a ¦’rBrCr@rDú__dbReady never set (auto): rErFrAú ERROR: Úverdictú?Úsummaryú verdict: ú popupOpened: ÚpopupOpenedú initial.hasFocus/hidden: ÚinitialHasFocusú / Ú initialHiddenú afterPopup.hasFocus/vs: ÚafterPopupHasFocusÚafterPopupVisibilityStateú afterBlur.hasFocus/hidden: ÚafterBlurHasFocusÚafterBlurHiddenú rapid hasFocus all true: ÚrapidAllTrueú iframeAlwaysTrue: ÚiframeAlwaysTrue©rRÚresult)ÚprintÚasyncioÚiscoroutiner+Únew_contextÚnew_pagerGrIrJr rKÚget) rrRZbrowser_factoryrMÚmaybeÚbrowserrNÚctxrLrOrkÚvrr r rÚrun_one_browserWsX &"ùý rvc@s$eZdZdd„Zdd„Zdd„ZdS)Ú_AsyncProxycCs|\|_|_dSr)Ú_pÚ_browser)rZsync_handler r rrƒsz_AsyncProxy.__init__cÃs|j ¡}t||j|jƒSr)ryroÚ _AsyncCtxrx)rrtr r rro…s z_AsyncProxy.new_contextcÃsHz|j ¡Wnty Yn0z|j ¡WntyBYn0dSr)ryr r+rxÚstop©rr r rr ˆsz_AsyncProxy.closeN)r.r/r0rror r r r rrw‚srwc@s$eZdZdd„Zdd„Zdd„ZdS)rzcCs||_||_||_dSr)Ú_ctxryrx)rrtrsrr r rr”sz_AsyncCtx.__init__cÃst|j ¡ƒSr)Ú _AsyncPager}rpr|r r rrp˜sz_AsyncCtx.new_pagecÃs&z|j ¡Wnty Yn0dSr)r}r r+r|r r rr šsz_AsyncCtx.closeN)r.r/r0rrpr r r r rrz“srzc@s<eZdZdd„Zdd„Zdd„Zdd„Zd d „Zdd„Zd S)r~cCs ||_dSr)Ú_page)rrLr r rr¢sz_AsyncPage.__init__cËs|jj|fi|¤ŽSr)rrG)rrMÚkwr r rrG¤sz_AsyncPage.gotocËs|jj|fi|¤ŽSr)rrH)rZselr€r r rrH¦sz_AsyncPage.clickcËs|jj|fi|¤ŽSr)rrI)rÚexprr€r r rrI¨sz_AsyncPage.wait_for_functioncÃs|j |¡Sr)rrK)rrr r rrKªsz_AsyncPage.evaluatecÃs |j ¡Sr)rrJr|r r rrJ¬sz_AsyncPage.contentN) r.r/r0rrGrHrIrKrJr r r rr~¡sr~c Cstdƒd}zTddlm}|ƒ*}|jjdddgd}| ¡}| ¡}|j|d d ddz|jd ddWnbt yÒ}zJ| ¡dd…}| ¡|d|›d|›dœWYd}~WdƒWSd}~00| d¡} | dur8| d¡} | ¡dd…}| ¡|d| dd…›d|›dœWdƒWS| ¡Wdƒn1sV0YWn6t y˜}z|d|›dœWYd}~Sd}~00t | tƒrÄd| vrÄtd| d›ƒnÂ| dd¡}| di¡}td |›ƒtd!| d"¡›ƒtd#| d$¡›d%| d&¡›ƒtd'| d(¡›d%| d)¡›ƒtd*| d+¡›d%| d,¡›ƒtd-| d.¡›ƒtd/| d0¡›ƒ|| d1œS)2Nz === patchright-headless ===zpatchright-headlessr)Úsync_playwrightTú--no-sandboxú--disable-dev-shm-usage©ZheadlessrrSr<r=r>rBrCr@rDrTrErQrFz>Array.isArray(window.__dbLog) ? window.__dbLog.join('\n') : ''i z.__dbResult was None after __dbReady=true; log=iz ; body[:800]=zpatchright launch/run failed: rArUrVrWrXrYrZr[r\r]r^r_r`rarbrcrdrerfrgrhrirj)rlZpatchright.sync_apir‚ÚchromiumÚlaunchrorprGrIr+rJr rKÚ isinstanceÚdictrq) rMrRr‚rrsrtrLrNrOrkÚlogrurr r rÚ_run_patchright_in_thread°sN þ< .,& r‹cCst d¡duot d¡duS)NZXvfbúxvfb-run)ÚshutilÚwhichr r r rÚ _have_xvfbÞsrc Cs,tdƒd}tƒs|ddœSd}z$tjdddd d ||gdddd }Wn4tyx}z|d|›dœWYd}~Sd}~00|jdkr¦|d|j›d|jdd…›dœSd}||jvrÎ|d|jdd…›dœSz t |j |d¡d ¡¡}WnFty4}z,|d|›d|jdd…›dœWYd}~Sd}~00t|t ƒr`d|vr`td|d›ƒnÂ| dd¡}| di¡}td|›ƒtd| d ¡›ƒtd!