`cloakbrowser info` printed a bare seat count with no denominator, so a
customer could not tell whether they were at capacity (#513). It also
collapsed six distinct outcomes into one "unavailable": unreachable,
timeout, invalid key, inactive licence, rate limited, and the server
reporting the count as unknown while degraded.
Adds SessionSeats (active, limit, state, reason) and getSessionSeats to
all three wrappers; get_active_session_count keeps its signature and
delegates. The limit is read from the server, never derived from the plan
name, and falls back to the old bare count when absent.
Python, JS and .NET renderers verified byte-identical.
Humanized actions could fail with an element-not-attached error after a
navigation driven by a click or form submit, since the checks only refreshed
on goto. Now refresh on any main-frame navigation. Python, JS
Playwright/Puppeteer, and .NET. Regression from 0.5.6.
A fully-visible element above/below the target zone on a page pinned at
that boundary can never reach the zone, so the scroll loop ran the full
budget (~7s/click) doing nothing. Bail when it's fully visible and the
page can't scroll toward the zone. Ported to JS, Python (sync+async),
and .NET with regression tests.
Forward caller-provided press delays through humanized page, frame, locator, element handle, and keyboard paths across Python, JavaScript, and .NET.
Use each automation library's native press operation for shortcut chords while retaining the existing humanized pre-press timing and focus behavior.
Ports the Python/JS stealth_dom fix to the .NET wrapper. Add StealthDom.cs:
reimplements the common Playwright selector grammar (css, :has-text, text=,
xpath=, trailing >> nth=N) for direct DOM resolution in the isolated execution
context, with a fallback to the regular Playwright read for unsupported grammar.
World reads are wrapped so a world/CDP failure falls back rather than propagating.
The pre-click actionability, scroll geometry, viewport, and pointer-events reads
now go through it. .NET hooks the humanized click at the locator layer with no
selector string, so page.Locator(selector) now threads the selector into
LocatorHumanizer, whose reads use the isolated world when the selector is known
(else Playwright). HumanPage's selector path is wired the same way. GetBy*/chained
locators fall back to Playwright; ElementHandle and sub-frame paths unchanged.
Tests: StealthDom builders + a Node-driven check of the shipped resolver JS
selector semantics (byte-identical to the other wrappers), and a guard that
page.Locator(selector) threads the selector into the humanized locator.
- humanize frames created after page load across Python and JavaScript\n- keep sync, async, Playwright, and Puppeteer paths idempotent\n- wrap .NET frame lifecycle event payloads without raw frame leaks\n- add cross-wrapper unit and browser regression coverage
context.NewCDPSessionAsync(page) threw NullReferenceException for any licensed
.NET user: Playwright down-casts the IPage/IFrame argument to its concrete
Page/Frame to read .Guid, which fails on the CloakBrowser proxy the wrapper
returns. The license-guard proxy (all licensed launches) and the humanize
decorator both produced a handle that fails that cast.
- guard proxy unwraps page/frame/handle arguments before forwarding, keeps
page.Context guarded, and Wrap() is idempotent
- HumanizedBrowserContext.NewCDPSessionAsync unwraps its argument (covers the
keyless+humanize path with no guard proxy)
- HumanizedPage.Context re-wraps so page.Context stays humanized
- public Humanize.Unwrap(page/frame) escape hatch
- regression tests build the guard proxy and assert the inner receives raw
Wire the existing launch()-time geoip resolver into the info/doctor command
across Python, JS, and .NET. With --proxy, info resolves the exit IP and the
timezone/locale a launch would apply (caching the GeoIP DB if absent) and prints
them in text and --json. Plain info is unchanged (no network) and now hints at
the flag. Adds diagnostics tests in all three suites.
An element scrolled into view can be pushed off screen again while we wait
for a reflowing page to settle. Nothing scrolled a second time, so the click
was dispatched outside the viewport and hit nothing, with no error raised.
Also stop the pointer-events check from turning a confirmed miss back into
'undetermined' when a late probe times out, which let that click through.
Measured on a page reflowing 10-25s: silent miss at ~32s before, clean click
now. Static pages and pages reflowing past the timeout are unchanged.
A concurrent-session denial resolves after the CDP handshake, so the browser
exits with a live connection already established. The launch-failure path never
sees it and the user gets a bare TargetClosedError on their first call (#477).
The binary records the license exit code (76-79) to a per-launch file whose path
the wrapper passes via CLOAKBROWSER_LICENSE_STATUS_FILE. The wrapper reads it
when a guarded call throws and re-raises the correct CloakBrowserLicenseError.
Discrimination is on the file, not the error type, so a genuine crash is never
mislabelled. Fail-safe (no key or unwritable dir -> feature off) and
backward-compatible (old binaries never write the file).
Guarded surfaces: new_page/new_context, a persistent context's already-open
pages (goto + the wait family), and Puppeteer user-created contexts. Orphaned
denial files are swept at mint time; an observed code is cached in-process so a
concurrent second call can't miss it; the .NET reader parses as tolerantly as
Python/JS.
