jW0dZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl m Z ddlmZdZdZdZejd Zd Zd Zd Zd ZdZd*dZdZd+dZd,dZGddeZd-d!Z Gd"d#Z!Gd$d%Z"d&Z#d.d)Z$dS)/aInvisible-but-headed browser windows. Playwright's ``headless=True`` flips Firefox onto a different code path - no widget tree, software-only rendering, distinct timing - and anti-bot systems can spot the divergence. Running the browser *headed* but hidden gives us the real rendering pipeline while keeping the windows off screen. One idea, two mechanisms: the browser is not hidden, the SCREEN it draws on is one nobody looks at. - **Windows**: a fresh Win32 desktop object (``CreateDesktop``) that is never switched to. The spawner creates the browser process with ``STARTUPINFO.lpDesktop`` naming it, so the whole tree - launcher, parent, GPU and content processes - is born there and never appears on the interactive desktop, in the taskbar or in alt-tab. The binary is stock: no window attribute is touched from inside it. - **Linux**: a private ``Xvfb`` instance, with ``DISPLAY`` pointed at it (X11/Wayland have no per-window cloak that keeps the GPU rendering). Both objects carry the same moves: ``start()`` creates the surface, ``launch_env()`` names the variables the BROWSER's environment must carry for it - and, with the value ``None``, the ones it must NOT carry -, ``stop()`` releases the surface. The launcher merges ``launch_env()`` into the one environment it composes for the child (``_session.build_env`` in the wrapper), so the fact stays with the session: a second session in the same process never inherits the first one's surface. Neither object touches ``os.environ``. Until 34.25.0 the Linux one wrote ``DISPLAY`` there in ``start()`` and restored it in ``stop()``, so a headed session opened while an Xvfb session was still alive in the same process was born on the Xvfb (B221); the ``None`` half of the contract is what moved the five Wayland removals out of the process too. The in-binary cloak (``DWMWA_CLOAK`` gated by ``zoom.stealth.cloak_windows``) that hid the Windows window from 2026-06-11 to 2026-09-20 is gone, and its pref is no longer emitted: the engine is stock on this surface again. ) annotationsN)Set)Optional)WAYLAND_DISPLAYXDG_RUNTIME_DIRXDG_SESSION_TYPE PULSE_SERVERWSL2_GUI_APPS_ENABLED INVPW_DESKTOPz/proc/net/unixz@?/tmp/\.X11-unix/X(\d+)ci sMIT-MAGIC-COOKIE-1ipathstrcookiebytesreturnNonec d d}tdd|dz|dz|tz||z}tj|tjtjztjzttdd zd } tj ||tj |d S#tj |wxYw) aCWrite a one-entry Xauthority file, readable by its owner only. The format is libXau's: family, then address, display number, auth name and auth data, each a 16-bit big-endian length and its bytes. Written here instead of with the ``xauth`` tool, which would be one more package to install for nothing. brrcNt|dd|zS)Nbig)lento_bytes)rs HC:\Projects\Muse2API\.venv\Lib\site-packages\invisible_core/_headless.pyfieldz _write_xauthority..fieldes!1vvq%((1,,rrrO_BINARYriN)rrrr) _FAMILY_WILDr _COOKIE_NAMEosopenO_WRONLYO_CREATO_EXCLgetattrwriteclose)rrrrecordfds r_write_xauthorityr+]s----##Au--c :UU3ZZGl##$&+eFmm4F r{RZ/");gb*VW>X>XXZ_ ` `B V   s 'CC(g>@c t|dd5}|cdddS#1swxYwYdS#t$rYdSwxYw)Nasciireplace)encodingerrors)r"readOSError)rfs r _read_procr5~s $ ; ; ; q6688                   rrs,A5 A9A9A AAsetct}ttddD]}|dd}t |dkr t |dnd}|r5|t| d|S)aDisplay numbers this network namespace already has an X server on. Any unix socket named for a display in /proc/net/unix, abstract or path, in any state, since an accepted connection also carries the name and still means a live server. The