Anti-detection layer; bump to 1.1.0 #4

Merged

richard merged 1 commit from anti-detection-and-v1.1 into main

2026-08-19 19:31:49 +02:00

richard commented

2026-08-19 19:28:19 +02:00

Owner

Closes the highest-value gap from the review: the spoofing was detectable as spoofing. This makes the hooks undetectable and fixes cross-surface leaks.

Anti-detection

toString masking — Function.prototype.toString is patched so every method we wrap and every getter we install reports function name() { [native code] } instead of its JS source. Each hook is registered with its exact native-looking string; ordinary user functions are unaffected.
Prototype placement — navigator/screen/window/plugins/audio accessors now live on their real prototypes (Navigator/Screen/Window/BaseAudioContext), so Object.getOwnPropertyDescriptor(navigator, 'userAgent') returns undefined like an unspoofed browser instead of exposing an own accessor.
Iframe bypass — matchOriginAsFallback: true injects into about:blank / srcdoc / blob: frames, closing the "read navigator from a fresh iframe" trick.
Date/timezone consistency — getHours/getDate/getMonth/getDay/etc. now reflect the spoofed timezone, so they no longer contradict Intl and getTimezoneOffset. (Getters only; setters stay native.)

Version

Bumped 1.0.0 → 1.1.0 — features were added since 1.0.0, and this is the store-ready build.

Verification

scripts/verify.mjs — 23 checks, incl. native-code masking, prototype placement, and Date/timezone agreement.
scripts/verify-options.mjs — 26 checks.

Both pass; compile and build clean.

🤖 Generated with Claude Code

Closes the highest-value gap from the review: the spoofing was **detectable as spoofing**. This makes the hooks undetectable and fixes cross-surface leaks. ## Anti-detection - **`toString` masking** — `Function.prototype.toString` is patched so every method we wrap and every getter we install reports `function name() { [native code] }` instead of its JS source. Each hook is registered with its exact native-looking string; ordinary user functions are unaffected. - **Prototype placement** — navigator/screen/window/plugins/audio accessors now live on their real prototypes (`Navigator`/`Screen`/`Window`/`BaseAudioContext`), so `Object.getOwnPropertyDescriptor(navigator, 'userAgent')` returns `undefined` like an unspoofed browser instead of exposing an own accessor. - **Iframe bypass** — `matchOriginAsFallback: true` injects into `about:blank` / `srcdoc` / `blob:` frames, closing the "read `navigator` from a fresh iframe" trick. - **Date/timezone consistency** — `getHours`/`getDate`/`getMonth`/`getDay`/etc. now reflect the spoofed timezone, so they no longer contradict `Intl` and `getTimezoneOffset`. (Getters only; setters stay native.) ## Version Bumped **1.0.0 → 1.1.0** — features were added since 1.0.0, and this is the store-ready build. ## Verification - `scripts/verify.mjs` — 23 checks, incl. native-code masking, prototype placement, and Date/timezone agreement. - `scripts/verify-options.mjs` — 26 checks. Both pass; `compile` and `build` clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

richard added 1 commit

2026-08-19 19:28:19 +02:00

Anti-detection layer; bump to 1.1.0 ede7cd8f1d

Make the spoofing itself undetectable and fix cross-surface leaks:

- Stealth: patch Function.prototype.toString so every hook we install
  (patched methods and spoofed getters) reports "[native code]" instead
  of its JS source. Each hook is registered with the exact native-looking
  string; normal user functions are unaffected.
- Move navigator/screen/window/plugins/audio getters onto their real
  prototypes (Navigator/Screen/Window/BaseAudioContext), so
  getOwnPropertyDescriptor(instance, prop) returns undefined like an
  unspoofed browser instead of exposing an own accessor.
- Inject into about:blank / srcdoc / blob frames via matchOriginAsFallback,
  closing the "read navigator from a fresh iframe" bypass.
- Make Date local getters (getHours/getDate/getMonth/getDay/…) reflect the
  spoofed timezone, so they no longer contradict Intl and getTimezoneOffset.

Version bumped 1.0.0 -> 1.1.0 (features added since 1.0.0).

Verification: scripts/verify.mjs now 23 checks (incl. native-code
masking, prototype placement, Date/timezone agreement);
scripts/verify-options.mjs 26 checks. Both pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

richard merged commit e020ac6947 into main

2026-08-19 19:31:49 +02:00

richard deleted branch anti-detection-and-v1.1

2026-08-19 19:31:49 +02:00

richard referenced this pull request from a commit

2026-08-19 19:31:50 +02:00

Merge pull request 'Anti-detection layer; bump to 1.1.0' (#4) from anti-detection-and-v1.1 into main