| d"¡›d#| d$¡›ƒtd%| d&¡›d#| d'¡›ƒtd(| d)¡›d#| d*¡›ƒtd+| d,¡›ƒtd-| d.¡›ƒ||d/œS)0z=Run the probe in a real (visible-window) Chromium under Xvfb.z! === vanilla-headful-via-xvfb ===úvanilla-headful-via-xvfbzXvfb not available on PATHrQaë import json, sys from playwright.sync_api import sync_playwright url = sys.argv[1] with sync_playwright() as p: browser = p.chromium.launch(headless=False, args=["--no-sandbox", "--disable-dev-shm-usage"]) ctx = browser.new_context() page = ctx.new_page() page.goto(url + "?auto=1", wait_until="domcontentloaded", timeout=20000) page.wait_for_function("window.__dbReady === true", timeout=15000) result = page.evaluate("window.__dbResult") if result is None: log = page.evaluate("Array.isArray(window.__dbLog) ? window.__dbLog.join('\\n') : ''") browser.close() raise RuntimeError(f"__dbResult was None; log={log[:400]}") browser.close() print("___HEADFUL_RESULT___" + json.dumps(result)) rŒz-az#--server-args=-screen 0 1280x800x24z/usr/bin/python3z-cTéx)Úcapture_outputÚtextr?zxvfb-run launch failed: Nrzxvfb-run exit=z stderr=ipþÿÿZ___HEADFUL_RESULT___zno result marker; stdout=rzjson parse failed: z; raw=rArUrVrWrXrYrZr[r\r]r^r_r`rarbrcrdrerfrgrhrirj)rlrÚ subprocessÚrunr+Ú returncodeÚstderrÚstdoutÚjsonÚloadsÚsplitÚstriprˆr‰rq) rMrRÚinnerÚprocrNZmarkerrkrurr r rÚ_run_headful_via_xvfbâsF ÿý & " 6 rŸc ƒstdƒtdƒtdƒtdt›ƒtdt›ƒtƒ}t|ƒ}d|›d‰tdˆ›ƒ‡fdd „}d dlm}d}zR|ƒ4IdHš*‰tˆd|ˆƒIdH}WdƒIdHqÈ1IdHs¾0YWn4tyþ}zdd |›dœ}WYd}~n d}~00t ¡ d‡fdd„¡IdH}tj dd¡dkr>dddœ}n:tƒsZdddœ}tdƒnt ¡ d‡fdd„¡IdH}z| ¡Wnty˜Yn0dt d¡d|||gdœ}ttdƒ } tj|| ddWdƒn1sæ0Ytd t›ƒ| d!¡pi d"d#¡} | d!¡p$i d"d#¡}| d!¡p.vanilla_headlessr)Úasync_playwrightzvanilla-headlesszplaywright crashed: rQcstˆƒSr)r‹r ©Ú probe_urlr rÚ=ózmain..ZHF_SKIP_HEADFULÚ0Ú1rzskipped via HF_SKIP_HEADFUL=1zXvfb/xvfb-run not on PATHz3 === vanilla-headful-via-xvfb === SKIPPED (no Xvfb)cstˆƒSr)rŸr r¢r rr¤Hr¥zhasfocus-always-truez%Y-%m-%d %H:%M:%Sr)ZspikeÚranAtZprobeÚtestsÚwé)Úindentz Wrote rkrVÚERRORrXzOVERALL VERDICT: zREASON: zWrote ÚPASSÚREJECTr)rlÚ PROBE_PATHrrr;Zplaywright.async_apir¡rvr+rmÚget_event_loopÚrun_in_executorr#ÚenvironrqrÚshutdownÚtimeÚstrftimer&ÚRESULTS_PATHr™ÚdumpÚ_decideÚ _write_reportÚREPORT_PATH)r8r9r r¡Úr1rNÚr2Úr3Úpayloadr,Úv1Úv2Úv3Ús1Ús2Ús3ÚoverallÚreasonr )rr£rÚmainsvB&ÿ ÿ ü0 rÈc Csfd|vpd|v} d|vpd|v} d|vp.d|v}| rN| rNdd|›d|›dfS| r`dd|›fStdd „|||fDƒƒ}|d kr„dS| d¡} | d ¡p | d¡}|p®| d¡}| rà|rà|ràdd|›d|›d|rÔdn|›dfS| d¡r| rdd|›d|›dfS| d ¡r*| s*dd|›dfS|sL| d¡rLdd|›dfSdd|›d|›d|›fS)NrrAr¯z-both vanilla and patchright errored (vanilla=z , patchright=ú)zvanilla headless errored: css.