cdpilot 0.3.0 → 0.4.1

package/bin/cdpilot.js

@@ -324,6 +324,11 @@ function showHelp() {
     new-tab [url]      Open new tab
     close-tab [id]     Close tab
 
+  STEALTH & CAPTCHA
+    stealth [on|off]   Toggle anti-fingerprint patches (opt-in)
+    captcha-check      Detect CAPTCHA on active page (JSON output)
+    captcha-wait [s]   Pause until user solves CAPTCHA (default 300s)
+
   PROJECTS
     projects           List all project browser instances
     project-stop <id>  Stop a specific project's browser

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdpilot",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Zero-dependency browser automation from your terminal. One command, full control.",
   "bin": {
     "cdpilot": "./bin/cdpilot.js",

package/src/cdpilot.py

@@ -14,7 +14,7 @@ Environment:
   CDPILOT_PROFILE      Isolated browser profile directory
 """
 
-__version__ = "0.1.2"
+__version__ = "0.4.1"
 
 import asyncio
 import json
@@ -221,8 +221,250 @@ window.__cdpilot_waitFor = function(selector, timeout) {
   });
 };
 """
+# ─── Stealth & CAPTCHA Detection ──────────────────────────────────────────────
+# Zero-dependency anti-fingerprinting layer. Patches common automation tells
+# (navigator.webdriver, missing chrome.runtime, plugin list, WebGL vendor).
+# Runs via Page.addScriptToEvaluateOnNewDocument BEFORE any page script.
+# Notes:
+#   - Does NOT weaken web security (CSP, CORS, SOP intact).
+#   - Idempotent: guarded by window.__cdpilot_stealth flag.
+#   - Fails silently per-patch; one failure cannot break the page.
+#   - Opt-in via `cdpilot stealth on`. Default OFF for backward compatibility.
+STEALTH_JS = r"""
+(function() {
+  'use strict';
+  if (window.__cdpilot_stealth) return;
+  try { Object.defineProperty(window, '__cdpilot_stealth', {value: true, writable: false, configurable: false}); } catch(e) {}
+
+  // 1) navigator.webdriver — only patch if it's actually `true`.
+  // Vanilla Chrome (no --enable-automation) already returns `false` and the
+  // property exists on Navigator.prototype. Replacing the getter when it's
+  // already safe creates a worse fingerprint (returning `undefined` instead
+  // of `false` is itself a tell). Only mask when CDP/automation flagged it.
+  try {
+    var wdValue;
+    try { wdValue = navigator.webdriver; } catch (_) {}
+    if (wdValue === true) {
+      Object.defineProperty(Navigator.prototype, 'webdriver', {
+        get: function() { return false; },
+        configurable: true
+      });
+    }
+  } catch (e) {}
+
+  // 2) window.chrome — real Chrome exposes chrome.runtime even without extensions
+  try {
+    if (!window.chrome) {
+      window.chrome = {};
+    }
+    if (!window.chrome.runtime) {
+      window.chrome.runtime = {
+        OnInstalledReason: {}, OnRestartRequiredReason: {}, PlatformArch: {},
+        PlatformNackArch: {}, PlatformOs: {}, RequestUpdateCheckStatus: {}
+      };
+    }
+    if (typeof window.chrome.app === 'undefined') {
+      window.chrome.app = { isInstalled: false, InstallState: {}, RunningState: {} };
+    }
+  } catch (e) {}
+
+  // 3) Permissions.query — reconcile with Notification.permission (classic tell)
+  try {
+    if (navigator.permissions && navigator.permissions.query) {
+      var origQuery = navigator.permissions.query.bind(navigator.permissions);
+      navigator.permissions.query = function(p) {
+        if (p && p.name === 'notifications') {
+          return Promise.resolve({ state: Notification.permission, onchange: null });
+        }
+        return origQuery(p);
+      };
+    }
+  } catch (e) {}
+
+  // 4) navigator.plugins — empty array is a headless tell. Provide standard PDF set.
+  // Critical: must be a real PluginArray instance, not vanilla Array, or
+  // detection scripts catch it via `navigator.plugins instanceof PluginArray`.
+  try {
+    var PluginArrayProto = (window.PluginArray && window.PluginArray.prototype) || null;
+    var PluginProto = (window.Plugin && window.Plugin.prototype) || null;
+    var MimeTypeProto = (window.MimeType && window.MimeType.prototype) || null;
+
