barebrowse 0.15.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,138 @@
 # Changelog
 
+## [0.18.0] - 2026-07-11
+
+### Added
+
+- **Firefox/BiDi noise-reduction + dialogs (parity plan Phase 3).** Two more
+  Chromium/CDP capabilities now work the same on the Firefox engine:
+  - **Ad/tracker blocking** (`blockAds`, on by default; `blockUrls` to extend).
+    BiDi's `network.addIntercept` can't express our glob patterns — its
+    `urlPatterns` reject `*` outright and have no subdomain wildcard — so the
+    Firefox path registers a *catch-all* `beforeRequestSent` intercept and
+    matches each request URL in-process against the shared `blocklist.js`
+    (new `makeBlockMatcher` compiles the CDP globs to a predicate, single-sourced
+    across engines). Matches are failed like CDP's `ERR_BLOCKED_BY_CLIENT`; the
+    rest continue. Default is **on** (Firefox is always a launched throwaway
+    profile, never attach mode). `src/blocklist-firefox.js`.
+  - **JS dialog handling** (`alert`/`confirm`/`prompt`/`beforeunload`). The BiDi
+    session is created with `unhandledPromptBehavior:'ignore'` so Firefox no
+    longer auto-dismisses prompts before we can act; `page.dialogLog` records
+    every dialog and `page.onDialog(handler)` overrides the default (accept all
+    except `beforeunload`), mirroring the CDP surface exactly.
+
+  BiDi mechanics were POC-measured against real Firefox before wiring (the "no
+  such alert" auto-dismiss race, and that `urlPatterns` reject `*`). Guarded by
+  `test/unit/blocklist-firefox.test.js` (10) and Firefox integration tests
+  (ad-block via a hermetic CORS server so the `blockAds:false` control genuinely
+  passes through; dialog auto-accept + `dialogLog` + custom `onDialog`).
+  Remaining Firefox gaps (Phase 4+): hybrid mode, `saveState`,
+  `waitForNavigation`, downloads, `reload({ignoreCache})`.
+
+## [0.17.0] - 2026-07-10
+
+### Added
+
+- **Firefox/BiDi observability parity (parity plan Phase 2).** The Firefox
+  engine now backs the same console/network capture and network-idle wait the
+  Chromium/CDP engine has, over WebDriver BiDi events instead of CDP:
+  - **`page.waitForNetworkIdle()`** works on Firefox (was a CDP-only stub that
+    threw). Wired to `network.beforeRequestSent` / `responseCompleted` /
+    `fetchError`, reusing the same orphan-resilient idle core as the CDP path
+    (`waitForNetworkIdleBiDi` in `network-idle.js`).
+  - **Daemon console + network log capture** on Firefox: the `console-logs`,
+    `network-log`, and `wait-idle` CLI commands now return real data for a
+    `--engine firefox` session (previously empty / unsupported). Backed by
+    `log.entryAdded` + `network.*` events (`attachBiDiCapture` in `daemon.js`),
+    mirroring the CDP `Runtime.consoleAPICalled` / `Network.*` capture. BiDi's
+    `warn` console level is normalized to CDP's `warning` so `--level` filters
+    match cross-engine.
+
+  Event shapes were measured against real Firefox before wiring (per the Phase 1
+  lesson). Unit-tested against those shapes in `test/unit/network-idle.test.js`
+  and `test/unit/daemon.test.js`; live-verified in `test/integration/firefox.test.js`.
+  Still Firefox gaps (Phase 3+): ad/tracker block, dialog capture, `saveState`,
+  `waitForNavigation`, hybrid mode.
+
+## [0.16.1] - 2026-07-10
+
+### Fixed
+
+- **Firefox consent auto-dismiss no longer risks clicking an unrelated button.**
+  A code review of v0.16.0 found (and reproduced) a false-positive: when a
+  consent *dialog* was detected but contained no in-dialog accept button, the
+  Firefox walker fell back to a page-wide "accept" scan that could auto-click an
+  unrelated `Accept all …` control elsewhere on the page (e.g. a ToS/signup
+  button) during `goto()`. The page-wide scan now runs **only** for banner-style
+  consent (no dialog container at all). Trade-off: an accept button rendered
+  *outside* its own dialog (some SourcePoint deployments) is no longer
