barebrowse 0.15.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,109 @@
 # Changelog
 
+## [0.17.0] - 2026-07-10
+
+### Added
+
+- **Firefox/BiDi observability parity (parity plan Phase 2).** The Firefox
+  engine now backs the same console/network capture and network-idle wait the
+  Chromium/CDP engine has, over WebDriver BiDi events instead of CDP:
+  - **`page.waitForNetworkIdle()`** works on Firefox (was a CDP-only stub that
+    threw). Wired to `network.beforeRequestSent` / `responseCompleted` /
+    `fetchError`, reusing the same orphan-resilient idle core as the CDP path
+    (`waitForNetworkIdleBiDi` in `network-idle.js`).
+  - **Daemon console + network log capture** on Firefox: the `console-logs`,
+    `network-log`, and `wait-idle` CLI commands now return real data for a
+    `--engine firefox` session (previously empty / unsupported). Backed by
+    `log.entryAdded` + `network.*` events (`attachBiDiCapture` in `daemon.js`),
+    mirroring the CDP `Runtime.consoleAPICalled` / `Network.*` capture. BiDi's
+    `warn` console level is normalized to CDP's `warning` so `--level` filters
+    match cross-engine.
+
+  Event shapes were measured against real Firefox before wiring (per the Phase 1
+  lesson). Unit-tested against those shapes in `test/unit/network-idle.test.js`
+  and `test/unit/daemon.test.js`; live-verified in `test/integration/firefox.test.js`.
+  Still Firefox gaps (Phase 3+): ad/tracker block, dialog capture, `saveState`,
+  `waitForNavigation`, hybrid mode.
+
+## [0.16.1] - 2026-07-10
+
+### Fixed
+
+- **Firefox consent auto-dismiss no longer risks clicking an unrelated button.**
+  A code review of v0.16.0 found (and reproduced) a false-positive: when a
+  consent *dialog* was detected but contained no in-dialog accept button, the
+  Firefox walker fell back to a page-wide "accept" scan that could auto-click an
+  unrelated `Accept all …` control elsewhere on the page (e.g. a ToS/signup
+  button) during `goto()`. The page-wide scan now runs **only** for banner-style
+  consent (no dialog container at all). Trade-off: an accept button rendered
+  *outside* its own dialog (some SourcePoint deployments) is no longer
+  auto-dismissed on Firefox — we accept that miss rather than risk a wrong
+  click. Regression-tested in `test/unit/consent-firefox.test.js`.
+
+### Documentation
+
+- **Firefox stealth + consent known limitations** captured in the PRD
+  (`docs/01-product/prd.md`), slated for the Phase 5 cross-engine fidelity
+  harness: the consent double AX-build per navigate (bounded latency, parity
+  with CDP), the single-click-without-re-verify behavior (`consent: false` to
+  opt out), and the latent `navigator.webdriver` own-property fallback. All
+  three were validated in the same review; none is a correctness defect on
+  current engines.
+
+## [0.16.0] - 2026-07-10
+
+### Added
+
+- **Firefox anti-detection + consent auto-dismiss (BiDi parity Phase 1).** The
+  two most agent-breaking Firefox gaps are closed: headless bot-detection and
+  cookie-consent dialogs that were never dismissed. Both now work on