+    var makeMime = function(type, suffixes, plugin) {
+      var m = Object.create(MimeTypeProto || Object.prototype);
+      Object.defineProperties(m, {
+        type:        { value: type,        enumerable: true },
+        suffixes:    { value: suffixes,    enumerable: true },
+        description: { value: '',          enumerable: true },
+        enabledPlugin: { value: plugin,    enumerable: true }
+      });
+      return m;
+    };
+    var makePlugin = function(name, filename) {
+      var p = Object.create(PluginProto || Object.prototype);
+      var mime = makeMime('application/pdf', 'pdf', p);
+      Object.defineProperties(p, {
+        name:        { value: name,        enumerable: true },
+        filename:    { value: filename,    enumerable: true },
+        description: { value: 'Portable Document Format', enumerable: true },
+        length:      { value: 1,           enumerable: true },
+        '0':         { value: mime,        enumerable: true }
+      });
+      p.item = function(i) { return i === 0 ? mime : null; };
+      p.namedItem = function(n) { return n === mime.type ? mime : null; };
+      return p;
+    };
+    var pluginNames = [
+      ['PDF Viewer', 'internal-pdf-viewer'],
+      ['Chrome PDF Viewer', 'internal-pdf-viewer'],
+      ['Chromium PDF Viewer', 'internal-pdf-viewer'],
+      ['Microsoft Edge PDF Viewer', 'internal-pdf-viewer'],
+      ['WebKit built-in PDF', 'internal-pdf-viewer'],
+    ];
+    var plugins = Object.create(PluginArrayProto || Array.prototype);
+    for (var i = 0; i < pluginNames.length; i++) {
+      var p = makePlugin(pluginNames[i][0], pluginNames[i][1]);
+      Object.defineProperty(plugins, i, { value: p, enumerable: true });
+      Object.defineProperty(plugins, p.name, { value: p });
+    }
+    Object.defineProperty(plugins, 'length', { value: pluginNames.length });
+    plugins.item = function(i) { return plugins[i] || null; };
+    plugins.namedItem = function(n) {
+      for (var k = 0; k < plugins.length; k++) if (plugins[k].name === n) return plugins[k];
+      return null;
+    };
+    plugins.refresh = function() {};
+    Object.defineProperty(Navigator.prototype, 'plugins', {
+      get: function() { return plugins; },
+      configurable: true
+    });
+  } catch (e) {}
+
+  // 4b) Worker stealth — workers have their own global scope, so navigator.webdriver
+  // patches above do NOT propagate. Fingerprint scripts that probe via Worker
+  // (e.g. fpscanner.WEBDRIVER) catch this inconsistency. Fix: wrap the Worker
+  // constructor to prepend a navigator.webdriver patch via blob URL. Limitations:
+  // module workers and same-origin script URLs are best-effort (importScripts
+  // doesn't support module workers; cross-origin URLs may bypass via direct fetch).
+  try {
+    var OrigWorker = window.Worker;
+    if (OrigWorker && !window.__cdpilot_worker_patched) {
+      var workerPatch = "(function(){try{Object.defineProperty(self.navigator||{},'webdriver',{get:function(){return undefined;},configurable:true});}catch(e){}})();";
+      var WrappedWorker = function(scriptURL, options) {
+        try {
+          var isModule = options && options.type === 'module';
+          if (typeof scriptURL === 'string' && !isModule) {
+            // Wrap script in a blob that applies the patch then importScripts the original.
+            var wrapped = workerPatch + "importScripts(" + JSON.stringify(String(scriptURL)) + ");";
+            var blob = new Blob([wrapped], { type: 'application/javascript' });
+            scriptURL = URL.createObjectURL(blob);
+          }
+        } catch (e) {}
+        return new OrigWorker(scriptURL, options);
+      };
+      WrappedWorker.prototype = OrigWorker.prototype;
+      Object.setPrototypeOf(WrappedWorker, OrigWorker);
+      window.Worker = WrappedWorker;
+      Object.defineProperty(window, '__cdpilot_worker_patched', { value: true });
+    }
+  } catch (e) {}
+
+  // 5) WebGL vendor/renderer — UNMASKED_* params reveal "SwiftShader" in headless.
+  // Override returns generic Intel values. Read-only spoof; does not affect rendering.
