@xbrowser/cli 1.21.0 → 1.23.0

package/dist/daemon-main.js

@@ -1,6 +1,10 @@
+import {
+  detectAntiBot,
+  formatDetectionMessage
+} from "./chunk-JKVUFP3G.js";
 import {
   getPluginLoader
-} from "./chunk-PIWNMC36.js";
+} from "./chunk-A3MORKYR.js";
 import {
   version
 } from "./chunk-43TEMG4U.js";
@@ -19,7 +23,7 @@ import {
 } from "./chunk-VEDJ5XSQ.js";
 import {
   SessionRecorder
-} from "./chunk-HBHOKZPN.js";
+} from "./chunk-V6KGBU5J.js";
 import {
   closeEphemeralContext,
   closeSessionByName,
@@ -34,24 +38,22 @@ import {
   resolveLaunchOpts,
   saveSessionDiskMeta,
   setActivePage
-} from "./chunk-AVSTNODR.js";
+} from "./chunk-T4WTKBWI.js";
+import {
+  createRuleEngine
+} from "./chunk-4OU37CXP.js";
+import {
+  queryJS
+} from "./chunk-A7NEA4PA.js";
 import {
-  createRuleEngine,
   rand,
   sleep,
   wheelDelta
-} from "./chunk-CLYZPSDR.js";
-import {
-  queryJS
-} from "./chunk-3FWLW7FS.js";
-import "./chunk-3KZ34AUC.js";
+} from "./chunk-GYB5BOSP.js";
+import "./chunk-MYH6FIBZ.js";
 import {
   errMsg
 } from "./chunk-GDKLH7ZY.js";
-import {
-  detectAntiBot,
-  formatDetectionMessage
-} from "./chunk-JKVUFP3G.js";
 import "./chunk-KFQGP6VL.js";
 
 // src/daemon/daemon-main.ts
@@ -7766,7 +7768,7 @@ async function executeCommand(commandName, params, sessionName = "default", extr
   }
   let targetPageOverride = null;
   if (_target && extraOpts?.cdpEndpoint) {
-    const { findTargetPage } = await import("./browser-C2VEOJC2.js");
+    const { findTargetPage } = await import("./browser-DSYUAE7H.js");
     targetPageOverride = await findTargetPage(extraOpts.cdpEndpoint, _target);
     if (!targetPageOverride) {
       return errorResult(`Target "${_target}" not found. Use 'xbrowser targets --cdp ${extraOpts.cdpEndpoint}' to list available pages.`);
@@ -7983,7 +7985,7 @@ async function executeCommand(commandName, params, sessionName = "default", extr
     const errorMessage = errMsg(err);
     if (session?.page && process.env.XBROWSER_RECOVERY && !extraOpts?._recoveryAttempted) {
       try {
-        const { attemptRecovery } = await import("./recovery-MDWAVXE4.js");
+        const { attemptRecovery } = await import("./recovery-LGY25LIM.js");
         const recovery = await attemptRecovery(
           session.page,
           sessionName,
@@ -9023,7 +9025,7 @@ function createRPCHandler() {
       return result;
     } catch (err) {
       const errorMessage = errMsg(err);
-      const { attemptRecovery } = await import("./recovery-MDWAVXE4.js");
+      const { attemptRecovery } = await import("./recovery-LGY25LIM.js");
       const recovery = await attemptRecovery(
         session?.page,
         sessionName,
@@ -9190,9 +9192,9 @@ function createRPCHandler() {
     return result;
   }
   async function handlePluginsReload() {
-    const { resetPluginLoader } = await import("./plugin-singleton-FCNDN3FX.js");
+    const { resetPluginLoader } = await import("./plugin-singleton-GJO7EZXB.js");
     resetPluginLoader();
-    const loader = await import("./plugin-singleton-FCNDN3FX.js").then((m) => m.getPluginLoader());
+    const loader = await import("./plugin-singleton-GJO7EZXB.js").then((m) => m.getPluginLoader());
     const sites = loader.getCore().loader.getSites();
     return { ok: true, plugins: sites.length };
   }
@@ -9588,7 +9590,7 @@ function createRPCHandler() {
     if (isNewFormat) {
       try {
         const replayErrors = [];
-        const { SessionReplayer } = await import("./session-replayer-EVD4HZBB.js");
+        const { SessionReplayer } = await import("./session-replayer-N665T3G5.js");
         const replayer = new SessionReplayer({
           page: session.page,
           stepDelay: slowMo * 500,
@@ -9613,6 +9615,8 @@ function createRPCHandler() {
           duration,
           eventsPlayed: result2.success,
           totalEvents: result2.success + result2.failed + result2.skipped,
+          healed: result2.healed,
+          healedDetails: result2.healedDetails,
           errors: replayErrors
         });
       } catch (e) {
@@ -9645,6 +9649,8 @@ function createRPCHandler() {
       duration: typeof input.duration === "number" ? input.duration : 0,
       eventsPlayed,
       totalEvents,
+      healed: typeof input.healed === "number" ? input.healed : 0,
+      healedDetails: Array.isArray(input.healedDetails) ? input.healedDetails : [],
       errors
     };
   }