|]&}t| d¡pi di¡ d¡ƒVqdS)rkrXr[N)Úboolrq)Ú.0r:r r rÚ „sÿz_decide..r)r¯uBpopup was blocked in every browser â€” focus-shift test cannot runZBASELINEzDETECTED-STEALTHzSUSPECTED-STEALTHr®zvanilla=BASELINE (z$), patchright shows stealth signal (z), headful=ZOKu" â€” differential signal confirmedÚMARGINALz>both vanilla and patchright land in BASELINE buckets (vanilla=u”) â€” no differential signal; either patchright's build does not patch hasFocus, or the patch is conditional on something this probe doesn't triggerz-vanilla already shows STEALTH-like behavior (uF) â€” control is contaminated; can't isolate patchright's contributionZDETECTEDz3headful via Xvfb also shows STEALTH-like behavior (uF) â€” the signal may be an Xvfb/headless artifact, not a stealth patchz(unexpected verdict combination: vanilla=z , headful=)Úsumr*)rÀrÁrÂrÃrÄrÅr¼r½r¾Zv1_errZv2_errZv3_errZ popups_openedZvanilla_is_baselineZstealth_signalZ headful_cleanr r rr¹{s@ÿ ÿ ÿÿ ÿr¹cCs*|d}g}| d¡| d¡| d|d›¡| d|›d¡| d|›¡| d¡| d ¡| d¡| d ¡| d¡| d¡| d ¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d¡| d ¡| d¡| d!¡| d"¡| d#¡| d$¡| d%¡| d&¡| d'¡| d(¡| d)¡| d¡| d*¡| d¡|D]ì}| d+|d,›d-¡| d¡d.|vrz| d/|d.›d-¡| d¡q&|d0}| d1i¡}| d2d3¡}| d4|›¡| d5| d6d3¡dd7…›¡| d8| d9¡›¡| d:| d;¡›d<| d=¡›d>| d?¡›¡| d@| dA¡›d<| dB¡›d>| dC¡›¡| dD| dE¡›d<| dF¡›d>| dG¡›¡| dH| dI¡›dJtdKdL„| dMg¡Dƒƒ›dNtdOdL„| dMg¡Dƒƒ›dP¡| dQ| dR¡›¡| dS| dT¡›¡| dU| dVd¡ddW…›d-¡| d¡q&| dX¡| d¡| dY¡| dZ¡|D]ô}d.|vrTqB|d0}| d1i¡}| d[g¡} | D]º} | d\i¡pŒi}| d]i¡pži}| d^i¡p°i} | d_|d,›d`| dad¡›db| dcd3¡›dd| ded3¡›db| dfd3¡›dg|r| dcd3¡ndh›dg| r$| dcd3¡ndh›di¡qxqB| d¡| dj¡| d¡|dkkrÆ| dl¡| dm¡| dn¡| do¡| dp¡| dq¡| dr¡| ds¡| dt¡| du¡nÊ|dvkrJ| dw¡| dx¡| dy¡| dz¡| d{¡| d|¡| d}¡| d~¡| d¡| d€¡| d¡| d‚¡nF| dƒ¡| d„¡| d…¡| d†¡| d‡¡| dˆ¡| d‰¡| d¡| dŠ¡| d¡| d‹¡| dŒ¡| d¡| dŽ¡| d¡| d¡ttdƒ }| d‘ |¡¡Wdƒn1s0YdS)’Nr©u,# hasfocus-always-true â€” VALIDATION REPORTÚz**Generated:** r¨z**Overall verdict:** **z**z**Reason:** z ## HypothesiszMPer `NIGHTLY-FINDINGS-2026-06-23`, stealth browser frameworks as of June 2026zMnow ship with `document.hasFocus()` patched to return `true` unconditionally,zNso the page LOOKS focused even when running headless without a window manager.zPReal headless Chromium (no WM) should report `false` once the window is blurred.zQReal headful Chromium should report `true` only when the tab/window has OS focus.zOThe signal inverts by context: a `STEALTH` framework that always returns `true`uQmakes the page appear focused when