clearcote 0.19.1 → 0.19.2

package/dist/launchopts.d.ts

@@ -30,10 +30,30 @@ export declare function privacySandboxArgs(): string[];
  * coherent with proxied Chrome, and a guarantee no UDP egresses around the proxy. No proxy -> leave
  * QUIC on (real Chrome uses it). */
 export declare function quicArgs(proxy: PwProxy | undefined): string[];
-/** When no persona WebRTC IP is configured, default WebRTC to disable_non_proxied_udp so the real
- * local IP can't leak via srflx (stock Chromium leaks it). Skipped if the caller already set a
- * handling policy or a webrtcIp (the engine owns coherent fabrication in that case). */
-export declare function webrtcDefaultDenyArgs(args: string[], webrtcIp: unknown): string[];
+/** Default WebRTC to disable_non_proxied_udp, so no UDP can egress around the proxy.
+ *
+ * This used to be skipped whenever `webrtcIp` was set, on the theory that the engine's srflx
+ * fabrication already covered WebRTC. It does not — the two defend different things:
+ *
+ *   - fabrication rewrites what the browser *reports*, which beats a page that reads the candidate;
+ *   - this policy stops UDP *leaving the machine*, which beats a server that watches where packets
+ *     arrive from.
+ *
+ * A page that sets `iceTransportPolicy: "relay"` forces the browser to talk to its own TURN server.
+ * TURN prefers UDP and an HTTP/SOCKS proxy carries only TCP, so that UDP left on the host's own
+ * path and the TURN server read the real public address straight off the packet — no candidate
+ * involved, so fabricating one changed nothing. Reported by a customer whose session was flagged
+ * for location spoofing with an otherwise perfectly coherent persona.
+ *
+ * Worse, `geoip: true` sets `webrtcIp` for you, so the more carefully a caller configured for
+ * coherence the more likely they had silently lost this. Now only an explicit policy from the
+ * caller suppresses it.
+ *
+ * Note this is a real trade-off, not a free win: denying non-proxied UDP means peer connections
+ * that genuinely need UDP will not establish. Callers who need working WebRTC through a proxy want
+ * a transport that actually carries UDP (SOCKS5 with UDP ASSOCIATE, or a full tunnel) and can set
+ * their own policy to opt out. */
+export declare function webrtcDefaultDenyArgs(args: string[], _webrtcIp?: unknown): string[];
 /** Switches to load unpacked extensions. Chromium needs BOTH --load-extension=<dirs> and
  * --disable-extensions-except=<dirs> (the latter keeps the listed extensions enabled while
  * everything else stays off). `paths` is a list of unpacked-extension directories. */

package/dist/launchopts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launchopts.d.ts","sourceRoot":"","sources":["../src/launchopts.ts"],"names":[],"mappings":"AAIA,qCAAqC;AACrC,MAAM,WAAW,OAAO;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;kFAWkF;AAClF,eAAO,MAAM,wBAAwB,yJAG3B,CAAC;AAEX;;;cAGc;AACd,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAa1D;AAED,sEAAsE;AACtE,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED;;;oCAGoC;AACpC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,EAAE,CAE7D;AAED;;wFAEwF;AACxF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAMjF;AAED;;sFAEsF;AACtF,wBAAgB,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAIxD;AAED;;;;;8FAK8F;AAC9F,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,CAcvG"}
+{"version":3,"file":"launchopts.d.ts","sourceRoot":"","sources":["../src/launchopts.ts"],"names":[],"mappings":"AAIA,qCAAqC;AACrC,MAAM,WAAW,OAAO;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;kFAWkF;AAClF,eAAO,MAAM,wBAAwB,yJAG3B,CAAC;AAEX;;;cAGc;AACd,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAa1D;AAED,sEAAsE;AACtE,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAE7C;AAED;;;oCAGoC;AACpC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;;;;;;;;;;;;kCAsBkC;AAClC,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAKnF;AAED;;sFAEsF;AACtF,wBAAgB,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAIxD;AAED;;;;;8FAK8F;AAC9F,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,CAcvG"}

