barebrowse 0.14.0 → 0.17.0

package/src/ax-snapshot.js

@@ -0,0 +1,287 @@
+// @ts-nocheck — AX_FN below is browser-context code (document, getComputedStyle,
+// CSS, real regex literals) serialized via .toString() and run inside Firefox,
+// never in Node. tsc's Node lib (no DOM) can't meaningfully check it, and the
+// readable.js string convention would corrupt its regex backslashes, so the
+// file opts out of type-checking. The Node-side exports are trivial.
+/**
+ * ax-snapshot.js — Reconstruct a CDP-shaped accessibility tree in-page.
+ *
+ * CDP hands you Accessibility.getFullAXTree; BiDi has no equivalent, so on
+ * Firefox we rebuild an equivalent tree inside the page via script.evaluate.
+ * The output tree uses the SAME node shape and role vocabulary as
+ * buildTree()'s CDP output, so prune.js and aria.js consume it unchanged:
+ *
+ *   { nodeId, role, name, properties, children, ignored }
+ *
+ * where `role` is CDP/ARIA vocabulary ('RootWebArea', 'StaticText', 'heading',
+ * 'link', 'button', 'img', 'paragraph', 'list', 'navigation', …), NOT tag
+ * names. The three things getFullAXTree gave us for free and we reimplement:
+ *   1. implicit ARIA role mapping (HTML element → role)
+ *   2. accessible-name computation (aria-labelledby → aria-label → native
+ *      label/alt/legend/title → text content) — the POC proved textContent
+ *      alone is NOT enough (img alt, <label>, aria-labelledby all missed).
+ *   3. hidden-subtree filtering (aria-hidden, display:none, visibility:hidden,
+ *      the hidden attribute).
+ *
+ * Each kept element is tagged with a data-bb-ref attribute carrying its ref,
+ * so firefox-page.js (resolveRef) can resolve a ref back to its element via
+ * querySelector.
+ * Refs are assigned from a caller-supplied `base` so they stay globally unique
+ * across browsing contexts (iframes), matching CDP's flat integer refs.
+ */
+
+/** Attribute used to tag elements for ref → element resolution. */
+export const REF_ATTR = 'data-bb-ref';
+
+/**
+ * The in-page reconstruction function, as source text. Evaluated in a browsing
+ * context with a `base` ref offset; returns JSON { tree, count }. Written as a
+ * single self-contained function (no closures over module scope) because it
+ * runs in the page, not in Node.
+ */
+const AX_FN = function reconstructAX(base, REF_ATTR) {
+  let ref = base;
+
+  // Roles whose accessible name comes from descendant text (so we must NOT
+  // also emit child StaticText nodes — CDP folds the text into the name).
+  const NAME_FROM_CONTENT = new Set([
+    'button', 'link', 'heading', 'cell', 'columnheader', 'rowheader',
+    'tab', 'menuitem', 'option', 'treeitem', 'switch', 'checkbox', 'radio',
+  ]);
+
+  // HTML tag → implicit ARIA role (the common, high-value subset).
