sleight 0.1.0a1__tar.gz

sleight-0.1.0a1/.gitignore

@@ -0,0 +1,32 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+
+# 虚拟环境
+.venv/
+venv/
+
+# 工具缓存
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/
+.coverage
+htmlcov/
+
+# 编辑器 / IDE —— 里面是开发机的绝对路径
+.idea/
+.vscode/
+
+# 本机的 Claude Code 配置（.claude/settings.json 这类共享配置仍然入库）
+.claude/settings.local.json
+
+# 凭据
+.env
+*.pem
+*.key
+
+# scripts/plot_path.py 的输出
+*.png

sleight-0.1.0a1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 sleight contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sleight-0.1.0a1/PKG-INFO

@@ -0,0 +1,158 @@
+Metadata-Version: 2.4
+Name: sleight
+Version: 0.1.0a1
+Summary: Drive any CDP browser like a human — trajectories, typing rhythm, instance leasing.
+Project-URL: Homepage, https://github.com/yuanqimanong/sleight
+Project-URL: Repository, https://github.com/yuanqimanong/sleight
+Project-URL: Issues, https://github.com/yuanqimanong/sleight/issues
+Project-URL: Documentation, https://github.com/yuanqimanong/sleight/blob/main/docs/%E8%AF%A6%E7%BB%86%E6%96%87%E6%A1%A3%E6%89%8B%E5%86%8C.md
+Author: sleight contributors
+License-Expression: MIT
+License-File: LICENSE
+Keywords: automation,browser,cdp,chrome-devtools-protocol,human-like
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: Browsers
+Classifier: Topic :: Software Development :: Testing
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: websocket-client>=1.9
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.6; extra == 'dev'
+Provides-Extra: redis
+Requires-Dist: redis>=5; extra == 'redis'
+Description-Content-Type: text/markdown
+
+# sleight
+
+**Drive any CDP browser like a human.** Bezier trajectories with real hand tremor,
+typing rhythm modelled on keystroke-dynamics research, and exclusive leasing for
+browser instance pools.
+
+Python ≥ 3.11 · one runtime dependency (`websocket-client`) · MIT
+
+📖 **[中文文档手册](docs/详细文档手册.md)** — 安装、快速开始、实战场景、CloakBrowser Manager 部署
+
+```bash
+pip install sleight
+```
+
+## 30 seconds
+
+```python
+from sleight import connect, Text
+
+with connect("http://127.0.0.1:9222") as s:      # opens its own tab, closes it on exit
+    s.open("https://example.com", wait=Text("Example Domain"))
+    print(s.title(), len(s.content()))
+```
+
+With a browser pool that has real profiles behind it:
+
+```python
+from sleight.providers import CloakBrowserManager
+
+mgr = CloakBrowserManager("http://127.0.0.1:19000", token="…")
+
+with mgr.lease() as inst:                    # exclusive lease, released on exit
+    with inst.session(human=True) as s:      # every action gets a human trajectory
+        s.open("https://example.com")
+        s.click("#login")
+        s.type("#email", "user@example.com")
+        s.click("#submit", human=False)      # …except this one, speed matters here
+```
+
+Target one specific profile — by id, by name, or by tag:
+
+```python
+with mgr.lease(instance_id="5edcc28a-…") as inst:            ...
+with mgr.lease(where=lambda i: i.name == "Win-US-02") as inst: ...
+with mgr.lease(where=lambda i: "us" in i.tags) as inst:        ...
+```
+
+Three providers' worth of instances, one logical pool:
+
+```python
+from sleight import Pool
+from sleight.providers import CloakBrowserManager, Plain
+
+pool = Pool([
+    CloakBrowserManager("http://10.0.0.1:9000", token=T1, name="hk"),
