onionwright 0.0.1__tar.gz

onionwright-0.0.1/.gitignore

@@ -0,0 +1,7 @@
+__pycache__/
+*.py[cod]
+.venv/
+dist/
+build/
+*.egg-info/
+harness/last-run.json

onionwright-0.0.1/LICENSE

@@ -0,0 +1,75 @@
+onionwright Commercial Licence
+Copyright (c) 2026 OpenOnion. All rights reserved.
+
+NOT OPEN SOURCE. This software is proprietary and is licensed, not sold.
+
+NOTE: This text has not been reviewed by a lawyer. It states the intent agreed for
+the product and is a drafting starting point, not final terms. Review before the
+first paid release.
+
+1. GRANT
+
+   Subject to an active subscription at the tier designated by OpenOnion, you are
+   granted a non-exclusive, non-transferable, revocable licence to install and use
+   this software for your own purposes, personal or commercial, on systems you
+   control.
+
+2. RESTRICTIONS
+
+   You may not:
+
+   a. Redistribute this software, in whole or in part, modified or unmodified.
+   b. Resell, sublicense, rent, lease, or repackage it.
+   c. Reverse engineer, decompile, or disassemble it, or attempt to derive its
+      source, except to the extent applicable law expressly permits despite this
+      restriction.
+   d. Remove or alter any copyright, licence, or attribution notice.
+   e. Share licence credentials, or use one licence across more concurrent
+      sessions than your tier permits.
+
+3. OEM / SAAS
+
+   A separate written agreement is required where this software is bundled,
+   embedded, exposed through an API, or otherwise used to provide functionality to
+   third-party customers. No subscription tier grants redistribution, resale,
+   sublicensing, bundling, embedding, hosted-service, white-label, OEM, or SaaS
+   rights unless expressly stated in a separate agreement.
+
+4. VERSIONS AND CONTINUITY
+
+   The latest major version requires an active subscription. Versions already
+   obtained lawfully under an earlier active subscription remain usable
+   indefinitely; lapsing only stops access to new releases, it does not disable
+   what you already have.
+
+5. ACCEPTABLE USE
+
+   This software is licensed for lawful automation of systems you own or are
+   authorised to access — testing, monitoring, authorised data collection, and
+   management of accounts you control under terms you are entitled to accept. It
+   is not licensed for unauthorised access, fraud, or circumventing controls you
+   have no right to circumvent. OpenOnion may terminate a licence for use in
+   breach of this section.
+
+6. NO WARRANTY
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. Detection and
+   anti-detection are adversarial and change continuously; no representation is
+   made that any particular site will accept traffic driven by this software.
+
+7. LIMITATION OF LIABILITY
+
+   IN NO EVENT SHALL OPENONION BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
+   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM
+   OR IN CONNECTION WITH THE SOFTWARE OR ITS USE.
+
+8. THIRD-PARTY COMPONENTS
+
+   This software depends on Playwright (Apache-2.0, Copyright (c) Microsoft
+   Corporation), which it uses through its public API without modification.
+   Playwright is not distributed as part of this software and remains governed by
+   its own licence.
+
+Contact: info@openonion.ai

