Reflect the previously-deferred items as done: gemini provider is fully wired
to native generateContent (vision + audio), unit-tested, with a note that live
use needs a real Google key. Document that get_stealth_script now takes
os/browser/locale/seed and returns a fingerprint, and that the evasion script
is templated to match it (coherent) — inject both together or share a seed.
Note reasoning-model <think> blocks are stripped before json parse. Record the
CAPTCHA_E2E_HEADED toggle, drop the done roadmap items, keep the honest note
that headless reCAPTCHA v2 usually won't mint a token, and call out the single
package-lock.json lockfile.
Two lockfiles existed (package-lock.json and pnpm-lock.yaml). Keep the
canonical npm package-lock.json and remove the pnpm one to avoid divergent
dependency resolution.
Real Google reCAPTCHA rarely yields a token in headless Chromium. When
CAPTCHA_E2E_HEADED=1 the script now launches { headless: false, slowMo: 80 }
so a user can attempt a real-profile solve; otherwise it keeps the existing
headless launch. Logs whether headed mode is on and that a headed/real-profile
browser improves the odds of a token. Go wrapper and best-effort exit-0
behavior unchanged; text-captcha script untouched.
Reasoning models prefix responses with <think>...</think> (or
<thinking>...</thinking>) scratchpad that can itself contain a JSON-looking
object. The brace-counting extractor would grab that inner object instead of
the real answer. Strip think/thinking blocks via a package-level regexp before
the balanced-object scan. Adds table cases covering both tag spellings while
keeping the plain, prose-wrapped, and unbalanced cases intact.
- Convert assets/evasions.js to evasions.js.tmpl (Go text/template)
- Placeholders: WebGLVendor, WebGLRenderer, Platform, Languages
- Add navigator.platform spoof from fingerprint
- ScriptParams gains OS, Browser, Locale, Seed fields (fieldalignment ordered)
- ScriptResult gains Fingerprint field — returns the identity the script was rendered for
- StealthScript calls GenerateFingerprint and renders template; single call gives both script and coherent fingerprint
- languagesJS: locale to JS list (en-GB -> 'en-GB', 'en')
- Template parsed once at init via template.Must
- StealthScriptIn in tools.go gains OS, Browser, Locale, Seed pass-through
- Tests: added TestStealthScriptCoherence asserting rendered values match fingerprint
- detect: recaptcha_v3 now suppresses recaptcha_v2 (hidden g-recaptcha div on v3 pages no longer mis-detected as LLM-solvable); funcaptcha drops over-broad bare "arkose" substring
- llm/gemini: stub methods return ErrUnsupported{Provider:"gemini"} so audio handler errors.As guard catches it; drop unused fmt import
- mcp/tools: remove gemini from audio capability (stub); pick audio filename (.wav/.mp3) from sniffed media type; schema notes for browser/actions no longer advertise unimplemented options
- imageutil: fetchURL uses a package client with 30s Timeout instead of http.DefaultClient
- captcha/json: extractJSON brace-counts to return the first balanced object (handles prose, markdown fences, example-before-real)
- config: remove dead CAPTCHA_LLM_TEMPERATURE / Config.Temperature; solving is fixed at temperature 0
- stealth: Action.Type doc comment drops nonexistent scroll case
Add opt-in live e2e under tags e2e,live + CAPTCHA_E2E_LIVE=1. Launches the
built server, speaks MCP over stdio, generates a 300x300 red-top-row grid,
and asserts a real vision model selects tiles {0,1,2}. make e2e (tag e2e
only) does not compile or run it.
lukaszraczylo