   * accept:false 对浏览器侧导航的取消语义不稳定，不保证）。 */
+  setBeforeUnloadBehavior(mode) {
+    this._beforeUnloadAccept = mode === "accept";
+  }
   /**
    * 开启/关闭原生文件选择框拦截（CDP stateful 开关）。
    *
@@ -2837,8 +2587,9 @@ Last error: ${lastError.message}` : "";
           }
         };
         this._emit("dialog", dialog);
+        const autoAccept = p.type === "beforeunload" ? this._beforeUnloadAccept : false;
         setTimeout(() => {
-          this.conn.send("Page.handleJavaScriptDialog", { accept: false }, this.sessionId).catch(() => {
+          this.conn.send("Page.handleJavaScriptDialog", { accept: autoAccept }, this.sessionId).catch(() => {
           });
         }, 0);
       })
@@ -2981,6 +2732,7 @@ Last error: ${lastError.message}` : "";
   _networkRequests = /* @__PURE__ */ new Map();
   _routeHandlers = [];
   _interceptionEnabled = false;
+  _beforeUnloadAccept = true;
   /** Store network data — called by browser.ts installNetworkCapture or internal event handlers */
   _storeNetworkRequest(requestId, data) {
     this._networkRequests.set(requestId, { requestId, ...data });
@@ -3092,7 +2844,10 @@ Last error: ${lastError.message}` : "";
     if (!this._interceptionEnabled) {
       this._interceptionEnabled = true;
       await this.conn.send("Fetch.enable", {
-        patterns: [{ urlPattern: "*", requestStage: "Request" }]
+        patterns: [{ urlPattern: "*", requestStage: "Request" }],
+        // sup-s9: 保留认证自动响应（Fetch.enable 为替换语义，不带此参数
+        // 会顶掉 _init 的 auth 配置）
+        handleAuthRequests: true
       }, this.sessionId);
       this._subscriptions.push(
         this.conn.subscribe("Fetch.requestPaused", this.sessionId, (params) => {
@@ -3145,6 +2900,36 @@ Last error: ${lastError.message}` : "";
     });
   }
   // ── setInputFiles ───────────────────────────────────────────
+  /**
+   * sup-s4: Dropzone 拖拽上传模拟——Dropzone/Uppy/自绘上传区只监听
+   * dragover/drop（无 input[type=file] 可点），真实用户靠 OS 文件拖入
+   * 触发，自动化无法产生 OS 拖拽。页内构造 DataTransfer+File，按拖放
+   * 协议派发 dragenter/dragover/drop（bubbles+cancelable，坐标取目标
+   * 中心）。
+   */
+  async dropFiles(selector, payload) {
+    await this.evaluate(`
+      (function() {
+        var el = ${queryJS(selector)};
+        if (!el) throw new Error('drop target not found: ' + ${JSON.stringify(selector)});
+        var b64 = ${JSON.stringify(payload.buffer.toString("base64"))};
+        var bin = atob(b64);
+        var buf = new Uint8Array(bin.length);
+        for (var i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);
+        var file = new File([buf], ${JSON.stringify(payload.name)}, { type: ${JSON.stringify(payload.mimeType)} });
+        var dt = new DataTransfer();
+        dt.items.add(file);
+        var rect = el.getBoundingClientRect();
+        var opts = {
+          bubbles: true, cancelable: true,
+          clientX: rect.x + rect.width / 2, clientY: rect.y + rect.height / 2,
+        };
+        el.dispatchEvent(new DragEvent('dragenter', Object.assign({ dataTransfer: dt }, opts)));
+        el.dispatchEvent(new DragEvent('dragover', Object.assign({ dataTransfer: dt }, opts)));
+        el.dispatchEvent(new DragEvent('drop', Object.assign({ dataTransfer: dt }, opts)));
+      })()
+    `);
+  }
   async setInputFiles(selector, files) {
     const fileArr = Array.isArray(files) ? files : [files];
     const fileList = fileArr.map((f) => ({
@@ -3287,6 +3072,18 @@ var XBContextImpl = class {