onionwright-0.0.1/PKG-INFO

@@ -0,0 +1,108 @@
+Metadata-Version: 2.4
+Name: onionwright
+Version: 0.0.1
+Summary: Humanized input for browser automation
+Project-URL: Homepage, https://openonion.ai
+Project-URL: Documentation, https://docs.connectonion.com
+Author-email: OpenOnion <info@openonion.ai>
+License: onionwright Commercial Licence
+        Copyright (c) 2026 OpenOnion. All rights reserved.
+        
+        NOT OPEN SOURCE. This software is proprietary and is licensed, not sold.
+        
+        NOTE: This text has not been reviewed by a lawyer. It states the intent agreed for
+        the product and is a drafting starting point, not final terms. Review before the
+        first paid release.
+        
+        1. GRANT
+        
+           Subject to an active subscription at the tier designated by OpenOnion, you are
+           granted a non-exclusive, non-transferable, revocable licence to install and use
+           this software for your own purposes, personal or commercial, on systems you
+           control.
+        
+        2. RESTRICTIONS
+        
+           You may not:
+        
+           a. Redistribute this software, in whole or in part, modified or unmodified.
+           b. Resell, sublicense, rent, lease, or repackage it.
+           c. Reverse engineer, decompile, or disassemble it, or attempt to derive its
+              source, except to the extent applicable law expressly permits despite this
+              restriction.
+           d. Remove or alter any copyright, licence, or attribution notice.
+           e. Share licence credentials, or use one licence across more concurrent
+              sessions than your tier permits.
+        
+        3. OEM / SAAS
+        
+           A separate written agreement is required where this software is bundled,
+           embedded, exposed through an API, or otherwise used to provide functionality to
+           third-party customers. No subscription tier grants redistribution, resale,
+           sublicensing, bundling, embedding, hosted-service, white-label, OEM, or SaaS
+           rights unless expressly stated in a separate agreement.
+        
+        4. VERSIONS AND CONTINUITY
+        
+           The latest major version requires an active subscription. Versions already
+           obtained lawfully under an earlier active subscription remain usable
+           indefinitely; lapsing only stops access to new releases, it does not disable
+           what you already have.
+        
+        5. ACCEPTABLE USE
+        
+           This software is licensed for lawful automation of systems you own or are
+           authorised to access — testing, monitoring, authorised data collection, and
+           management of accounts you control under terms you are entitled to accept. It
+           is not licensed for unauthorised access, fraud, or circumventing controls you
+           have no right to circumvent. OpenOnion may terminate a licence for use in
+           breach of this section.
+        
+        6. NO WARRANTY
+        
+           THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+           IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+           FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. Detection and
+           anti-detection are adversarial and change continuously; no representation is
+           made that any particular site will accept traffic driven by this software.
+        
+        7. LIMITATION OF LIABILITY
+        
+           IN NO EVENT SHALL OPENONION BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
+           LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM
+           OR IN CONNECTION WITH THE SOFTWARE OR ITS USE.
+        
+        8. THIRD-PARTY COMPONENTS
+        
+           This software depends on Playwright (Apache-2.0, Copyright (c) Microsoft
+           Corporation), which it uses through its public API without modification.
+           Playwright is not distributed as part of this software and remains governed by
+           its own licence.
+        
+        Contact: info@openonion.ai
+License-File: LICENSE
+Keywords: automation,browser,human,input,playwright
+Classifier: Intended Audience :: Developers
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.9
+Requires-Dist: playwright>=1.55
+Description-Content-Type: text/markdown
+
+# onionwright
+
+Humanized input for browser automation — a commercial layer over Playwright that
+makes automated interaction behave like a person using the browser.
+
+**This is a placeholder release. There is no implementation in this version.**
+
+onionwright is proprietary software distributed under a commercial licence, not
+from this index. This entry reserves the name and points at the product.
+
+- Product: https://openonion.ai
+- Docs: https://docs.connectonion.com
+- Licensing enquiries: info@openonion.ai
+
+Licensed, not sold. Redistribution, resale, and reverse engineering are not
+permitted. See the LICENSE included in the distribution.