+  auto-dismissed on Firefox — we accept that miss rather than risk a wrong
+  click. Regression-tested in `test/unit/consent-firefox.test.js`.
+
+### Documentation
+
+- **Firefox stealth + consent known limitations** captured in the PRD
+  (`docs/01-product/prd.md`), slated for the Phase 5 cross-engine fidelity
+  harness: the consent double AX-build per navigate (bounded latency, parity
+  with CDP), the single-click-without-re-verify behavior (`consent: false` to
+  opt out), and the latent `navigator.webdriver` own-property fallback. All
+  three were validated in the same review; none is a correctness defect on
+  current engines.
+
+## [0.16.0] - 2026-07-10
+
+### Added
+
+- **Firefox anti-detection + consent auto-dismiss (BiDi parity Phase 1).** The
+  two most agent-breaking Firefox gaps are closed: headless bot-detection and
+  cookie-consent dialogs that were never dismissed. Both now work on
+  `connect({ engine: 'firefox' })` (and therefore the CLI/daemon/MCP Firefox
+  paths), behind the same flags as the CDP engine.
+  - **Stealth** (`src/stealth-firefox.js`, headless only, via BiDi
+    `script.addPreloadScript`). Deliberately *not* a port of Chromium's
+    `STEALTH_SCRIPT`: a POC measured stock Firefox-under-BiDi and found it
+    already exposes a realistic surface (no `window.chrome`, a real plugin set,
+    the real GPU, a UA with no "Headless" marker) — injecting Chromium's
+    Chrome-shims would have *created* a spoof tell worse than the one removed.
+    Firefox's only real tell is `navigator.webdriver` (`true`), so it gets a
+    minimal script: `navigator.webdriver` hiding + canvas-fingerprint noise.
+    `WEBDRIVER_PATCH` and `CANVAS_NOISE_PATCH` are now exported from
+    `stealth.js` and shared by both engines (single-sourcing the canvas
+    double-XOR fix).
+- **Hardened `navigator.webdriver` hiding on both engines.** The shared
+  `WEBDRIVER_PATCH` now *deletes* the getter off `Navigator.prototype` instead
+  of shadowing it with an own property. A naive override hid the value but left
+  `navigator.hasOwnProperty('webdriver') === true` — a tell that advanced
+  anti-bot checks (e.g. sannysoft's "WebDriver New") detect. After the change
+  `navigator.webdriver` is `undefined` and both `hasOwnProperty` and
+  `'webdriver' in navigator` read `false`, matching a stock browser
+  (POC-verified on Chromium and Firefox). This improves the Chromium engine
+  too, not just Firefox.
+  - **Consent** (`src/consent-firefox.js`). A walker over the reconstructed
+    nested AX tree that clicks the "accept" button via the existing BiDi
+    `pointerClick`. The multilingual accept/dialog patterns were extracted to
+    `src/consent-patterns.js`, now imported by both the CDP (`consent.js`) and
+    BiDi walkers, so language coverage stays single-sourced. Runs after
+    `goto()` behind the same `consent !== false` flag as CDP.
+  - **Tests:** `test/unit/consent-firefox.test.js` (pure walker: dialog
+    scoping, pattern priority, non-English, banner fallback, false-positive
+    guard) plus Firefox integration tests (webdriver hidden at page-parse time,
+    no `window.chrome` spoof, consent auto-dismiss + a `consent: false` control
+    that proves the test can fail).
+
+### Known gaps (Firefox engine)
+
+- `hybrid` mode, ad/tracker blocking, and console/network log capture remain
+  Chromium-only (BiDi parity Phases 2–4). `saveState`, `waitForNavigation`,
+  and `waitForNetworkIdle` still throw a clear "not supported on the
+  Firefox/BiDi engine" error; download/dialog logs read empty.
+- `reload()` still cannot honour `ignoreCache` (Firefox BiDi does not support
+  it yet).
+- Consent auto-dismiss clicks once without re-verifying dismissal (the CDP
+  path's synthetic→real retry is unnecessary here — BiDi `pointerClick` is
+  already a real pointer event). Accessible-name computation remains a
+  high-value subset of the full W3C accname spec.
+
 ## [0.15.0] - 2026-07-10
 