Implemented across Python, JavaScript (Playwright + Puppeteer), and .NET, with
unit tests. Reproduced end-to-end with a real over-cap denial.
Playwright's launch defaults switch off a feature stock Chrome ships enabled.
When the Windows font-metrics profile is requested, re-enable it so the feature
set matches a real browser rather than a test harness. Merged into any existing
--enable-features value instead of appending a second flag.
Python, JS and .NET wrappers.
Chromium only handles --version on POSIX, so on Windows the switch is
ignored and a browser starts instead of printing. The 10s probe then
timed out and a healthy install was reported as broken, flashing a
window on screen each run.
Probe with --no-startup-window there: it exits immediately, opens no
window, and a broken binary still exits non-zero. No version is
reported on Windows, as nothing is printed. Linux and macOS unchanged.
Test uses a stub that hangs unless the flag is passed, mirroring the
real binary rather than a print-and-exit stub.
Add a preview release channel system to all wrappers (Python, JavaScript, .NET),
allowing users to opt into newer binary builds before they go stable.
- Python: preview/stable channel resolution in download, launch, CLI
(install, update, clear-cache), and license validation
- JavaScript: preview/stable channel in CLI, launch, license, and config
- .NET: preview/stable channel in CLI, license, diagnostics, and config
- All wrappers: channel fallback indicator, auto-update gate,
CLOAKBROWSER_RELEASE_CHANNEL env var support
- Harden channel resolution: reuse the resolution sidecar on offline lookups,
defensive marker/JSON parsing, atomic version-marker writes, a launch-time
preview-to-stable fallback notice, channel-aware info download URL, and
Python/JS/.NET parity for the fallback default
- Binary 150.0.7871.114.4 changelog (Linux x64 + arm64)
- Updated READMEs, CHANGELOG, and tests for all wrappers
cloakbrowser login gets a free key via GitHub sign-in (or saves a paid key); logout reverts. Launch banner and info are now tier-aware (keyless / free / pro). A free key drops any version pin so it always gets the latest build (server force-serves latest; a pinned manifest would fail checksum). Python, JS, and .NET kept in sync. README documents the free tier + commands.
A raw --fingerprint-timezone/--lang/--fingerprint-locale in args is now
promoted to an explicit value in maybe_resolve_geoip, so geoip only fills
the values the user did not set. Mirrors the timezone=/locale= param path.
Python, JS, and .NET, with tests.
geoip.py used Path.rename which cannot overwrite on Windows, so a stale
DB never refreshed and every launch re-downloaded ~70 MB in a loop. No
lock meant concurrent launches each fired their own download.
- Python: os.replace + threading.Lock (initial + background paths)
- .NET: File.Move(overwrite) + SemaphoreSlim guard
- JS: shared in-flight promise (rename already overwrites)
- tests: overwrite + concurrent single-download coverage
pyproject: bump classifier to Production/Stable
Points the READMEs at 150 as the latest Pro binary (71 patches, all five
platforms) and bumps the Pro major in the launch banner and the info
upgrade hint across Python, JS, and .NET.
A Pro license now gets a "Sessions: N seats in use" line, answering
"how many sessions do I have running?" without asking support.
Never cached (a cached count is a wrong count), skipped under --quick to
keep `info` network-free, and prints "unavailable" rather than a made-up
number when the count cannot be determined.
Python, JS and .NET.
The Pro binary exits with a distinct code per license failure; the wrappers ignored it, so a user got a bare "browser closed" error with no reason.
Add CloakBrowserLicenseError plus a launch-error parser that maps the exit code to a clear message, mirrored across the Python, JS, and .NET wrappers. Non-license failures pass through unchanged.
Route authenticated HTTP/HTTPS proxies through the browser's native proxy
authentication only on binaries that support it, resolved per platform and
binary version via a capability gate (sibling to the existing viewport and
window-geometry gates). Older binaries, including the free macOS and ARM
builds, fall back to the standard Playwright proxy path instead of emitting
credentials the binary cannot parse, so authenticated proxies keep working on
macOS and ARM instead of silently failing. Applied across the Python,
JavaScript, Puppeteer, and .NET wrappers.
Free-tier launch banner and 'cloakbrowser info' upgrade hint now advertise
the 7-day free Pro trial (Chromium 148) across Python, JS, and .NET; same
CTA added to both READMEs. Also surface binary verification failures verbatim
instead of falling back to a cached build (transient-only fallback).
info now shows the cached build that will launch AND the server's latest
Pro version on separate lines, so the two can no longer silently diverge
(a customer saw info report latest while launch ran a stale cache).
- Pro version resolution: unpinned launch prefers the server latest when it
is newer than or replaces a missing cached build, else stays on cache;
advances the version marker so info and later offline launches match.
- update command is license-aware: a valid Pro key updates the Pro binary,
everyone else updates free.
- Replace the fire-and-forget Pro background update thread with a foreground
rate-limited check (one network call/hour), honoring CLOAKBROWSER_AUTO_UPDATE=false.
