granclaw 0.0.1-beta.22 → 0.0.1-beta.24

package/dist/backend/assets/stealth-extension/stealth.js

@@ -217,4 +217,52 @@
       return result.replace(/at .*puppeteer_evaluation_script.*\n?/g, '');
     };
   });
+
+  // ── 10. navigator.userAgent — strip HeadlessChrome ─────────────────────
+  // Headless Chrome embeds "HeadlessChrome/" in the UA string instead of
+  // "Chrome/". Strip it here so JS-readable UA matches a real user session.
+  // Network-level UA is handled at launch via --user-agent; this covers
+  // all runtime reads (navigator.userAgent, performance.getEntriesByType, etc.)
+  safe(() => {
+    const realUA = navigator.userAgent.replace('HeadlessChrome/', 'Chrome/');
+    Object.defineProperty(Navigator.prototype, 'userAgent', {
+      get: () => realUA,
+      configurable: true,
+    });
+  });
+
+  // ── 11. navigator.userAgentData — Client Hints API ─────────────────────
+  // The modern Client Hints UA API also leaks "Headless" in its brand list.
+  // Patch brands to strip the "Headless" prefix so sites using getHighEntropyValues
+  // or brands directly see a normal Chrome brand string.
+  safe(() => {
+    if (typeof navigator.userAgentData === 'undefined') return;
+    const uad = navigator.userAgentData;
+    const brands = (uad.brands || []).map((b) => ({
+      brand: b.brand.replace(/^Headless/i, ''),
+      version: b.version,
+    }));
+    Object.defineProperty(Navigator.prototype, 'userAgentData', {
+      get: () => new Proxy(uad, {
+        get(target, prop) {
+          if (prop === 'brands') return brands;
+          if (prop === 'mobile') return false;
+          const val = Reflect.get(target, prop);
+          return typeof val === 'function' ? val.bind(target) : val;
+        },
+      }),
+      configurable: true,
+    });
+  });
+
+  // ── 12. navigator.deviceMemory ──────────────────────────────────────────
+  // Headless Chrome may expose the host's actual RAM or a low default.
+  // Spoofing 8 GB matches the most common desktop tier and avoids leaking
+  // the container/VM memory footprint to fingerprinting scripts.
+  safe(() => {
+    Object.defineProperty(Navigator.prototype, 'deviceMemory', {
+      get: () => 8,
+      configurable: true,
+    });
+  });
 })();

package/dist/backend/browser/stealth.js

@@ -64,7 +64,10 @@ let cachedChromePath;
 function detectChromePath() {
     if (cachedChromePath !== undefined)
         return cachedChromePath;
-    const override = process.env.GRANCLAW_CHROME_PATH;
+    // GRANCLAW_CHROME_PATH takes priority; fall back to the agent-browser env
+    // var so Docker containers (which set AGENT_BROWSER_CHROME_PATH=/usr/bin/chromium)
+    // automatically point stealth at the same binary agent-browser will use.
+    const override = process.env.GRANCLAW_CHROME_PATH || process.env.AGENT_BROWSER_CHROME_PATH;
     if (override && fs_1.default.existsSync(override)) {
         cachedChromePath = override;
         return override;
@@ -113,12 +116,9 @@ function detectChromePath() {
  *   const argv = ['--session', agentId, ...stealthArgv(), 'open', url];
  */
 function stealthArgv() {
-    // DISABLED 2026-04-11: the stealth extension / real-Chrome swap was
-    // producing buggy behaviour in agent browser sessions. Keep the code
-    // in place so we can re-enable with one edit once we understand why.
-    // Set GRANCLAW_STEALTH_ENABLED=1 to opt back in.
-    if (process.env.GRANCLAW_STEALTH_ENABLED !== '1')
-        return [];
+    // Re-enabled 2026-04-14: UA/deviceMemory patches added, AGENT_BROWSER_CHROME_PATH
+    // wired up so Docker containers automatically use the in-place Chromium.
+    // Set GRANCLAW_STEALTH_DISABLED=1 to opt out entirely.
     if (process.env.GRANCLAW_STEALTH_DISABLED === '1')
         return [];
     const argv = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granclaw",
-  "version": "0.0.1-beta.22",
+  "version": "0.0.1-beta.24",
   "description": "A personal AI assistant you run on your own machine.",
   "license": "MIT",
   "repository": {