package/dist/{human-interaction-Y5IDH6LD.js → human-interaction-57VYIR56.js}

@@ -1,6 +1,6 @@
 import {
   HumanInteractionManager
-} from "./chunk-NKW4A74J.js";
+} from "./chunk-XTUAUFL3.js";
 import "./chunk-KFQGP6VL.js";
 export {
   HumanInteractionManager

package/dist/{human-interaction-ZUTR5AC2.js → human-interaction-67K43B4O.js}

@@ -1,6 +1,6 @@
 import {
   HumanInteractionManager
-} from "./chunk-TEXCXIBW.js";
+} from "./chunk-LPW6QS4M.js";
 import "./chunk-ZTHE5RBZ.js";
 import "./chunk-KFQGP6VL.js";
 export {

package/dist/{human-interaction-4YR2N6R6.js → human-interaction-MXST5ZQM.js}

@@ -1,6 +1,6 @@
 import {
   HumanInteractionManager
-} from "./chunk-OMU63E6J.js";
+} from "./chunk-FBQZ3PVD.js";
 import "./chunk-HBMEFSTB.js";
 import "./chunk-KFQGP6VL.js";
 export {

package/dist/index.d.ts

@@ -137,6 +137,12 @@ interface XBContextOptions {
     ignoreHTTPSErrors?: boolean;
     /** S194: stealth 伪装配置（UA-CH 档案等）——经 context 传至 page 的注入层 */
     stealthConfig?: Partial<StealthConfig>;
+    /** sup-s9: HTTP Basic/Digest 凭证——Fetch.authRequired 自动 ProvideCredentials；
+     * 缺省 CancelAuth（快速失败，不弹认证框不挂起） */
+    httpCredentials?: {
+        username: string;
+        password: string;
+    };
 }
 interface XBContext {
     newPage(): Promise<XBPage>;
@@ -270,6 +276,8 @@ interface XBPage {
         width: number;
         height: number;
     }): Promise<void>;
+    /** env-E2: 缩放变异——deviceScaleFactor 切换（CSS 视口尺寸不变） */
+    setDeviceScaleFactor(dsf: number): Promise<void>;
     addInitScript(script: string): Promise<void>;
     /** 覆盖当前页会话的 User-Agent（Network.setUserAgentOverride，会话级持久） */
     setUserAgent(userAgent: string): Promise<void>;
@@ -286,6 +294,10 @@ interface XBPage {
     route(url: string | RegExp, handler: (route: XBRoute) => Promise<void> | void): Promise<void>;
     unroute(url: string | RegExp, handler?: (route: XBRoute) => Promise<void> | void): Promise<void>;
     setInputFiles(selector: string, files: XBFilePayload | XBFilePayload[]): Promise<void>;
+    /** sup-s4: Dropzone 拖拽上传模拟——DataTransfer+File 派发 dragenter/dragover/drop */
+    dropFiles(selector: string, payload: XBFilePayload): Promise<void>;
+    /** sup-s11: beforeunload 自动应答语义（accept=离开默认 / dismiss=留守） */
+    setBeforeUnloadBehavior(mode: 'accept' | 'dismiss'): void;
     dragAndDrop(source: string, target: string): Promise<void>;
     on(event: string, handler: Function): void;
     off(event: string, handler: Function): void;
@@ -1136,7 +1148,7 @@ interface DetectionConfig {
  * along with optional `waitForHuman` (CAPTCHA handling) and
  * `detectAntiBot` (anti-bot detection) capabilities.
  */
-interface BrowserCommandContext extends CommandContext {
+interface BrowserCommandContext extends Omit<CommandContext, 'waitForHuman' | 'detectAntiBot' | 'page'> {
     page: XBPage;
     browser: XBBrowser;
     browserContext: XBContext;
@@ -1853,7 +1865,7 @@ interface HoverContext {
 }
 interface UserAction {
     id: number;
-    type: 'click' | 'input' | 'change' | 'keydown' | 'submit' | 'scroll' | 'navigation' | 'goto' | 'cdp-fill' | 'cdp-click' | 'cdp-eval' | 'filechooser' | 'dblclick' | 'contextmenu' | 'hover' | 'drag' | 'resize' | 'clipboard' | 'touch' | 'focus' | 'visibility' | 'popup_appear' | 'discovered_filters';