table lists live sockets only, so a stale socket file left in /tmp/.X11-unix does not count, and it covers servers whose /tmp is not this one (a container sharing the network namespace keeps its lockfile in its own /tmp). A path socket counts although this Xvfb opens none: a client of that server asking for :n tries the abstract name first, and would reach ours. TCP is not read: this Xvfb does not listen on it (see ``_spawn``), so a listener on 6000+n is no concern of this display. A filter, never the judge: whether a number is free is decided by the Xvfb started on it (see ``_spawn``). But it is what keeps sessions of this package apart, because an Xvfb started with ``-displayfd`` writes no lockfile, so the lockfile check cannot see them. Measured without it: with 100 sessions alive, 11 of 51 attempts landed on a taken number, and with 250 a start ran out of its ten attempts. N) r6r5 _PROC_UNIX splitlinessplitr _X_SOCKET fullmatchaddintgroup)busylinecolsms r_x_displays_listeningrGs, 55D:&&1133ABB7&&zz$"",/IINNI  Q ( ( (  & HHS__ % % % KrceZdZdZdS) _XvfbExitedzThe Xvfb started on a number exited before it was listening: the number was taken, by something the filters could not see. Another number can succeed, so ``start()`` tries one.N)__name__ __module__ __qualname____doc__rrrIrIs....rrIr*rAtimeoutfloat str | Nonectj|z}d}|dst|tjz }|dkstj|ggg|dstt j|d}|sdS||z }|dt|ddS) zThe line Xvfb writes on ``-displayfd`` once its sockets are open, or ``None`` at end of file: every copy of the write end is closed, which, with ours closed after the spawn, means the server has exited.r r@Nr-r.)r0) time monotonicendswithselect TimeoutErrorr!r2decodestrip)r*rOdeadlinebufleftchunks r_read_ready_liner`s~')H Cll5!!$.*** 199FM2$B==a@9 B 4 u ll5!! ::gi: 0 0 6 6 8 88rcpeZdZdZddd Zdd Zdd ZddZddZe fddZ ddZ ddZ ddZ dS)_LinuxVirtualDisplayzCStandalone Xvfb instance owned by this InvisiblePlaywright session.8widthrAheightrrcX|d|d|_d|_d|_d|_d|_dS)Nxx24) _geometry_proc_display _auth_dir _auth_file)selfrerfs r__init__z_LinuxVirtualDisplay.__init__s:!//F///15 '+ (,)-rctdstdtjd|_t j|jd|_t|jtj d | dS#t$r|wxYw)NXvfbzSinvisible_playwright headless=True requires Xvfb. Install it: sudo apt install xvfbz invpw-xauth-)prefix Xauthority)_binary_on_path RuntimeErrortempfilemkdtemprmr!rjoinrnr+secrets token_bytes _start_server BaseException _remove_authros rstartz_LinuxVirtualDisplay.startsv&& 4 ")@@@',,t~|DD$/7+>r+B+BCCC                s B!! CcFd}t}ttD]c}||}|| |||_dS#t$r }|}Yd}~\d}~wwxYwtdtd|)N)excludezXvfb failed to start after z attempts: ) r6range _ATTEMPTS _pick_displayr@_spawnrlrIrw)rolast_errtried_displayes rr}z"_LinuxVirtualDisplay._start_servers)-%%y!!  A(((77G IIg     $ G 4 4      J) J J J JLL LsA00 B:BBrrctj\}} tjd|dt |dd|jdddddd dd d |jgtjtjd |f |_n##t$rtj |wxYw tj |n#tj |wxYw t|t}n]#t$r2|td|dtdddt$r|wxYw tj |n#tj |wxYw|'|t!d|d|s*|td|d|dd|S)ahStart Xvfb on ``display`` and return the display it is serving. Ready means the SERVER says so: with ``-displayfd`` it writes its display number on the pipe after its listening sockets are open and its SIGTERM handler is installed, and if it exits first the pipe reports end of file. Nothing a third party leaves in /tmp can stand in for that. Until this change ready meant "/tmp/.X{n}-lock exists", which an Xvfb creates BEFORE opening its sockets: one that then failed to open them was taken for a live server, and the loser of a race between two sessions read the winner's lockfile as its own - both ended on one Xvfb, one of them with a dead one. And a stop() right