+  const TAG_ROLE = {
+    A: (el) => (el.hasAttribute('href') ? 'link' : 'generic'),
+    BUTTON: () => 'button',
+    NAV: () => 'navigation', MAIN: () => 'main', ASIDE: () => 'complementary',
+    HEADER: (el) => (isTopLevelLandmark(el) ? 'banner' : 'generic'),
+    FOOTER: (el) => (isTopLevelLandmark(el) ? 'contentinfo' : 'generic'),
+    FORM: () => 'form', SEARCH: () => 'search',
+    SECTION: (el) => (accName(el) ? 'region' : 'generic'),
+    ARTICLE: () => 'article',
+    H1: () => 'heading', H2: () => 'heading', H3: () => 'heading',
+    H4: () => 'heading', H5: () => 'heading', H6: () => 'heading',
+    P: () => 'paragraph',
+    UL: () => 'list', OL: () => 'list', LI: () => 'listitem',
+    DL: () => 'list', DT: () => 'term', DD: () => 'definition',
+    IMG: (el) => (el.getAttribute('alt') === '' ? 'none' : 'image'),
+    FIGURE: () => 'figure', FIGCAPTION: () => 'Figcaption',
+    TABLE: () => 'table', TR: () => 'row', TD: () => 'cell',
+    TH: (el) => (el.getAttribute('scope') === 'row' ? 'rowheader' : 'columnheader'),
+    THEAD: () => 'rowgroup', TBODY: () => 'rowgroup', TFOOT: () => 'rowgroup',
+    SELECT: (el) => (el.multiple ? 'listbox' : 'combobox'),
+    TEXTAREA: () => 'textbox',
+    OPTION: () => 'option',
+    LABEL: () => 'LabelText', SPAN: () => 'generic', DIV: () => 'generic',
+    STRONG: () => 'strong', EM: () => 'emphasis', B: () => 'strong', I: () => 'emphasis',
+    BLOCKQUOTE: () => 'blockquote', CODE: () => 'code', PRE: () => 'generic',
+    HR: () => 'separator',
+    IFRAME: () => 'Iframe', FRAME: () => 'Iframe',
+    INPUT: (el) => {
+      const t = (el.getAttribute('type') || 'text').toLowerCase();
+      return ({
+        button: 'button', submit: 'button', reset: 'button', image: 'button',
+        checkbox: 'checkbox', radio: 'radio', range: 'slider',
+        search: 'searchbox', email: 'textbox', tel: 'textbox', url: 'textbox',
+        text: 'textbox', password: 'textbox', number: 'spinbutton',
+        hidden: 'none',
+      })[t] || 'textbox';
+    },
+  };
+
+  function isTopLevelLandmark(el) {
+    // <header>/<footer> are landmarks only when not scoped inside article/section/main/aside.
+    for (let p = el.parentElement; p; p = p.parentElement) {
+      if (/^(ARTICLE|SECTION|MAIN|ASIDE|NAV)$/.test(p.tagName)) return false;
+    }
+    return true;
+  }
+
+  function roleOf(el) {
+    const explicit = el.getAttribute('role');
+    if (explicit) return explicit.trim().split(/\s+/)[0];
+    const fn = TAG_ROLE[el.tagName];
+    return fn ? fn(el) : 'generic';
+  }
+
+  function isHidden(el) {
+    if (el.getAttribute('aria-hidden') === 'true') return true;
+    if (el.hasAttribute('hidden')) return true;
+    const s = getComputedStyle(el);
+    if (s.display === 'none' || s.visibility === 'hidden' || s.visibility === 'collapse') return true;
+    return false;
+  }
+
+  // Accessible-name computation (compact subset of the accname spec, covering
+  // the cases the POC proved textContent misses).
+  function accName(el, depth) {
+    depth = depth || 0;
+    // 1. aria-labelledby (resolve id refs → their text)
+    const lb = el.getAttribute && el.getAttribute('aria-labelledby');
+    if (lb && depth < 2) {
+      const txt = lb.split(/\s+/).map((id) => {
+        const t = document.getElementById(id);
+        return t ? accName(t, depth + 1) || t.textContent.trim() : '';
+      }).filter(Boolean).join(' ').trim();
+      if (txt) return txt;
+    }
+    // 2. aria-label
+    const al = el.getAttribute && el.getAttribute('aria-label');
+    if (al && al.trim()) return al.trim();
+    const tag = el.tagName;
+    // 3. native naming
+    if (tag === 'IMG' || tag === 'AREA') {
+      const alt = el.getAttribute('alt');
+      if (alt) return alt.trim();
+    }
+    if (tag === 'INPUT' || tag === 'TEXTAREA' || tag === 'SELECT') {
+      // associated <label> (for= or wrapping ancestor)
+      if (el.id) {
+        const lab = document.querySelector('label[for="' + CSS.escape(el.id) + '"]');
+        if (lab) return lab.textContent.trim();
+      }
+      const wrap = el.closest && el.closest('label');
+      if (wrap) return wrap.textContent.trim();
+      const ph = el.getAttribute('placeholder');
+      if (ph && ph.trim()) return ph.trim();
+    }
+    if (tag === 'FIELDSET') {
+      const lg = el.querySelector && el.querySelector('legend');
+      if (lg) return lg.textContent.trim();
+    }
+    if (tag === 'TABLE') {
+      const cap = el.querySelector && el.querySelector('caption');
+      if (cap) return cap.textContent.trim();
+    }
+    // 4. title attribute
+    const title = el.getAttribute && el.getAttribute('title');
+    if (title && title.trim()) return title.trim();
+    return '';
+  }
+
+  function props(el, role) {
+    const p = {};
+    if (role === 'checkbox' || role === 'radio' || role === 'switch') p.checked = !!el.checked;
+    if (el.disabled || el.getAttribute('aria-disabled') === 'true') p.disabled = true;
+    const exp = el.getAttribute('aria-expanded');
+    if (exp !== null) p.expanded = exp === 'true';
+    if (role === 'heading') p.level = Number(el.getAttribute('aria-level')) || Number(el.tagName[1]) || 2;
+    if (el.getAttribute('aria-selected') === 'true') p.selected = true;
+    if (el.required || el.getAttribute('aria-required') === 'true') p.required = true;
+    if ((role === 'textbox' || role === 'searchbox' || role === 'combobox' || role === 'spinbutton') && el.value) {
+      p.value = el.value;
+    }
+    return p;
+  }
+
+  function makeNode(role, name, properties) {
+    return { nodeId: String(++ref), role, name: name || '', properties: properties || {}, children: [], ignored: false };
+  }
+
+  // Walk a DOM element → AX node (or null if hidden/irrelevant). Text runs
+  // become StaticText children unless the parent names from content.