     this.options = opts;
     this.setupAutoAttach();
   }
+  /** S194: 任务 tab 的 stealth 配置（UA-CH 档案等）经 context 传给 page 层 */
+  get stealthConfig() {
+    return this.options.stealthConfig;
+  }
+  /** sup-s9: HTTP 认证凭证经 context 传给 page 层（authRequired 自动响应） */
+  get httpCredentials() {
+    return this.options.httpCredentials;
+  }
+  /** sup-s12: 自签/无效证书放行——经 context 传给 page 层（原为死字段） */
+  get ignoreHTTPSErrors() {
+    return this.options.ignoreHTTPSErrors;
+  }
   async newPage() {
     if (this.closed) throw new Error("Context is closed");
     const { targetId } = await this._browser._createTarget(this.contextId);
@@ -3453,20 +3250,8 @@ var XBContextImpl = class {
 
 // src/cdp-driver/browser.ts
 var XBBrowserImpl = class {
-  conn;
-  _emitter = new EventEmitter3();
-  _contexts = /* @__PURE__ */ new Map();
-  _disconnected = false;
-  childProcess = null;
-  tmpDir;
-  _exitHandler = null;
-  /**
-   * Original CDP endpoint (HTTP or ws URL) used to construct this browser.
-   * Used by discoverContexts() as a fallback to HTTP /json/list when
-   * Target.getTargets doesn't return page-type targets (e.g. cdp-tunnel proxy).
-   */
-  cdpEndpoint;
-  constructor(conn, childProcess, tmpDir, cdpEndpoint) {
+  constructor(conn, childProcess, tmpDir, cdpEndpoint, launchOpts) {
+    this.launchOpts = launchOpts;
     this.conn = conn;
     this.childProcess = childProcess ?? null;
     this.tmpDir = tmpDir;
@@ -3494,6 +3279,20 @@ var XBBrowserImpl = class {
       process.on("exit", this._exitHandler);
     }
   }
+  launchOpts;
+  conn;
+  _emitter = new EventEmitter3();
+  _contexts = /* @__PURE__ */ new Map();
+  _disconnected = false;
+  childProcess = null;
+  tmpDir;
+  _exitHandler = null;
+  /**
+   * Original CDP endpoint (HTTP or ws URL) used to construct this browser.
+   * Used by discoverContexts() as a fallback to HTTP /json/list when
+   * Target.getTargets doesn't return page-type targets (e.g. cdp-tunnel proxy).
+   */
+  cdpEndpoint;
   get disconnected() {
     return this._disconnected;
   }
@@ -3514,13 +3313,16 @@ var XBBrowserImpl = class {
       this._exitHandler = null;
     }
     if (this.childProcess) {
-      const { killChrome: killChrome2 } = await import("./launcher-EXJHHAUL.js");
+      const { killChrome: killChrome2 } = await import("./launcher-LUOMMGZC.js");
       await killChrome2(this.childProcess, this.tmpDir);
     }
     await this.conn.close();
     this._emitter.emit("disconnected");
   }
   async newContext(opts = {}) {
+    if (this.launchOpts?.stealthConfig && !opts.stealthConfig) {
+      opts = { ...opts, stealthConfig: this.launchOpts.stealthConfig };
+    }
     if (this._disconnected) {
       throw new Error("Browser is disconnected");
     }
@@ -3537,6 +3339,38 @@ var XBBrowserImpl = class {
     } catch {
     }
     const context = new XBContextImpl(this.conn, contextId, this, opts);
+    if (!this.cdpEndpoint && contextId !== "default") {
+      const downloadDir = join(tmpdir(), "xbrowser-downloads");
+      try {
+        mkdirSync(downloadDir, { recursive: true });
+      } catch {
+      }
+      await this.conn.send("Browser.setDownloadBehavior", {
+        behavior: "allowAndName",
+        downloadPath: downloadDir,
+        eventsEnabled: false,
+        browserContextId: contextId
+      }, void 0, 1e4).catch(() => {
+      });
+      await this.conn.send("Browser.grantPermissions", {
