invisible-playwright 0.3.5__tar.gz

invisible_playwright-0.3.5/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+dist/
+build/
+.pytest_cache/
+.venv/
+firefox-source/
+
+# Third-party source trees kept on disk for on-demand compatibility audits.
+# They are somebody else's code, with their own licence and their own .git, and
+# they must never be committed into this repository: `git add -A` would either
+# stage 3.9 MB of Apache-2.0 sources into an MIT repo or, worse, record a bare
+# gitlink that nobody can clone. The sdist/wheel excludes only protect the
+# published artifacts, not the repo, so the ignore has to live here too.
+tests/playwright-upstream/

invisible_playwright-0.3.5/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 stealthfox contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

invisible_playwright-0.3.5/PKG-INFO

@@ -0,0 +1,234 @@
+Metadata-Version: 2.4
+Name: invisible-playwright
+Version: 0.3.5
+Summary: Playwright wrapper for a patched Firefox with deterministic stealth profile.
+Project-URL: Homepage, https://github.com/feder-cr/invisible_playwright
+Project-URL: Repository, https://github.com/feder-cr/invisible_playwright
+Project-URL: Issues, https://github.com/feder-cr/invisible_playwright/issues
+Project-URL: Changelog, https://github.com/feder-cr/invisible_playwright/blob/main/CHANGELOG.md
+Project-URL: Documentation, https://github.com/feder-cr/invisible_playwright#readme
+Author-email: feder-cr <85809106+feder-cr@users.noreply.github.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: anti-detect,automation,firefox,playwright,stealth
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: Browsers
+Classifier: Topic :: Software Development :: Testing
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: invisible-core==18.0.0
+Requires-Dist: playwright<=1.61.0,>=1.55
+Provides-Extra: dev
+Requires-Dist: build>=1; extra == 'dev'
+Requires-Dist: playwright<=1.61.0,>=1.55; extra == 'dev'
+Requires-Dist: pytest-mock>=3; extra == 'dev'
+Requires-Dist: pytest-rerunfailures>=14; extra == 'dev'
+Requires-Dist: pytest>=7; extra == 'dev'
+Requires-Dist: responses>=0.24; extra == 'dev'
+Description-Content-Type: text/markdown
+
+<p>
+  <a href="https://github.com/feder-cr/invisible_playwright/actions/workflows/tests.yml"><img src="https://github.com/feder-cr/invisible_playwright/actions/workflows/tests.yml/badge.svg" alt="tests"></a>
+  <a href="https://github.com/feder-cr/invisible_playwright/blob/main/LICENSE"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/license.svg" alt="License: MIT"></a>
+  <a href="https://www.python.org/downloads/"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/python.svg" alt="Python 3.11+"></a>
+  <a href="https://github.com/feder-cr/firefox_antidetect_patch/releases"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/firefox.svg" alt="Firefox 151.0"></a>
+  <a href="https://github.com/feder-cr/invisible_playwright/stargazers"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/stars.svg" alt="GitHub stars"></a>
+  <a href="https://github.com/feder-cr/firefox_antidetect_patch/releases/tag/usage-counter"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/launches.svg" alt="browser launches"></a>
+</p>
+
+<div align="center">
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/feder-cr/invisible_playwright/7a8693c6b4386e9a84dd93bedc479ca8654482e1/docs/banner-dark.png">
+  <img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/7a8693c6b4386e9a84dd93bedc479ca8654482e1/docs/banner-light.png" alt="invisible_playwright" width="620">
+</picture>
+</div>
+
+<h3 align="center">A modified Firefox that passes every bot detection test.</h3>
+
+![invisible_playwright - 5/5 detection suites passed](https://raw.githubusercontent.com/feder-cr/invisible_playwright/7a8693c6b4386e9a84dd93bedc479ca8654482e1/docs/screenshots/hero.gif)
+
+## How it works
+
+Anti-bots ask two questions. invisible_playwright answers yes to both.
+
+**1. Is this a real browser?** Yes. It is Firefox, patched at the C++ source level.
