testaro 74.0.0 → 74.1.0

package/README.md

@@ -169,6 +169,11 @@ Here is a sample job, showing properties that you can set:
     }
   },
   browserID: 'chromium', // or 'webkit' or 'firefox'
+  stealth: true, // Optional. Whether to enable puppeteer-extra-plugin-stealth
+                 // evasions. Only applies to Chromium (the plugin is
+                 // Chromium-specific). Defaults to true. Set false to opt
+                 // out — useful for sites whose anti-bot heuristics react
+                 // badly to stealth's patches.
   creationTimeStamp: '241229T0537', // When job was created
   executionTimeStamp: '250110T1200', // When job will be ready to be performed
   target: {

package/actSpecs.js

@@ -1,6 +1,7 @@
 /*
   © 2021–2024 CVS Health and/or one of its affiliates. All rights reserved.
-  © 2025 Jonathan Robert Pool.
+  © 2026 Jeff Witt.
+  © 2025–2026 Jonathan Robert Pool.
 
   Licensed under the MIT License. See LICENSE file at the project root or
   https://opensource.org/license/mit/ for details.

package/call.js

@@ -22,13 +22,9 @@
 
 // IMPORTS
 
-// Module to keep secrets.
 require('dotenv').config();
-// Module to process files.
 const fs = require('fs/promises');
-// Function to process a testing request.
 const {doJob} = require('./run');
-// Function to watch for jobs.
 const {dirWatch} = require('./dirWatch');
 const {netWatch} = require('./netWatch');
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testaro",
-  "version": "74.0.0",
+  "version": "74.1.0",
   "description": "Run 1300 web accessibility tests from 10 tools and get a standardized report",
   "main": "index.js",
   "scripts": {

package/procs/job.js

@@ -40,6 +40,8 @@ const tools = exports.tools = {
 
 // FUNCTIONS
 
+// Validates a browser type.
+const isBrowserID = exports.isBrowserID = type => ['chromium', 'firefox', 'webkit'].includes(type);
 // Returns whether a variable has a specified type.
 const hasType = (variable, type) => {
   if (type === 'string') {
@@ -105,8 +107,6 @@ const hasSubtype = (variable, subtype) => {
 };
 // Validates a device ID.
 const isDeviceID = exports.isDeviceID = deviceID => deviceID === 'default' || !! devices[deviceID];
-// Validates a browser type.
-const isBrowserID = exports.isBrowserID = type => ['chromium', 'firefox', 'webkit'].includes(type);
 // Validates a load state.
 const isState = string => ['loaded', 'idle'].includes(string);
 // Validates a URL.
@@ -177,6 +177,7 @@ exports.isValidJob = job => {
       standard,
       device,
       browserID,
+      stealth,
       creationTimeStamp,
       executionTimeStamp,
       target,
@@ -215,6 +216,15 @@ exports.isValidJob = job => {
         error: 'Bad job browserID'
       };
     }
+    // `stealth` is optional. When omitted, Testaro defaults to enabling the
+    // puppeteer-extra-plugin-stealth evasions on Chromium (historical
+    // behavior). When present, it must be a boolean.
+    if (stealth !== undefined && typeof stealth !== 'boolean') {
+      return {
+        isValid: false,
+        error: 'Bad job stealth (must be boolean if present)'
+      };
+    }
     if (
       ! (creationTimeStamp && typeof creationTimeStamp === 'string' && dateOf(creationTimeStamp))
     ) {

package/procs/launch.js

@@ -19,15 +19,22 @@
 // Module to handle errors.
 const {addError} = require('./error');
 const headedBrowser = process.env.HEADED_BROWSER === 'true';
-const {chromium, webkit, firefox} = require('playwright-extra');
+// Two flavors of Playwright:
+// - `playwrightCore`: the upstream Playwright SDK with no plugins attached.
+// - `playwrightExtra`: the playwright-extra wrapper. `run.js` registers
+//   puppeteer-extra-plugin-stealth on its `chromium` only (the plugin is
+//   Chromium-specific by design — see comment in run.js).
+// At launch time we pick the flavor per call: Chromium with stealth enabled
+// goes through playwright-extra, every other case (Chromium with stealth
+// disabled, WebKit, Firefox) goes through plain Playwright.
+const playwrightCore = require('playwright');
+const playwrightExtra = require('playwright-extra');
 const {isBrowserID, isDeviceID, isURL, isValidJob} = require('./job');
 
