capiumbrowser 1.1.6 → 1.1.8

package/lib/channels.json

@@ -1,35 +1,35 @@
 {
- "_comment": "SINGLE SOURCE OF TRUTH for the current stable Capium browser build per OS/arch. Each OS reaches stable independently -- edit one entry without touching the others. This file ships inside the wheel (the SDK reads it to pick each host's stable build) AND is published to the download server by the release pipeline. `version` is the Chromium version (what the browser reports to the customer -- unchanged by the revision); `revision` is our packaging counter -- the served R2 folder is chromium-v<version>.<revision>/, ALWAYS dotted-suffixed starting at 1 (chromium-v<version>.1/ is the first build, .2/ a same-engine re-spin), so publishing a re-spin never overwrites the artifact older SDKs still fetch. `published: false` means the tag is declared but no artifact exists yet -- the SDK raises a clear 'not published yet' error instead of a raw 404.",
- "schema": 1,
- "updated": "2026-10-06",
- "channels": {
-  "stable": {
-   "windows-x64": {
-    "version": "153.0.8010.53",
-    "engine_version": "153.0.8010.52",
-    "revision": 5,
-    "sha256": "3f53b86f80a3b145cb75995615f19c957a74d6a1a0ae1151ff64517b3a931d67",
-    "published": true
-   },
-   "macos-arm64": {
-    "version": "153.0.8010.53",
-    "engine_version": "153.0.8010.52",
-    "revision": 5,
-    "sha256": "4e65cc764eda17a5ea9a70eafdda214fccac78b8ddf4de41a05addf036006f43",
-    "published": true
-   },
-   "linux-x64": {
-    "version": "153.0.8010.52",
-    "revision": 4,
-    "sha256": "5968821210bb54c7003637444dbf52ccfc93e06d229d21da240b8fc3cfd35d98",
-    "published": true
-   },
-   "linux-arm64": {
-    "version": "153.0.8010.52",
-    "revision": 1,
-    "sha256": null,
-    "published": false
-   }
+  "_comment": "SINGLE SOURCE OF TRUTH for the current stable Capium browser build per OS/arch. Each OS reaches stable independently -- edit one entry without touching the others. This file ships inside the wheel (the SDK reads it to pick each host's stable build) AND is published to the download server by the release pipeline. `version` is the Chromium version (what the browser reports to the customer -- unchanged by the revision); `revision` is our packaging counter -- the served R2 folder is chromium-v<version>.<revision>/, ALWAYS dotted-suffixed starting at 1 (chromium-v<version>.1/ is the first build, .2/ a same-engine re-spin), so publishing a re-spin never overwrites the artifact older SDKs still fetch. `published: false` means the tag is declared but no artifact exists yet -- the SDK raises a clear 'not published yet' error instead of a raw 404.",
+  "schema": 1,
+  "updated": "2026-10-08",
+  "channels": {
+    "stable": {
+      "windows-x64": {
+        "version": "153.0.8010.53",
+        "engine_version": "153.0.8010.52",
+        "revision": 5,
+        "sha256": "3f53b86f80a3b145cb75995615f19c957a74d6a1a0ae1151ff64517b3a931d67",
+        "published": true
+      },
+      "macos-arm64": {
+        "version": "153.0.8010.53",
+        "engine_version": "153.0.8010.52",
+        "revision": 6,
+        "sha256": "eca400433d74e5ac3b59fa1764bba783674a05cfc5a34598c8c1d2f02c708e18",
+        "published": true
+      },
+      "linux-x64": {
+        "version": "153.0.8010.52",
+        "revision": 5,
+        "sha256": "f65f11a2b15dea523ee95e35cadbbd43c77aba4751cdc0f96f8c138143f041bb",
+        "published": true
+      },
+      "linux-arm64": {
+        "version": "153.0.8010.52",
+        "revision": 1,
+        "sha256": null,
+        "published": false
+      }
+    }
   }
- }
 }