+
+- Fingerprint set inside the engine, not injected into the page: Navigator, screen, GPU/WebGL, Canvas, fonts, audio, WebRTC, timezone, network.
+- No JS shim, no override, no seam to read.
+
+**2. Is a real person using it?** Yes. The actions are humanized in the driver.
+
+- Every click, hover and drag follows a natural mouse path with human timing, no teleporting cursor.
+- Each input is byte-identical to a real mouse: real input source, pressure, trusted events.
+
+Driven by the standard Playwright API. Full breakdown: [feder-cr/firefox_antidetect_patch](https://github.com/feder-cr/firefox_antidetect_patch).
+
+---
+
+## Still seeing captchas or anti-bot? It's the proxy.
+Once the browser is handled it stops being the variable. If you are still getting challenged, the tell is no longer the browser, it is the IP you come from. Around 90% of proxies are public: anyone can rent the same address, so it is already known and sits on the blocked-IP lists sites check. A perfect browser on a known IP still loses.
+
+> The fix is the clean 10%, residential IPs that aren't already known. For those we recommend [sx.org](https://sx.org/?c=invisible_playwright), who filter for and serve only IPs that aren't already on those lists.
+
+---
+
+## Install
+
+```bash
+pip install invisible-playwright
+python -m invisible_playwright fetch      # one-time ~100 MB download, SHA256-verified
+```
+
+Supported platforms: **Windows x86_64**, **Linux x86_64 / arm64**, **macOS arm64 / x86_64**. On macOS the app is ad-hoc signed (not notarized): if Gatekeeper complains, clear the quarantine flag once with `xattr -dr com.apple.quarantine` on the cached `Firefox.app`.
+
+---
+
+## Usage
+### Random fingerprint per session
+**100% Playwright-compatible** - sync and async, all methods, zero API changes. If you already use Playwright, switching is two lines:
+
+```diff
+- from playwright.sync_api import sync_playwright
+- with sync_playwright() as p:
+-     browser = p.firefox.launch()
++ from invisible_playwright import InvisiblePlaywright
++ with InvisiblePlaywright() as browser:
+```
+
+Every session gets a distinct fingerprint (GPU, audio, fonts, screen, ~400 fields) and Bezier-curve mouse motion.
+
+**Sync**
+```python
+from invisible_playwright import InvisiblePlaywright
+
+with InvisiblePlaywright(proxy={"server": "socks5://...", "username": "u", "password": "p"}) as browser:
+    page = browser.new_page()
+    page.goto("https://example.com")
+    page.click("#submit")   # mouse arcs to the button on a Bezier curve
+```
+
+**Async**
+```python
+from invisible_playwright.async_api import InvisiblePlaywright
+
+async with InvisiblePlaywright(proxy={"server": "socks5://...", "username": "u", "password": "p"}) as browser:
+    page = await browser.new_page()
+    await page.goto("https://example.com")
+    await page.click("#submit")
+```
+
+The `browser` object is a `playwright.sync_api.Browser` / `playwright.async_api.Browser` - every Playwright method works as-is.
+
+Log the seed to replay a run:
+
+```python
+sf = InvisiblePlaywright()
+with sf as browser:
+    print("seed =", sf.seed)
+    # ...
+```
+
+### Reproducible fingerprint
+
+```python
+with InvisiblePlaywright(seed=42) as browser:
+    ...   # same GPU, same canvas hash, same audio context, every run
+```
+
+### Proxies
+
+```python
+proxy = {
+    "server": "socks5://gate.example.com:1080",
+    "username": "user",
+    "password": "pass",
+}
+with InvisiblePlaywright(proxy=proxy) as browser:
+    ...
+```
+
+Schemes supported: `socks5`, `socks4`, `http`, `https`. DNS is routed through the proxy by default, no local leak.
+
+Around 90% of proxies are public, so their IPs are already known and blocked. For the clean 10%, residential IPs that aren't already known, we recommend [sx.org](https://sx.org/?c=invisible_playwright), who filter for and serve only IPs that aren't already on those lists.