 ### Added
@@ -23,7 +156,13 @@
     parity with CDP.
   - Fidelity validated against real CDP snapshots; iframes (incl. nested +
     multi-tab), shadow DOM, CSP, and SPA timing covered in
-    `test/integration/firefox.test.js` (15 tests).
+    `test/integration/firefox.test.js` (18 tests).
+  - `goto`/`reload`/history navigation honour a timeout (a page that never
+    finishes loading rejects instead of hanging). Proxy honours the URL scheme
+    (`http`/`https` → HTTP+SSL, `socks`/`socks5`/`socks4` → SOCKS). Cookie
+    injection is host-scoped like CDP (shared `scopedCookiesForUrl`, not the
+    whole jar). Snapshot fidelity: a collapsed `<select>` surfaces as its value
+    (not every `<option>`), and bare text directly under `<body>` is kept.
 
 - **Incognito mode — a clean, unauthenticated session (`incognito: true`).**
   Skips ALL auth injection: no cookie extraction/injection and no

package/README.md

@@ -145,10 +145,29 @@ const page = await connect({ engine: 'firefox' }); // headless by default
 
 From the CLI: `barebrowse open <url> --engine firefox`. From MCP: set
 `BAREBROWSE_ENGINE=firefox`. Firefox cookies (plaintext) reuse into the same
-engine. Chromium (CDP) remains the default; `hybrid` mode is Chromium-only.
+engine. Consent auto-dismiss and headless stealth (v0.16.0), the daemon's
+console/network capture and `waitForNetworkIdle` (v0.17.0), and ad/tracker
+blocking plus JS dialog handling (`dialogLog`/`onDialog`, v0.18.0) all work on
+Firefox too. Chromium (CDP) remains the default; only `hybrid` mode is still
+Chromium-only.
 
 No clone profile, no fresh cookies — the agent sees what you see.
 
+### Incognito (clean session)
+
+Pass `incognito: true` for a clean, **unauthenticated** session — barebrowse
+skips *all* auth injection (cookies + storage state), so the agent browses
+logged out. It is not Chrome's `--incognito` flag: the session already runs in
+a throwaway profile, so this gates the *other* auth source — your real browser
+cookies. Works on both engines:
+
+```js
+const page = await connect({ incognito: true });
+```
+
+From the CLI: `barebrowse open <url> --incognito`. From MCP: set
+`BAREBROWSE_INCOGNITO=1`.
+
 ## What it handles automatically
 
 Cookie consent walls (29 languages, with real mouse click fallback for stubborn CMPs), login walls (cookie extraction from your browsers), bot detection (ARIA node count heuristic + stealth patches + automatic headed fallback — snapshot shows `[BOT CHALLENGE DETECTED]` warning when blocked), permission prompts, SPA navigation, JS dialogs, off-screen elements, pre-filled inputs, ARIA noise, and profile locking. The agent doesn't think about any of it.

package/barebrowse.context.md

@@ -95,7 +95,7 @@ const snapshot = await browse('https://example.com', {
 | `close()` | -- | void | Close page, disconnect CDP, kill browser (if headless) |
 
