capiumbrowser 0.1.1 → 1.0.0

package/lib/channels.json

@@ -1,12 +1,12 @@
 {
   "_comment": "SINGLE SOURCE OF TRUTH for the current stable Capium browser build per OS/arch. Each OS reaches stable independently -- edit one entry without touching the others. This file ships inside the wheel (the SDK reads it to pick each host's stable build) AND is published to the download server by the release pipeline (so the server/website can resolve 'latest stable' without a new SDK release). `version` is the Chromium base of the immutable artifact folder; `revision` is the cap<N> re-spin counter. `published: false` means the tag is declared but no artifact exists yet -- the SDK raises a clear 'not published yet' error instead of a raw 404.",
   "schema": 1,
-  "updated": "2026-09-01",
+  "updated": "2026-09-02",
   "channels": {
     "stable": {
-      "windows-x64": { "version": "152.0.7977.65", "revision": 1, "sha256": "c3cf933325907b36a157ed74db80c1acb1d3aca0faa93c3bb224fe735cafc4a5", "published": true },
-      "macos-arm64": { "version": "152.0.7977.65", "revision": 1, "sha256": "e328158c5a272594e01d2135eb418f649f46ee5b0a80fbc79f6923dcc809be01", "published": true },
-      "linux-x64":   { "version": "152.0.7977.64", "revision": 1, "sha256": "aeb36b509d26e40969d64502f0a2a3f0ad73c7cdd8c42c5fab8a54e953bc3b3a", "published": true },
+      "windows-x64": { "version": "152.0.7977.65", "revision": 2, "sha256": "eec6d63a8a1ae7371388a39d10506117261131768020f15aa2d281d9931d35c0", "published": true },
+      "macos-arm64": { "version": "152.0.7977.65", "revision": 2, "sha256": "350e7f87b8f8e7e32feee26b8844e80b4650c9aa5fb6888fbcf4cc19fb08eda9", "published": true },
+      "linux-x64":   { "version": "152.0.7977.64", "revision": 2, "sha256": "248e735b3afec58a44e962cd866f704adfb15ee8b71cf976665dd109f512b7c5", "published": true },
       "linux-arm64": { "version": "152.0.7977.64", "revision": 1, "sha256": null, "published": false }
     }
   }

package/lib/download.js

@@ -41,9 +41,10 @@ const tar = require('tar');
 const config = require('./config');
 const license = require('./license');
 const { CapiumError, CapiumExpiredError, CapiumServerDownError } = require('./errors');
-const { binaryVersionFor, isPublished } = require('./version');
+const { SDK_VERSION, binaryVersionFor, isPublished } = require('./version');
 
 const NET_TIMEOUT_MS = 300000;
+const USER_AGENT = `capiumbrowser/${SDK_VERSION}`;
 
 // (normalized os, normalized arch) -> distro tag used in the filename/URL.
 const SUPPORTED = {
@@ -86,8 +87,11 @@ function downloadTag(system = null, machine = null) {
 }
 
 /**
- * The signed request path for a build. Filename is version-independent; only the folder
- * carries the version (per the '...end name will all be the same' contract).
+ * The signed request path for a build: version in the folder, tag in the filename
+ * (`/download/distro/chromium-v<version>/capiumbrowser-<tag>.tar.gz`). Per-OS versions work
+ * because each tag lives under its own chromium-v<version>/ folder (win/mac .65 while linux
+ * is .64). Key travels in the X-Capzy-License header, the path is HMAC-signed, and the bytes
+ * are verified against the response's X-Capzy-SHA256.
  */
 function distroPath(version, tag) {
   return `/download/distro/chromium-v${version}/capiumbrowser-${tag}.tar.gz`;
@@ -216,8 +220,12 @@ function removeInstalls(root) {
  */
 async function download(url, headers, dest, version, tag) {
   let res;
+  // Identify the SDK on every request. undici otherwise sends a default UA that Cloudflare's
+  // Browser Integrity Check rejects as a bot (403) before the request reaches the origin. A
+  // stable product UA is both correct hygiene and what the edge allows.
+  const h = Object.assign({ 'User-Agent': USER_AGENT }, headers || {});
   try {
-    res = await fetch(url, { headers: headers || {}, signal: AbortSignal.timeout(NET_TIMEOUT_MS) });
+    res = await fetch(url, { headers: h, signal: AbortSignal.timeout(NET_TIMEOUT_MS) });
   } catch (e) {
     throw new CapiumServerDownError(
       `could not reach the download server ${url}: ${e.cause?.message || e.message || e}`);

package/lib/license.js

@@ -14,8 +14,10 @@ const os = require('os');
 const path = require('path');
 
 const { CapiumConfigError, CapiumExpiredError, CapiumServerDownError } = require('./errors');
+const { SDK_VERSION } = require('./version');
 
 const DEFAULT_SERVER = 'https://license.capzy.ai';
+const USER_AGENT = `capiumbrowser/${SDK_VERSION}`;
 
 function licenseFile() {
   // CAPIUM_LICENSE_FILE is a test/deploy override; the contract path is ~/.capium/license.
@@ -167,6 +169,7 @@ async function status(key = null, server = null) {
         'X-Capzy-Device-Fp': fp,
         'X-Capzy-Signature': sig,
         'Content-Type': 'application/json',
+        'User-Agent': USER_AGENT,
       },
       signal: AbortSignal.timeout(10000),
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "capiumbrowser",
-  "version": "0.1.1",
+  "version": "1.0.0",
   "description": "Drop-in stealth browser SDK on top of Playwright or Puppeteer (Capium Chromium).",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Capzy (https://capzy.ai)",