+    CloakBrowserManager("http://10.0.0.2:9000", token=T2, name="sg"),
+    Plain("http://127.0.0.1:9222", name="local"),
+])
+
+with pool.lease(where=lambda i: "us" in i.tags) as inst:
+    ...
+```
+
+## Why this exists
+
+Fingerprint-level anti-detection is a solved problem — CloakBrowser patches Chromium
+at the source level, Camoufox patches Firefox. They fix **what the browser looks like**.
+Nothing fixes **how it moves**.
+
+- Playwright and Puppeteer teleport the mouse. `mouse.move(steps=N)` interpolates a
+  **straight line at constant speed** — zero jitter, zero acceleration. That is itself
+  a signature.
+- The browser will not fill in the trajectory for you. Even with a humanize feature
+  enabled browser-side, an external CDP client produces **zero** `mousemove` events
+  between press and release. Measured, not assumed.
+- The good trajectory work lives in JavaScript (`ghost-cursor`). Python ports are
+  thinly maintained.
+- Crawlee for Python's `BrowserPool` [does not support remote browsers](https://github.com/apify/crawlee-python/issues/1743).
+
+sleight fills exactly that gap: **Python + remote CDP + human behaviour + instance leasing.**
+
+## Relationship to Playwright
+
+**Not a replacement — a complement.** sleight is a driver layer, not a framework.
+It deliberately does not do iframes/OOPIF, downloads, video, tracing, or a full
+locator DSL. When you need those, use Playwright.
+
+The interesting part is that you can use both: sleight's `human` module is
+[sans-io](https://sans-io.readthedocs.io/) — it emits `(method, params, sleep_after)`
+tuples and never touches a socket — so it drives a Playwright `CDPSession` just as
+happily as sleight's own transport.
+
+## What makes the motion credible
+
+| | sleight | typical automation |
+|---|---|---|
+| Path shape | cubic Bezier, control points offset to one side | straight line |
+| Micro-motion | WindMouse wind term (correlated tremor) | none, or white noise |
+| Point count | Fitts's law — far small targets take longer | fixed `steps=N` |
+| Landing | truncated Gaussian inside the box | dead centre |
+| Coordinates | integers | floats used as "jitter" |
+| Overshoot | past the target then back, distance-scaled | exact arrival |
+| Typing | per-character events, interval by digraph class | one `insertText` |
+| Scrolling | repeated small `mouseWheel` deltas | one `scrollTo` |
+
+Parameters are not invented. They come from the
+[WindMouse](https://ben.land/post/2021/04/25/windmouse-human-mouse-movement/) physical
+model, [ghost-cursor](https://github.com/Xetera/ghost-cursor)'s Fitts-law point
+budgeting, and published keystroke-dynamics measurements (alternating-hand digraphs
+average 114 ms, same-hand-different-finger 131 ms, same-finger slowest and most
+variable).
+
+## Scope
+
+**Does:** navigation and typed wait conditions · rendered-DOM reads · CSS queries ·
+human mouse / keyboard / wheel · instance discovery across providers · cooperative
+exclusive leasing with TTL renewal · idempotent recovery.
+
+**Does not:** data extraction · scheduling and queues · fingerprint spoofing (that is
+the browser's job) · iframe / OOPIF / Shadow DOM piercing · strict fencing · WebDriver
+BiDi · Firefox.
+
+## Status
+
+`0.1.0a1` — alpha, the API will move. Every release documents its breaking changes.
+
+## License
+
+MIT