+  `connect({ engine: 'firefox' })` (and therefore the CLI/daemon/MCP Firefox
+  paths), behind the same flags as the CDP engine.
+  - **Stealth** (`src/stealth-firefox.js`, headless only, via BiDi
+    `script.addPreloadScript`). Deliberately *not* a port of Chromium's
+    `STEALTH_SCRIPT`: a POC measured stock Firefox-under-BiDi and found it
+    already exposes a realistic surface (no `window.chrome`, a real plugin set,
+    the real GPU, a UA with no "Headless" marker) — injecting Chromium's
+    Chrome-shims would have *created* a spoof tell worse than the one removed.
+    Firefox's only real tell is `navigator.webdriver` (`true`), so it gets a
+    minimal script: `navigator.webdriver` hiding + canvas-fingerprint noise.
+    `WEBDRIVER_PATCH` and `CANVAS_NOISE_PATCH` are now exported from
+    `stealth.js` and shared by both engines (single-sourcing the canvas
+    double-XOR fix).
+- **Hardened `navigator.webdriver` hiding on both engines.** The shared
+  `WEBDRIVER_PATCH` now *deletes* the getter off `Navigator.prototype` instead
+  of shadowing it with an own property. A naive override hid the value but left
+  `navigator.hasOwnProperty('webdriver') === true` — a tell that advanced
+  anti-bot checks (e.g. sannysoft's "WebDriver New") detect. After the change
+  `navigator.webdriver` is `undefined` and both `hasOwnProperty` and
+  `'webdriver' in navigator` read `false`, matching a stock browser
+  (POC-verified on Chromium and Firefox). This improves the Chromium engine
+  too, not just Firefox.
+  - **Consent** (`src/consent-firefox.js`). A walker over the reconstructed
+    nested AX tree that clicks the "accept" button via the existing BiDi
+    `pointerClick`. The multilingual accept/dialog patterns were extracted to
+    `src/consent-patterns.js`, now imported by both the CDP (`consent.js`) and
+    BiDi walkers, so language coverage stays single-sourced. Runs after
+    `goto()` behind the same `consent !== false` flag as CDP.
+  - **Tests:** `test/unit/consent-firefox.test.js` (pure walker: dialog
+    scoping, pattern priority, non-English, banner fallback, false-positive
+    guard) plus Firefox integration tests (webdriver hidden at page-parse time,
+    no `window.chrome` spoof, consent auto-dismiss + a `consent: false` control
+    that proves the test can fail).
+
+### Known gaps (Firefox engine)
+
+- `hybrid` mode, ad/tracker blocking, and console/network log capture remain
+  Chromium-only (BiDi parity Phases 2–4). `saveState`, `waitForNavigation`,
+  and `waitForNetworkIdle` still throw a clear "not supported on the
+  Firefox/BiDi engine" error; download/dialog logs read empty.
+- `reload()` still cannot honour `ignoreCache` (Firefox BiDi does not support
+  it yet).
+- Consent auto-dismiss clicks once without re-verifying dismissal (the CDP
+  path's synthetic→real retry is unnecessary here — BiDi `pointerClick` is
+  already a real pointer event). Accessible-name computation remains a
+  high-value subset of the full W3C accname spec.
+
 ## [0.15.0] - 2026-07-10
 
