barebrowse 0.5.8 → 0.5.9

package/README.md

@@ -105,7 +105,7 @@ For code examples, API reference, and wiring instructions, see **[barebrowse.con
 
 ## What it handles automatically
 
-Cookie consent walls (29 languages, with real mouse click fallback for stubborn CMPs), login walls (cookie extraction from your browsers), bot detection (stealth patches + automatic headed fallback on challenge pages, error pages, and near-empty responses), permission prompts, SPA navigation, JS dialogs, off-screen elements, pre-filled inputs, ARIA noise, and profile locking. The agent doesn't think about any of it.
+Cookie consent walls (29 languages, with real mouse click fallback for stubborn CMPs), login walls (cookie extraction from your browsers), bot detection (ARIA node count heuristic + stealth patches + automatic headed fallback — snapshot shows `[BOT CHALLENGE DETECTED]` warning when blocked), permission prompts, SPA navigation, JS dialogs, off-screen elements, pre-filled inputs, ARIA noise, and profile locking. The agent doesn't think about any of it.
 
 ## What the agent sees
 

package/barebrowse.context.md

@@ -76,9 +76,10 @@ const snapshot = await browse('https://example.com', {
 | `waitForNetworkIdle(opts?)` | { timeout?: number, idle?: number } | void | Wait until no pending requests for `idle` ms (default 500) |
 | `saveState(filePath)` | filePath: string | void | Export cookies + localStorage to JSON file |
 | `injectCookies(url, opts?)` | url: string, { browser?: string } | void | Extract cookies from user's browser and inject via CDP |
+| `botBlocked` | -- | boolean | True if last `goto()` hit a bot challenge (ARIA node count <50). Resets on each navigation. |
 | `dialogLog` | -- | Array<{type, message, timestamp}> | Auto-dismissed JS dialog history |
 | `cdp` | -- | object | Raw CDP session for escape hatch: `page.cdp.send(method, params)` |
-| `createTab()` | -- | tab handle | New tab in same browser. Returns `{ goto, injectCookies, waitForNetworkIdle, cdp, close }`. Tab close doesn't affect session. |
+| `createTab()` | -- | tab handle | New tab in same browser. Returns `{ goto, botBlocked, injectCookies, waitForNetworkIdle, cdp, close }`. Tab close doesn't affect session. |
 | `close()` | -- | void | Close page, disconnect CDP, kill browser (if headless) |
 
 **connect() options** (in addition to mode/port/consent):
@@ -154,7 +155,7 @@ barebrowse can inject cookies from the user's real browser sessions, bypassing l
 | Off-screen elements | `DOM.scrollIntoViewIfNeeded` before every click | Both |
 | Form submission | `press('Enter')` triggers onsubmit | Both |
 | SPA navigation | `waitForNavigation()` uses loadEventFired + frameNavigated | Both |
-| Bot detection | Hybrid fallback: detects challenge pages, error pages, and near-empty responses, then switches to headed | Hybrid |
+| Bot detection | ARIA node count (<50 = bot-blocked) + text heuristics. `botBlocked` flag set after every `goto()`. Hybrid fallback switches to headed. Snapshot shows `[BOT CHALLENGE DETECTED]` warning. | Hybrid |
 | `navigator.webdriver` | Stealth patches in headless (webdriver, plugins, chrome obj) | Headless |
 | Profile locking | Unique temp dir per headless instance | Headless |
 | Shared memory crash (Linux) | `--disable-dev-shm-usage` flag prevents `/dev/shm` exhaustion | Headless |

package/mcp-server.js

@@ -54,26 +54,18 @@ async function getPage() {
   }
 }
 
-// Concurrency limiter for assess — max 3 tabs at once
-const ASSESS_MAX = 3;
-let _assessRunning = 0;
-const _assessQueue = [];
+// Concurrency limiter — one assess at a time.
+// Headless tabs are fast, but headed fallback uses the user's single browser.
+// Running multiple headed navigations simultaneously hangs the browser.
+let _assessLock = Promise.resolve();
 
 function acquireAssessSlot() {
-  if (_assessRunning < ASSESS_MAX) {
-    _assessRunning++;
-    return Promise.resolve();
-  }
-  return new Promise((resolve) => _assessQueue.push(resolve));
+  let release;
+  const prev = _assessLock;
+  _assessLock = new Promise((r) => { release = r; });
+  return prev.then(() => release);
 }
 
-function releaseAssessSlot() {
-  if (_assessQueue.length > 0) {
-    _assessQueue.shift()();
-  } else {
-    _assessRunning--;
-  }
-}
 
 const TOOLS = [
   {
@@ -292,7 +284,7 @@ async function handleToolCall(name, args) {
     }
     case 'assess': {
       if (!assessFn) throw new Error('wearehere is not installed. Run: npm install wearehere');
-      await acquireAssessSlot();
+      const releaseSlot = await acquireAssessSlot();
       try {
         const runAssess = async (headed) => {
           let tab;
@@ -351,7 +343,7 @@ async function handleToolCall(name, args) {
           }
         }
       } finally {
-        releaseAssessSlot();
+        releaseSlot();
       }
     }
     default:
@@ -374,7 +366,7 @@ async function handleMessage(msg) {
     return jsonrpcResponse(id, {
       protocolVersion: '2024-11-05',
       capabilities: { tools: {} },
-      serverInfo: { name: 'barebrowse', version: '0.5.8' },
+      serverInfo: { name: 'barebrowse', version: '0.5.9' },
     });
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "barebrowse",
-  "version": "0.5.8",
+  "version": "0.5.9",
   "description": "Authenticated web browsing for autonomous agents via CDP. URL in, pruned ARIA snapshot out.",
   "type": "module",
   "main": "src/index.js",