jA bdZddlmZddlZddlZddlZddlZddlZddlZddl m Z m Z m Z ddl mZejejdddZd Zd d d d dddddd Zd>dZd?dZd@dAd$Zd@dBd%ZdCdAd'ZdDdEd*ZdFdGd-ZdHd1ZdId2Zdd3dJd6Zd7dd8dKd;Z dLd=Z!dS)MuWhat this session's exit can REALLY do, measured before the launch. ⛔ THIS IS PRODUCT, NOT MEASURING APPARATUS, and the difference shows in one line: what this module answers DECIDES how the browser is configured. It was born on the bench and lived there for a day; that file is now a pointer to this one, because a fact computed in two places drifts. **The rule the owner dictated on 2026-08-25, which simplifies everything:** what is detected BEFORE the browser starts is the truth of the session, and it is absolute for its lifetime. It is not re-checked, drift is not chased, and whether the proxy stays sticky does not matter. Measure once, configure accordingly. ⛔ CAPABILITIES ARE A PROPERTY OF THE GATEWAY, NOT OF THE SESSION, and that is what makes probing them practical. Measured 2026-08-25 over 500 sessions: 95 live peers on one provider all answer `rep=7`, 100 out of 100 on another, and two gateways of the same account share 71 addresses out of 71 while giving DIFFERENT answers. Changing peer does not change the answer; changing gateway does. So it is probed once per endpoint and reused, rather than paying seconds at every launch. Measured cost: 4-19 seconds, once every 24 hours per gateway. ⛔ AND ABSENCE OF PROOF ALWAYS FALLS ON THE CAUTIOUS SIDE. If the probe does not answer, or answers ambiguously, the configuration is the usual one. A capability is only exploited once it is DEMONSTRATED, because erring in that direction costs the worst sentence a detector can write: measured by reading a real detector's code, a browser that emits no candidates is given "Javascript is manipulated" instead of "VPN detected". No function here ever prints a credential. ) annotationsN)AnyDictOptional)urlparseTEMPz/tmpzexit_capability.jsoniQokzgeneral failurez not allowedznetwork unreachablezhost unreachablezconnection refusedz ttl expiredzcommand not supportedzaddress type not supported) ruserstrsecretreturn Optional[str]c<|d|d}t|dks |ddkrdS|ddkr||}}|dt t|gz|zt t|gz|z|d}t|dks |ddkrdSn|dd krd SdS) Nsr rrznot a SOCKS5 greetingr zauthentication refusedz#no acceptable authentication method)sendallrecvlenencodebytes)srrrupas JC:\Projects\Muse2API\.venv\Lib\site-packages\invisible_core/_capability.py _greet_socks5r%=sIIo q A 1vv{{adaii&&tqyy{{}}fmmoo1 'E3q66(OO+a/%Q//AAEFFF FF1II q66Q;;!A$!))++$ 144 4hostportint Optional[int]c>|}|dtt|gz|zt jd|z|d}t|dkr|ddkr|dndS)Ns!H r rrr )rrrrstructpackr)rr'r(hr s r$_connect_socks5r1Ms AII!E3q66(OO3a7&+dD:Q:QQRRR r Aq66Q;;1Q41991Q44$6r&proxyDict[str, str]timeoutfloatcRt|d} tj|j|jf|}|||jdkr2ddl}| ||j} |j drt|| dd | d d r | dSt|d d dkr | dS|d nddl}|| dd d| d d }|d|zd}t)|dkr0|d}|sn||z }t)|dk0t-jd|dd} | r'| dnd | S#| wxYw#t4$rYdSwxYw)zHThe address TCP leaves from, read in the clear over a single connection.serverr5httpsrN)server_hostnamesocksusernamepasswordz api.ipify.orgPsNGET / HTTP/1.1 Host: api.ipify.org Connection: close User-Agent: curl/8 :zGET http://api.ipify.org/ HTTP/1.1 Host: api.ipify.org Proxy-Authorization: Basic %s Connection: close User-Agent: curl/8 r&s\b(?:\d{1,3}\.){3}\d{1,3}\b )rsocketcreate_connectionhostnamer( settimeoutschemesslcreate_default_context wrap_socket startswithr%getcloser1rbase64 b64encoderdecoderrresearchsplitgroupOSError) r3r5r!rrJrPcreddatar"ms r$tcp_exitr[Tsx!!A'  $aj!&%97 K K K W 8w   JJJ**,,88AJ8WWA x""7++ _ EIIj"$=$=uyyUW?X?XYY , GGIIIII+#1or::a??