+    type: 'click' | 'input' | 'change' | 'keydown' | 'submit' | 'scroll' | 'navigation' | 'goto' | 'cdp-fill' | 'cdp-click' | 'cdp-eval' | 'filechooser' | 'dblclick' | 'contextmenu' | 'hover' | 'drag' | 'resize' | 'clipboard' | 'touch' | 'focus' | 'visibility' | 'drop' | 'popup_appear' | 'discovered_filters';
     timestamp: number;
     url: string;
     pageTitle: string;
@@ -1877,6 +1889,24 @@ interface UserAction {
         placeholder?: string;
         ariaLabel?: string;
         href?: string;
+        /** 结构地址（r6）：祖先 form 在同级 form 中的序 + 元素在 form 内同 tag
+         * 兄弟中的序（仅 form 直接子元素捕获）。布局位移后坐标失效时仍可定位。 */
+        ordinal?: {
+            formNth: number;
+            tagNth: number;
+        };
+        /** 关联 label 的文本（r16）：for= 关联或祖先 label 包裹。行重排/虚拟
+         * 列表重建后结构序失效时的内容锚。 */
+        labelText?: string;
+        /** 元素尺寸（r25）：录制时 rounded rect。同指纹诱饵消歧的评分信号
+         * （仅加分不否决——响应式布局合法改变尺寸）。 */
+        size?: {
+            w: number;
+            h: number;
+        };
+        /** 所在行文本（r27）：closest('tr,li') 的 textContent 前 40 字符。
+         * 表格/列表行重排后结构序失效时的内容锚（label 锚的行推广）。 */
+        rowText?: string;
     };
     value?: string;
     key?: string;
@@ -2277,6 +2307,12 @@ interface PlaybackResult {
         event?: RecordedEvent;
         error: string;
     }>;
+    /** r13: 自愈步数与明细（SessionReplayer 路径填充） */
+    healed?: number;
+    healedDetails?: Array<{
+        index: number;
+        strategy: string;
+    }>;
 }
 /**
  * Engine for playing back a recorded browser session.
@@ -2908,26 +2944,38 @@ interface HTTPServerConfig {
     port?: number;
     host?: string;
     tokens?: string[];
+    /**
+     * Explicit CORS origin allowlist for remote web clients (e.g.
+     * `['https://app.example']`, or `['*']` to opt back into wildcard).
+     * When omitted, only loopback browser origins are granted CORS.
+     */
+    corsOrigins?: string[];
 }
 
 /**
  * HTTP server exposing the xbrowser REST API for remote command execution.
  *
  * Provides endpoints for health checks, session management, single command
- * execution, and command chain execution. Supports optional Bearer token
+ * execution, and command chain execution. Supports Bearer token
  * authentication via config or environment variable.
+ *
+ * Secure defaults: binds loopback (127.0.0.1) only, and grants CORS only
+ * to loopback browser origins. Binding a non-loopback host requires a
+ * token — `start()` refuses otherwise.
  */
 declare class HTTPServer {
     private port;
     private host;
     private server;
     private validTokens;
+    private corsOrigins;
     constructor(config?: HTTPServerConfig);
     /**
      * Start the HTTP server and begin listening for requests.
      *
      * @returns The actual port and host the server bound to.
-     * @throws If the server is already running or fails to start.
+     * @throws If the server is already running, if binding a non-loopback
+     *   host without an auth token, or if the port cannot be bound.
      */
     start(): Promise<{
         port: number;