+  try {
+    var spoofParam = function(orig, parameter) {
+      if (parameter === 37445) return 'Intel Inc.';                       // UNMASKED_VENDOR_WEBGL
+      if (parameter === 37446) return 'Intel Iris OpenGL Engine';         // UNMASKED_RENDERER_WEBGL
+      return orig.call(this, parameter);
+    };
+    if (window.WebGLRenderingContext) {
+      var gp1 = WebGLRenderingContext.prototype.getParameter;
+      WebGLRenderingContext.prototype.getParameter = function(p) { return spoofParam.call(this, gp1, p); };
+    }
+    if (window.WebGL2RenderingContext) {
+      var gp2 = WebGL2RenderingContext.prototype.getParameter;
+      WebGL2RenderingContext.prototype.getParameter = function(p) { return spoofParam.call(this, gp2, p); };
+    }
+  } catch (e) {}
+
+  // 6) navigator.hardwareConcurrency — 0 is a tell. Clamp to a sane default if missing.
+  try {
+    if (!navigator.hardwareConcurrency || navigator.hardwareConcurrency < 2) {
+      Object.defineProperty(Navigator.prototype, 'hardwareConcurrency', {
+        get: function() { return 8; },
+        configurable: true
+      });
+    }
+  } catch (e) {}
+})();
+"""
+
+# ─── CAPTCHA Detection ────────────────────────────────────────────────────────
+# Read-only DOM probe. Detects common CAPTCHA/challenge providers post-navigation.
+# Returns JSON string: {"detected": bool, "types": [...], "details": [...]}
+# Pure detection — no DOM mutation, no network, no user data leak.
+CAPTCHA_DETECT_JS = r"""
+(function() {
+  try {
+    var result = { detected: false, types: [], details: [] };
+    var add = function(type, provider, extra) {
+      result.detected = true;
+      if (result.types.indexOf(type) < 0) result.types.push(type);
+      var d = { type: type, provider: provider };
+      if (extra) for (var k in extra) d[k] = extra[k];
+      result.details.push(d);
+    };
+
+    // Cloudflare Turnstile
+    var ts = document.querySelectorAll('iframe[src*="challenges.cloudflare.com"]');
+    if (ts.length > 0) add('turnstile', 'Cloudflare', { count: ts.length });
+
+    // Cloudflare interstitial / managed challenge
+    var cfChallenge = document.querySelector('#challenge-form, #challenge-stage, #cf-challenge-running, #cf-please-wait');
+    var titleLower = (document.title || '').toLowerCase();
+    if (cfChallenge || titleLower.indexOf('just a moment') >= 0 || titleLower.indexOf('attention required') >= 0) {
+      add('cloudflare-challenge', 'Cloudflare');
+    }
+
+    // hCaptcha
+    var hc = document.querySelectorAll('iframe[src*="hcaptcha.com"]');
+    var hcDiv = document.querySelector('.h-captcha, [data-hcaptcha-sitekey]');
+    if (hc.length > 0 || hcDiv) add('hcaptcha', 'hCaptcha');
+
+    // reCAPTCHA (v2 visible, v2 invisible, v3, enterprise)
+    var rc = document.querySelectorAll('iframe[src*="recaptcha/api2"], iframe[src*="recaptcha/enterprise"]');
+    var rcDiv = document.querySelector('.g-recaptcha');
+    if (rc.length > 0 || (rcDiv && !hcDiv)) add('recaptcha', 'Google');
+
+    // DataDome
+    if (document.querySelector('#datadome-captcha, iframe[src*="captcha-delivery.com"]')) {
+      add('datadome', 'DataDome');
+    }
+
+    // PerimeterX / HUMAN
+    if (document.querySelector('#px-captcha, [class*="px-captcha"]')) {
+      add('perimeterx', 'HUMAN');
+    }
+
+    // Arkose Labs (FunCaptcha)
+    if (document.querySelector('iframe[src*="arkoselabs.com"], iframe[src*="funcaptcha.com"], #FunCaptcha')) {
+      add('arkose', 'Arkose Labs');
+    }
+
+    // GeeTest
+    if (document.querySelector('.geetest_holder, .geetest_panel, [id^="geetest_"]')) {
+      add('geetest', 'GeeTest');
+    }
+
+    return JSON.stringify(result);
+  } catch (e) {
+    return JSON.stringify({ detected: false, error: String(e) });
+  }
+})()
+"""
+
 PROXY_CONFIG_FILE = os.path.join(PROFILE_DIR, 'proxy.json')
 HEADLESS_CONFIG_FILE = os.path.join(PROFILE_DIR, 'headless.json')
+STEALTH_CONFIG_FILE = os.path.join(PROFILE_DIR, 'stealth.json')
 DOWNLOAD_CONFIG_FILE = os.path.join(PROFILE_DIR, 'download-config.json')
 SESSION_FILE = os.path.join(PROFILE_DIR, 'sessions.json')
 