onionwright-0.0.1/README.md

@@ -0,0 +1,94 @@
+# onionwright
+
+Humanized input for browser automation. A drop-in layer over Playwright's public
+API that makes automated interaction statistically indistinguishable from a person
+using the browser.
+
+**Status: scaffold.** No implementation yet — the repo exists so the name, the
+licence, and the release path are settled before code lands. Work is tracked in
+issues.
+
+## Positioning
+
+> Patchright makes you look like a real browser.
+> onionwright makes you *act* like a real person.
+
+[Patchright](https://github.com/Kaliiiiiiiiii-Vinyzu/patchright) (Apache-2.0, free,
+and what OpenOnion's free tier uses) fixes **static** automation tells: the
+`Runtime.enable` CDP leak, detectable launch flags, the `__playwright__binding__`
+global. It does not touch timing or behaviour at all.
+
+Measured on stock Playwright 1.55 driving Chrome 150 (`harness/measure.py`):
+
+| signal | stock Playwright | human |
+|---|---|---|
+| keystroke flight (keyup → next keydown) | **2.8 ms** | 200–400 ms |
+| keystroke hold, standard deviation | **0.7 ms** | tens of ms |
+| click hold (mousedown → mouseup) | **0.4 ms** | 60–150 ms |
+| hover → press dwell | **0.45 ms** | hundreds of ms |
+| mouse path | exact linear interpolation — every step `movementX` 11–12, zero acceleration | jerk-limited, with corrective submovements |
+
+`page.keyboard.type(delay=80)` sets key **hold** time, not flight time. That is
+why flights come out at 2.8 ms: nothing in Playwright's API controls the interval
+a detector actually measures.
+
+These are different layers, not competing products. The free tier keeps Patchright.
+
+## Where this sits
+
+```
+free   playwright    + stock Chrome
+paid   onionwright   + onion browser (patched Chromium)
+```
+
+onionwright ships first: it works against stock Chrome, so it needs no build
+infrastructure and is useful before a single Chromium patch exists. The patched
+browser ([openonion/browser](https://github.com/openonion/browser)) covers what no
+driver-level layer can reach — TLS/JA3, HTTP/2 framing, and fingerprint surfaces
+that live below the script layer.
+
+## Design commitments
+
+**On top of Playwright, never inside it.** onionwright calls `page.mouse.move()`
+and friends through the public API. It does not patch Playwright's internals, so
+there is no AST surgery, no per-release rebase treadmill, and no inherited test
+failures. Playwright upgrades do not break us. (Patchright takes the other route —
+~4,900 lines of ts-morph rewriting against a fresh upstream tree — and pays ~70
+failing Playwright tests for it, including Console being entirely dead.)
+
+**Distributions, not paths.** Detectors compare moments of empirical distributions,
+not screenshots. DataDome's payload ships sigma/mu and angle medians; Unbotify's
+patent (US 2017/0185758 A1) describes histogram comparison against references. A
+trajectory that looks human and has the wrong variance is not an improvement, so
+`harness/` asserts on distributions.
+
+**Bézier is a signature, not a defence.** Cloudflare's Precursor launch names the
+tell directly: bots produce "linear interpolations or mathematically ideal Bézier
+curves". BeCAPTCHA-Mouse (*Pattern Recognition*, 2022) trained a GAN reproducing
+human traits and a plain random forest still detected it. Every open-source
+humanizer is Bézier-plus-easing, which is roughly 2020 state of the art. Our core
+is a biomechanical model instead — minimum-jerk (Flash & Hogan 1985) with
+optimized submovements (Meyer et al. 1988), so overshoot-and-correct emerges from
+the model rather than being bolted on as a random branch.
+
+## harness/
+
+The measurement instrument, not the product. Serves an instrumented page over
+`http://127.0.0.1` (a secure context, so `pointerrawupdate` and
+`getCoalescedEvents` behave as they do in production — on `about:blank` they
+silently disappear, which is the likely origin of several widely repeated false
+claims about CDP).
+
+```
+python3 harness/measure.py              # system Chrome via channel="chrome"
+python3 harness/measure.py --bundled    # Playwright's bundled Chromium
+```
+
+Run it before writing any humanization code: the numbers above are the baseline
+every change is measured against.
+
+## Licence
+
+Proprietary and commercial — see [`LICENSE`](LICENSE). This is not open source.
+Distribution is gated on an active licence
+([openonion/browser#6](https://github.com/openonion/browser/issues/6)).