+
+### Timezone
+
+The browser timezone follows `timezone=`:
+
+```python
+# default: timezone is auto-derived from the egress IP (proxy egress if a
+# proxy is set, otherwise the host's own public IP)
+with InvisiblePlaywright(proxy=proxy) as browser:
+    ...
+
+# explicit IANA zone always wins, the only way to force a specific zone
+with InvisiblePlaywright(proxy=proxy, timezone="America/New_York") as browser:
+    ...
+```
+
+### Pinning specific fingerprint fields
+
+By default everything comes from `seed`. To force specific values while the rest stays seed-derived:
+
+```python
+with InvisiblePlaywright(
+    seed=42,
+    pin={
+        "gpu.renderer": "ANGLE (NVIDIA, NVIDIA GeForce RTX 4090 Direct3D11)",
+        "gpu.vendor":   "Google Inc. (NVIDIA)",
+        "screen.width":  2560,
+        "screen.height": 1440,
+        "hardware.concurrency": 16,
+    },
+) as browser:
+    ...
+```
+
+Full list of pinnable keys, how pinning interacts with the Bayesian sampler, and common patterns are in **[docs/pinning.md](https://github.com/feder-cr/invisible_playwright/blob/main/docs/pinning.md)**.
+
+---
+
+## CLI
+
+```bash
+invisible_playwright fetch          # download the binary if missing
+invisible_playwright fetch --force  # re-download even if cached
+invisible_playwright path           # print the absolute path to the cached binary
+invisible_playwright version        # wrapper and binary versions
+invisible_playwright clear-cache    # remove all cached binaries
+```
+
+## Related projects
+
+Related projects that cover similar ground:
+
+- **[arkenfox/user.js](https://github.com/arkenfox/user.js)** - Firefox privacy hardening via prefs. invisible_playwright patches C++ where prefs are insufficient.
+- **[LibreWolf](https://librewolf.net)** - Firefox fork with privacy defaults. LibreWolf ships a configured binary; invisible_playwright ships source patches + automation wrapper.
+- **[Camoufox](https://github.com/daijro/camoufox)** - open-source anti-detect Firefox. Patches a wider surface and ships its own fingerprint database; invisible_playwright uses a Bayesian sampler.
+
+---
+
+## License
+
+MIT - see [LICENSE](https://github.com/feder-cr/invisible_playwright/blob/main/LICENSE). The patched Firefox binary is distributed under the MPL-2.0 (Firefox upstream license). The C++ patches against mozilla-central that produce that binary are at [feder-cr/firefox_antidetect_patch](https://github.com/feder-cr/firefox_antidetect_patch).
+
+---
+
+## Disclaimer
+
+This project is for educational purposes only. It is provided as-is, with no warranties. I take no responsibility for how it is used. Use it at your own risk and in compliance with the laws of your jurisdiction.
+
+
+---
+
+<p align="center">
+  Built by <a href="https://it.linkedin.com/in/federico-elia-5199951b6">Federico Elia</a>
+  &nbsp;<a href="https://it.linkedin.com/in/federico-elia-5199951b6"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/linkedin.svg" alt="LinkedIn"></a>
+</p>

invisible_playwright-0.3.5/README.md

@@ -0,0 +1,198 @@
+<p>
+  <a href="https://github.com/feder-cr/invisible_playwright/actions/workflows/tests.yml"><img src="https://github.com/feder-cr/invisible_playwright/actions/workflows/tests.yml/badge.svg" alt="tests"></a>
+  <a href="https://github.com/feder-cr/invisible_playwright/blob/main/LICENSE"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/license.svg" alt="License: MIT"></a>
+  <a href="https://www.python.org/downloads/"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/python.svg" alt="Python 3.11+"></a>
+  <a href="https://github.com/feder-cr/firefox_antidetect_patch/releases"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/firefox.svg" alt="Firefox 151.0"></a>
+  <a href="https://github.com/feder-cr/invisible_playwright/stargazers"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/stars.svg" alt="GitHub stars"></a>
+  <a href="https://github.com/feder-cr/firefox_antidetect_patch/releases/tag/usage-counter"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/launches.svg" alt="browser launches"></a>
+</p>
+
+<div align="center">
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/feder-cr/invisible_playwright/7a8693c6b4386e9a84dd93bedc479ca8654482e1/docs/banner-dark.png">
+  <img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/7a8693c6b4386e9a84dd93bedc479ca8654482e1/docs/banner-light.png" alt="invisible_playwright" width="620">
+</picture>
+</div>
+
+<h3 align="center">A modified Firefox that passes every bot detection test.</h3>
+
+![invisible_playwright - 5/5 detection suites passed](https://raw.githubusercontent.com/feder-cr/invisible_playwright/7a8693c6b4386e9a84dd93bedc479ca8654482e1/docs/screenshots/hero.gif)
+
+## How it works
+
+Anti-bots ask two questions. invisible_playwright answers yes to both.