package/lib/config.js

@@ -17,16 +17,55 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 
+// Playwright/Puppeteer default args to SUPPRESS (ignoreDefaultArgs): these leak automation
+// or force a software render.
+//   --enable-automation         : exposes navigator.webdriver=true + an automation banner.
+//   --enable-unsafe-swiftshader : the driver adds this so headless WebGL "works", but it ENABLES
+//                                 the (for us, broken-ICD) bundled SwiftShader path -> getContext
+//                                 ('webgl')=null headless / a software-raster tell. Stripping it
+//                                 forces Chromium onto the real GPU (GPU host) or system Mesa.
+const IGNORE_DEFAULT_ARGS = ['--enable-automation', '--enable-unsafe-swiftshader'];
+
+// Headless default screen/viewport. Headless has no real display, so the per-seed device-pool
+// screen (e.g. 2560x1440) has no window manager to size a matching window against -- the
+// framebuffer would stay at Chromium's small headless default and screen != viewport (a
+// browserscan VM tell). Instead model the single MOST COMMON real setup: a maximized Chrome
+// window on a 1080p Windows monitor -- screen 1920x1080, viewport 1920x947 (1040 avail height
+// minus ~93px of tab/omnibox/bookmark chrome). Dominant real-world viewport, so a headless
+// instance blends in, and screen > viewport stays coherent. Applied only in headless and only
+// when the caller pins no screen (an explicit --fingerprint-screen-* / --window-size opts out).
+const HEADLESS_SCREEN = [1920, 1080];
+const HEADLESS_VIEWPORT = [1920, 947];
+
+function getHeadlessDefaultArgs() {
+  const [sw, sh] = HEADLESS_SCREEN;
+  const [vw, vh] = HEADLESS_VIEWPORT;
+  return [
+    `--fingerprint-screen-width=${sw}`,
+    `--fingerprint-screen-height=${sh}`,
+    `--window-size=${vw},${vh}`,
+  ];
+}
+
+function hasScreenOverride(extra) {
+  if (!Array.isArray(extra)) return false;
+  const keys = ['--window-size', '--fingerprint-screen-width', '--fingerprint-screen-height'];
+  return extra.some((a) => typeof a === 'string' && keys.some((k) => a.startsWith(k)));
+}
+
 /**
  * Return the default per-launch fingerprint flags.
  *
  * seed:     int identity seed (a stable, coherent device per seed). Random if null.
  * platform: "windows" | "macos" | "linux" -- the spoofed OS persona.
- * screen:   [width, height] for the spoofed screen AND the browser window, kept
- *           equal so screen == window == viewport. Pass null to skip (rely on the
- *           seed's device screen + fitWindow; only coherent on a real display).
+ * screen:   DEFAULT null -> use the seed's COHERENT per-seed device screen from the binary's
+ *           device pool (GPU-matched resolution + realistic dpr); fitWindow then sizes the window
+ *           to it so viewport ~= screen. Passing an explicit [w,h] FORCES that resolution on every
+ *           seed (all instances share one screen AND can pair e.g. an RTX 5080 with 1440x900) --
+ *           only for a fixed-kiosk scenario. (Previously defaulted to [1440,900], a cross-instance
+ *           correlation + GPU-incoherence tell -- now matches the python SDK's screen=None.)
  */
-function getDefaultStealthArgs(seed = null, platform = 'windows', screen = [1440, 900]) {
+function getDefaultStealthArgs(seed = null, platform = 'windows', screen = null) {
   const args = [];
   if (seed !== null && seed !== undefined) {
     const s = Math.trunc(Number(seed));
@@ -282,6 +321,11 @@ function findBinary(binary = null) {
 
 module.exports = {
   getDefaultStealthArgs,
+  IGNORE_DEFAULT_ARGS,
+  HEADLESS_SCREEN,
+  HEADLESS_VIEWPORT,
+  getHeadlessDefaultArgs,
+  hasScreenOverride,
   newSeed,
   findBinary,
   searchBases,

package/lib/launch-common.js

@@ -39,9 +39,17 @@ function proxyAndGeoArgs(spec, geoipOn) {
   return { launchOptions, args: out };
 }
 
-function buildArgs({ seed, platform, stealthArgs, timezone, locale, extensionPaths, extra }) {
+function buildArgs({ seed, platform, stealthArgs, timezone, locale, extensionPaths, extra,
+  headless = false }) {
   let args = [];
-  if (stealthArgs) args = args.concat(config.getDefaultStealthArgs(seed, platform));
+  if (stealthArgs) {
+    args = args.concat(config.getDefaultStealthArgs(seed, platform));
+    // Headless: pin the maximized-1080p-Windows screen/viewport (see config), unless the
+    // caller already set their own screen/window via extra args.
+    if (headless && !config.hasScreenOverride(extra)) {
+      args = args.concat(config.getHeadlessDefaultArgs());
+    }
+  }
   if (timezone) args.push(`--timezone=${timezone}`); // capium in-binary tz spoof
   if (locale) {
     args.push(`--lang=${locale}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "capiumbrowser",
-  "version": "1.1.6",
+  "version": "1.1.8",
   "description": "Drop-in stealth browser SDK on top of Playwright or Puppeteer (Capium Chromium).",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Capzy (https://capzy.ai)",