 ### Added
@@ -23,7 +127,13 @@
     parity with CDP.
   - Fidelity validated against real CDP snapshots; iframes (incl. nested +
     multi-tab), shadow DOM, CSP, and SPA timing covered in
-    `test/integration/firefox.test.js` (15 tests).
+    `test/integration/firefox.test.js` (18 tests).
+  - `goto`/`reload`/history navigation honour a timeout (a page that never
+    finishes loading rejects instead of hanging). Proxy honours the URL scheme
+    (`http`/`https` → HTTP+SSL, `socks`/`socks5`/`socks4` → SOCKS). Cookie
+    injection is host-scoped like CDP (shared `scopedCookiesForUrl`, not the
+    whole jar). Snapshot fidelity: a collapsed `<select>` surfaces as its value
+    (not every `<option>`), and bare text directly under `<body>` is kept.
 
 - **Incognito mode — a clean, unauthenticated session (`incognito: true`).**
   Skips ALL auth injection: no cookie extraction/injection and no

package/README.md

@@ -145,10 +145,27 @@ const page = await connect({ engine: 'firefox' }); // headless by default
 
 From the CLI: `barebrowse open <url> --engine firefox`. From MCP: set
 `BAREBROWSE_ENGINE=firefox`. Firefox cookies (plaintext) reuse into the same
-engine. Chromium (CDP) remains the default; `hybrid` mode is Chromium-only.
+engine. Consent auto-dismiss and headless stealth work on Firefox too (as of
+v0.16.0). Chromium (CDP) remains the default; `hybrid` mode, ad/tracker
+blocking, and the daemon's console/network capture are still Chromium-only.
 
 No clone profile, no fresh cookies — the agent sees what you see.
 