+  function walk(el) {
+    if (isHidden(el)) return null;
+    let role = roleOf(el);
+    if (role === 'none') return collapseChildren(el); // presentational: keep kids
+
+    // Accessible name: explicit sources first, then fall back to descendant
+    // text for roles that name from content (button/link/heading/…), matching
+    // CDP — otherwise those nodes come back nameless.
+    let name = accName(el);
+    if (!name && NAME_FROM_CONTENT.has(role)) {
+      name = el.textContent.replace(/\s+/g, ' ').trim();
+    }
+    const node = makeNode(role, name, props(el, role));
+    el.setAttribute(REF_ATTR, node.nodeId);
+
+    // A collapsed native <select> exposes its current value via props/name;
+    // don't expand its <option> list into the tree (a 200-item country select
+    // would otherwise flood every snapshot). A multi/size listbox keeps them.
+    if (el.tagName === 'SELECT' && !el.multiple) return node;
+
+    if (!NAME_FROM_CONTENT.has(role)) {
+      for (const child of kidsOf(el)) {
+        if (child.nodeType === 3) {
+          const t = child.textContent.replace(/\s+/g, ' ').trim();
+          if (t) node.children.push(makeNode('StaticText', t, {}));
+        } else if (child.nodeType === 1) {
+          const c = walk(child);
+          if (c) Array.isArray(c) ? node.children.push(...c) : node.children.push(c);
+        }
+      }
+    } else {
+      // name-from-content: still recurse into element children for nested
+      // interactives (e.g. a link inside a heading), but drop bare text.
+      for (const child of kidsOf(el)) {
+        if (child.nodeType !== 1) continue;
+        const c = walk(child);
+        if (c) Array.isArray(c) ? node.children.push(...c) : node.children.push(c);
+      }
+    }
+    return node;
+  }
+
+  // Effective children to traverse: shadow-root content when the element hosts
+  // an open shadow tree (that is what actually renders — CDP's AX tree includes
+  // it), assigned light nodes for a <slot>, else plain light-DOM childNodes.
+  function kidsOf(el) {
+    if (el.tagName === 'SLOT') {
+      const assigned = el.assignedNodes ? el.assignedNodes({ flatten: true }) : [];
+      return assigned.length ? assigned : [...el.childNodes];
+    }
+    if (el.shadowRoot) return [...el.shadowRoot.childNodes];
+    return [...el.childNodes];
+  }
+
+  // Presentational element (role=none/presentation): emit its children only.
+  function collapseChildren(el) {
+    const out = [];
+    for (const child of kidsOf(el)) {
+      if (child.nodeType === 3) {
+        const t = child.textContent.replace(/\s+/g, ' ').trim();
+        if (t) out.push(makeNode('StaticText', t, {}));
+      } else if (child.nodeType === 1 && !isHidden(child)) {
+        const c = walk(child);
+        if (c) Array.isArray(c) ? out.push(...c) : out.push(c);
+      }
+    }
+    return out;
+  }
+
+  // Clear stale refs from a prior snapshot so resolution never hits a ghost.
