jidZddlmZddlZddlmZmZmZm Z ddl m Z ddl mZmZddlmZmZmZdd lmZmZmZdd lmZmZmZmZgd Zd ZdCdDdZ ddlm Z!m"Z"nA#e#$r9Z$ddl%m&Z' e'pdZ(n #e)$rdZ(YnwxYwe#de(de$de$dZ$[$wwxYwddddddEd#Z*ddd$dFd1Z+Gd2d3e,Z-Gd4d5e,Z.d6Z/d7Z0d8Z1d9d:dGd@Z2GdAdBZ3dS)HaGSession logic shared by the sync and async entry points. WHY THIS FILE EXISTS. There are two `InvisiblePlaywright` classes, and the only thing keeping them equal was somebody remembering. Measured 2026-07-27: 203 of 252 normalised lines of `async_api.py` also appear in `launcher.py` - 80.6% - and `__init__`, `_teardown`, `_build_env` and `_default_context_kwargs` are 100% identical once the word `await` is deleted. So the duplication is not the price of async; async was the excuse for it. That is a defect GENERATOR, and it has already produced three: * the 0.4.0 process-leak fix reached the sync class only, and shipped to the other half of the users under a release note saying it was fixed; * `INVPW_TRUE_HEADLESS`, a documented env var, worked on the async API alone; * `_build_prefs` was a method on one side and twenty inline lines on the other. Anything here must stay free of Playwright imports: it is the part that has nothing to do with which API a caller picked. What legitimately differs between the two classes is `await`, and nothing else belongs in this file. ) annotationsN) ENGINE_BINARY ENGINE_PYTHON enable_formax_seconds_for)resolve_executable)MOTION_BUDGET_PREFSESSION_SEED_PREF)AnyDictOptional)compose_session_prefscontext_geometrymake_virtual_display)FontManifestMismatchbuild_launch_envcached_font_manifest_pathverify_font_manifest) build_prefstrue_headless_requestedTRUE_HEADLESS_ENVProxyEgressDriftedegress_ancora_validoINVPW_TRUE_HEADLESSenvOptional[Dict[str, str]]returnboolcZ||n tjtdkS)N1)osenvirongetr)rs MC:\Projects\Muse2API\.venv\Lib\site-packages\invisible_playwright/_session.pyrrDs&?CC 7 78I J Jc QQ)IANA_TO_POSIX_TZtz_env)declared_core_pinza newer versionz*invisible-playwright needs invisible-core zS: the installed one does not provide the timezone conversion this version imports (za). Upgrade with `pip install -U invisible-playwright`, which pulls the core it was built against.)profile executablebase_env display_envtimezone Optional[str]srflx_declaredr*r r+r,r-"Optional[Dict[str, Optional[str]]]Dict[str, str]c d}tt|dddd}|rQ|r@t||}|r.tdt|d|ddd|d t |}t i||||| S) aThe environment the Firefox subprocess is launched with, minus the token. The session token is stamped by the caller, because it is the one part that is genuinely per-session; everything here was written twice, identically, in `launcher._build_env` and `async_api._build_env`. Fonts DO need an env, and only an env will do. The engine builds its font list during app startup, inside InitSharedFontListForPlatform, and on this path the prefs never reach the profile at all - Playwright sends them over the wire and JS applies them once the browser is already running. Measured 2026-08-08: the pref of the same name always read empty there, so the engine's packaged copy won and the manifest this package declares was inert. An environment variable is set at process creation and inherited by every content process. `profile=None` sets nothing, which leaves the engine on its own copy - the floor that keeps a browser launched without this package rendering. What is composed here is only what needs the EXECUTABLE: the manifest is verified against the engine's own fonts before its path is handed over. The environment itself is composed by the core's `build_launch_env`, the one place that knows TZ, the WebRTC declaration, the manifest variable and the hidden surface's `launch_env()`; until 0.25.2 this function was a twin of that body, and the hidden-surface half of the contract lived only here. Nfontmanifestz.the font manifest this package declares names z. face file(s) the engine does not carry (e.g. z ). Engine: z6. The metrics would describe fonts that are not there.)r.r0 manifest_pathr,r-)getattrrrlenrr) r.r0r*r+r,r-r8r5missings r% build_envr<ls`Mww55z2FFH<  A*8Z@@G  A*@7||@@$RaR[@@5?@@@AAA 2(;; B.