+### Incognito (clean session)
+
+Pass `incognito: true` for a clean, **unauthenticated** session — barebrowse
+skips *all* auth injection (cookies + storage state), so the agent browses
+logged out. It is not Chrome's `--incognito` flag: the session already runs in
+a throwaway profile, so this gates the *other* auth source — your real browser
+cookies. Works on both engines:
+
+```js
+const page = await connect({ incognito: true });
+```
+
+From the CLI: `barebrowse open <url> --incognito`. From MCP: set
+`BAREBROWSE_INCOGNITO=1`.
+
 ## What it handles automatically
 
 Cookie consent walls (29 languages, with real mouse click fallback for stubborn CMPs), login walls (cookie extraction from your browsers), bot detection (ARIA node count heuristic + stealth patches + automatic headed fallback — snapshot shows `[BOT CHALLENGE DETECTED]` warning when blocked), permission prompts, SPA navigation, JS dialogs, off-screen elements, pre-filled inputs, ARIA noise, and profile locking. The agent doesn't think about any of it.

package/barebrowse.context.md

@@ -95,7 +95,7 @@ const snapshot = await browse('https://example.com', {
 | `close()` | -- | void | Close page, disconnect CDP, kill browser (if headless) |
 
 **connect() options** (in addition to mode/port/consent):
-- `engine: 'chromium'|'firefox'` — Browser engine. Default `chromium` (CDP). `firefox` drives Firefox over WebDriver BiDi (CDP is deprecated there) — a separate transport with the same `page.*` API; the ARIA snapshot is reconstructed in-page since BiDi has no `getFullAXTree`. Chromium-only: `hybrid` mode, consent auto-dismiss, stealth, and the CLI daemon's console/network capture. `reload()` ignores `ignoreCache` on Firefox (BiDi limitation).
+- `engine: 'chromium'|'firefox'` — Browser engine. Default `chromium` (CDP). `firefox` drives Firefox over WebDriver BiDi (CDP is deprecated there) — a separate transport with the same `page.*` API; the ARIA snapshot is reconstructed in-page since BiDi has no `getFullAXTree`. Consent auto-dismiss and stealth (headless anti-detection) work on Firefox as of v0.16.0; the CLI daemon's console/network capture and `waitForNetworkIdle` work as of v0.17.0. Still Chromium-only: `hybrid` mode and ad/tracker blocking. `reload()` ignores `ignoreCache` on Firefox (BiDi limitation).
 - `port: 9222` — Attach to a Chromium already running with `--remote-debugging-port=N` instead of spawning one. The browser keeps running on `close()`. Stealth + permission denial + download capture are skipped to avoid mutating the user's running browser.
 - `proxy: 'http://...'` — HTTP/SOCKS proxy for browser
 - `viewport: '1280x720'` — Set viewport dimensions
@@ -189,8 +189,8 @@ barebrowse can inject cookies from the user's real browser sessions, bypassing l
 
 | Obstacle | How | Mode |
 |---|---|---|
-| Cookie consent | ARIA scan + jsClick accept button, 29 languages | Both |
-| Consent behind iframes | JS `.click()` via DOM.resolveNode bypasses overlays, real mouse click fallback for CMPs that ignore synthetic clicks | Both |
+| Cookie consent | ARIA scan for the accept button, 29 languages. CDP: `jsClick` (overlay-bypassing) then a real-mouse-click fallback for CMPs that ignore synthetic clicks. Firefox/BiDi: a single real pointer click. A page-wide accept scan runs only for banner-style consent (no dialog) — when a dialog is detected but has no in-dialog accept button, no page-wide scan runs, to avoid clicking an unrelated `Accept all …` control | Both engines |
+| Consent behind iframes | Scanned/clicked in the owning frame (CDP `DOM.resolveNode`; Firefox resolves the ref in its browsing context) | Both engines |
 | Permission prompts | Launch flags + CDP Browser.setPermission auto-deny | Both |
 | Media autoplay blocked | `--autoplay-policy=no-user-gesture-required` | Both |
 | Login walls | Cookie extraction from Firefox/Chromium + CDP injection | Both |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "barebrowse",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Authenticated web browsing for autonomous agents via CDP. URL in, pruned ARIA snapshot out.",
   "repository": {
     "type": "git",