 // CONSTANTS
 
 // Whether to log page-context log messages.
 const debug = process.env.DEBUG === 'true';
-// Playwright browser types.
-const playwrightBrowsers = {chromium, webkit, firefox};
 // Strings in log messages indicating errors.
 const errorWords = [
   'but not used',
@@ -238,12 +245,27 @@ const launchOnce = async opts => {
   if (isBrowserID(browserID) && isDeviceID(deviceID) && isURL(url)) {
     // Replace the report target URL with the specified URL.
     report.target.url = url;
-    const browserType = playwrightBrowsers[browserID];
+    // Resolve whether to run with stealth evasions. Defaults to true (the
+    // historical behavior). `report.stealth === false` opts out — useful
+    // for sites whose anti-bot heuristics react badly to stealth's patches,
+    // or when reproducing a real user agent's exact JS environment matters.
+    // Stealth only ever applies to Chromium; WebKit and Firefox always use
+    // plain Playwright regardless of the `stealth` field.
+    const useStealth = browserID === 'chromium' && report.stealth !== false;
+    const playwright = useStealth ? playwrightExtra : playwrightCore;
+    // Create a browser of the specified or default type.
+    const browserType = playwright[browserID];
+    // Define the browser-option args, depending on the browser type and head-emulation level.
     const browserOptionArgs = [];
     if (browserID === 'chromium') {
-      browserOptionArgs.push(
-        '--disable-dev-shm-usage', '--disable-blink-features=AutomationControlled'
-      );
+      browserOptionArgs.push('--disable-dev-shm-usage');
+      // `--disable-blink-features=AutomationControlled` is a stealth-only
+      // arg: it hides the automation flag that stealth's other evasions
+      // assume is hidden. When stealth is opted out, leave the flag off
+      // so the browser presents an honest automation profile.
+      if (useStealth) {
+        browserOptionArgs.push('--disable-blink-features=AutomationControlled');
+      }
       if (headEmulation === 'high') {
         browserOptionArgs.push(
           '--disable-gpu',

package/procs/shoot.js

@@ -1,4 +1,5 @@
 /*
+  © 2026 Jeff Witt.
   © 2025–2026 Jonathan Robert Pool.
   Licensed under the MIT License. See LICENSE file for details.
 */
@@ -29,10 +30,12 @@ const {PNG} = require('pngjs');
 
 // FUNCTIONS
 
-// Coerces a label into a filesystem-safe string. Runs of any character outside
-// [A-Za-z0-9._-] collapse to one underscore; leading and trailing dots and
-// underscores are stripped (no hidden files, no traversal); capped at 100
-// characters; falls back to 'unnamed' if nothing usable remains.
+/*
+  Coerces a label into a filesystem-safe string. Runs of any character outside
+  [A-Za-z0-9._-] collapse to one underscore; leading and trailing dots and
+  underscores are stripped (no hidden files, no traversal); capped at 100
+  characters; falls back to 'unnamed' if nothing usable remains.
+*/
 const sanitizeLabel = (label) => {
   const raw = String(label);
   const cleaned = raw

package/run.js

@@ -21,13 +21,16 @@ require('dotenv').config({quiet: true});
 const {isValidJob} = require('./procs/job');
 const {getCatalog} = require('./procs/catalog');
 const {nowString} = require('./procs/dateTime');
-const {chromium, webkit, firefox} = require('playwright-extra');
-const fs = require('fs').promises;
-const os = require('os');
+// Module to create browsers.
+const {chromium} = require('playwright-extra');
+// Module to evade automation detection.
+// Stealth is Chromium-specific: its evasions inject Chromium-only launch
+// flags (e.g. `--disable-blink-features=AutomationControlled`) and patch
+// Blink-only DOM globals. WebKit and Firefox reject the unknown args at
+// startup, so registering stealth on them breaks every launch. Job-level
+// opt-out for Chromium happens in procs/launch.js via the `stealth` field.
 const StealthPlugin = require('puppeteer-extra-plugin-stealth');
 chromium.use(StealthPlugin());
-webkit.use(StealthPlugin());
-firefox.use(StealthPlugin());
 
 // FUNCTIONS