 **connect() options** (in addition to mode/port/consent):
-- `engine: 'chromium'|'firefox'` — Browser engine. Default `chromium` (CDP). `firefox` drives Firefox over WebDriver BiDi (CDP is deprecated there) — a separate transport with the same `page.*` API; the ARIA snapshot is reconstructed in-page since BiDi has no `getFullAXTree`. Chromium-only: `hybrid` mode, consent auto-dismiss, stealth, and the CLI daemon's console/network capture. `reload()` ignores `ignoreCache` on Firefox (BiDi limitation).
+- `engine: 'chromium'|'firefox'` — Browser engine. Default `chromium` (CDP). `firefox` drives Firefox over WebDriver BiDi (CDP is deprecated there) — a separate transport with the same `page.*` API; the ARIA snapshot is reconstructed in-page since BiDi has no `getFullAXTree`. Consent auto-dismiss and stealth (headless anti-detection) work on Firefox as of v0.16.0; the CLI daemon's console/network capture and `waitForNetworkIdle` work as of v0.17.0; ad/tracker blocking (`blockAds`/`blockUrls`) and JS dialog handling (`dialogLog`/`onDialog`) work as of Phase 3. Still Chromium-only: `hybrid` mode. `reload()` ignores `ignoreCache` on Firefox (BiDi limitation).
 - `port: 9222` — Attach to a Chromium already running with `--remote-debugging-port=N` instead of spawning one. The browser keeps running on `close()`. Stealth + permission denial + download capture are skipped to avoid mutating the user's running browser.
 - `proxy: 'http://...'` — HTTP/SOCKS proxy for browser
 - `viewport: '1280x720'` — Set viewport dimensions
@@ -189,8 +189,8 @@ barebrowse can inject cookies from the user's real browser sessions, bypassing l
 
 | Obstacle | How | Mode |
 |---|---|---|
-| Cookie consent | ARIA scan + jsClick accept button, 29 languages | Both |
-| Consent behind iframes | JS `.click()` via DOM.resolveNode bypasses overlays, real mouse click fallback for CMPs that ignore synthetic clicks | Both |
+| Cookie consent | ARIA scan for the accept button, 29 languages. CDP: `jsClick` (overlay-bypassing) then a real-mouse-click fallback for CMPs that ignore synthetic clicks. Firefox/BiDi: a single real pointer click. A page-wide accept scan runs only for banner-style consent (no dialog) — when a dialog is detected but has no in-dialog accept button, no page-wide scan runs, to avoid clicking an unrelated `Accept all …` control | Both engines |
+| Consent behind iframes | Scanned/clicked in the owning frame (CDP `DOM.resolveNode`; Firefox resolves the ref in its browsing context) | Both engines |
 | Permission prompts | Launch flags + CDP Browser.setPermission auto-deny | Both |
 | Media autoplay blocked | `--autoplay-policy=no-user-gesture-required` | Both |
 | Login walls | Cookie extraction from Firefox/Chromium + CDP injection | Both |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "barebrowse",
-  "version": "0.15.0",
+  "version": "0.18.0",
   "description": "Authenticated web browsing for autonomous agents via CDP. URL in, pruned ARIA snapshot out.",
   "repository": {
     "type": "git",

package/src/bidi.js

@@ -135,8 +135,14 @@ export async function createBiDi(wsUrl) {
     close() { ws.close(); },
   };
 
-  // Open the session. capabilities:{} accepts Firefox's defaults.
-  const session = await client.send('session.new', { capabilities: {} });
+  // Open the session. unhandledPromptBehavior:'ignore' stops Firefox from
+  // auto-dismissing JS dialogs (alert/confirm/prompt) before we can handle them
+  // — without it, browsingContext.handleUserPrompt loses the race and fails
+  // with "no such alert" (measured). firefox-page.js wires a userPromptOpened
+  // handler before any navigation, so no dialog is ever left hanging.
+  const session = await client.send('session.new', {
+    capabilities: { alwaysMatch: { unhandledPromptBehavior: 'ignore' } },
+  });
   client.sessionId = session.sessionId;
   client.capabilities = session.capabilities;
   return client;