package/src/consent-firefox.js

@@ -0,0 +1,125 @@
+/**
+ * consent-firefox.js — Auto-dismiss cookie consent dialogs on the Firefox/BiDi
+ * engine, by walking the reconstructed AX tree (ax-snapshot.js).
+ *
+ * The CDP walker (consent.js) can't be reused verbatim: it consumes CDP's flat
+ * getFullAXTree (nodes[] with parentId / role.value / backendDOMNodeId) and
+ * clicks via DOM.resolveNode + Input.dispatchMouseEvent. The Firefox tree is a
+ * DIFFERENT shape — nested `children`, string `role`/`name`, and each node's
+ * `nodeId` IS its ref (stamped as data-bb-ref) — and clicks go through
+ * input.performActions. So this is a parallel walker sharing only the language
+ * patterns (consent-patterns.js).
+ *
+ * It's written as a PURE function over (root tree, click(ref)) so it can be
+ * unit-tested against fixture trees with no browser: the caller (firefox-page)
+ * injects a real click that routes ref → pointerClick. The nested tree also
+ * makes "descendant of dialog" a plain subtree walk — no parentMap needed.
+ */
+
+import { ACCEPT_PATTERNS, DIALOG_ROLES, CONSENT_DIALOG_HINTS } from './consent-patterns.js';
+
+/** Roles whose text confirms a container is a consent dialog. */
+const CONSENT_TEXT_ROLES = new Set(['heading', 'StaticText', 'generic']);
+
+/** Depth-first walk yielding every node in the subtree rooted at `node`. */
+function* walk(node) {
+  if (!node) return;
+  yield node;
+  for (const child of node.children || []) yield* walk(child);
+}
+
+/** True if any node in this subtree carries consent-hint text. */
+function hasConsentContent(dialog) {
+  for (const node of walk(dialog)) {
+    if (node === dialog) continue;
+    if (CONSENT_TEXT_ROLES.has(node.role) && CONSENT_DIALOG_HINTS.some((p) => p.test(node.name || ''))) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Find the best "accept" button inside a dialog subtree, honouring
+ * ACCEPT_PATTERNS priority (most specific first).
+ */
+function findAcceptButton(dialog) {
+  for (const pattern of ACCEPT_PATTERNS) {
+    for (const node of walk(dialog)) {
+      if (node.role === 'button' && node.name && pattern.test(node.name)) return node;
+    }
+  }
+  return null;
+}
+
+/**
+ * Fallback when no consent dialog container is found: scan the whole tree for a
+ * button matching a STRONG (multi-word) accept pattern. Excludes the bare
+ * ^accept$/^agree$/^ok$ fallbacks (last 3) so we don't false-match unrelated
+ * page buttons — mirrors consent.js's tryGlobalConsentButton.
+ */
+function findGlobalAcceptButton(root) {
+  const safePatterns = ACCEPT_PATTERNS.slice(0, -3);
+  for (const pattern of safePatterns) {
+    for (const node of walk(root)) {
+      if (node.role === 'button' && node.name && pattern.test(node.name)) return node;
+    }
+  }
+  return null;
+}
+
+/**
+ * Try to dismiss a cookie consent dialog in a reconstructed Firefox AX tree.
+ *
+ * @param {object} root - Spliced AX tree root (from firefox-page's buildTree).
+ * @param {(ref: string) => Promise<void>} click - Clicks the element for a ref
+ *   (firefox-page injects one that routes to pointerClick / performActions).
+ * @returns {Promise<boolean>} true if an accept button was found and clicked.
+ */
+export async function dismissConsentFirefox(root, click) {
+  if (!root) return false;
+
+  // Find dialog containers that look like consent dialogs.
+  const consentDialogs = [];
+  for (const node of walk(root)) {
+    if (!DIALOG_ROLES.has(node.role)) continue;
+    const name = node.name || '';
+    if (CONSENT_DIALOG_HINTS.some((p) => p.test(name)) || hasConsentContent(node)) {
+      consentDialogs.push(node);
+    }
+  }
+
+  // Accept button inside a consent dialog (preferred — scoped, low false-positive).
+  for (const dialog of consentDialogs) {
+    const button = findAcceptButton(dialog);
+    if (button?.nodeId) {
+      try {
+        await click(button.nodeId);
+        return true;
+      } catch {
+        // Click failed (stale ref / navigated) — try the next dialog.
+      }
+    }
+  }
+
+  // Banner-style consent (no dialog container at all): scan the page for a
+  // strong accept button. We deliberately DO NOT run this page-wide scan when a
+  // consent dialog WAS detected but had no in-scope accept button — a page-wide
+  // match there can click an UNRELATED "Accept all …" control elsewhere (e.g. a
+  // ToS/signup button), an automatic wrong mutation on goto(). The trade-off is
+  // losing the rare "accept button rendered outside its own dialog" pattern; we
+  // accept that miss rather than risk a wrong click. See the PRD "known
+  // limitations" note for the validated false-positive this guards against.
+  if (consentDialogs.length === 0) {
+    const global = findGlobalAcceptButton(root);
+    if (global?.nodeId) {
+      try {
+        await click(global.nodeId);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  }
+  return false;
+}