+        permissions: [
+          "notifications",
+          "geolocation",
+          "clipboardReadWrite",
+          "clipboardSanitizedWrite",
+          "videoCapture",
+          "audioCapture",
+          "midi"
+        ],
+        browserContextId: contextId
+      }, void 0, 1e4).catch(() => {
+        this.conn.send("Browser.grantPermissions", {
+          permissions: ["notifications", "geolocation"],
+          browserContextId: contextId
+        }, void 0, 1e4).catch(() => {
+        });
+      });
+    }
     context.on("page", (page) => {
       this._emitter.emit("page", page);
     });
@@ -3649,7 +3483,7 @@ var XBBrowserImpl = class {
     if (pageTargets.length === 0 && httpFallbackUrl) {
       console.log(`[discoverContexts] Target.getTargets returned ${targetInfos.length} targets (0 page type). Falling back to HTTP /json/list at ${httpFallbackUrl}`);
       try {
-        const { getCDPTargets: getCDPTargets2 } = await import("./launcher-EXJHHAUL.js");
+        const { getCDPTargets: getCDPTargets2 } = await import("./launcher-LUOMMGZC.js");
         const httpPages = await getCDPTargets2(httpFallbackUrl);
         console.log(`[discoverContexts] HTTP /json/list returned ${httpPages.length} pages`);
         for (const p of httpPages) {
@@ -3747,6 +3581,9 @@ function extractAllStrings(rawArgs) {
   }
   return strings.length > 0 ? strings.join("\n") : null;
 }
+function isProbeMarked(code) {
+  return code.includes("/* @xb-probe */");
+}
 
 // src/cdp-interceptor/rules/dom-mutation.ts
 var DOM_PATTERNS = [
@@ -4309,6 +4146,7 @@ var eventSimulationRule = {
   evaluate(ctx) {
     const userCode = extractUserCode(ctx);
     if (!userCode) return null;
+    if (isProbeMarked(userCode)) return null;
     for (const p of EVENT_PATTERNS) {
       if (p.pattern.test(userCode)) {
         return {
@@ -4636,6 +4474,11 @@ function createRuleEngine(customRules) {
         ...ctx,
         sessionState: getSessionState(ctx.sessionId)
       };
+      try {
+        const code = typeof ctx.params?.expression === "string" ? ctx.params.expression : JSON.stringify(ctx.params ?? "");
+        if (isProbeMarked(code)) return null;
+      } catch {
+      }
       for (const rule of rules) {
         if (rule.canHandle && !rule.canHandle(fullCtx)) continue;
         const decision = rule.evaluate(fullCtx);
@@ -5016,8 +4859,23 @@ async function launch(options = {}) {
   }
   const conn = new CDPConnection(wsEndpoint);
   await conn.ready();
+  let stealthOpts;
+  try {
+    const bv = await conn.send("Browser.getVersion");
+    const m = bv.product.match(/(\d+)\.(\d+)\.(\d+)\.(\d+)/);
+    if (m && !options.stealthConfig?.uaChProfile) {
+      const { deriveUaChProfileForBinary } = await import("./stealth-2AA2FSNN.js");
+      stealthOpts = { stealthConfig: { uaChProfile: deriveUaChProfileForBinary(m[0], m[1]) } };
+    }
+  } catch {
+  }
+  if (options.stealthConfig) {
+    stealthOpts = {
+      stealthConfig: { ...stealthOpts?.stealthConfig ?? {}, ...options.stealthConfig }
+    };
+  }
   const httpEndpoint = options.cdpEndpoint && !options.cdpEndpoint.startsWith("ws") ? options.cdpEndpoint : void 0;
-  const browser = new XBBrowserImpl(conn, childProcess, tmpDir, httpEndpoint);
+  const browser = new XBBrowserImpl(conn, childProcess, tmpDir, httpEndpoint, stealthOpts);
   return { browser, wsEndpoint };
 }
 export {