onionwright-0.0.1/harness/measure.py

@@ -0,0 +1,167 @@
+"""Measure the input-timing distributions a driver actually produces.
+
+Run against stock Playwright to get the baseline every humanization change is
+measured against. The point is distributions, not paths: detectors compare
+moments of empirical distributions (DataDome ships sigma/mu/angle medians;
+Unbotify's patent describes histogram comparison), so a trajectory that looks
+human in a screenshot but has the wrong variance is not an improvement.
+
+    python3 harness/measure.py                # stock playwright, system Chrome
+    python3 harness/measure.py --bundled      # playwright's bundled Chromium
+
+Served over http://127.0.0.1 rather than set_content(): localhost is a secure
+context, so pointerrawupdate and getCoalescedEvents behave as they would in
+production. On about:blank they silently disappear.
+"""
+
+import argparse
+import functools
+import http.server
+import json
+import math
+import statistics
+import threading
+from pathlib import Path
+
+from playwright.sync_api import sync_playwright
+
+HERE = Path(__file__).parent
+PORT = 8931
+
+
+def serve():
+    handler = functools.partial(http.server.SimpleHTTPRequestHandler, directory=str(HERE))
+    handler.log_message = lambda *a: None
+    server = http.server.ThreadingHTTPServer(("127.0.0.1", PORT), handler)
+    threading.Thread(target=server.serve_forever, daemon=True).start()
+    return server
+
+
+def drive(page):
+    """One scenario: move to the field, type, then move to the button and click."""
+    page.mouse.move(60, 60)
+    page.click("#field")
+    page.keyboard.type("hello world", delay=80)
+    page.mouse.move(480, 344, steps=25)
+    page.click("#target")
+
+
+def spans(events, down, up, key=lambda e: None):
+    """Durations from each `down` to the matching `up`, in ms."""
+    open_at = {}
+    out = []
+    for e in events:
+        if e["type"] == down:
+            open_at[key(e)] = e["t"]
+        elif e["type"] == up and key(e) in open_at:
+            out.append(e["t"] - open_at.pop(key(e)))
+    return out
+
+
+def flights(events):
+    """keyup -> next keydown, in ms. The interval Playwright's `delay` does NOT set."""
+    out = []
+    last_up = None
+    for e in events:
+        if e["type"] == "keyup":
+            last_up = e["t"]
+        elif e["type"] == "keydown" and last_up is not None:
+            out.append(e["t"] - last_up)
+    return out
+
+
+def describe(name, values, human):
+    """Median leads: one setup gap (the click before typing) skews the mean badly
+    at these sample sizes, and it is the steady-state interval we care about."""
+    if not values:
+        print(f"  {name:<26} (none observed)")
+        return
+    print(f"  {name:<26} n={len(values):<3} median={statistics.median(values):8.2f}ms  "
+          f"mean={statistics.mean(values):8.2f}  sd={statistics.pstdev(values):7.2f}  human≈{human}")
+
+
+def longest_run(events):
+    """The longest unbroken stretch of mousemove events.
+
+    A scenario contains both teleports (page.click jumps straight to the target)
+    and travelled paths. Mixing them makes a teleport look like curvature, which
+    flatters the straightness index. Measure one journey at a time.
+    """
+    # pointermove/pointerrawupdate interleave with every mousemove and must stay
+    # transparent here, or every run is length 1.
+    transparent = {"pointermove", "pointerrawupdate", "mouseover"}