package/src/blocklist-firefox.js

@@ -0,0 +1,60 @@
+/**
+ * blocklist-firefox.js — Ad/tracker blocking on the Firefox/BiDi engine.
+ *
+ * The BiDi analogue of index.js's applyBlocklist (CDP Network.setBlockedURLs).
+ * BiDi's network.addIntercept can't express our glob patterns — its urlPatterns
+ * reject '*' ("forbidden character *") and have no subdomain wildcard — so we
+ * register a *catch-all* intercept (empty urlPatterns) at the beforeRequestSent
+ * phase and decide per request in-process, matching each URL against the shared
+ * blocklist (makeBlockMatcher). Matches are failed (net error, like CDP's
+ * ERR_BLOCKED_BY_CLIENT); everything else is continued immediately.
+ *
+ * Cost vs. CDP: CDP matches browser-side with zero round-trips. Here every
+ * request pauses for one continue/fail round-trip to Node. On a typical page
+ * (tens–low-hundreds of requests over a local socket) that's negligible, and
+ * it's the only route that preserves glob parity without a second list.
+ */
+
+import { resolveBlocklistPatterns, makeBlockMatcher } from './blocklist.js';
+
+/**
+ * Install ad/tracker blocking on a BiDi session. Idempotent per session is the
+ * caller's concern; call once at connect time before the first navigation.
+ *
+ * @param {object} bidi - BiDi client (send, subscribe, on).
+ * @param {object} pageOpts
+ * @param {boolean} [pageOpts.blockAds] - false disables the default list.
+ * @param {string[]} [pageOpts.blockUrls] - extra CDP-format globs; extend the
+ *   default unless blockAds is false, in which case they're the whole list.
+ * @returns {Promise<void>}
+ */
+export async function applyFirefoxBlocklist(bidi, pageOpts = {}) {
+  const patterns = resolveBlocklistPatterns(pageOpts);
+  if (!patterns.length) return;
+
+  const isBlocked = makeBlockMatcher(patterns);
+
+  await bidi.send('network.addIntercept', {
+    phases: ['beforeRequestSent'],
+    urlPatterns: [],
+  });
+  await bidi.subscribe(['network.beforeRequestSent']);
+
+  bidi.on('network.beforeRequestSent', async (e) => {
+    // Only paused (intercepted) events need a decision; capture-only listeners
+    // see the same event with isBlocked=false and must be ignored here.
+    if (!e.isBlocked) return;
+    const id = e.request?.request;
+    if (!id) return;
+    try {
+      if (isBlocked(e.request.url)) {
+        await bidi.send('network.failRequest', { request: id });
+      } else {
+        await bidi.send('network.continueRequest', { request: id });
+      }
+    } catch {
+      // "no such request" — the request completed or was cancelled between the
+      // event and our reply (redundant nav requests, aborted fetches). Harmless.
+    }
+  });
+}

package/src/blocklist.js

@@ -200,3 +200,52 @@ export const DEFAULT_BLOCKLIST = [
   '*://*.bluekai.com/*',              // Oracle Data Cloud
   '*://*.krxd.net/*',                 // Salesforce / Krux
 ];
+
+/**
+ * Resolve the effective blocklist from a page's blockAds/blockUrls options.
+ * Single-sourced across engines (CDP applyBlocklist + BiDi applyFirefoxBlocklist)
+ * so the merge/extend rule can't drift between them:
+ *   - blockAds !== false → DEFAULT_BLOCKLIST plus any blockUrls (extend);
+ *   - blockAds === false → only blockUrls (the default list is dropped);
+ *   - neither → empty (blocking disabled).
+ *
+ * @param {object} [pageOpts]
+ * @param {boolean} [pageOpts.blockAds] - false drops the default list.
+ * @param {string[]} [pageOpts.blockUrls] - extra CDP-format globs.
+ * @returns {string[]} the patterns to block (possibly empty).
+ */
+export function resolveBlocklistPatterns(pageOpts = {}) {
+  return pageOpts.blockAds === false
+    ? (pageOpts.blockUrls || [])
+    : [...DEFAULT_BLOCKLIST, ...(pageOpts.blockUrls || [])];
+}
+
+/**
+ * Compile CDP-format glob patterns into a single URL-matching predicate.
+ *
+ * CDP blocks natively via Network.setBlockedURLs, which does the glob matching
+ * browser-side. WebDriver BiDi has no glob-capable equivalent — network.
+ * addIntercept's urlPatterns reject '*' outright ("forbidden character *") and
+ * can't express subdomain wildcards like *.doubleclick.net. So the Firefox
+ * path intercepts *all* requests and matches each URL here, in-process, against
+ * the same patterns — keeping the blocklist single-sourced across engines.
+ *
+ * Matches CDP's glob semantics: '*' = any run of characters, '?' = exactly
+ * one character, whole-URL (anchored) match; every other character is literal.
+ *
+ * @param {string[]} patterns - CDP-format globs (e.g. DEFAULT_BLOCKLIST).
+ * @returns {(url: string) => boolean} true when `url` matches any pattern.
+ */
+export function makeBlockMatcher(patterns) {
+  const regexes = patterns.map((p) => {
+    // Escape every regex metachar EXCEPT the two glob wildcards, then expand
+    // them: '*' -> '.*', '?' -> '.'. (Escaping runs first so it never touches
+    // the '.' / '*' we insert next.)
+    const escaped = p
+      .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+      .replace(/\*/g, '.*')
+      .replace(/\?/g, '.');
+    return new RegExp('^' + escaped + '$');
+  });
+  return (url) => regexes.some((re) => re.test(url));
+}