it shouldn't â€” a false positive in the OTHERzKdirection (a real headless browser correctly reports `false` after a blur).z ## MethodzIThe probe (`probe.js`) samples `document.hasFocus()` at four checkpoints:u91. **T1 initial** â€” page just loaded, should be focuseduJ2. **T2 after popup** â€” a `window.open()` popup stole OS focus from mainuJ3. **T3 after `window.blur()`** â€” main window explicitly blurred, then az< `popup.focus()` / `popup.blur()` / `window.focus()` cycleuU4. **T4 rapid x10** â€” 10 samples at 20 ms intervals (catches time-of-check patches)z,At each checkpoint it captures three values:u.- `document.hasFocus()` â€” the primary signaluS- `document.visibilityState` â€” cross-reference; should be `'hidden'` when blurredu/- `document.hidden` â€” cross-reference booleanzNIt also probes the same values inside a same-origin `srcdoc` iframe (differentuP`WindowProxy` / `Document` per the HTML spec) â€” stealth frameworks often patchzIthe top-level Document only, leaking the original behavior in the iframe.z## Verdict logicuV- **STEALTH** â€” `hasFocus` returns `true` at every checkpoint (initial, after popup,zO after blur, rapid x10). Optionally paired with `document.hidden=true` at somez2 checkpoint (inconsistent with any real browser).uQ- **BASELINE** â€” `hasFocus` correctly toggles: `true` at initial, `false` afterz@ blur()/popup steal. Consistent with real Chromium focus state.uN- **SUSPECTED-HEADLESS-NO-WINDOW** â€” `hasFocus=false` everywhere. ConsistentzK with real headless without a window manager (no OS focus ever available).uT- **BASELINE-HEADLESS** â€” `hasFocus=false` initially, mixed during rapid sampling.zE Consistent with real headless where focus is unstable without a WM.z## Testsz### `rRú`rAz**ERROR:** `rkrXrVrWz- **verdict:** z- **userAgent:** Z userAgentr‘z- **popup opened:** r[z- **initial:** hasFocus=r]z, visibilityState=`ZinitialVisibilityStatez `, hidden=r_z- **after popup:** hasFocus=rarbZafterPopupHiddenz- **after blur():** hasFocus=rdZafterBlurVisibilityStaterez- **rapid x10 all true:** rgz (true=css|]}|rdVqdS©rNr ©rËÚxr r rrÌèr¥z _write_report..Zrapidz, false=css|]}|sdVqdSrÑr rÒr r rrÌér¥rÉz- **iframe (srcdoc) probed:** ZiframeSameOriginz- **iframe always true:** riz- **`hasFocus.toString()`:** `ZhasFocusStringéPz## Per-row detailza| Stage | main.hasFocus | main.visibilityState | main.hidden | iframe.hasFocus | popup.hasFocus |z|---|---|---|---|---|---|ÚrowsrÈÚiframeÚpopupz| `r^Zstagez` | ZhasFocusz | `ZvisibilityStateZhiddenz | zn/az |z## Interpretationr®zK- **Vanilla headless Chromium** behaves as expected: `hasFocus()` is `true`zI at page load and flips to `false` after the popup steals focus or afterz( `window.blur()`. The control is clean.zE- **patchright headless Chromium** returns `hasFocus()=true` at everyzG checkpoint (initial, after popup, after blur, rapid x10). This is thezV `hasfocus-always-true` stealth signature predicted by `NIGHTLY-FINDINGS-2026-06-23`.zG- A detector can confidently flag a browser as a stealth framework whenzK `document.hasFocus()` is `true` after a `window.blur()` + popup cycle ANDzL `document.visibilityState === 'hidden'` (the latter is the cross-referencezJ that proves the window actually lost focus but `hasFocus()` still lies).rÍuI- Vanilla headless and patchright produced the same verdict bucket â€” noz& differential signal from this build.z- Possible causes:zK 1. patchright's build does not patch `document.hasFocus` in this version.zH 2. The patch is conditional (e.g. only when running in a real headlessuI context, not when launched via patchright's own driver â€” which mayz already disable the patch).zE 3. The probe's blur mechanic didn't actually blur in either browserzJ (e.g. Playwright's headless mode retains focus regardless of blur()).zC- Recommended next step: re-run with a known-stealth framework thatzG explicitly injects `Object.defineProperty(document, 'hasFocus', ...)`zJ returning `() => true`, and confirm the probe flips to DETECTED-STEALTH.zD- The control or the probe itself failed. See per-test errors above.z- Common causes:zP - Popups blocked (Chromium `--headless=new` blocks `window.open` by default inuQ some configs â€” try `--disable-features=BlockInsecurePrivateNetworkRequests`z6 or pass `--headless` instead of `--headless=new`).z* - Playwright/patchright driver mismatch.z3 - Xvfb headful path missing required system libs.z## Verdict keyuP- **PASS** â€” vanilla=BASELINE / BASELINE-HEADLESS, patchright=DETECTED-STEALTHzS or SUSPECTED-STEALTH, headful (if run) = BASELINE. Confirmed differential signal.uT- **MARGINAL** â€” both headless runs land in the same bucket, or headful disagrees.z/ Re-test with a known leaky stealth framework.uQ- **REJECT** â€” control broken (popup blocked everywhere, or both runs errored).rªÚ )ÚappendrqrÎr&r»ÚwriteÚjoin)r¿rÆrÇr©Úlinesr:rrrurÕÚrowrÈrÖr×r,r r rrºžs@ ÿÿÿÿÿÿÿþ " ÿ þ ýüû rºÚ__main__)'Ú__doc__rmr™r#rrr”Úsysr4rµZhttp.serverrrr$ÚdirnameÚabspathÚ__file__rrÛr°r·r»rrr;rPrvrwrzr~r‹rrŸrÈr¹rºr.Úexitr•r r r rÚs>+.=\#