after that kind of ready reached the server before its SIGTERM handler, so it died without removing its lockfile. The number is passed explicitly: ``-displayfd`` alone makes the server scan from :0, which under WSLg takes :0 in front of the desktop's own display. Explicit number plus ``-displayfd`` is honoured since xorg-server 1.16 (2014). ``-displayfd`` also means the server writes no lockfile (``nolock``, in every version), which is why _pick_display reads the socket table. The one socket it opens is the abstract ``@/tmp/.X11-unix/X{n}``, which is what a client asking for ``:n`` reaches first: no socket file in /tmp, and no TCP. Until this change it also listened on TCP 6000+n, on every interface, with access control off (``-ac``): any host that could reach the port could read and drive the browser's screen, and the browser never used it (measured: Firefox on the display holds one unix connection and no TCP one, with TCP on or off). It was also one more way to collide: a listener on [::]:6000+n made this Xvfb exit. Access control is on: ``-auth`` loads the session's cookie (see ``start``). Until 37.33.0 it was ``-ac``, so with TCP gone the abstract socket was still open, without credentials, to every local process. rrz -displayfdz-screen0z +extensionGLXRENDERz -nolistenunixtcpz-authT)stdoutstderrstart_new_sessionpass_fdszXvfb z& neither reported ready nor exited in gsNz exited before it was listeningz reported z on -displayfd:)r!pipe subprocessPopenrrjrnDEVNULLrkr~r(r`_READY_TIMEOUTrY_reaprwrIisdigit)rorread_end write_endrDs rrz_LinuxVirtualDisplay._spawns)H!gii) #)G #i..sDN % (T_ ")!)"&#DJJ     HX     ! , HY    BHY     #Hn==DD 2 2 2 JJLLL'''!&'''((-1 2    JJLLL    HX    BHX     < JJLLLNgNNNOO O||~~ R JJLLLPwPP$PPPQQ Q4zzs=AA43B-4 BB--CCEAD77EE&c|jdS|j|j|jd|_dS)z~Kill our Xvfb if it still runs, and wait for it: a child nobody waits for stays a zombie for the life of this process.N)rkpollkillwaitrs rrz_LinuxVirtualDisplay._reapCsR :  F :??   $ JOO     rrAbstractSet[str]ctfdtttdzD}|st dtdtdt j|S)Ncpg|]2}d|vr)|v tjd|d0|3S)rz/tmp/.Xz-lock)r!rexists).0nrCrs r z6_LinuxVirtualDisplay._pick_display..Ys]   1wwg%% GNN#5Q#5#5#566  rr8zno free X display number in :z-:r)rGr_FIRST_DISPLAY _LAST_DISPLAYrwr{choice)rorfreerCs ` @rrz"_LinuxVirtualDisplay._pick_displayMs%&&     ^]Q->??     SQQQ-QQSS S)7>$'')))rdictcX|jsiS|j|jddd}tD]}d||<|S)a/What the browser's environment must carry to draw on this Xvfb. ``DISPLAY`` names the display, ``XAUTHORITY`` the file holding the cookie the server asks for, the two GTK/Firefox switches keep the toolkit on X11, and the five Wayland variables are named with ``None`` so the launcher REMOVES them: inherited from WSLg or GNOME they make Firefox prefer the compositor over the display we set, and the window leaks onto the real desktop. All of it is this session's, none of it is the process's. rx11)DISPLAY XAUTHORITYMOZ_ENABLE_WAYLAND GDK_BACKENDN)rlrn_WAYLAND_LEAK_VARS)roenvks r launch_envz_LinuxVirtualDisplay.launch_envdsP} I}/"%    $  ACFF rc|j|j|j |jdnI#tj$r7|j|jdYnwxYwd|_d|_|dS)N)rOr) rkr terminaterrTimeoutExpiredrrlrrs rstopz_LinuxVirtualDisplay.stop{s : !djoo&7&7&? J " " " + ****, + + + !!! ***** +   sAABBc|j2 tj|jn#t$rYnwxYwd|_|j4 tj|jn#t$rYnwxYwd|_dSdS)zhDelete the cookie file and its private directory: the cookie is this server's, and dies with it.N)rnr!remover3rmrmdirrs rrz!_LinuxVirtualDisplay._remove_auths ? &  $/****    "DO > % ((((    !DNNN & %s# 00A A)(A)N)rcrd)rerArfrArrrr)rrrr)rrrrrr)rJrKrLrMrprr}rr frozensetrrrrrNrrrbrbsMM.....