package/src/consent-firefox.js

@@ -0,0 +1,125 @@
+/**
+ * consent-firefox.js — Auto-dismiss cookie consent dialogs on the Firefox/BiDi
+ * engine, by walking the reconstructed AX tree (ax-snapshot.js).
+ *
+ * The CDP walker (consent.js) can't be reused verbatim: it consumes CDP's flat
+ * getFullAXTree (nodes[] with parentId / role.value / backendDOMNodeId) and
+ * clicks via DOM.resolveNode + Input.dispatchMouseEvent. The Firefox tree is a
+ * DIFFERENT shape — nested `children`, string `role`/`name`, and each node's
+ * `nodeId` IS its ref (stamped as data-bb-ref) — and clicks go through
+ * input.performActions. So this is a parallel walker sharing only the language
+ * patterns (consent-patterns.js).
+ *
+ * It's written as a PURE function over (root tree, click(ref)) so it can be
+ * unit-tested against fixture trees with no browser: the caller (firefox-page)
+ * injects a real click that routes ref → pointerClick. The nested tree also
+ * makes "descendant of dialog" a plain subtree walk — no parentMap needed.
+ */
+
+import { ACCEPT_PATTERNS, DIALOG_ROLES, CONSENT_DIALOG_HINTS } from './consent-patterns.js';
+
+/** Roles whose text confirms a container is a consent dialog. */
+const CONSENT_TEXT_ROLES = new Set(['heading', 'StaticText', 'generic']);
+
+/** Depth-first walk yielding every node in the subtree rooted at `node`. */
+function* walk(node) {
+  if (!node) return;
+  yield node;
+  for (const child of node.children || []) yield* walk(child);
+}
+
+/** True if any node in this subtree carries consent-hint text. */
+function hasConsentContent(dialog) {
+  for (const node of walk(dialog)) {
+    if (node === dialog) continue;
+    if (CONSENT_TEXT_ROLES.has(node.role) && CONSENT_DIALOG_HINTS.some((p) => p.test(node.name || ''))) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Find the best "accept" button inside a dialog subtree, honouring
+ * ACCEPT_PATTERNS priority (most specific first).
+ */
+function findAcceptButton(dialog) {
+  for (const pattern of ACCEPT_PATTERNS) {
+    for (const node of walk(dialog)) {
+      if (node.role === 'button' && node.name && pattern.test(node.name)) return node;
+    }
+  }
+  return null;
+}
+
+/**
+ * Fallback when no consent dialog container is found: scan the whole tree for a
+ * button matching a STRONG (multi-word) accept pattern. Excludes the bare
+ * ^accept$/^agree$/^ok$ fallbacks (last 3) so we don't false-match unrelated
+ * page buttons — mirrors consent.js's tryGlobalConsentButton.
+ */
+function findGlobalAcceptButton(root) {
+  const safePatterns = ACCEPT_PATTERNS.slice(0, -3);
+  for (const pattern of safePatterns) {
+    for (const node of walk(root)) {
+      if (node.role === 'button' && node.name && pattern.test(node.name)) return node;
+    }
+  }
+  return null;
+}
+
+/**
+ * Try to dismiss a cookie consent dialog in a reconstructed Firefox AX tree.
+ *
+ * @param {object} root - Spliced AX tree root (from firefox-page's buildTree).
+ * @param {(ref: string) => Promise<void>} click - Clicks the element for a ref
+ *   (firefox-page injects one that routes to pointerClick / performActions).
+ * @returns {Promise<boolean>} true if an accept button was found and clicked.
+ */
+export async function dismissConsentFirefox(root, click) {
+  if (!root) return false;
+
+  // Find dialog containers that look like consent dialogs.
+  const consentDialogs = [];
+  for (const node of walk(root)) {
+    if (!DIALOG_ROLES.has(node.role)) continue;
+    const name = node.name || '';
+    if (CONSENT_DIALOG_HINTS.some((p) => p.test(name)) || hasConsentContent(node)) {
+      consentDialogs.push(node);
+    }
+  }
+
+  // Accept button inside a consent dialog (preferred — scoped, low false-positive).
+  for (const dialog of consentDialogs) {
+    const button = findAcceptButton(dialog);
+    if (button?.nodeId) {
+      try {
+        await click(button.nodeId);
+        return true;
+      } catch {
+        // Click failed (stale ref / navigated) — try the next dialog.
+      }
+    }
+  }
+
+  // Banner-style consent (no dialog container at all): scan the page for a
+  // strong accept button. We deliberately DO NOT run this page-wide scan when a
+  // consent dialog WAS detected but had no in-scope accept button — a page-wide
+  // match there can click an UNRELATED "Accept all …" control elsewhere (e.g. a
+  // ToS/signup button), an automatic wrong mutation on goto(). The trade-off is
+  // losing the rare "accept button rendered outside its own dialog" pattern; we
+  // accept that miss rather than risk a wrong click. See the PRD "known
+  // limitations" note for the validated false-positive this guards against.
+  if (consentDialogs.length === 0) {
+    const global = findGlobalAcceptButton(root);
+    if (global?.nodeId) {
+      try {
+        await click(global.nodeId);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  }
+  return false;
+}