+  for (const old of document.querySelectorAll('[' + REF_ATTR + ']')) old.removeAttribute(REF_ATTR);
+
+  // Wrap body content in an ignored 'none' node, mirroring the html/body
+  // wrappers CDP's getFullAXTree emits. prune.js's region extraction only
+  // inspects RootWebArea's DIRECT children for landmarks, so without this
+  // wrapper a top-level <form>/<nav> (no <main>) would be treated as a
+  // directly-extractable region and dropped in act mode — a divergence from
+  // CDP, where the same landmark is buried under body and flows through.
+  const root = makeNode('RootWebArea', document.title || '', {});
+  const body = makeNode('none', '', {});
+  body.ignored = true;
+  // childNodes (not .children) so bare text directly under <body> is kept as
+  // StaticText, matching walk()/CDP; .children would silently drop it.
+  for (const child of document.body ? document.body.childNodes : []) {
+    if (child.nodeType === 3) {
+      const t = child.textContent.replace(/\s+/g, ' ').trim();
+      if (t) body.children.push(makeNode('StaticText', t, {}));
+    } else if (child.nodeType === 1) {
+      const c = walk(child);
+      if (c) Array.isArray(c) ? body.children.push(...c) : body.children.push(c);
+    }
+  }
+  root.children.push(body);
+  return JSON.stringify({ tree: root, count: ref - base });
+};
+
+/**
+ * Build the script.evaluate expression that reconstructs the AX tree in a
+ * context, assigning refs from `base`.
+ * @param {number} base - Starting ref offset (exclusive; first ref is base+1)
+ * @returns {string} JS expression returning JSON { tree, count }
+ */
+export function axSnapshotExpression(base) {
+  return `(${AX_FN.toString()})(${Number(base)}, ${JSON.stringify(REF_ATTR)})`;
+}

package/src/bidi.js

@@ -0,0 +1,143 @@
+/**
+ * bidi.js — Minimal WebDriver BiDi client over WebSocket (Firefox transport).
+ *
+ * The W3C-standard successor to CDP. CDP was deprecated in Firefox, so Firefox
+ * is driven over BiDi instead. This is the BiDi analogue of cdp.js: same
+ * JSON-RPC-over-WebSocket shape (id/method/params → result), same `ws`
+ * dependency and 256 MB maxPayload (a full AX snapshot of a large page is
+ * returned as one big string from script.evaluate — see ax-snapshot.js — and
+ * would blow the built-in WebSocket cap exactly as getFullAXTree did on CDP).
+ *
+ * Differences from CDP that shape this client:
+ *   - A session must be created explicitly (`session.new`) before any command.
+ *   - Events must be subscribed to (`session.subscribe`); we lean on
+ *     command results (navigate's `wait:'complete'`) instead where possible.
+ *   - Errors arrive as `{ type:'error', error, message }`, not `{ error:{} }`.
+ *   - Everything is scoped by `context` (a browsing-context id), not sessionId.
+ */
+
+import WebSocket from 'ws';
+
+/** Lift the message ceiling well past any realistic AX/DOM payload. */
+const MAX_PAYLOAD = 256 * 1024 * 1024; // 256 MB
+
+/**
+ * Create a BiDi client connected to the given /session WebSocket URL and open
+ * a session. Firefox prints its BiDi endpoint to stderr as
+ * "WebDriver BiDi listening on ws://HOST:PORT"; the direct-connection socket
+ * (no WebDriver-classic handshake) lives at that URL + "/session".