+
+**1. Is this a real browser?** Yes. It is Firefox, patched at the C++ source level.
+
+- Fingerprint set inside the engine, not injected into the page: Navigator, screen, GPU/WebGL, Canvas, fonts, audio, WebRTC, timezone, network.
+- No JS shim, no override, no seam to read.
+
+**2. Is a real person using it?** Yes. The actions are humanized in the driver.
+
+- Every click, hover and drag follows a natural mouse path with human timing, no teleporting cursor.
+- Each input is byte-identical to a real mouse: real input source, pressure, trusted events.
+
+Driven by the standard Playwright API. Full breakdown: [feder-cr/firefox_antidetect_patch](https://github.com/feder-cr/firefox_antidetect_patch).
+
+---
+
+## Still seeing captchas or anti-bot? It's the proxy.
+Once the browser is handled it stops being the variable. If you are still getting challenged, the tell is no longer the browser, it is the IP you come from. Around 90% of proxies are public: anyone can rent the same address, so it is already known and sits on the blocked-IP lists sites check. A perfect browser on a known IP still loses.
+
+> The fix is the clean 10%, residential IPs that aren't already known. For those we recommend [sx.org](https://sx.org/?c=invisible_playwright), who filter for and serve only IPs that aren't already on those lists.
+
+---
+
+## Install
+
+```bash
+pip install invisible-playwright
+python -m invisible_playwright fetch      # one-time ~100 MB download, SHA256-verified
+```
+
+Supported platforms: **Windows x86_64**, **Linux x86_64 / arm64**, **macOS arm64 / x86_64**. On macOS the app is ad-hoc signed (not notarized): if Gatekeeper complains, clear the quarantine flag once with `xattr -dr com.apple.quarantine` on the cached `Firefox.app`.
+
+---
+
+## Usage
+### Random fingerprint per session
+**100% Playwright-compatible** - sync and async, all methods, zero API changes. If you already use Playwright, switching is two lines:
+
+```diff
+- from playwright.sync_api import sync_playwright
+- with sync_playwright() as p:
+-     browser = p.firefox.launch()
++ from invisible_playwright import InvisiblePlaywright
++ with InvisiblePlaywright() as browser:
+```
+
+Every session gets a distinct fingerprint (GPU, audio, fonts, screen, ~400 fields) and Bezier-curve mouse motion.
+
+**Sync**
+```python
+from invisible_playwright import InvisiblePlaywright
+
+with InvisiblePlaywright(proxy={"server": "socks5://...", "username": "u", "password": "p"}) as browser:
+    page = browser.new_page()
+    page.goto("https://example.com")
+    page.click("#submit")   # mouse arcs to the button on a Bezier curve
+```
+
+**Async**
+```python
+from invisible_playwright.async_api import InvisiblePlaywright
+
+async with InvisiblePlaywright(proxy={"server": "socks5://...", "username": "u", "password": "p"}) as browser:
+    page = await browser.new_page()
+    await page.goto("https://example.com")
+    await page.click("#submit")
+```
+
+The `browser` object is a `playwright.sync_api.Browser` / `playwright.async_api.Browser` - every Playwright method works as-is.