package/src/consent-patterns.js

@@ -0,0 +1,154 @@
+/**
+ * consent-patterns.js — Shared cookie-consent detection data.
+ *
+ * The engine-agnostic half of consent handling: the multilingual regex sets
+ * and dialog roles used to recognise a consent dialog and its "accept" button.
+ * Both the CDP walker (consent.js) and the BiDi walker (consent-firefox.js)
+ * import these so the language coverage is single-sourced — a new language or
+ * pattern is added once and both engines get it.
+ */
+
+// Button text patterns that mean "accept all" / "I agree" across common languages.
+// Order matters: more specific patterns first to avoid false positives.
+export const ACCEPT_PATTERNS = [
+  // English
+  /\baccept\s*all\b/i,
+  /\ballow\s*all\b/i,
+  /\bagree\s*to\s*all\b/i,
+  /\byes,?\s*i\s*agree\b/i,
+  /\bi\s*agree\b/i,
+  /\baccept\s*cookies?\b/i,
+  /\ballow\s*cookies?\b/i,
+  /\bgot\s*it\b/i,
+  // Dutch
+  /\balles\s*accepteren\b/i,
+  /\balles\s*toestaan\b/i,
+  /\baccepteren\b/i,
+  /\bakkoord\b/i,
+  // German
+  /\balle\s*akzeptieren\b/i,
+  /\ballem\s*zustimmen\b/i,
+  /\balle\s*cookies?\s*akzeptieren\b/i,
+  // French
+  /\btout\s*accepter\b/i,
+  /\baccepter\s*tout\b/i,
+  /\bj['']accepte\b/i,
+  // Spanish
+  /\baceptar\s*todo\b/i,
+  /\baceptar\s*todas?\b/i,
+  // Italian
+  /\baccetta\s*tutto\b/i,
+  /\baccetto\b/i,
+  // Portuguese
+  /\baceitar\s*tudo\b/i,
+  // Russian
+  /принять\s*все/i,
+  /принять/i,
+  /согласен/i,
+  // Ukrainian
+  /прийняти\s*все/i,
+  /прийняти/i,
+  // Polish
+  /zaakceptuj\s*wszystk/i,
+  /akceptuj\s*wszystk/i,
+  /zgadzam\s*się/i,
+  // Czech
+  /přijmout\s*vše/i,
+  /souhlasím/i,
+  // Turkish
+  /tümünü\s*kabul\s*et/i,
+  /kabul\s*et/i,
+  /kabul\s*ediyorum/i,
+  // Romanian
+  /acceptă\s*tot/i,
+  /accept\s*toate/i,
+  // Hungarian
+  /összes\s*elfogadás/i,
+  /elfogad/i,
+  // Greek
+  /αποδοχή\s*όλων/i,
+  /αποδέχομαι/i,
+  // Swedish
+  /acceptera\s*alla/i,
+  /godkänn\s*alla/i,