@@ -542,11 +784,21 @@ window.__cdpilot_glow_timeout = setTimeout(function() {
 _glow_script_id = None  # addScriptToEvaluateOnNewDocument identifier
 
 async def _control_start(ws_url):
-    """Enable glow, input blocker, and visual feedback at command start."""
+    """Enable glow, input blocker, visual feedback, and (if enabled) stealth.
+
+    Stealth JS is registered via addScriptToEvaluateOnNewDocument so it runs
+    BEFORE any page script on the next navigation. It cannot un-fingerprint
+    the currently-loaded document — that's by design.
+    """
     global _glow_script_id
     try:
-        # Remove previous persistent script if exists (prevent accumulation)
-        cmds = []
+        # NOTE: addScriptToEvaluateOnNewDocument registered here is session-bound
+        # to the WS connection cdp_send opens — it dies when this call returns.
+        # That's fine for GLOW (also injected via Runtime.evaluate below) but
+        # NOT for stealth, which must run BEFORE page scripts. Stealth is
+        # therefore registered inside navigate_collect on the same WS as
+        # Page.navigate, so it survives long enough to apply.
+        cmds = [(898, "Page.enable", {})]
         if _glow_script_id:
             cmds.append((900, "Page.removeScriptToEvaluateOnNewDocument", {"identifier": _glow_script_id}))
             _glow_script_id = None
@@ -853,6 +1105,18 @@ async def navigate_collect(ws_url, url, network=False, console=False, glow=True)
             await ws.send(json.dumps({"id": sid, "method": f"{domain}.enable", "params": {}}))
             sid += 1
 
+        # Register stealth script BEFORE navigate, on this same WS session.
+        # addScriptToEvaluateOnNewDocument is session-bound: it persists only
+        # as long as this connection lives — which is exactly the window we
+        # need (until Page.loadEventFired below). Stealth must run before
+        # any page script inspects navigator; addScript guarantees that.
+        stealth_active = get_stealth_config()
+        if stealth_active:
+            await ws.send(json.dumps({
+                "id": 50, "method": "Page.addScriptToEvaluateOnNewDocument",
+                "params": {"source": STEALTH_JS}
+            }))
+
         # Navigate
         await ws.send(json.dumps({"id": 100, "method": "Page.navigate", "params": {"url": url}}))
 
@@ -1187,6 +1451,25 @@ def get_headless_config():
             pass
     return False
 
+
+def get_stealth_config():
+    """Return whether stealth fingerprint patches are enabled.
+
+    Default: False (opt-in) — preserves existing behavior, lets users enable
+    only when needed. Some sites detect inconsistent fingerprints and
+    block stealth-mode harder than they would block plain Chrome.
+    """
+    env = os.environ.get('CDPILOT_STEALTH', '')
+    if env:
+        return env.lower() in ('1', 'true', 'yes', 'on')
+    if os.path.exists(STEALTH_CONFIG_FILE):
+        try:
+            with open(STEALTH_CONFIG_FILE) as f:
+                return bool(json.load(f).get('stealth', False))
+        except (OSError, ValueError):
+            pass
+    return False
+
 # ─── Commands ───
 
 def cmd_launch():
@@ -1220,6 +1503,15 @@ def cmd_launch():
     proj_label = f' [{PROJECT_ID}]' if PROJECT_ID else ''
     print(f'Launching browser (isolated session, port {CDP_PORT}){proj_label}...')
 