*7((3 5 5 55r&) show_cursor session_seedlocale extra_prefsOptional[Dict[str, Any]]virtual_display cursor_enginestrhumanizer=Optional[bool]r> Optional[int]Dict[str, Any]c t||||||tkrt|nd|j} |M|rKt || t <t t t|dz| t<| S)a&Fingerprint prefs plus the humanize toggle, which is always set explicitly. Takes values rather than a session object so it stays callable from a test without constructing either class - and so that adding a field to one class cannot silently change what the other one builds. F)r?r.r@rBrEr=Ng@@)rr_cursor_max_secondsprefsintr roundr ) r*r?r.r@rBrCrEr=r>rKs r%rrsX " ("m33&h///9>     TH#&|#4#4 $'  ) )F 2)4)4%5%5 ! Lr&ceZdZdZdS)rafThe egress IP changed MID-SESSION. This is not a condition the product can recover from, and it is deliberate that it is an error instead of a silent update. The IP we declare to the engine for the WebRTC srflx candidate is discovered ONCE, at launch. If the egress changes afterwards, the page exits from one address and WebRTC announces another: it is exactly the comparison detectors make ("WebRTC IP doesn't match your Remote IP"), and no Firefox on a real connection produces it. Updating the value on the fly would be worse, not better: the site would see the WebRTC IP change before its own eyes mid-session, which is just as unnatural a signal. If the egress does not hold for the duration of the session, that proxy is not sticky and is not usable for this purpose. Measured on 2026-08-25: the two providers tried both declare sessions sticky by TIME (60 minutes at most for one, a sliding timeout for the other, which decays even earlier if the residential peer disconnects), so on a long enough session the drift is not a risk: it is a certainty. N__name__ __module__ __qualname____doc__r&r%rrsr&rceZdZdZdS)ProxyEgressNonVerificabileanThe egress could not be MEASURED, repeatedly. This is not drift and it is not parity: it is absence of measurement. A proxy that does not answer the probe for several checks in a row is not a proxy that holds, it is a proxy we are flying blind on while the engine keeps declaring to every page an address that nobody is confirming any more. NrOrTr&r%rVrV,sr&rVreggederivatanon_misurabiletimeoutproxyattesor\rL'tuple[str, Optional[str]]'c|r|s tdfSddlm} |||}n#t$r t dfcYSwxYw||krtnt |fS)u(outcome, current_ip), with outcome among the three `USCITA_*`. ⛔ THERE ARE THREE OUTCOMES BECAUSE TWO LIE. Until 2026-08-25 this function returned `(True, None)` when the probe FAILED, with a comment that argued the right half of the thing well - "a failed discovery is not a drift", and that is true, a network problem is not turned into an accusation against the proxy. But the returned value said `regge` (holds), i.e. it **asserted parity on the basis of a measurement that had not taken place**. It is the same class of defect this project has already paid for twice and fixed twice: - `fppro_consistency.py` printed CONSISTENCY PASS when `visitor_id` was mute in BOTH runs, because two `None`s come out identical. It has had a third outcome since 2026-08-15, exit code 2 = NOT INTERPRETABLE. - `repair_core` set `verdict = None` under a handler that said "a broken probe is not a licence", above a test `verdict is not None` that then let the reinstall proceed. The caller now distinguishes: on `USCITA_DERIVATA` it refuses right away, on `USCITA_NON_MISURABILE` it counts and refuses only if it repeats, because a probe that fails once is the network and one that always fails is blindness. The case with no proxy or no expected value stays `USCITA_REGGE`, and it is different from the other two: there is nothing to betray there, no measurement was missed. Nr)_geor[) USCITA_REGGEinvisible_coreradiscover_egress_ip ExceptionUSCITA_NON_MISURABILEUSCITA_DERIVATA)r]r^r\raattuales r%rr>s@ ""T!!######+))%)AA +++$d****+#v--LL?W LLs-AAcBeZdZdZddZddZdd Zdd ZddZddZ dS) CommonLaunchuThe six methods both entry points had, written once. ⛔ THE DUPLICATION THIS CLOSES IS THE ONE THIS FILE WAS CREATED FOR, and it survived the file's own creation. `_session` was written on 2026-07-27 to hold what the sync and async classes share, and it did extract the functions - `build_env`, `build_prefs`, `true_headless_requested`. What it left behind were the METHODS that call them: six of them, in both classes, with bodies that are identical byte for byte once the docstrings are removed. 222 lines saying the same thing twice. The measurement that says it is the same thing: the two classes use the SAME FOURTEEN attributes of `self` across those six methods, and the ASTs of the bodies compare equal. What made them look different - similarity ratios between 32% and 69% - was entirely comments worded differently. ⛔ AND THE COST OF THE SPLIT IS NOT HYPOTHETICAL. The three defects listed at the top of this file all have the same shape, and one of them is in the code that moved here: `INVPW_TRUE_HEADLESS` was honoured by the async class alone, so a documented environment variable worked or not depending on which entry point the caller had picked. ⛔ WHAT THIS CLASS EXPECTS, said out loud because a mixin's contract is otherwise invisible: both subclasses set `seed`, `_binary_path`, `_cursor_engine`, `_extra_prefs`, `_headless`, `_humanize`, `_lifetime_guard`, `_locale` (the core's SessionLocale, None until `__enter__` decides it), `_profile`, `_session_token`, `_show_cursor`, `_srflx_declared`, `_timezone` and `_virtual_display` in their own `__init__`. They already did, identically, which is why this works at all. rrc|jsdStrdSt}||||_dS)ufTranslate the user's ``headless`` flag. When ``True``, Firefox stays in headed mode (real rendering pipeline → coherent fingerprint) and the window is hidden by drawing on a screen nobody looks at: on Linux a fresh Xvfb spawned here; on Windows a fresh Win32 desktop the spawner creates the browser on (``STARTUPINFO.lpDesktop``, read from ``INVPW_DESKTOP``). The engine is stock on this surface: no pref hides anything. ``self._virtual_display`` is the fact ``_build_prefs`` reads to decide whether the desktop workarounds apply (B172). FT) _headlessrrstart_virtual_display)selfvds r%_resolve_headlesszCommonLaunch._resolve_headlesssR~ 5 # $ $ 4 ! # # > HHJJJ$&D !ur&rHcit|j}|jr |j|d<|j|jj|d<|S)N timezone_idr?)r_profile _timezone_localeprimary)rokwargss r%_default_context_kwargsz$CommonLaunch._default_context_kwargssQ " t}--"  > 3$(NF= ! < ##|3F8  r&rKr2c |j}|jt|j|j|jt|j|| ndS)aEnv for the Firefox subprocess, then stamped with this session's token. The body is `build_env`, shared with the async class - it was written twice, identically, and the WebRTC pair is a contract with the binary, so two landing sites meant two chances to miss a change. The token stamp stays here because it is the only genuinely per-session part: children inherit the environment, so every process in the tree carries it and teardown can find its own tree and only its own. N)r.r0r*r+r-) rn_session_tokenstampr<ru_srflx_declaredrtr _binary_path launch_env)rorKrps r% _build_envzCommonLaunch._build_envso ""(( t~%)%9"m!3D4E!F!F57^"--///  O O OPP Pr&c t|j|j|j|j|jdu|j|j|j|j  S)atFingerprint prefs plus humanize toggle (always set explicitly). The body lives in `build_prefs`, which the async class calls too. It used to be twenty lines here and the SAME twenty inlined into `async_api.__aenter__` - identical calls in identical order, differing only in their comments, which is how the two entry points drift. N) r*r?r.r@rBrCrEr=r>) rrtrvru _extra_prefsrn_cursor_engine _humanize _show_cursorseedros r% _build_prefszCommonLaunch._build_prefssQM<^) 1=-^)    r&ownerr Nonec||jtkrdSt||jt |jdS)a=Register this session so its pages move through the Python generator. Registered on the browser (or on the persistent context, which is all there is in that mode) rather than on each page: pages appear by several routes we do not control - ``browser.new_page()`` builds its context inside the driver, and a site can open a popup on its own - and every one of them can find its way back to this owner. The seed is the session seed, so a replayed seed replays the cursor exactly as it replays the fingerprint. N)r max_seconds)rr_enable_cursor_enginerrJr)rors r%_arm_cursor_enginezCommonLaunch._arm_cursor_enginesL  - / / F  /B4>/R/R      r&ch |j|jdS#t$rYdSwxYw)aoTie the browser tree to this process's lifetime, at the OS level. MEASURED before being written, because the first attempt at this fixed a path that was not broken: an exception out of the `with` block does NOT leak - __exit__ runs and Playwright cleans up, zero survivors over an interleaved A/B. The leak is the killed-runner path, where __exit__ never executes at all: launch, kill the runner, and eight processes were still alive; twelve on the second attempt. Nothing written inside _teardown can reach that, so the guarantee comes from a Windows job object that the kernel empties when this process's handle closes, however this process ends. Best-effort by construction: a failure here leaves the pre-existing behaviour rather than breaking a launch that is otherwise fine. N)_lifetime_guardbindr{rers r%_bind_process_treezCommonLaunch._bind_process_treesI    % %d&9 : : : : :    DD s # 11N)rr)rrH)rKrHrr2)rr rr)rr) rPrQrRrSrqryrrrrrTr&r%rjrjhs<6<PPPP&    (    "r&rj)N)rrrr)r.r/r0r/r*r r+r/r,rr-r1rr2)r*r r?r r.r/r@rArBrrCrDrEr r=rFr>rGrrH)r]rr^r/r\rLrr_)4rS __future__rr"_cursorrrrrrrJ_enginer _juggler.serverr r typingr r rrcrrrinvisible_core.launchrrrr__all__rrr'_IANA_TO_POSIX_TZr( ImportError_exc_pinr)_declared_core_pin_wantrer<r RuntimeErrorrrVrbrgrfrrjrTr&r%rsQ(#""""" >>>>>>>>>>>>('''''BBBBBBBB&&&&&&&&&&XXXXXXXXXX999999999999  9 9 96*RRRRR*   ======"""$$9(9 """!" + 0U 0 0  0 0 0     0 $)-7;+H5H5H5H5H5H5h#'"&ZZZZZZz0 ( ,.'M'M'M'M'M'MTccccccccccs<AB!B( A54B5A?<B>A??BB