+  // Danish
+  /accepter\s*alle/i,
+  /acceptér\s*alle/i,
+  // Norwegian
+  /godta\s*alle/i,
+  /aksepter\s*alle/i,
+  // Finnish
+  /hyväksy\s*kaikki/i,
+  /hyväksyn/i,
+  // Arabic
+  /قبول\s*الكل/,
+  /قبول\s*الجميع/,
+  /موافق/,
+  /قبول/,
+  // Persian
+  /پذیرش\s*همه/,
+  /موافقم/,
+  /پذیرش/,
+  // Chinese (Simplified + Traditional)
+  /全部接受/,
+  /接受所有/,
+  /接受全部/,
+  /同意并继续/,
+  /全部接受/,
+  /接受/,
+  /同意/,
+  // Japanese
+  /すべて受け入れ/,
+  /すべて許可/,
+  /同意する/,
+  /同意します/,
+  // Korean
+  /모두\s*수락/,
+  /모두\s*동의/,
+  /동의합니다/,
+  /수락/,
+  // Vietnamese
+  /chấp\s*nhận\s*tất\s*cả/i,
+  /đồng\s*ý\s*tất\s*cả/i,
+  /đồng\s*ý/i,
+  // Thai
+  /ยอมรับทั้งหมด/,
+  /ยอมรับ/,
+  // Hindi
+  /सभी\s*स्वीकार/,
+  /स्वीकार\s*करें/,
+  /सहमत/,
+  // Indonesian / Malay
+  /terima\s*semua/i,
+  /setuju/i,
+  // Generic single-word fallbacks (only matched inside dialogs)
+  /^accept$/i,
+  /^agree$/i,
+  /^ok$/i,
+];
+
+// Roles that indicate a consent dialog container.
+export const DIALOG_ROLES = new Set(['dialog', 'alertdialog']);
+
+// Text patterns in dialog names/headings that confirm it's about consent.
+export const CONSENT_DIALOG_HINTS = [
+  /cookie/i,
+  /consent/i,
+  /privacy/i,
+  /before\s*you\s*continue/i,
+  /voordat\s*je\s*verdergaat/i,  // Dutch
+  /bevor\s*du\s*fortf/i,         // German
+  /avant\s*de\s*continuer/i,     // French
+  /antes\s*de\s*continuar/i,     // Spanish / Portuguese
+  /prima\s*di\s*continuare/i,    // Italian
+  /zanim\s*przejdziesz/i,        // Polish
+  /прежде\s*чем\s*продолжить/i,  // Russian
+  /devam\s*etmeden\s*önce/i,     // Turkish
+  /続行する前に/,                  // Japanese
+  /继续前/,                        // Chinese Simplified
+  /繼續前/,                        // Chinese Traditional
+  /계속하기\s*전에/,                // Korean
+  /trước\s*khi\s*tiếp\s*tục/i,   // Vietnamese
+  /ملفات\s*تعريف\s*الارتباط/,    // Arabic: cookies
+  /คุกกี้/,                        // Thai: cookies
+];