+
+Log the seed to replay a run:
+
+```python
+sf = InvisiblePlaywright()
+with sf as browser:
+    print("seed =", sf.seed)
+    # ...
+```
+
+### Reproducible fingerprint
+
+```python
+with InvisiblePlaywright(seed=42) as browser:
+    ...   # same GPU, same canvas hash, same audio context, every run
+```
+
+### Proxies
+
+```python
+proxy = {
+    "server": "socks5://gate.example.com:1080",
+    "username": "user",
+    "password": "pass",
+}
+with InvisiblePlaywright(proxy=proxy) as browser:
+    ...
+```
+
+Schemes supported: `socks5`, `socks4`, `http`, `https`. DNS is routed through the proxy by default, no local leak.
+
+Around 90% of proxies are public, so their IPs are already known and blocked. For the clean 10%, residential IPs that aren't already known, we recommend [sx.org](https://sx.org/?c=invisible_playwright), who filter for and serve only IPs that aren't already on those lists.
+
+### Timezone
+
+The browser timezone follows `timezone=`:
+
+```python
+# default: timezone is auto-derived from the egress IP (proxy egress if a
+# proxy is set, otherwise the host's own public IP)
+with InvisiblePlaywright(proxy=proxy) as browser:
+    ...
+
+# explicit IANA zone always wins, the only way to force a specific zone
+with InvisiblePlaywright(proxy=proxy, timezone="America/New_York") as browser:
+    ...
+```
+
+### Pinning specific fingerprint fields
+
+By default everything comes from `seed`. To force specific values while the rest stays seed-derived:
+
+```python
+with InvisiblePlaywright(
+    seed=42,
+    pin={
+        "gpu.renderer": "ANGLE (NVIDIA, NVIDIA GeForce RTX 4090 Direct3D11)",
+        "gpu.vendor":   "Google Inc. (NVIDIA)",
+        "screen.width":  2560,
+        "screen.height": 1440,
+        "hardware.concurrency": 16,
+    },
+) as browser:
+    ...
+```
+
+Full list of pinnable keys, how pinning interacts with the Bayesian sampler, and common patterns are in **[docs/pinning.md](https://github.com/feder-cr/invisible_playwright/blob/main/docs/pinning.md)**.
+
+---
+
+## CLI
+
+```bash
+invisible_playwright fetch          # download the binary if missing
+invisible_playwright fetch --force  # re-download even if cached
+invisible_playwright path           # print the absolute path to the cached binary
+invisible_playwright version        # wrapper and binary versions
+invisible_playwright clear-cache    # remove all cached binaries
+```
+
+## Related projects
+
+Related projects that cover similar ground:
+
+- **[arkenfox/user.js](https://github.com/arkenfox/user.js)** - Firefox privacy hardening via prefs. invisible_playwright patches C++ where prefs are insufficient.
+- **[LibreWolf](https://librewolf.net)** - Firefox fork with privacy defaults. LibreWolf ships a configured binary; invisible_playwright ships source patches + automation wrapper.
+- **[Camoufox](https://github.com/daijro/camoufox)** - open-source anti-detect Firefox. Patches a wider surface and ships its own fingerprint database; invisible_playwright uses a Bayesian sampler.
+
+---
+
+## License
+
+MIT - see [LICENSE](https://github.com/feder-cr/invisible_playwright/blob/main/LICENSE). The patched Firefox binary is distributed under the MPL-2.0 (Firefox upstream license). The C++ patches against mozilla-central that produce that binary are at [feder-cr/firefox_antidetect_patch](https://github.com/feder-cr/firefox_antidetect_patch).
+
+---
+
+## Disclaimer
+
+This project is for educational purposes only. It is provided as-is, with no warranties. I take no responsibility for how it is used. Use it at your own risk and in compliance with the laws of your jurisdiction.