+    # ─── Stability fixes (2026-04-21) ───
+    # Brave on Apple Silicon crashed with SIGTRAP/EXC_BREAKPOINT deterministically
+    # at ~7 min uptime on ThreadPoolForegroundWorker. Two changes:
+    #   1) `--disable-gpu-compositing` removed — conflicts with Metal accel on
+    #      M-series. Browser falls back to GPU-accel rendering which is the
+    #      Chromium default and matches what websites expect.
+    #   2) `--disable-features=...` added — catches Brave-specific background
+    #      tasks that individual `--disable-brave-*` flags don't fully kill
+    #      (Rewards ad scanner, Sync heartbeat, News fetcher).
     chrome_args = [
         CHROME_BIN,
         f'--remote-debugging-port={CDP_PORT}',
@@ -1238,6 +1530,14 @@ def cmd_launch():
         '--disable-tor',
         '--disable-ipfs',
         '--disable-brave-extension',
+        # Feature-level disables — catch background workers the
+        # single-purpose flags above miss. Comma-joined string = one arg.
+        '--disable-features=' + ','.join([
+            'BraveRewards', 'BraveAds', 'BraveSync', 'BraveNewsToday',
+            'BraveVPN', 'BraveWalletBubble', 'SpeedReader', 'Tor',
+            'IPFSCompanion', 'Translate', 'OptimizationGuideModelDownloading',
+            'InterestFeedContentSuggestions', 'CalculateNativeWinOcclusion',
+        ]),
         # ─── Chromium performance flags ───
         '--disable-background-networking',
         '--disable-background-timer-throttling',
@@ -1259,7 +1559,9 @@ def cmd_launch():
         '--safebrowsing-disable-auto-update',
         '--password-store=basic',
         # ─── GPU / rendering ───
-        '--disable-gpu-compositing',
+        # --disable-gpu-compositing REMOVED: caused EXC_BREAKPOINT on Apple
+        # Silicon Brave 147+ after ~7min. Let the browser use its default
+        # (Metal-accelerated) compositor.
         '--disable-smooth-scrolling',
         '--new-window', 'about:blank',
     ]
@@ -1315,6 +1617,15 @@ async def cmd_go(url):
     ws, page = get_page_ws()
     content, _ = await navigate_collect(ws, url)
     print(content)
+    # Post-navigation CAPTCHA probe. Non-blocking: stderr warning only.
+    # Users can run `cdpilot captcha-wait` to pause for manual solve.
+    try:
+        info = await _detect_captcha(ws)
+        if info.get("detected"):
+            types = ",".join(info.get("types", [])) or "unknown"
+            sys.stderr.write(f"⚠️  CAPTCHA tespit edildi ({types}). Çözüm için: cdpilot captcha-wait\n")
+    except Exception:
+        pass
 
 
 async def cmd_content():
@@ -1933,52 +2244,71 @@ def cmd_session_close(session_id=None):
 
 
 def cmd_extensions():
-    """List installed extensions."""
-    ext_dir = os.path.join(PROFILE_DIR, "Default", "Extensions")
-    if not os.path.isdir(ext_dir):
-        print("No extensions installed.")
-        return
+    """List installed extensions (packed via Chrome Web Store + dev mode unpacked).
 
-    prefs_path = os.path.join(PROFILE_DIR, "Default", "Preferences")
+    Two sources are checked independently — neither absence should hide the other.
+    Previously an early-return on missing Default/Extensions/ silently swallowed
+    dev-mode entries written by `ext-install`.
+    """
+    # 1) Packed (CRX) extensions live under Default/Extensions and are described
+    #    in Default/Preferences. Only present after the user installs from the
+    #    Chrome Web Store; ext-install does NOT write here.
+    ext_dir = os.path.join(PROFILE_DIR, "Default", "Extensions")
+    packed_ids = []
     ext_names = {}
-    if os.path.exists(prefs_path):
-        try:
-            with open(prefs_path) as f:
-                prefs = json.load(f)
-            settings = prefs.get("extensions", {}).get("settings", {})
-            for ext_id, info in settings.items():
-                manifest = info.get("manifest", {})
-                ext_names[ext_id] = {
-                    "name": manifest.get("name", ext_id),
-                    "version": manifest.get("version", "?"),
-                    "enabled": info.get("state", 1) == 1,
-                    "path": info.get("path", ""),
-                }
-        except Exception:
-            pass
+    if os.path.isdir(ext_dir):
+        prefs_path = os.path.join(PROFILE_DIR, "Default", "Preferences")
+        if os.path.exists(prefs_path):
+            try:
+                with open(prefs_path) as f:
+                    prefs = json.load(f)
+                settings = prefs.get("extensions", {}).get("settings", {})
+                for ext_id, info in settings.items():
+                    manifest = info.get("manifest", {})
+                    ext_names[ext_id] = {
+                        "name": manifest.get("name", ext_id),
+                        "version": manifest.get("version", "?"),
+                        "enabled": info.get("state", 1) == 1,
+                    }
+            except Exception:
+                pass
+        packed_ids = [d for d in os.listdir(ext_dir) if not d.startswith(".")]
+
+    # 2) Dev-mode (unpacked) extensions registered by `ext-install` —
+    #    loaded into the browser via --load-extension on each launch.
+    dev_exts = get_dev_extensions()
 