- A valid Pro license never falls back to the free binary: get_effective_version
returns None when no Pro build is cached; resolution fails loudly instead.
- Tampering signal (BinaryVerificationError) surfaces verbatim on the unpinned
upgrade path — the cached-Pro fallback is only for transient download failures.
- get_effective_version(pro) requires the binary be executable, so info can't
report a build launch would reject.
- info --quick stays network-free (skips the server latest lookup); prints a
'not downloaded yet' line instead of 'None' when offline with no cache.
- Align the JS .last_update_check marker to seconds (Python/.NET parity).
- Mirror across Python, JS, and .NET wrappers; add update/CLI tests.
Windows font check now covers the full 8-font set (adds the two monospace
fonts) and reports a strict N/8 count; the launch-time warning fires on any
incomplete set, not just when none are present. Adds a separate Office-font
group (10 fonts) reported as an informational N/10 with no install nudge.
Ported across all three wrappers (Python, JS, .NET) to keep them in sync.
Follow-up fixes for the geoip-no-proxy and start-maximized commits:
- geoip: resolve the egress IP before the DB check so a DB-download failure
still yields the WebRTC exit IP — the proxy WebRTC spoof survives a DB hiccup
- geoip: skip the exit-IP echo call on no-proxy + explicit tz/locale (the WebRTC
IP would just be the real connection IP the site already sees — a no-op)
- launch_context: suppress auto --start-maximized when the caller set an explicit
viewport, matching JS across Python and .NET
- docker: poll for X readiness before starting openbox instead of a blind sleep
(avoids a silent window-manager startup race)
- refactor: extract the WebRTC exit-IP append into one helper per wrapper
- remove a dead isPrivateIp in the JS wrapper
- tests: fix stale no-proxy geoip assertions; add launch_context parity + .NET
geoip coverage
Python, JS and .NET wrappers kept in parity.
Default headed and headless launches to a maximized window (fills the
screen) on binaries at or above the same threshold as the headless
no-viewport default. Suppressed when the caller sets --window-size /
--window-position / --start-maximized or an explicit viewport; older
builds are unchanged. Version-gated via a dedicated helper sharing the
no-viewport threshold. Mirrored across Python, JS and .NET with parity tests.
The Docker image runs openbox so headed --start-maximized is honored
(bare Xvfb has no window manager; headless is unaffected).
When geoip=True and no proxy is set, resolve the machine's own public IP
directly (echo services, no proxy) and use it for timezone, locale, and the
WebRTC exit IP — same path as the proxied case. Previously geoip no-oped
without a proxy, leaving UTC + en-US in bare Docker/cloud launches.
Expand COUNTRY_LOCALE_MAP from 50 to 132 countries across all three wrappers
(Python, JS, .NET) so far more egress IPs resolve a locale.
Mirrored in cloakbrowser/, js/src/, and dotnet/. Tests added for the no-proxy
resolution path.
Headed launches already skip Playwright's emulated viewport (no_viewport)
because a fixed CDP viewport on a real window forces outerWidth < innerWidth,
a physically impossible geometry that's a bot tell. Headless historically kept
a fixed DEFAULT_VIEWPORT since there's no window chrome to make coherent
without emulation — but a newer Chromium build (>=148.0.7778.215.4) now
reports coherent dimensions in headless too, so it can drop the emulated
viewport the same way headed does.
Added binary_supports_headless_no_viewport() (mirrored in Python, JS, .NET) to
gate this per resolved binary version: local overrides with no declared
version stay on the old fixed-viewport path (unknown version = safe default),
while an explicit browser_version/CLOAKBROWSER_VERSION always wins so internal
builds can opt in. HEADLESS_NO_VIEWPORT_MIN_VERSION is currently set to a
version that hasn't shipped yet, so this is a no-op until that build is live —
behavior is byte-identical to today for every existing binary.
- Pass the resolved license key via environment (CLOAKBROWSER_LICENSE_KEY)
when launching the Chromium binary so the Pro binary can authenticate.
- Inject key when a custom user_env is provided with default file source:
Playwright replaces (not merges) the child env, which can drop HOME and
prevent the binary from finding ~/.cloakbrowser/license.key.
- Normalize user_env by filtering None/undefined values consistently across
Python, JS, and .NET wrappers.
- Add HomeDirOverride test seam to the .NET wrapper for cache path mocking.
info (plus a doctor alias) now reports the binary that will actually
launch for the resolved license instead of whatever is cached on disk:
it resolves and validates the license, shows the real tier, and on a
keyless or invalid key reports the free binary. Adds a launch test
(chrome --version) with a Linux missing-shared-library probe, a
Windows-font check (Linux only), GeoIP DB presence, and optional-dep
checks. --quick skips the launch test; --json emits machine output.
Python, JS, and .NET, with tests.
One-time, suppressible startup warning when spoofing Windows on a Linux host
with no Windows fonts detected (fc-list probe of the documented base set),
across Python, JS, and .NET. The first-launch banner now re-shows to free
users every 3 days; Pro users still see it once.
CloakHQ