+    runs, current = [], []
+    for e in events:
+        if e["type"] in transparent:
+            continue
+        if e["type"] == "mousemove":
+            current.append(e)
+        elif current:
+            runs.append(current)
+            current = []
+    runs.append(current)
+    return max(runs, key=len)
+
+
+def path_metrics(moves):
+    """Straightness and velocity variability over a mouse path."""
+    pts = [(m["clientX"], m["clientY"], m["t"]) for m in moves]
+    if len(pts) < 3:
+        print(f"  path                       only {len(pts)} move events — no path to measure")
+        return
+    step = [math.dist(pts[i][:2], pts[i + 1][:2]) for i in range(len(pts) - 1)]
+    gap = [pts[i + 1][2] - pts[i][2] for i in range(len(pts) - 1)]
+    direct = math.dist(pts[0][:2], pts[-1][:2]) or 1
+    speeds = [d / g for d, g in zip(step, gap) if g > 0]
+    cov = statistics.pstdev(speeds) / statistics.mean(speeds) if speeds else 0
+    print(f"  path                       n={len(pts)} moves")
+    print(f"    straightness index       {sum(step) / direct:.4f}      human≈1.02–1.5, bot→1.0000")
+    print(f"    velocity CoV             {cov:.4f}      human>0.4")
+    print(f"    step length sd           {statistics.pstdev(step):.4f}      0 means linear interpolation")
+    print(f"    inter-event gap          mean={statistics.mean(gap):.2f}ms sd={statistics.pstdev(gap):.2f}"
+          f"   real mice quantize to 8ms@125Hz")
+
+
+def main():
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--bundled", action="store_true", help="use Playwright's bundled Chromium")
+    args = ap.parse_args()
+
+    serve()
+    with sync_playwright() as p:
+        launch = {"headless": False} if args.bundled else {"headless": False, "channel": "chrome"}
+        browser = p.chromium.launch(**launch)
+        page = browser.new_page()
+        page.goto(f"http://127.0.0.1:{PORT}/page.html")
+        drive(page)
+        events = page.evaluate("window.__events")
+        ctx = page.evaluate("window.__ctx")
+        version = browser.version
+        browser.close()
+
+    print(f"\nengine       {'bundled chromium' if args.bundled else 'system chrome'} {version}")
+    print(f"context      secure={ctx['isSecureContext']} coalescedAPI={ctx['hasCoalesced']} "
+          f"webdriver={ctx['webdriver']}")
+
+    mouse = [e for e in events if e["type"] == "mousemove"]
+    leak = sum(1 for e in mouse if e["clientX"] == e["screenX"] and e["clientY"] == e["screenY"])
+    print(f"screen/client coords         {leak}/{len(mouse)} identical "
+          f"(brotector Input.cordinatesLeak; fixed upstream ~Chrome 142)")
+    print(f"isTrusted                    all={all(e['trusted'] for e in events)}")
+
+    print("\nkeyboard")
+    describe("hold (keydown->keyup)", spans(events, "keydown", "keyup", lambda e: e["code"]), "60–150ms, sd tens")
+    describe("flight (keyup->keydown)", flights(events), "200–400ms")
+
+    print("\nmouse")
+    describe("click hold (down->up)", spans(events, "mousedown", "mouseup"), "60–150ms")
+    dwell = spans(events, "mouseover", "mousedown", lambda e: e.get("target"))
+    describe("hover->press dwell", dwell, "hundreds of ms")
+    path_metrics(longest_run(events))
+
+    Path(HERE / "last-run.json").write_text(json.dumps(events, indent=1))
+    print(f"\nraw events -> {HERE / 'last-run.json'}\n")
+
+
+if __name__ == "__main__":
+    main()