-    ext_ids = [d for d in os.listdir(ext_dir) if not d.startswith(".")]
-    if not ext_ids:
+    if not packed_ids and not dev_exts:
         print("No extensions installed.")
         return
 
-    for ext_id in sorted(ext_ids):
-        info = ext_names.get(ext_id, {})
-        name = info.get("name", ext_id)
-        version = info.get("version", "?")
-        enabled = info.get("enabled", True)
-        status = "✅" if enabled else "⏸️"
-        print(f"  {status} {name} (v{version})")
-        print(f"     ID: {ext_id}")
+    if packed_ids:
+        for ext_id in sorted(packed_ids):
+            info = ext_names.get(ext_id, {})
+            name = info.get("name", ext_id)
+            version = info.get("version", "?")
+            enabled = info.get("enabled", True)
+            status = "✅" if enabled else "⏸️"
+            print(f"  {status} {name} (v{version})")
+            print(f"     ID: {ext_id}")
+        print(f"\n{len(packed_ids)} packed extension{'s' if len(packed_ids) != 1 else ''}")
 
-    print(f"\n{len(ext_ids)} extensions")
-
-    dev_exts = get_dev_extensions()
     if dev_exts:
-        print(f'\nDev Mode Extensions ({len(dev_exts)}):')
+        if packed_ids:
+            print()
+        print(f"Dev Mode Extensions ({len(dev_exts)}):")
         for i, path in enumerate(dev_exts):
             exists = '✅' if os.path.isdir(path) else '❌ (directory not found)'
-            print(f'  {exists} [{i}] {path}')
+            # Try to read manifest for friendlier output
+            label = os.path.basename(path.rstrip('/'))
+            try:
+                with open(os.path.join(path, 'manifest.json')) as f:
+                    mf = json.load(f)
+                label = f"{mf.get('name', label)} (v{mf.get('version', '?')})"
+            except Exception:
+                pass
+            print(f"  {exists} [{i}] {label}")
+            print(f"        {path}")
 
 
 def cmd_ext_install(source):
@@ -2297,6 +2627,183 @@ def cmd_headless(state=None):
     print('Restart browser (stop → launch).')
 