package/playwright.js

@@ -78,7 +78,7 @@ async function prepare(opts) {
     seed = null, platform = 'windows', proxy = null, geoip = null, args = null,
     stealthArgs = true, timezone = null, locale = null, extensionPaths = null,
     binary = null, licenseKey = null, licenseServer = null,
-    licenseThroughProxy = false, licensePreflight = true,
+    licenseThroughProxy = false, licensePreflight = true, headless = false,
   } = opts;
   if (licensePreflight) license.preflight(licenseKey, licenseServer);
   const { key } = license.effective(licenseKey, licenseServer);
@@ -87,6 +87,7 @@ async function prepare(opts) {
   const { launchOptions, args: proxyArgs } = proxyAndGeoArgs(proxy, geoip);
   const launchArgs = proxyArgs.concat(buildArgs({
     seed: finalSeed, platform, stealthArgs, timezone, locale, extensionPaths, extra: args,
+    headless,
   }));
   if (licenseThroughProxy) launchArgs.push('--license-through-proxy');
   const env = license.childEnv(licenseKey, licenseServer);
@@ -121,10 +122,11 @@ async function buildLaunchOptions(opts = {}) {
   } = opts;
   const prep = await prepare({
     seed, platform, proxy, geoip, args, stealthArgs, timezone, locale, extensionPaths,
-    binary, licenseKey, licenseServer, licenseThroughProxy, licensePreflight,
+    binary, licenseKey, licenseServer, licenseThroughProxy, licensePreflight, headless,
   });
   return {
     executablePath: prep.binPath, headless, args: prep.launchArgs, env: prep.env,
+    ignoreDefaultArgs: config.IGNORE_DEFAULT_ARGS,   // strip automation + forced-software WebGL defaults
     ...prep.launchOptions, ...rest,
   };
 }
@@ -174,13 +176,14 @@ async function launch(opts = {}) {
   } = opts;
   const prep = await prepare({
     seed, platform, proxy, geoip, args, stealthArgs, timezone, locale, extensionPaths,
-    binary, licenseKey, licenseServer, licenseThroughProxy, licensePreflight,
+    binary, licenseKey, licenseServer, licenseThroughProxy, licensePreflight, headless,
   });
   const pw = requireDriver();
   let browser;
   try {
     browser = await pw.chromium.launch({
       executablePath: prep.binPath, headless, args: prep.launchArgs, env: prep.env,
+      ignoreDefaultArgs: config.IGNORE_DEFAULT_ARGS,   // strip automation + forced-software WebGL defaults
       ...prep.launchOptions, ...rest,
     });
   } catch (e) {
@@ -204,7 +207,7 @@ async function launchPersistentContext(userDataDir, opts = {}) {
   } = opts;
   const prep = await prepare({
     seed, platform, proxy, geoip, args, stealthArgs, timezone, locale, extensionPaths,
-    binary, licenseKey, licenseServer, licenseThroughProxy, licensePreflight,
+    binary, licenseKey, licenseServer, licenseThroughProxy, licensePreflight, headless,
   });
   // Default to the page filling the window (see launchContext) unless the caller pinned a
   // viewport themselves. viewport: null is Playwright-JS for "no fixed viewport".
@@ -214,6 +217,7 @@ async function launchPersistentContext(userDataDir, opts = {}) {
   try {
     ctx = await pw.chromium.launchPersistentContext(userDataDir, {
       executablePath: prep.binPath, headless, args: prep.launchArgs, env: prep.env,
+      ignoreDefaultArgs: config.IGNORE_DEFAULT_ARGS,   // strip automation + forced-software WebGL defaults
       ...prep.launchOptions, ...rest,
     });
   } catch (e) {
@@ -236,10 +240,12 @@ async function fitWindow(browser, context, page) {
     if (!scr || !scr.w || !scr.h) return;
     const aw = Math.trunc(scr.w);
     const ah = Math.trunc(scr.h);
-    const w = Math.min(aw, 1440);
-    const h = Math.min(ah, 900);
-    const left = Math.max(0, Math.floor((aw - w) / 5));
-    const top = Math.max(0, Math.floor((ah - h) / 6));
+    // Size the window to the FULL per-seed screen (match python _fit_window_to_screen) so
+    // screen ~= viewport -- avoids the browserscan "screen != viewport" VM tell. NOT a forced 1440x900.
+    const w = aw;
+    const h = ah;
+    const left = 0;
+    const top = 0;
     const pcdp = await context.newCDPSession(page);
     const { targetInfo } = await pcdp.send('Target.getTargetInfo');
     const bcdp = await browser.newBrowserCDPSession();