onionwright-0.0.1/harness/page.html

@@ -0,0 +1,70 @@
+<!doctype html>
+<meta charset="utf-8">
+<title>input measurement harness</title>
+<style>
+  body { font: 14px system-ui; margin: 40px; }
+  #target { width: 160px; height: 48px; margin-top: 300px; margin-left: 400px; }
+  #field { width: 300px; padding: 8px; }
+</style>
+
+<h1>input measurement harness</h1>
+<p>Records raw input events for distribution analysis. Nothing here is stealth
+   logic — this is the instrument, not the thing being measured.</p>
+
+<input id="field" placeholder="typing target">
+<button id="target">click target</button>
+
+<script>
+// One flat event log. Analysis happens in Python, where the distribution work
+// belongs — this file only needs to observe without perturbing timing.
+window.__events = [];
+
+function record(e) {
+  const r = {
+    type: e.type,
+    t: e.timeStamp,
+    trusted: e.isTrusted,
+  };
+  if (e instanceof MouseEvent) {
+    Object.assign(r, {
+      clientX: e.clientX, clientY: e.clientY,
+      screenX: e.screenX, screenY: e.screenY,
+      movementX: e.movementX, movementY: e.movementY,
+      buttons: e.buttons, detail: e.detail,
+      target: e.target.id || null,
+    });
+  }
+  if (e instanceof PointerEvent) {
+    Object.assign(r, {
+      pointerId: e.pointerId, pointerType: e.pointerType,
+      pressure: e.pressure, tiltX: e.tiltX, tiltY: e.tiltY,
+      // Coalescing is how real pointer streams arrive; a driver that emits one
+      // discrete event per move never produces a group here.
+      coalesced: e.getCoalescedEvents ? e.getCoalescedEvents().length : -1,
+    });
+  }
+  if (e instanceof KeyboardEvent) {
+    Object.assign(r, { key: e.key, code: e.code, repeat: e.repeat });
+  }
+  window.__events.push(r);
+}
+
+for (const type of [
+  'mousemove', 'mousedown', 'mouseup', 'click', 'mouseover',
+  'pointermove', 'pointerrawupdate', 'pointerdown', 'pointerup',
+  'keydown', 'keyup', 'wheel',
+]) {
+  window.addEventListener(type, record, { capture: true, passive: true });
+}
+
+// Secure-context gate check. pointerrawupdate and getCoalescedEvents are only
+// available in a secure context; testing on about:blank or a data: URL makes
+// them look absent and produces wrong conclusions.
+window.__ctx = {
+  isSecureContext: window.isSecureContext,
+  hasCoalesced: typeof PointerEvent.prototype.getCoalescedEvents === 'function',
+  webdriver: navigator.webdriver,
+  outerInnerDelta: window.outerHeight - window.innerHeight,
+  screen: { x: window.screenX, y: window.screenY },
+};
+</script>

onionwright-0.0.1/packaging/README-pypi.md

@@ -0,0 +1,16 @@
+# onionwright
+
+Humanized input for browser automation — a commercial layer over Playwright that
+makes automated interaction behave like a person using the browser.
+
+**This is a placeholder release. There is no implementation in this version.**
+
+onionwright is proprietary software distributed under a commercial licence, not
+from this index. This entry reserves the name and points at the product.
+
+- Product: https://openonion.ai
+- Docs: https://docs.connectonion.com
+- Licensing enquiries: info@openonion.ai
+
+Licensed, not sold. Redistribution, resale, and reverse engineering are not
+permitted. See the LICENSE included in the distribution.

onionwright-0.0.1/pyproject.toml

@@ -0,0 +1,35 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "onionwright"
+version = "0.0.1"
+description = "Humanized input for browser automation"
+# NOT the repo README. That one is internal: it carries the positioning, the
+# measured competitive baseline, and links to private repos that would 404 for
+# everyone reading PyPI. What ships to a public index is the minimal one.
+readme = "packaging/README-pypi.md"
+requires-python = ">=3.9"
+license = { file = "LICENSE" }
+authors = [{ name = "OpenOnion", email = "info@openonion.ai" }]
+keywords = ["playwright", "automation", "browser", "human", "input"]
+
+# Proprietary. The trove classifier matters: PyPI shows it on the project page,
+# and it is the difference between a developer assuming they can vendor this and
+# knowing they cannot.
+classifiers = [
+  "License :: Other/Proprietary License",
+  "Programming Language :: Python :: 3",
+  "Topic :: Software Development :: Testing",
+  "Intended Audience :: Developers",
+]
+
+dependencies = ["playwright>=1.55"]
+
+[project.urls]
+Homepage = "https://openonion.ai"
+Documentation = "https://docs.connectonion.com"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/onionwright"]

onionwright-0.0.1/src/onionwright/__init__.py

@@ -0,0 +1,7 @@
+"""onionwright — humanized input for browser automation.
+
+Placeholder release. The package name is reserved; the implementation is tracked
+in https://github.com/openonion/onionwright/issues
+"""
+
+__version__ = "0.0.1"