*LLLL*OOOOb9B *****..    """"""rrbcJeZdZdZd dZed dZd dZdd Zd d Z d S)_WindowsVirtualDesktopuA Win32 desktop object nobody switches to, owned by this session. Windows has no per-window cloak that leaves a stock binary untouched, but it has something Linux lacks: a process is CREATED on a desktop, and every process it spawns is born on the same one. Naming a fresh desktop in ``STARTUPINFO.lpDesktop`` therefore hides the whole browser tree at once - launcher, parent, GPU process, content processes - with no cooperation from the binary. The desktop lives on the interactive window station, so the GPU is the real one; only ``SwitchDesktop`` would show it, and nothing here ever calls that. Two facts about that desktop are consequences, not choices, and the prefs that follow from them live in ``prefs._WIN_VIRT_DESKTOP_WORKAROUNDS``: the GPU process cannot parent its compositor window across desktops under the default GPU sandbox, and content processes above sandbox level 4 are put on the sandbox's own window station. Both were measured on this exact setup in 2026-05 (`22-patch-port-history.md` §P16, `71-bug-archive.md` #18 Bug A) and are what ``virtual_display=True`` switches on. ⛔ ``SetThreadDesktop`` on the launching thread is NOT enough, and that is the mistake this class replaces for the second time: with ``lpDesktop`` NULL a child inherits the parent PROCESS desktop, not the thread's, so a thread-level switch hid nothing (measured 2026-06-11). The name has to reach ``CreateProcess`` itself, which is why ``launch_env()`` hands it to the environment the spawner reads - the SESSION's, never the process's: a headed session opened while a hidden one is still alive must not be born on the hidden one's desktop. rrc"d|_d|_dSN)_handle_namers rrpz_WindowsVirtualDesktop.__init__s&* $( r Optional[str]c|jSr)rrs rnamez_WindowsVirtualDesktop.names zrcddl}ddlm}|dd}|j|j_|j|j|j|j|j|jf|j_ dtj dz}d}||ddd|d}|s&| }td |zt||_||_dS) Nrwintypesuser32Tuse_last_errorinvpw_iainvisible_playwright headless=True could not create a hidden desktop (CreateDesktopW failed, WinError %d). A session with no interactive window station - a service, a scheduled task with no logon - cannot host a headed browser; run from a logged-on session.)ctypesrWinDLLHANDLECreateDesktopWrestypeLPCWSTRc_void_pDWORDargtypesr{ token_hexget_last_errorrwrArr)rorrrr generic_allhandleerrs rrz_WindowsVirtualDesktop.starts ######x==(0%  h. NHNFO*=& '+A... &&tT4KNN ,''))C%(+ +,, , 6{{  rrc0|jrt|jiniS)z?The one variable the spawner needs: which desktop to create on.)r DESKTOP_ENVrs rrz!_WindowsVirtualDesktop.launch_envs,0J> TZ((B>rc|jqddl}ddlm}|dd}|jf|j_|j|j_|||jd|_d|_ dS)NrrrTr) rrrrr CloseDesktoprBOOLrr)rorrrs rrz_WindowsVirtualDesktop.stops < # MMM ' ' ' ' ' ']]8D]AAF,4O+=F  (*2-F  '    = = > > >  rNr)rrr) rJrKrLrMrppropertyrrrrrNrrrrs:))))X4????      rrctjdrtStjdkrt St dtjd)zReturn a start()/stop()-able hidden surface for this platform. - Linux: a fresh ``Xvfb`` (the launcher start()s/stop()s it). - Windows: a fresh Win32 desktop the spawner creates the browser on. linuxwin32z^invisible_playwright supports Windows and Linux (macOS is no longer a supported platform; got ))sysplatform startswithrbrrwrNrrmake_virtual_displayrsp  |w''&#%%% |w%'''  K9< K K K  rrboolc8ddl}||duS)Nr)shutilwhich)rrs rrvrvs"MMM <<  T ))r)rrrrrr)rrrr)rr6)r*rArOrPrrQ)rrrr)%rM __future__rr!rer{rXrrrxrUcollections.abcr AbstractSettypingrrrr;compiler>rrrr rr+rr5rGrwrIr`rbrrrvrNrrrs$$J#"""""    ......  BJ2 3 3   %  <B.....,... 9999"W"W"W"W"W"W"W"W"tOOOOOOOOd    ******r