+ *
+ * @param {string} wsUrl - BiDi session WebSocket URL (ws://HOST:PORT/session)
+ * @returns {Promise<object>} BiDi client ({ send, evaluate, on, once, subscribe, sessionId, close })
+ */
+export async function createBiDi(wsUrl) {
+  const ws = new WebSocket(wsUrl, { maxPayload: MAX_PAYLOAD, perMessageDeflate: false });
+  let nextId = 1;
+  const pending = new Map();   // id → { resolve, reject }
+  const listeners = new Map(); // "method" → Set<callback>
+
+  /** @type {Promise<void>} */
+  const connected = new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => reject(new Error('BiDi connection timeout (5s)')), 5000);
+    ws.onopen = () => { clearTimeout(timeout); resolve(); };
+    ws.onerror = (e) => {
+      clearTimeout(timeout);
+      reject(new Error(`BiDi WebSocket connection failed: ${e.message || 'unknown error'}`));
+    };
+  });
+  await connected;
+
+  ws.onmessage = (event) => {
+    const msg = JSON.parse(typeof event.data === 'string' ? event.data : event.data.toString());
+
+    // Command response (has id + type 'success' | 'error')
+    if (msg.id !== undefined && pending.has(msg.id)) {
+      const handler = pending.get(msg.id);
+      pending.delete(msg.id);
+      if (msg.type === 'error') {
+        handler.reject(new Error(`BiDi error: ${msg.error} — ${msg.message || ''}`.trim()));
+      } else {
+        handler.resolve(msg.result);
+      }
+      return;
+    }
+
+    // Event (type 'event', has method + params)
+    if (msg.type === 'event' && msg.method) {
+      const set = listeners.get(msg.method);
+      if (set) for (const cb of set) cb(msg.params);
+    }
+  };
+
+  ws.onclose = () => {
+    for (const [id, handler] of pending) {
+      handler.reject(new Error('BiDi WebSocket closed'));
+      pending.delete(id);
+    }
+  };
+
+  const client = {
+    /**
+     * Send a BiDi command and wait for its result.
+     * @param {string} method - e.g. 'browsingContext.navigate'
+     * @param {object} [params]
+     * @returns {Promise<object>} result
+     */
+    send(method, params = {}) {
+      const id = nextId++;
+      return new Promise((resolve, reject) => {
+        pending.set(id, { resolve, reject });
+        ws.send(JSON.stringify({ id, method, params }));
+      });
+    },
+
+    /**
+     * Evaluate an expression in a browsing context and return its value.
+     * Throws on an in-page exception (BiDi reports these as a `success`
+     * envelope with `type:'exception'`, unlike a protocol error).
+     * @param {string} context - browsing-context id
+     * @param {string} expression - JS source to evaluate
+     * @param {boolean} [awaitPromise=true]
+     * @returns {Promise<*>} the deserialized primitive value (result.value)
+     */
+    async evaluate(context, expression, awaitPromise = true) {
+      const res = await client.send('script.evaluate', {
+        expression, target: { context }, awaitPromise,
+      });
+      if (res.type === 'exception') {
+        const d = res.exceptionDetails;
+        throw new Error(`BiDi script exception: ${d?.text || d?.exception?.value || 'unknown'}`);
+      }
+      return res.result?.value;
+    },
+
+    /** Subscribe to BiDi events by method name (required before events fire). */
+    async subscribe(events) {
+      await client.send('session.subscribe', { events });
+    },
+
+    /** Register an event listener. Returns an unsubscribe function. */
+    on(method, callback) {
+      if (!listeners.has(method)) listeners.set(method, new Set());
+      listeners.get(method).add(callback);
+      return () => listeners.get(method)?.delete(callback);
+    },
+
+    /** Resolve once a named event fires (or reject on timeout). */
+    once(method, timeout = 30000) {
+      return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => { unsub(); reject(new Error(`Timeout waiting for BiDi event: ${method}`)); }, timeout);
+        const unsub = client.on(method, (params) => { clearTimeout(timer); unsub(); resolve(params); });
+      });
+    },
+
+    sessionId: null,
+    close() { ws.close(); },
+  };
+
+  // Open the session. capabilities:{} accepts Firefox's defaults.
+  const session = await client.send('session.new', { capabilities: {} });
+  client.sessionId = session.sessionId;
+  client.capabilities = session.capabilities;
+  return client;
+}

package/src/consent-firefox.js

@@ -0,0 +1,125 @@
+/**
+ * consent-firefox.js — Auto-dismiss cookie consent dialogs on the Firefox/BiDi
+ * engine, by walking the reconstructed AX tree (ax-snapshot.js).
+ *
+ * The CDP walker (consent.js) can't be reused verbatim: it consumes CDP's flat
+ * getFullAXTree (nodes[] with parentId / role.value / backendDOMNodeId) and
+ * clicks via DOM.resolveNode + Input.dispatchMouseEvent. The Firefox tree is a
+ * DIFFERENT shape — nested `children`, string `role`/`name`, and each node's
+ * `nodeId` IS its ref (stamped as data-bb-ref) — and clicks go through
+ * input.performActions. So this is a parallel walker sharing only the language
+ * patterns (consent-patterns.js).