( GGIIIII' MNNNN '' % *b 9 9 9 9 % *b 9 9 9;r? r )Fz$the gateway closed without answeringrr)Fzanswer could not be readr z rep=%d %s?r r,r )z0.0.0.0z::Tz%s:%dzerror %sN)rrIrMrErFrGr(rHr%rNrOrrr_REP inet_ntoarR inet_ntopAF_INET6r.unpackrWtype__name__) r3r5r!rer atypaddrr(exs r$ udp_associaterksx!!A 8  w ' 'aUXYX````5  $aj!&%97 K K K W a:r!:!:EIIjRTJ3J+,J5J+ J+J+9J:J+C.J=J+J((J++ K5K KK cnt|\}}|sdS|d\}}}t|d} tj|j|jf|}||t|| dd| ddr| dS| d| d tjtj tj} | | d } d tt!| gz| zt#jd d z} | | dzt)jdz|t-|f| d\} }t!| d ks | ddkr+ | | dS| dd}} || dkrdn| dkr d| dzndz }| |dzd}t!|dks|dddkr+ | | dSddt#jd |dddz}}|dzt3|t!|krt#jd|||dz\}}||dz|dz|z}|dkr~t!|dkrktdt5|dddD}tj|| | S|d|zd|dzz dzzz }|dzt3|t!|k | | dS#| | wxYw#t8$rYdSwxYw)a^The address UDP leaves from, asked of STUN. `None` if UDP does not pass. This is the half almost nobody measures, and without it "the proxy carries UDP" is not enough: if this address is not the same as the TCP one, using it for WebRTC produces two addresses in one session, which is exactly the disagreement detectors look for. NrAr8r9r=r>r?r]r-sstun.l.google.comsr,ifKs!Brlir rr r r r_sz!HH rc3&K|] \}}||z V dS)N).0r#bs r$ zudp_exit..s*RRAq1uRRRRRRr&s!B)rk rpartitionrrErFrGr(rHr%rNrOrrAF_INET SOCK_DGRAMrrr.r/sendtoosurandomr)recvfromrdminziprarW)r3r5r wherer'_r(r!ctrlrr0testadrhicjfinetlnvips r$udp_exitrse$$IB t$$S))MD!Tx!!A$'QV(>QCII& ( ( (::d##DAq1vv{{adaii GGIII JJLLLLL!dA!D daii$!))a!A$hh DA!a%&& A1vv{{a!f 33 GGIII JJLLLLL"v}T1QqS6::1==tAa%3tSVV,,,, eQqQwZ882a!eAEBJ&';;3q66Q;;RRQqsV=P1Q1QRRRRRB!+B// GGIII JJLLLL QVBF a/00 a%3tSVV,,,, GGIII JJLLLLL GGIII JJLLLL ttsYBP& A(P&5B/O9%(P&AO9&(P&CO9-(P&8O9(P&9*P##P&& P43P4rnOptional[bool]ct|d}|jdsdS tj|j|jf|}|| t|| dd| ddr | dSt|dd d kr | d S| d d }t|dkr0|d}|sn||z }t|dk0|dd}d|vo$t|dk | S#| wxYw#t"$rYdSwxYw)u`True`/`False`, or `None` when the question was not settled. ⛔ The `None` is NOT a `False`: a network failure and an exit without IPv6 are different things, and flattening them would switch IPv6 off over a timeout. r8r<Nr9r=r>r?zapi6.ipify.orgr@rFsOGET / HTTP/1.1 Host: api6.ipify.org Connection: close User-Agent: curl/8 r&rBrCrD:r )rrIrMrErFrGr(rHr%rNrOr1rrrrUstriprW)r3r5r!rrYr"corpos r$has_ipv6rs x!!A 8  w ' 't  $aj!&%97 K K K W Q *b 9 9599ZQS;T;TUU  GGIIIIIq"2B771<< GGIIIII III J J JDd))d""FF4LL  d))d"" JJ{++B/E5=;S%7%7!%; ; GGIIIIAGGIIII ttsB7F3+9F%F3;FF3'BFF3F00F33 GGrroundscfdt|D}d|D}tt|}|sdgfSt|dk|fS)z`(sticky, addresses)`. Six reads with the SAME credential. Six and not two: two identical draws in a row from an urn do not prove the urn holds a single ball, and that is a mistake this project has already made and written down. c.g|]}tSrq)r[)rrrr3s r$ zis_sticky..s 4 4 4Xe__ 4 4 4r&cg|]}||Srqrq)rrxs r$rzis_sticky..s # # #1 #Q # # #r&Nr )rangesortedsetr)r3rvistibuonidistintis` r$ is_stickyrsq 5 4 4 4eFmm 4 4 4E # # # # #Ec%jj!!H Rx x==A x ''r& udp_allowed udp_exit_ip tcp_exit_ipc4|sdSt|o||kS)a!Is this gateway's UDP USABLE, rather than merely GRANTED? Three answers. Measured, and the whole reason the distinction exists: a gateway grants the UDP ASSOCIATE and hands back a relay, and through that relay STUN never answers. Granted is not usable, so the grant on its own must never be read as a capability - `_geo._srflx_suppressed` requires this AND the grant before it stops declaring a candidate, and getting that wrong costs the worst sentence a detector writes. The three answers are not two: * ``None`` - the question does not apply. The gateway did not grant UDP ASSOCIATE, so there is nothing