chore(release): 0.27.0-fork.26 — stealth navigator.platform=MacIntel (anti-detection fix)

platform_string() feeds the CDP Emulation.setUserAgentOverride 'platform' field,
which sets the LEGACY navigator.platform. It was returning the UA-CH form
("macOS"/"Linux") — but real Chrome reports navigator.platform = "MacIntel" on
macOS and "Linux x86_64" on Linux. "macOS" contradicts the UA's "Intel Mac OS X"
and is a trivial bot-detection tell (platform vs UA mismatch). UA-CH
(navigator.userAgentData.platform via platform_hint) stays "macOS"/"Windows"/
"Linux" — that form is correct there.

Verified locally on bot.sannysoft.com (all rows green incl. navigator.platform=
MacIntel) + eval probes: webdriver false, no Headless in UA, real WebGL
(Apple M3 Metal, not SwiftShader), plugins/permissions consistent.

cli/Cargo.lock

@@ -45,7 +45,7 @@ dependencies = [
 
 [[package]]
 name = "agent-browser-stealth"
-version = "0.27.0-fork.21"
+version = "0.27.0-fork.26"
 dependencies = [
  "aes-gcm",
  "async-trait",

cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "agent-browser-stealth"
-version = "0.27.0-fork.21"
+version = "0.27.0-fork.26"
 edition = "2021"
 description = "Fast browser automation CLI for AI agents"
 license = "Apache-2.0"

cli/src/main.rs

@@ -658,8 +658,15 @@ fn main() {
         if clean.get(1).map(|s| s.as_str()) == Some("connect") {
             match connect::relay_url() {
                 Some(url) => {
+                    // The connect path reads `flags.cdp` (parsed from the original
+                    // argv, which was `extension connect` → None), NOT `clean`.
+                    // Without this the relay URL is dropped and we fall through to
+                    // auto-connect, grabbing some other Chrome (stale :9222) or
+                    // popping the remote-debug prompt. Point the daemon at the
+                    // relay explicitly.
+                    flags.cdp = Some(url.clone());
+                    flags.auto_connect = false;
                     clean = vec!["connect".to_string(), url];
-                    // fall through to the normal connect handling below
                 }
                 None => {
                     eprintln!(

cli/src/native/actions.rs

@@ -672,7 +672,10 @@ impl DaemonState {
                     }
 
                     let tab_id = mgr.assign_tab_id();
-                    mgr.add_page(super::browser::PageInfo {
+                    // Passively discovered (event-driven) — must NOT steal the
+                    // active tab, or a foreign/user/other-session tab opening
+                    // hijacks this session's eval/screenshot target.
+                    mgr.add_background_page(super::browser::PageInfo {
                         tab_id,
                         label: None,
                         target_id: te.target_info.target_id.clone(),

cli/src/native/browser.rs

@@ -1532,6 +1532,21 @@ impl BrowserManager {
         self.active_page_index = index;
     }
 
+    /// Add a passively-discovered page WITHOUT changing the active tab.
+    ///
+    /// On a shared browser (ab-connect), `Target.targetCreated` events stream in
+    /// for tabs the user or OTHER agent sessions open. Those are drained on every
+    /// command; routing them through `add_page` made the active tab silently jump
+    /// to a foreign tab, so the session's own `eval`/`get title`/`screenshot`
+    /// landed on the wrong page. Passively-tracked pages must not steal focus —
+    /// only explicit opens (`tab new`, switch) set the active tab.
+    pub fn add_background_page(&mut self, page: PageInfo) {
+        if self.pages.iter().any(|p| p.target_id == page.target_id) {
+            return;
+        }
+        self.pages.push(page);
+    }
+
     pub fn update_page_target_info(&mut self, target: &TargetInfo) -> bool {
         update_page_target_info_in_pages(&mut self.pages, target)
     }

cli/src/native/cdp/types.rs

@@ -106,7 +106,13 @@ pub struct TargetInfo {
     pub target_id: String,
     #[serde(rename = "type")]
     pub target_type: String,
+    // Tolerate minimal targetInfo: the ab-connect relay's synthesized
+    // Target.attachedToTarget (re-announce path) omits title/url, and real CDP
+    // occasionally omits them too. Default to empty rather than fail the whole
+    // Target.getTargets deserialize.
+    #[serde(default)]
     pub title: String,
+    #[serde(default)]
     pub url: String,
     pub attached: Option<bool>,
     pub browser_context_id: Option<String>,

cli/src/native/relay.rs

@@ -107,6 +107,22 @@ impl RelayState {
         let session_id = raw.get("sessionId").and_then(|s| s.as_str());
 
         match method {
+            // Browser-level command the daemon uses as its liveness probe
+            // (`is_connection_alive` → `Browser.getVersion`). The extension only
+            // speaks per-tab `chrome.debugger`, so forwarding it errors → the
+            // daemon would deem the connection dead and reconnect+re-discover on
+            // EVERY command, resetting the active tab (eval/screenshot drift).
+            // Answer it locally so the relay connection reads as alive.
+            "Browser.getVersion" => ClientRoute::Local(json!({
+                "id": id,
+                "result": {
+                    "protocolVersion": "1.3",
+                    "product": "Chrome/ab-connect-relay",
+                    "revision": "",
+                    "userAgent": "",
+                    "jsVersion": ""
+                }
+            })),
             // Discovery is best-effort and event-driven in real CDP; abs only
             // reads the getTargets result, so an empty ack is enough here.
             "Target.setDiscoverTargets" | "Target.setAutoAttach" => {
@@ -302,6 +318,21 @@ mod tests {
         }
     }
 
+    #[test]
+    fn browser_get_version_is_answered_locally() {
+        // Liveness probe must NOT be forwarded (the extension can't do
+        // browser-level commands) — else the daemon reconnects on every command.
+        let mut s = RelayState::new();
+        let route = s.route_client_command(1, &json!({ "id": 7, "method": "Browser.getVersion" }));
+        match route {
+            ClientRoute::Local(v) => {
+                assert_eq!(v["id"], 7);
+                assert!(v["result"]["protocolVersion"].is_string());
+            }
+            _ => panic!("Browser.getVersion must be answered locally"),
+        }
+    }
+
     #[test]
     fn attach_to_target_returns_known_session() {
         let mut s = RelayState::new();

cli/src/native/stealth.rs

@@ -270,13 +270,18 @@ pub fn strip_source_url_labels(input: &str) -> String {
     re_block.replace_all(&output, "").to_string()
 }
 
+/// The legacy `navigator.platform` value (set via the CDP
+/// `Emulation.setUserAgentOverride` `platform` field). This is NOT the UA-CH
+/// platform (see `platform_hint`): real Chrome reports `MacIntel` on macOS and
+/// `Linux x86_64` on Linux, so emitting the UA-CH form ("macOS"/"Linux") here is
+/// a detectable mismatch against the UA's "Intel Mac OS X" / Linux strings.
 fn platform_string() -> &'static str {
     if cfg!(target_os = "macos") {
-        "macOS"
+        "MacIntel"
     } else if cfg!(target_os = "windows") {
         "Win32"
     } else {
-        "Linux"
+        "Linux x86_64"
     }
 }
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-browser-stealth",
-  "version": "0.27.0-fork.21",
+  "version": "0.27.0-fork.26",
   "description": "Browser automation CLI for AI agents \u2014 stealth fork with anti-detection",
   "type": "module",
   "packageManager": "pnpm@11.1.3",