sleight-0.1.0a1/README.md

@@ -0,0 +1,129 @@
+# sleight
+
+**Drive any CDP browser like a human.** Bezier trajectories with real hand tremor,
+typing rhythm modelled on keystroke-dynamics research, and exclusive leasing for
+browser instance pools.
+
+Python ≥ 3.11 · one runtime dependency (`websocket-client`) · MIT
+
+📖 **[中文文档手册](docs/详细文档手册.md)** — 安装、快速开始、实战场景、CloakBrowser Manager 部署
+
+```bash
+pip install sleight
+```
+
+## 30 seconds
+
+```python
+from sleight import connect, Text
+
+with connect("http://127.0.0.1:9222") as s:      # opens its own tab, closes it on exit
+    s.open("https://example.com", wait=Text("Example Domain"))
+    print(s.title(), len(s.content()))
+```
+
+With a browser pool that has real profiles behind it:
+
+```python
+from sleight.providers import CloakBrowserManager
+
+mgr = CloakBrowserManager("http://127.0.0.1:19000", token="…")
+
+with mgr.lease() as inst:                    # exclusive lease, released on exit
+    with inst.session(human=True) as s:      # every action gets a human trajectory
+        s.open("https://example.com")
+        s.click("#login")
+        s.type("#email", "user@example.com")
+        s.click("#submit", human=False)      # …except this one, speed matters here
+```
+
+Target one specific profile — by id, by name, or by tag:
+
+```python
+with mgr.lease(instance_id="5edcc28a-…") as inst:            ...
+with mgr.lease(where=lambda i: i.name == "Win-US-02") as inst: ...
+with mgr.lease(where=lambda i: "us" in i.tags) as inst:        ...
+```
+
+Three providers' worth of instances, one logical pool:
+
+```python
+from sleight import Pool
+from sleight.providers import CloakBrowserManager, Plain
+
+pool = Pool([
+    CloakBrowserManager("http://10.0.0.1:9000", token=T1, name="hk"),
+    CloakBrowserManager("http://10.0.0.2:9000", token=T2, name="sg"),
+    Plain("http://127.0.0.1:9222", name="local"),
+])
+
+with pool.lease(where=lambda i: "us" in i.tags) as inst:
+    ...
+```
+
+## Why this exists
+
+Fingerprint-level anti-detection is a solved problem — CloakBrowser patches Chromium
+at the source level, Camoufox patches Firefox. They fix **what the browser looks like**.
+Nothing fixes **how it moves**.
+
+- Playwright and Puppeteer teleport the mouse. `mouse.move(steps=N)` interpolates a
+  **straight line at constant speed** — zero jitter, zero acceleration. That is itself
+  a signature.
+- The browser will not fill in the trajectory for you. Even with a humanize feature
+  enabled browser-side, an external CDP client produces **zero** `mousemove` events
+  between press and release. Measured, not assumed.
+- The good trajectory work lives in JavaScript (`ghost-cursor`). Python ports are
+  thinly maintained.
+- Crawlee for Python's `BrowserPool` [does not support remote browsers](https://github.com/apify/crawlee-python/issues/1743).
+
+sleight fills exactly that gap: **Python + remote CDP + human behaviour + instance leasing.**
+
+## Relationship to Playwright
+
+**Not a replacement — a complement.** sleight is a driver layer, not a framework.
+It deliberately does not do iframes/OOPIF, downloads, video, tracing, or a full
+locator DSL. When you need those, use Playwright.
+
+The interesting part is that you can use both: sleight's `human` module is
+[sans-io](https://sans-io.readthedocs.io/) — it emits `(method, params, sleep_after)`
+tuples and never touches a socket — so it drives a Playwright `CDPSession` just as
+happily as sleight's own transport.
+
+## What makes the motion credible
+
+| | sleight | typical automation |
+|---|---|---|
+| Path shape | cubic Bezier, control points offset to one side | straight line |
+| Micro-motion | WindMouse wind term (correlated tremor) | none, or white noise |
+| Point count | Fitts's law — far small targets take longer | fixed `steps=N` |
+| Landing | truncated Gaussian inside the box | dead centre |
+| Coordinates | integers | floats used as "jitter" |
+| Overshoot | past the target then back, distance-scaled | exact arrival |
+| Typing | per-character events, interval by digraph class | one `insertText` |
+| Scrolling | repeated small `mouseWheel` deltas | one `scrollTo` |
+
+Parameters are not invented. They come from the
+[WindMouse](https://ben.land/post/2021/04/25/windmouse-human-mouse-movement/) physical
+model, [ghost-cursor](https://github.com/Xetera/ghost-cursor)'s Fitts-law point
+budgeting, and published keystroke-dynamics measurements (alternating-hand digraphs
+average 114 ms, same-hand-different-finger 131 ms, same-finger slowest and most
+variable).
+
+## Scope
+
+**Does:** navigation and typed wait conditions · rendered-DOM reads · CSS queries ·
+human mouse / keyboard / wheel · instance discovery across providers · cooperative
+exclusive leasing with TTL renewal · idempotent recovery.
+
+**Does not:** data extraction · scheduling and queues · fingerprint spoofing (that is
+the browser's job) · iframe / OOPIF / Shadow DOM piercing · strict fencing · WebDriver
+BiDi · Firefox.
+
+## Status
+
+`0.1.0a1` — alpha, the API will move. Every release documents its breaking changes.
+
+## License
+
+MIT