package/puppeteer.js

@@ -78,7 +78,7 @@ async function prepare(opts) {
     seed = null, platform = 'windows', proxy = null, geoip = null, args = null,
     stealthArgs = true, timezone = null, locale = null, extensionPaths = null,
     binary = null, licenseKey = null, licenseServer = null,
-    licenseThroughProxy = false, licensePreflight = true,
+    licenseThroughProxy = false, licensePreflight = true, headless = false,
   } = opts;
   if (licensePreflight) license.preflight(licenseKey, licenseServer);
   const { key } = license.effective(licenseKey, licenseServer);
@@ -87,6 +87,7 @@ async function prepare(opts) {
   const { launchOptions, args: proxyArgs } = proxyAndGeoArgs(proxy, geoip);
   const launchArgs = proxyArgs.concat(buildArgs({
     seed: finalSeed, platform, stealthArgs, timezone, locale, extensionPaths, extra: args,
+    headless,
   }));
   if (licenseThroughProxy) launchArgs.push('--license-through-proxy');
   const env = license.childEnv(licenseKey, licenseServer);
@@ -135,7 +136,7 @@ async function buildLaunchOptions(opts = {}) {
   } = opts;
   const prep = await prepare({
     seed, platform, proxy, geoip, args, stealthArgs, timezone, locale, extensionPaths,
-    binary, licenseKey, licenseServer, licenseThroughProxy, licensePreflight,
+    binary, licenseKey, licenseServer, licenseThroughProxy, licensePreflight, headless,
   });
   const proxyOption = prep.launchOptions.proxy || null;
   const launchArgs = [...prep.launchArgs];
@@ -149,7 +150,7 @@ async function buildLaunchOptions(opts = {}) {
     args: launchArgs,
     env: prep.env,
     defaultViewport: 'defaultViewport' in rest ? rest.defaultViewport : null,
-    ignoreDefaultArgs: ignoreDefaultArgs === undefined ? ['--enable-automation'] : ignoreDefaultArgs,
+    ignoreDefaultArgs: ignoreDefaultArgs === undefined ? config.IGNORE_DEFAULT_ARGS : ignoreDefaultArgs,
     ...rest,
   };
 }
@@ -167,7 +168,7 @@ async function launch(opts = {}) {
   } = opts;
   const prep = await prepare({
     seed, platform, proxy, geoip, args, stealthArgs, timezone, locale, extensionPaths,
-    binary, licenseKey, licenseServer, licenseThroughProxy, licensePreflight,
+    binary, licenseKey, licenseServer, licenseThroughProxy, licensePreflight, headless,
   });
   const puppeteer = requireDriver();
   // The CDP escape hatch puts {proxy: {server, username?, ...}} in launchOptions; Puppeteer
@@ -178,8 +179,8 @@ async function launch(opts = {}) {
     launchArgs.push(`--proxy-server=${proxyOption.server}`);
     if (proxyOption.bypass) launchArgs.push(`--proxy-bypass-list=${proxyOption.bypass}`);
   }
-  // Strip Puppeteer's --enable-automation unless the caller took over ignoreDefaultArgs.
-  const ida = ignoreDefaultArgs === undefined ? ['--enable-automation'] : ignoreDefaultArgs;
+  // Strip automation + forced-software WebGL defaults unless the caller took over ignoreDefaultArgs.
+  const ida = ignoreDefaultArgs === undefined ? config.IGNORE_DEFAULT_ARGS : ignoreDefaultArgs;
   let browser;
   try {
     browser = await puppeteer.launch({
@@ -216,10 +217,12 @@ async function fitWindow(browser, page) {
     if (!scr || !scr.w || !scr.h) return;
     const aw = Math.trunc(scr.w);
     const ah = Math.trunc(scr.h);
-    const w = Math.min(aw, 1440);
-    const h = Math.min(ah, 900);
-    const left = Math.max(0, Math.floor((aw - w) / 5));
-    const top = Math.max(0, Math.floor((ah - h) / 6));
+    // Size the window to the FULL per-seed screen (match python _fit_window_to_screen) so
+    // screen ~= viewport -- avoids the browserscan "screen != viewport" VM tell. NOT a forced 1440x900.
+    const w = aw;
+    const h = ah;
+    const left = 0;
+    const top = 0;
     const cdp = await page.createCDPSession();
     const { targetInfo } = await cdp.send('Target.getTargetInfo');
     const { windowId } = await cdp.send('Browser.getWindowForTarget',