 
+def cmd_health():
+    """Print JSON health summary of the cdpilot browser session.
+
+    Output keys:
+      alive          — bool, CDP /json/version reachable
+      port           — int, current CDP port
+      project_id     — str|null, project identifier (multi-instance)
+      tabs           — int, count of page targets (when alive)
+      browser        — str|null, version string from /json/version
+      crashes_today  — int, Brave crash dump count from macOS today
+      stealth        — bool, current stealth config
+      uptime_warning — str|null, hint when browser is alive but very old
+
+    Exit codes: 0 = alive, 2 = down. Designed for shell watchdog loops:
+      `until cdpilot health >/dev/null; do cdpilot launch; sleep 2; done`
+    """
+    import datetime as _dt
+    import glob as _glob
+
+    info = {
+        'alive': False,
+        'port': CDP_PORT,
+        'project_id': PROJECT_ID,
+        'tabs': 0,
+        'browser': None,
+        'crashes_today': 0,
+        'stealth': get_stealth_config(),
+        'uptime_warning': None,
+    }
+    ver = cdp_get('/json/version')
+    if ver:
+        info['alive'] = True
+        info['browser'] = ver.get('Browser') or ver.get('browser') or ''
+        targets = cdp_get('/json') or []
+        info['tabs'] = sum(1 for t in targets if t.get('type') == 'page')
+
+    # Today's crash count from macOS DiagnosticReports (Brave only).
+    if platform.system() == 'Darwin':
+        today = _dt.date.today().strftime('%Y-%m-%d')
+        pattern = os.path.expanduser(f'~/Library/Logs/DiagnosticReports/Brave Browser-{today}-*.ips')
+        info['crashes_today'] = len(_glob.glob(pattern))
+        if info['crashes_today'] >= 3:
+            info['uptime_warning'] = f"{info['crashes_today']} Brave crashes today — consider `cdpilot stop` then relaunch"
+
+    print(json.dumps(info, ensure_ascii=False))
+    sys.exit(0 if info['alive'] else 2)
+
+
+def cmd_stealth(state=None):
+    """Toggle stealth fingerprint patches.
+
+    Usage:
+      cdpilot stealth            # show status
+      cdpilot stealth on|off     # toggle
+      cdpilot stealth status     # show status (alias)
+
+    Patches navigator.webdriver, chrome.runtime, plugins, WebGL vendor and
+    permissions API to defeat the most common automation tells. Effect
+    applies on the NEXT navigation (current pages keep their fingerprint).
+    Zero new dependencies. Disabled by default.
+    """
+    if state is None or state.lower() == 'status':
+        current = get_stealth_config()
+        print(f'Stealth: {"on" if current else "off"}')
+        if current:
+            print('  Patches: navigator.webdriver, chrome.runtime, plugins, WebGL vendor, permissions, hardwareConcurrency')
+        return
+
+    s = state.lower()
+    if s not in ('on', 'off', '1', '0', 'true', 'false', 'yes', 'no'):
+        print(f"Invalid state: {state}. Use 'on', 'off', or 'status'.", file=sys.stderr)
+        sys.exit(1)
+    enabled = s in ('on', '1', 'true', 'yes')
+    os.makedirs(os.path.dirname(STEALTH_CONFIG_FILE), exist_ok=True)
+    with open(STEALTH_CONFIG_FILE, 'w') as f:
+        json.dump({'stealth': enabled}, f)
+    print(f'Stealth: {"on" if enabled else "off"}')
+    print('Effect applies on next navigation (`cdpilot go <url>`).')
+
+
+async def _detect_captcha(ws_url):
+    """Run CAPTCHA_DETECT_JS in the active page, return parsed dict.
+
+    Returns: {"detected": bool, "types": [...], "details": [...], "error"?: str}
+    Never raises — failures return {"detected": False, "error": "..."}.
+    """
+    try:
+        r = await cdp_send(ws_url, [(1, "Runtime.evaluate", {
+            "expression": CAPTCHA_DETECT_JS,
+            "returnByValue": True,
+        })], timeout=5)
+        raw = r.get(1, {}).get("result", {}).get("value")
+        if not raw:
+            return {"detected": False}
+        try:
+            return json.loads(raw)
+        except (ValueError, TypeError):
+            return {"detected": False, "error": "parse_failed"}
+    except Exception as e:
+        return {"detected": False, "error": str(e)[:120]}
+
+
+async def cmd_captcha_check():
+    """One-shot CAPTCHA detection on the active page. Prints JSON.
+
+    Exit codes: 0 = no CAPTCHA, 3 = CAPTCHA detected, 1 = error.
+    Useful in scripts: `cdpilot captcha-check && do-stuff`.
+    """
+    ws, _ = get_page_ws()
+    info = await _detect_captcha(ws)
+    print(json.dumps(info, ensure_ascii=False))
+    if info.get("error") and not info.get("detected"):
+        sys.exit(1)