package/src/consent-patterns.js

@@ -0,0 +1,154 @@
+/**
+ * consent-patterns.js — Shared cookie-consent detection data.
+ *
+ * The engine-agnostic half of consent handling: the multilingual regex sets
+ * and dialog roles used to recognise a consent dialog and its "accept" button.
+ * Both the CDP walker (consent.js) and the BiDi walker (consent-firefox.js)
+ * import these so the language coverage is single-sourced — a new language or
+ * pattern is added once and both engines get it.
+ */
+
+// Button text patterns that mean "accept all" / "I agree" across common languages.
+// Order matters: more specific patterns first to avoid false positives.
+export const ACCEPT_PATTERNS = [
+  // English
+  /\baccept\s*all\b/i,
+  /\ballow\s*all\b/i,
+  /\bagree\s*to\s*all\b/i,
+  /\byes,?\s*i\s*agree\b/i,
+  /\bi\s*agree\b/i,
+  /\baccept\s*cookies?\b/i,
+  /\ballow\s*cookies?\b/i,
+  /\bgot\s*it\b/i,
+  // Dutch
+  /\balles\s*accepteren\b/i,
+  /\balles\s*toestaan\b/i,
+  /\baccepteren\b/i,
+  /\bakkoord\b/i,
+  // German
+  /\balle\s*akzeptieren\b/i,
+  /\ballem\s*zustimmen\b/i,
+  /\balle\s*cookies?\s*akzeptieren\b/i,
+  // French
+  /\btout\s*accepter\b/i,
+  /\baccepter\s*tout\b/i,
+  /\bj['']accepte\b/i,
+  // Spanish
+  /\baceptar\s*todo\b/i,
+  /\baceptar\s*todas?\b/i,
+  // Italian
+  /\baccetta\s*tutto\b/i,
+  /\baccetto\b/i,
+  // Portuguese
+  /\baceitar\s*tudo\b/i,
+  // Russian
+  /принять\s*все/i,
+  /принять/i,
+  /согласен/i,
+  // Ukrainian
+  /прийняти\s*все/i,
+  /прийняти/i,
+  // Polish
+  /zaakceptuj\s*wszystk/i,
+  /akceptuj\s*wszystk/i,
+  /zgadzam\s*się/i,
+  // Czech
+  /přijmout\s*vše/i,
+  /souhlasím/i,
+  // Turkish
+  /tümünü\s*kabul\s*et/i,
+  /kabul\s*et/i,
+  /kabul\s*ediyorum/i,
+  // Romanian
+  /acceptă\s*tot/i,
+  /accept\s*toate/i,
+  // Hungarian
+  /összes\s*elfogadás/i,
+  /elfogad/i,
+  // Greek
+  /αποδοχή\s*όλων/i,
+  /αποδέχομαι/i,
+  // Swedish
+  /acceptera\s*alla/i,
+  /godkänn\s*alla/i,
+  // Danish
+  /accepter\s*alle/i,
+  /acceptér\s*alle/i,
+  // Norwegian
+  /godta\s*alle/i,
+  /aksepter\s*alle/i,
+  // Finnish
+  /hyväksy\s*kaikki/i,
+  /hyväksyn/i,
+  // Arabic
+  /قبول\s*الكل/,
+  /قبول\s*الجميع/,
+  /موافق/,
+  /قبول/,
+  // Persian
+  /پذیرش\s*همه/,
+  /موافقم/,
+  /پذیرش/,
+  // Chinese (Simplified + Traditional)
+  /全部接受/,
+  /接受所有/,
+  /接受全部/,
+  /同意并继续/,
+  /全部接受/,
+  /接受/,
+  /同意/,
+  // Japanese
+  /すべて受け入れ/,
+  /すべて許可/,
+  /同意する/,
+  /同意します/,
+  // Korean
+  /모두\s*수락/,
+  /모두\s*동의/,
+  /동의합니다/,
+  /수락/,
+  // Vietnamese
+  /chấp\s*nhận\s*tất\s*cả/i,
+  /đồng\s*ý\s*tất\s*cả/i,
+  /đồng\s*ý/i,
+  // Thai
+  /ยอมรับทั้งหมด/,
+  /ยอมรับ/,
+  // Hindi
+  /सभी\s*स्वीकार/,
+  /स्वीकार\s*करें/,
+  /सहमत/,
+  // Indonesian / Malay
+  /terima\s*semua/i,
+  /setuju/i,
+  // Generic single-word fallbacks (only matched inside dialogs)
+  /^accept$/i,
+  /^agree$/i,
+  /^ok$/i,
+];
+
+// Roles that indicate a consent dialog container.
+export const DIALOG_ROLES = new Set(['dialog', 'alertdialog']);
+
+// Text patterns in dialog names/headings that confirm it's about consent.
+export const CONSENT_DIALOG_HINTS = [
+  /cookie/i,
+  /consent/i,
+  /privacy/i,
+  /before\s*you\s*continue/i,
+  /voordat\s*je\s*verdergaat/i,  // Dutch
+  /bevor\s*du\s*fortf/i,         // German
+  /avant\s*de\s*continuer/i,     // French
+  /antes\s*de\s*continuar/i,     // Spanish / Portuguese
+  /prima\s*di\s*continuare/i,    // Italian
+  /zanim\s*przejdziesz/i,        // Polish
+  /прежде\s*чем\s*продолжить/i,  // Russian
+  /devam\s*etmeden\s*önce/i,     // Turkish
+  /続行する前に/,                  // Japanese
+  /继续前/,                        // Chinese Simplified
+  /繼續前/,                        // Chinese Traditional
+  /계속하기\s*전에/,                // Korean
+  /trước\s*khi\s*tiếp\s*tục/i,   // Vietnamese
+  /ملفات\s*تعريف\s*الارتباط/,    // Arabic: cookies
+  /คุกกี้/,                        // Thai: cookies
+];