package/dist/launchopts.js

@@ -51,12 +51,30 @@ export function privacySandboxArgs() {
 export function quicArgs(proxy) {
     return proxy && proxy.server ? ["--disable-quic"] : [];
 }
-/** When no persona WebRTC IP is configured, default WebRTC to disable_non_proxied_udp so the real
- * local IP can't leak via srflx (stock Chromium leaks it). Skipped if the caller already set a
- * handling policy or a webrtcIp (the engine owns coherent fabrication in that case). */
-export function webrtcDefaultDenyArgs(args, webrtcIp) {
-    if (webrtcIp)
-        return [];
+/** Default WebRTC to disable_non_proxied_udp, so no UDP can egress around the proxy.
+ *
+ * This used to be skipped whenever `webrtcIp` was set, on the theory that the engine's srflx
+ * fabrication already covered WebRTC. It does not — the two defend different things:
+ *
+ *   - fabrication rewrites what the browser *reports*, which beats a page that reads the candidate;
+ *   - this policy stops UDP *leaving the machine*, which beats a server that watches where packets
+ *     arrive from.
+ *
+ * A page that sets `iceTransportPolicy: "relay"` forces the browser to talk to its own TURN server.
+ * TURN prefers UDP and an HTTP/SOCKS proxy carries only TCP, so that UDP left on the host's own
+ * path and the TURN server read the real public address straight off the packet — no candidate
+ * involved, so fabricating one changed nothing. Reported by a customer whose session was flagged
+ * for location spoofing with an otherwise perfectly coherent persona.
+ *
+ * Worse, `geoip: true` sets `webrtcIp` for you, so the more carefully a caller configured for
+ * coherence the more likely they had silently lost this. Now only an explicit policy from the
+ * caller suppresses it.
+ *
+ * Note this is a real trade-off, not a free win: denying non-proxied UDP means peer connections
+ * that genuinely need UDP will not establish. Callers who need working WebRTC through a proxy want
+ * a transport that actually carries UDP (SOCKS5 with UDP ASSOCIATE, or a full tunnel) and can set
+ * their own policy to opt out. */
+export function webrtcDefaultDenyArgs(args, _webrtcIp) {
     if (args.some((a) => a.startsWith("--webrtc-ip-handling-policy") || a.startsWith("--force-webrtc-ip-handling-policy"))) {
         return [];
     }

package/dist/launchopts.js.map

@@ -1 +1 @@
-{"version":3,"file":"launchopts.js","sourceRoot":"","sources":["../src/launchopts.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,iGAAiG;AACjG,0BAA0B;AAU1B;;;;;;;;;;;kFAWkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,gBAAgB,EAAE,2BAA2B,EAAE,QAAQ,EAAE,sBAAsB;IAC/E,uBAAuB,EAAE,kBAAkB,EAAE,cAAc;CACnD,CAAC;AAEX;;;cAGc;AACd,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;aAC3F,IAAI,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;;YAClG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,EAAY,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,IAAI,QAAQ,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,sBAAsB,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;oCAGoC;AACpC,MAAM,UAAU,QAAQ,CAAC,KAA0B;IACjD,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;wFAEwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,IAAc,EAAE,QAAiB;IACrE,IAAI,QAAQ;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC,EAAE,CAAC;QACvH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,qDAAqD,CAAC,CAAC;AACjE,CAAC;AAED;;sFAEsF;AACtF,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,oBAAoB,MAAM,EAAE,EAAE,+BAA+B,MAAM,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;8FAK8F;AAC9F,MAAM,UAAU,YAAY,CAAC,KAA0B;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjD,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,8FAA8F;YAC5F,gGAAgG;YAChG,+DAA+D,CAClE,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,CAAC,kBAAkB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"launchopts.js","sourceRoot":"","sources":["../src/launchopts.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,iGAAiG;AACjG,0BAA0B;AAU1B;;;;;;;;;;;kFAWkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,gBAAgB,EAAE,2BAA2B,EAAE,QAAQ,EAAE,sBAAsB;IAC/E,uBAAuB,EAAE,kBAAkB,EAAE,cAAc;CACnD,CAAC;AAEX;;;cAGc;AACd,MAAM,UAAU,iBAAiB,CAAC,IAAc;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;aAC3F,IAAI,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;;YAClG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,EAAY,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,IAAI,QAAQ,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,sBAAsB,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;oCAGoC;AACpC,MAAM,UAAU,QAAQ,CAAC,KAA0B;IACjD,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;kCAsBkC;AAClC,MAAM,UAAU,qBAAqB,CAAC,IAAc,EAAE,SAAmB;IACvE,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,mCAAmC,CAAC,CAAC,EAAE,CAAC;QACvH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,qDAAqD,CAAC,CAAC;AACjE,CAAC;AAED;;sFAEsF;AACtF,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,oBAAoB,MAAM,EAAE,EAAE,+BAA+B,MAAM,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;;;;8FAK8F;AAC9F,MAAM,UAAU,YAAY,CAAC,KAA0B;IACrD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACjD,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,8FAA8F;YAC5F,gGAAgG;YAChG,+DAA+D,CAClE,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,CAAC,kBAAkB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clearcote",
-  "version": "0.19.1",
+  "version": "0.19.2",
   "description": "Playwright drop-in for the Clearcote anti-fingerprint Chromium build. launch() returns a standard Playwright Browser backed by the verified Clearcote binary, which is auto-downloaded and SHA-256 checked.",
   "type": "module",
   "main": "./dist/index.js",