+
+
+---
+
+<p align="center">
+  Built by <a href="https://it.linkedin.com/in/federico-elia-5199951b6">Federico Elia</a>
+  &nbsp;<a href="https://it.linkedin.com/in/federico-elia-5199951b6"><img src="https://raw.githubusercontent.com/feder-cr/invisible_playwright/main/docs/badges/linkedin.svg" alt="LinkedIn"></a>
+</p>

invisible_playwright-0.3.5/pyproject.toml

@@ -0,0 +1,106 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "invisible-playwright"
+version = "0.3.5"
+description = "Playwright wrapper for a patched Firefox with deterministic stealth profile."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+authors = [{ name = "feder-cr", email = "85809106+feder-cr@users.noreply.github.com" }]
+keywords = ["playwright", "firefox", "stealth", "anti-detect", "automation"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Operating System :: Microsoft :: Windows",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Software Development :: Testing",
+    "Topic :: Internet :: WWW/HTTP :: Browsers",
+    "Typing :: Typed",
+]
+dependencies = [
+    # Pure config (seed -> fingerprint -> prefs, binary download, proxy, geo) lives
+    # in invisible-core since the 2026-07-03 split; it pulls platformdirs/requests/
+    # maxminddb/tzdata transitively. The wrapper only adds Playwright.
+    #
+    # An EXACT specifier, not the bare `invisible-core @ git+...` direct reference
+    # this line used to carry. Measured, not assumed: pip is structurally blind to
+    # a violated direct reference. A direct reference carries no version specifier,
+    # so there is nothing for `pip check` to compare, and it reports "No broken
+    # requirements found" (exit 0) on an environment where the wrong core is
+    # installed. The same mismatch written as a real version specifier is reported,
+    # exit 1. pip also discards the metadata it just built for a moved git tag and
+    # leaves direct_url.json recording the OLD commit, so the file meant to be
+    # ground truth lies exactly when it matters.
+    #
+    # Cost, accepted knowingly: the pin literal now moves on every engine release,
+    # so a firefox-N bump is a three-repo release instead of a core-only push.
+    # invisible-core must be live on the index BEFORE this package is published,
+    # or a cold install fails to resolve.
+    #
+    # This literal is the ONLY place the expected core version is written. The
+    # import-time assertion in _pin.py reads it back out of this package's own
+    # metadata; nothing in src/ hardcodes a second copy (tests/test_core_pin.py
+    # fails if one appears). What stays invisible to install-time machinery is the
+    # --no-deps / lockfile residue, and _pin.py is the only layer that sees it.
+    "invisible-core==18.0.0",
+    # Install-time approximation of the Juggler client range we test against.
+    # 1.61 added an isMobile field to Browser.setDefaultViewport that an older
+    # Juggler rejects, which kills the session (issue #48). The authoritative
+    # range now travels in the seal and is enforced at import by
+    # _engine.assert_playwright_range(), so widening it no longer needs a
+    # wrapper release; this bound only keeps a fresh install in the ballpark.
+    "playwright>=1.55,<=1.61.0",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=7", "pytest-mock>=3", "responses>=0.24", "build>=1", "pytest-rerunfailures>=14", "playwright>=1.55,<=1.61.0"]
+
+[tool.pytest.ini_options]
+markers = [
+    "unit: pure-logic tests, no I/O or external deps",
+    "integration: multi-module tests, no browser",
+    "e2e: requires patched Firefox binary and display",
+    "slow: tests that build the wheel - opt-in only",
+    "linux_only: tests that require Linux platform",
+]
+addopts = "-m 'not slow and not e2e'"
+# tests/playwright-upstream/ is a vendored Microsoft Playwright test suite
+# used for compatibility verification on demand. It has its own deps
+# (pixelmatch with API not matching our version) and a conftest that fails
+# collection in our env. Run it explicitly with --override-ini for compat
+# audits, not on every push.