+ *
+ * It's written as a PURE function over (root tree, click(ref)) so it can be
+ * unit-tested against fixture trees with no browser: the caller (firefox-page)
+ * injects a real click that routes ref → pointerClick. The nested tree also
+ * makes "descendant of dialog" a plain subtree walk — no parentMap needed.
+ */
+
+import { ACCEPT_PATTERNS, DIALOG_ROLES, CONSENT_DIALOG_HINTS } from './consent-patterns.js';
+
+/** Roles whose text confirms a container is a consent dialog. */
+const CONSENT_TEXT_ROLES = new Set(['heading', 'StaticText', 'generic']);
+
+/** Depth-first walk yielding every node in the subtree rooted at `node`. */
+function* walk(node) {
+  if (!node) return;
+  yield node;
+  for (const child of node.children || []) yield* walk(child);
+}
+
+/** True if any node in this subtree carries consent-hint text. */
+function hasConsentContent(dialog) {
+  for (const node of walk(dialog)) {
+    if (node === dialog) continue;
+    if (CONSENT_TEXT_ROLES.has(node.role) && CONSENT_DIALOG_HINTS.some((p) => p.test(node.name || ''))) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Find the best "accept" button inside a dialog subtree, honouring
+ * ACCEPT_PATTERNS priority (most specific first).
+ */
+function findAcceptButton(dialog) {
+  for (const pattern of ACCEPT_PATTERNS) {
+    for (const node of walk(dialog)) {
+      if (node.role === 'button' && node.name && pattern.test(node.name)) return node;
+    }
+  }
+  return null;
+}
+
+/**
+ * Fallback when no consent dialog container is found: scan the whole tree for a
+ * button matching a STRONG (multi-word) accept pattern. Excludes the bare
+ * ^accept$/^agree$/^ok$ fallbacks (last 3) so we don't false-match unrelated
+ * page buttons — mirrors consent.js's tryGlobalConsentButton.
+ */
+function findGlobalAcceptButton(root) {
+  const safePatterns = ACCEPT_PATTERNS.slice(0, -3);
+  for (const pattern of safePatterns) {
+    for (const node of walk(root)) {
+      if (node.role === 'button' && node.name && pattern.test(node.name)) return node;
+    }
+  }
+  return null;
+}
+
+/**
+ * Try to dismiss a cookie consent dialog in a reconstructed Firefox AX tree.
+ *
+ * @param {object} root - Spliced AX tree root (from firefox-page's buildTree).
+ * @param {(ref: string) => Promise<void>} click - Clicks the element for a ref
+ *   (firefox-page injects one that routes to pointerClick / performActions).
+ * @returns {Promise<boolean>} true if an accept button was found and clicked.
+ */
+export async function dismissConsentFirefox(root, click) {
+  if (!root) return false;
+
+  // Find dialog containers that look like consent dialogs.
+  const consentDialogs = [];
+  for (const node of walk(root)) {
+    if (!DIALOG_ROLES.has(node.role)) continue;
+    const name = node.name || '';
+    if (CONSENT_DIALOG_HINTS.some((p) => p.test(name)) || hasConsentContent(node)) {
+      consentDialogs.push(node);
+    }
+  }
+
+  // Accept button inside a consent dialog (preferred — scoped, low false-positive).
+  for (const dialog of consentDialogs) {
+    const button = findAcceptButton(dialog);
+    if (button?.nodeId) {
+      try {
+        await click(button.nodeId);
+        return true;
+      } catch {
+        // Click failed (stale ref / navigated) — try the next dialog.
+      }
+    }
+  }
+
+  // Banner-style consent (no dialog container at all): scan the page for a
+  // strong accept button. We deliberately DO NOT run this page-wide scan when a
+  // consent dialog WAS detected but had no in-scope accept button — a page-wide
+  // match there can click an UNRELATED "Accept all …" control elsewhere (e.g. a
+  // ToS/signup button), an automatic wrong mutation on goto(). The trade-off is
+  // losing the rare "accept button rendered outside its own dialog" pattern; we
+  // accept that miss rather than risk a wrong click. See the PRD "known
+  // limitations" note for the validated false-positive this guards against.
+  if (consentDialogs.length === 0) {
+    const global = findGlobalAcceptButton(root);
+    if (global?.nodeId) {
+      try {
+        await click(global.nodeId);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  }
+  return false;
+}