package/src/consent.js

@@ -4,152 +4,13 @@
  * Scans the page ARIA tree for consent dialogs and clicks the "accept" button.
  * Works across languages by matching common accept/agree patterns.
  * Runs once after page load — no polling, no mutation observers.
+ *
+ * The multilingual pattern sets live in consent-patterns.js (shared with the
+ * Firefox/BiDi walker in consent-firefox.js); this file owns the CDP-specific
+ * tree walk + click.
  */
 
-// Button text patterns that mean "accept all" / "I agree" across common languages.
-// Order matters: more specific patterns first to avoid false positives.
-const ACCEPT_PATTERNS = [
-  // English
-  /\baccept\s*all\b/i,
-  /\ballow\s*all\b/i,
-  /\bagree\s*to\s*all\b/i,
-  /\byes,?\s*i\s*agree\b/i,
-  /\bi\s*agree\b/i,
-  /\baccept\s*cookies?\b/i,
-  /\ballow\s*cookies?\b/i,
-  /\bgot\s*it\b/i,
-  // Dutch
-  /\balles\s*accepteren\b/i,
-  /\balles\s*toestaan\b/i,
-  /\baccepteren\b/i,
-  /\bakkoord\b/i,
-  // German
-  /\balle\s*akzeptieren\b/i,
-  /\ballem\s*zustimmen\b/i,
-  /\balle\s*cookies?\s*akzeptieren\b/i,
-  // French
-  /\btout\s*accepter\b/i,
-  /\baccepter\s*tout\b/i,
-  /\bj['']accepte\b/i,
-  // Spanish
-  /\baceptar\s*todo\b/i,
-  /\baceptar\s*todas?\b/i,
-  // Italian
-  /\baccetta\s*tutto\b/i,
-  /\baccetto\b/i,
-  // Portuguese
-  /\baceitar\s*tudo\b/i,
-  // Russian
-  /принять\s*все/i,
-  /принять/i,
-  /согласен/i,
-  // Ukrainian
-  /прийняти\s*все/i,
-  /прийняти/i,
-  // Polish
-  /zaakceptuj\s*wszystk/i,
-  /akceptuj\s*wszystk/i,
-  /zgadzam\s*się/i,
-  // Czech
-  /přijmout\s*vše/i,
-  /souhlasím/i,
-  // Turkish
-  /tümünü\s*kabul\s*et/i,
-  /kabul\s*et/i,
-  /kabul\s*ediyorum/i,
-  // Romanian
-  /acceptă\s*tot/i,
-  /accept\s*toate/i,
-  // Hungarian
-  /összes\s*elfogadás/i,
-  /elfogad/i,
-  // Greek
-  /αποδοχή\s*όλων/i,
-  /αποδέχομαι/i,
-  // Swedish
-  /acceptera\s*alla/i,
-  /godkänn\s*alla/i,
-  // Danish
-  /accepter\s*alle/i,
-  /acceptér\s*alle/i,
-  // Norwegian
-  /godta\s*alle/i,
-  /aksepter\s*alle/i,
-  // Finnish
-  /hyväksy\s*kaikki/i,
-  /hyväksyn/i,
-  // Arabic
-  /قبول\s*الكل/,
-  /قبول\s*الجميع/,
-  /موافق/,
-  /قبول/,
-  // Persian
-  /پذیرش\s*همه/,
-  /موافقم/,
-  /پذیرش/,
-  // Chinese (Simplified + Traditional)
-  /全部接受/,
-  /接受所有/,
-  /接受全部/,
-  /同意并继续/,
-  /全部接受/,
-  /接受/,
-  /同意/,
-  // Japanese
-  /すべて受け入れ/,
-  /すべて許可/,
-  /同意する/,
-  /同意します/,
-  // Korean
-  /모두\s*수락/,
-  /모두\s*동의/,
-  /동의합니다/,
-  /수락/,
-  // Vietnamese
-  /chấp\s*nhận\s*tất\s*cả/i,
-  /đồng\s*ý\s*tất\s*cả/i,
-  /đồng\s*ý/i,
-  // Thai
-  /ยอมรับทั้งหมด/,
-  /ยอมรับ/,
-  // Hindi
-  /सभी\s*स्वीकार/,
-  /स्वीकार\s*करें/,
-  /सहमत/,
-  // Indonesian / Malay
-  /terima\s*semua/i,
-  /setuju/i,
-  // Generic single-word fallbacks (only matched inside dialogs)
-  /^accept$/i,
-  /^agree$/i,
-  /^ok$/i,
-];
-
-// Roles that indicate a consent dialog container.
-const DIALOG_ROLES = new Set(['dialog', 'alertdialog']);
-
-// Text patterns in dialog names/headings that confirm it's about consent.
-const CONSENT_DIALOG_HINTS = [
-  /cookie/i,
-  /consent/i,
-  /privacy/i,
-  /before\s*you\s*continue/i,
-  /voordat\s*je\s*verdergaat/i,  // Dutch
-  /bevor\s*du\s*fortf/i,         // German
-  /avant\s*de\s*continuer/i,     // French
-  /antes\s*de\s*continuar/i,     // Spanish / Portuguese
-  /prima\s*di\s*continuare/i,    // Italian
-  /zanim\s*przejdziesz/i,        // Polish
-  /прежде\s*чем\s*продолжить/i,  // Russian
-  /devam\s*etmeden\s*önce/i,     // Turkish
-  /続行する前に/,                  // Japanese
-  /继续前/,                        // Chinese Simplified
-  /繼續前/,                        // Chinese Traditional
-  /계속하기\s*전에/,                // Korean
-  /trước\s*khi\s*tiếp\s*tục/i,   // Vietnamese
-  /ملفات\s*تعريف\s*الارتباط/,    // Arabic: cookies
-  /คุกกี้/,                        // Thai: cookies
-];
+import { ACCEPT_PATTERNS, DIALOG_ROLES, CONSENT_DIALOG_HINTS } from './consent-patterns.js';
 
 /**
  * Click a node via JavaScript .click() instead of mouse events.