+norecursedirs = ["playwright-upstream"]
+
+[project.scripts]
+invisible-playwright = "invisible_playwright.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/feder-cr/invisible_playwright"
+Repository = "https://github.com/feder-cr/invisible_playwright"
+Issues = "https://github.com/feder-cr/invisible_playwright/issues"
+Changelog = "https://github.com/feder-cr/invisible_playwright/blob/main/CHANGELOG.md"
+Documentation = "https://github.com/feder-cr/invisible_playwright#readme"
+
+# No [tool.hatch.metadata] allow-direct-references opt-in: there is no direct
+# reference left in [project].dependencies, and leaving the switch on is what
+# would let one creep back in silently. Without it hatchling refuses to build a
+# direct reference at all, which turns the decision above into a build-time gate.
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/invisible_playwright"]
+exclude = ["*.bak", "*-bak"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/invisible_playwright", "tests", "README.md", "LICENSE", "pyproject.toml"]
+# tests/playwright-upstream/ is a vendored copy of microsoft/playwright-python,
+# Apache-2.0, ~322 files. Redistributing it inside an sdist whose only declared
+# licence is MIT misstates the licence of what is being distributed, and a PyPI
+# filename can never be re-uploaded once published.
+exclude = ["tests/playwright-upstream"]

invisible_playwright-0.3.5/src/invisible_playwright/__init__.py

@@ -0,0 +1,68 @@
+"""invisible_playwright - Playwright wrapper for a patched Firefox with stealth profile.
+
+Quickstart:
+
+    from invisible_playwright import InvisiblePlaywright
+
+    with InvisiblePlaywright() as browser:        # random seed
+        page = browser.new_page()
+        page.goto("https://example.com")
+
+    with InvisiblePlaywright(seed=42) as browser: # deterministic
+        ...
+
+    with InvisiblePlaywright(humanize=True) as browser:  # human-like cursor motion
+        page = browser.new_page()
+        page.click("#submit")   # expanded into a Bezier trajectory
+"""
+# ── Import-time core assertion, and repair ───────────────────────────────────
+# Runs BEFORE every other import. Two questions, one check: is the installed
+# invisible-core new enough to carry a release seal at all, and is it the exact
+# version this distribution declares in pyproject? The expected version is read
+# back out of our own metadata, so it is written in exactly one place.
+#
+# A mismatch is REPAIRED, not just reported: the declared core is installed and
+# picked up in this process, so the script that just imported us keeps going.
+# That is only sound here, on the first line, while invisible_core has not been
+# imported by anyone yet; _pin.py captures exactly that fact before it imports
+# the core, and the repair refuses itself if the snapshot says otherwise. Every
+# failure of the repair falls back to the message it replaced.
+#
+# The comparison and the repair both live in invisible_core._pin, shared with the
+# profile manager so both products diagnose and fix an environment the same way.
+# Our _pin.py is the floor: it owns the three states a module inside the core
+# cannot report on (core absent, core present but unimportable, core present but
+# too damaged to derive its own version) and delegates everything else.
+from ._pin import enforce_core_pin as _enforce_core_pin
+_enforce_core_pin()
+
+from ._engine import assert_playwright_range as _assert_pw_range
+_assert_pw_range()
+
+from .config import get_default_args, get_default_stealth_prefs
+from .constants import BINARY_VERSION, FIREFOX_UPSTREAM_VERSION
+from ._geo import GeoTimezoneError, resolve_session_timezone
+from .download import ensure_binary, ensure_geoip_mmdb
+from .launcher import InvisiblePlaywright
+
+from importlib.metadata import PackageNotFoundError, version as _pkg_version
+
+try:
+    __version__ = _pkg_version("invisible-playwright")
+except PackageNotFoundError:
+    # Editable / source checkout without an install record: fall back to a
+    # marker rather than risk shipping a stale hardcoded string.
+    __version__ = "0.0.0+unknown"
+
+__all__ = [
+    "InvisiblePlaywright",
+    "ensure_binary",
+    "ensure_geoip_mmdb",
+    "get_default_stealth_prefs",
+    "get_default_args",
+    "resolve_session_timezone",
+    "GeoTimezoneError",
+    "BINARY_VERSION",
+    "FIREFOX_UPSTREAM_VERSION",
+    "__version__",
+]

invisible_playwright-0.3.5/src/invisible_playwright/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+import sys
+
+sys.exit(main())