barebrowse 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -1,8 +1,21 @@
 # Changelog
 
-## 0.5.1
+## 0.5.3
 
-bareagent tool parity + test fix.
+Improved bot detection for hybrid mode fallback.
+
+### Challenge detection (`src/index.js`)
+- `isChallengePage()` now catches near-empty pages (< 50 chars of text) as blocks
+- Added challenge phrases: "unknown error", "access denied", "permission denied", "request blocked"
+- Sites like CNN that return generic error pages instead of Cloudflare challenges now correctly trigger hybrid → headed fallback
+
+## 0.5.2
+
+Clean npm tarball + bareagent tool parity.
+
+### npm package
+- `.npmignore` updated: excluded `.barebrowse/`, `.mcp.json`, `baremobile.md`, `CLAUDE.md`, `docs/` from tarball
+- Package size: 41 files / 390KB → 21 files / 180KB
 
 ### bareagent adapter
 - Added `hover`, `tabs`, `switchTab`, `pdf` tools (was 13 + assess, now 17 + assess)
@@ -12,10 +25,6 @@ bareagent tool parity + test fix.
 - Fixed 2 snapshot URL prefix assertions (`# url` → `url: url`) to match 0.4.7 format change
 - 69/69 passing
 
-### Version
-- Package version: 0.5.1
-- MCP server version string updated
-
 ## 0.5.0
 
 Privacy assessment via wearehere integration.

package/README.md

@@ -105,7 +105,7 @@ For code examples, API reference, and wiring instructions, see **[barebrowse.con
 
 ## What it handles automatically
 
-Cookie consent walls (29 languages), login walls (cookie extraction from your browsers), bot detection (stealth patches + automatic headed fallback), permission prompts, SPA navigation, JS dialogs, off-screen elements, pre-filled inputs, ARIA noise, and profile locking. The agent doesn't think about any of it.
+Cookie consent walls (29 languages), login walls (cookie extraction from your browsers), bot detection (stealth patches + automatic headed fallback on challenge pages, error pages, and near-empty responses), permission prompts, SPA navigation, JS dialogs, off-screen elements, pre-filled inputs, ARIA noise, and profile locking. The agent doesn't think about any of it.
 
 ## What the agent sees
 

package/barebrowse.context.md

@@ -1,7 +1,7 @@
 # barebrowse -- Integration Guide
 
 > For AI assistants and developers wiring barebrowse into a project.
-> v0.5.1 | Node.js >= 22 | 0 required deps | MIT
+> v0.5.3 | Node.js >= 22 | 0 required deps | MIT
 
 ## What this is
 
@@ -153,7 +153,7 @@ barebrowse can inject cookies from the user's real browser sessions, bypassing l
 | Off-screen elements | `DOM.scrollIntoViewIfNeeded` before every click | Both |
 | Form submission | `press('Enter')` triggers onsubmit | Both |
 | SPA navigation | `waitForNavigation()` uses loadEventFired + frameNavigated | Both |
-| Bot detection | Headed mode with real cookies bypasses most checks | Headed |
+| Bot detection | Hybrid fallback: detects challenge pages, error pages, and near-empty responses, then switches to headed | Hybrid |
 | `navigator.webdriver` | Stealth patches in headless (webdriver, plugins, chrome obj) | Headless |
 | Profile locking | Unique temp dir per headless instance | Headless |
 | ARIA noise | 9-step pruning: wrapper collapse, noise removal, landmark promotion | Both |

package/mcp-server.js

@@ -286,7 +286,7 @@ async function handleMessage(msg) {
     return jsonrpcResponse(id, {
       protocolVersion: '2024-11-05',
       capabilities: { tools: {} },
-      serverInfo: { name: 'barebrowse', version: '0.5.1' },
+      serverInfo: { name: 'barebrowse', version: '0.5.3' },
     });
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "barebrowse",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Authenticated web browsing for autonomous agents via CDP. URL in, pruned ARIA snapshot out.",
   "type": "module",
   "main": "src/index.js",

package/src/index.js

@@ -565,6 +565,8 @@ function waitForNetworkIdle(session, opts = {}) {
 function isChallengePage(tree) {
   if (!tree) return true;
   const text = flattenTreeText(tree);
+  // Near-empty pages are almost certainly blocks
+  if (text.trim().length < 50) return true;
   const challengePhrases = [
     'just a moment',
     'checking if the site connection is secure',
@@ -574,6 +576,10 @@ function isChallengePage(tree) {
     'prove your humanity',
     'attention required',
     'file a ticket',
+    'unknown error',
+    'access denied',
+    'permission denied',
+    'request blocked',
   ];
   const lower = text.toLowerCase();
   return challengePhrases.some((p) => lower.includes(p));