+    sys.exit(3 if info.get("detected") else 0)
+
+
+async def cmd_captcha_wait(timeout_arg=None):
+    """Detect CAPTCHA and wait for the user to solve it.
+
+    Behavior:
+      - Interactive (stdin is a TTY): print warning, block on Enter.
+      - Non-interactive (pipe / MCP): poll every 2s until the CAPTCHA
+        disappears or timeout expires; emit one JSON line per poll on
+        state change so callers can stream progress.
+
+    Args:
+      timeout_arg: int seconds (default 300, max 1800). Passed as string from CLI.
+
+    Exit codes: 0 = solved (or none detected), 2 = timeout, 1 = error.
+    """
+    try:
+        timeout = int(timeout_arg) if timeout_arg else 300
+    except (ValueError, TypeError):
+        print(f"Invalid timeout: {timeout_arg}", file=sys.stderr)
+        sys.exit(1)
+    timeout = max(5, min(timeout, 1800))
+
+    ws, _ = get_page_ws()
+    info = await _detect_captcha(ws)
+    if not info.get("detected"):
+        print(json.dumps({"detected": False, "status": "none"}, ensure_ascii=False))
+        return
+
+    types = ",".join(info.get("types", [])) or "unknown"
+    interactive = sys.stdin.isatty() and not IS_MCP_SESSION
+
+    if interactive:
+        sys.stderr.write(f"\n⚠️  CAPTCHA tespit edildi: {types}\n")
+        sys.stderr.write("    Tarayıcıda çözün, ardından Enter'a basın (Ctrl+C iptal)...\n")
+        sys.stderr.flush()
+        try:
+            input()
+        except (EOFError, KeyboardInterrupt):
+            print(json.dumps({"detected": True, "status": "cancelled", "types": info.get("types", [])}, ensure_ascii=False))
+            sys.exit(1)
+        # Verify it's gone
+        post = await _detect_captcha(ws)
+        if post.get("detected"):
+            print(json.dumps({"detected": True, "status": "still_present", "types": post.get("types", [])}, ensure_ascii=False))
+            sys.exit(2)
+        print(json.dumps({"detected": False, "status": "solved"}, ensure_ascii=False))
+        return
+
+    # Non-interactive: poll until solved or timeout
+    print(json.dumps({"detected": True, "status": "waiting", "types": info.get("types", []), "timeout": timeout}, ensure_ascii=False), flush=True)
+    deadline = time.time() + timeout
+    poll_interval = 2.0
+    while time.time() < deadline:
+        await asyncio.sleep(poll_interval)
+        post = await _detect_captcha(ws)
+        if not post.get("detected"):
+            print(json.dumps({"detected": False, "status": "solved", "elapsed": round(timeout - (deadline - time.time()), 1)}, ensure_ascii=False), flush=True)
+            return
+    print(json.dumps({"detected": True, "status": "timeout", "types": info.get("types", []), "waited": timeout}, ensure_ascii=False), flush=True)
+    sys.exit(2)
+
+
 def _stop_browser_on_port(port):
     """Stop the browser process listening on the given port."""
     import signal
@@ -4334,6 +4841,8 @@ if __name__ == "__main__":
         'version': cmd_version,
         'proxy': lambda: cmd_proxy(args[0] if args else None),
         'headless': lambda: cmd_headless(args[0] if args else None),
+        'stealth': lambda: cmd_stealth(args[0] if args else None),
+        'health': cmd_health,
         'session': cmd_session,
         'sessions': cmd_sessions,
         'session-close': lambda: cmd_session_close(args[0] if args else None),
@@ -4444,12 +4953,15 @@ if __name__ == "__main__":
         'throttle': lambda: (require_args(1, 'throttle [slow3g|fast3g|offline|off|custom <down> <up> <lat>]'), None)[1] if not args else cmd_throttle(args[0], *args[1:]),
         'geo': lambda: (require_args(1, 'geo [<lat> <lng>|istanbul|london|newyork|off]'), None)[1] if not args else cmd_geo(args[0], args[1] if len(args) > 1 else None, args[2] if len(args) > 2 else None),
         'permission': lambda: (require_args(1, 'permission [grant|deny|reset] [<permission>]'), None)[1] if not args else cmd_permission(args[0], args[1] if len(args) > 1 else None),
+        'captcha-check': cmd_captcha_check,
+        'captcha-wait': lambda: cmd_captcha_wait(args[0] if args else None),
     }
 
     # Commands that do not require the visual indicator / input blocker
     NO_CONTROL_CMDS = {'glow', 'stop', 'tabs', 'close', 'close-tab', 'new-tab',
                        'dialog', 'download', 'throttle', 'permission', 'intercept',
-                       'batch', 'screenshot-diff', 'run'}
+                       'batch', 'screenshot-diff', 'run',
+                       'captcha-check', 'captcha-wait'}
     # Clean up idle sessions before running any command
     _cleanup_idle_sessions()