that could have been usable. Flattening it to ``False`` erases the difference between a gateway that refused and one that granted and then failed to carry a packet, which are different facts about the provider and different things to do about them. * ``False`` - granted and not usable: no UDP exit came back at all, or the one that did is not the address TCP leaves from. * ``True`` - granted, and the two exits are the same address. A top-level function, and not the inline expression it was inside ``measure``, because ``measure`` does network and so cannot be called by anything that wants to check this rule. The workbench gate that exists to prove exactly this line had copied it instead, and the copy fell behind the day the core was translated and the field names moved. One place computes it now; a caller that cannot afford the network calls this. N)bool)rrrs r$ udp_is_usabler s)< t    ; !;;r&c^t|d}|jd|jd|jS)Nr8z://rA)rrIrGr()r3r!s r$_keyr/s0x!!A888QZZZ 88r&known_tcp_exitrDict[str, Any]c F|pt|}t|\}}|rt|nd}t|t |dj||||t |||t|ttj d S)uEverything that can be known about an exit without launching a browser. ``known_tcp_exit`` avoids measuring again what the caller already has. ``prepare_session_geo`` discovers the exit IP for the timezone and the locale, with one round trip through the proxy: doing it again here would be the same fact computed in two places, plus one more trip to an echo endpoint, which is non-browser traffic on the same exit. ⛔ STICKINESS IS NO LONGER HERE, and that is the owner's decision of 2026-08-25: whether proxies are sticky is not interesting, because the truth is what is detected before the launch and it is absolute for the session. Removing it costs nothing and is worth it twice over: * it was **six network rounds out of eight** of this probe's cost; * and it **lied**. It reported `sticky = yes` for all four providers, while the same endpoint had been measured rotating **8 times in 25 minutes**. Six consecutive reads take a few seconds and rotation happens on a scale of minutes: that field could not see the phenomenon it was named after. ``is_sticky`` stays available for anyone who wants to MEASURE rotation over a suitable window, but it no longer enters any decision the product makes. Nr8)rr) endpointschemar[udp udp_percherudp_matches_tcpipv6 measured_at) r[rkrrrrIrrr)time)r3rip_tcpok_udpwhyip_udps r$measurer4s0 .xF&&KFC & 0Xe___DFKK5?++2 )V5;===49;;''  r&F) remeasurerrrcjt|}i} ttd5}tj|}dddn #1swxYwYn#t t f$rYnwxYw||}|r<|s:tj|ddz tkrd|d<|St||}|||< ttd d5}tj ||d dddn #1swxYwYn#t $rYnwxYwd |d<|S) zThe measurement, from cache when it is recent. Capabilities belong to the gateway rather than to the session, which is what makes caching them sound at all. zutf-8)encodingNrrT from_cacherwr )indentF) ropenCACHEjsonloadrW ValueErrorrNr VALID_FOR_Srdump)r3rrkey rememberedfentrys r$ capabilityras u++CJ %' * * * &a1J & & & & & & & & & & & & & & & Z      NN3  E YDIKK%))M12M2M$MQ\#\#\"l E. 9 9 9EJsO %w / / / /1 Ij!A . . . . / / / / / / / / / / / / / / /      E, LsiAA  A AAAAA*)A*D.D DDDDD D+*D+rc d}|ddd||ddd||ddd ||d S) Nc|durdn|durdndS)NTsiFnoznon determinatorq)rs r$_szsummarise.._ss!DyyttqEzztt?PQr&r46z udp=r16z coerente=rz ipv6=rrq)rrs r$ summariser~snRRR}}}}bb5lllllBBq1B/C,D,D,D,D,Dbb6mmm UVr&)rrrrrr)r'rr(r)rr*)r2)r3r4r5r6rr)r3r4r5r6)rl)rn)r3r4r5r6rr)r)r3r4rr))rrrrrrrr)r3r4rr)r3r4rrrr)r3r4rrrrrr)rrrr)"__doc__ __future__rrryrSrEr.rtypingrrr urllib.parserpathjoinenvironrNrrr`r%r1r[rkrrrrrrrrrqr&r$rs"<#""""" &&&&&&&&&&!!!!!!  RZ^^FF335KLL   %-