refactor: drop utls, simplify to 2-tier strategy (HTTP + Chrome)

Remove utls TLS fingerprint spoofing entirely — it triggers
Trojan:Win32/Bearfoos.B!ml on Windows Defender.

New strategy:
  Tier 1: Plain HTTP with browser headers (~50ms)
  Tier 2: Headless Chrome via go-rod (~1-2s)

Chrome provides a real TLS fingerprint — better than utls forgery,
and passes all Cloudflare challenges utls was trying to handle.

Removed: utls dep, --no-tls-spoof flag, build tags, stub files
Renamed: fetch_tier3.go → fetch_chrome.go (now Tier 2)

Author: aksOps

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Run tests
         id: tests
         run: |
-          TEST_OUTPUT=$(go test -tags all -v -race -count=1 ./... 2>&1)
+          TEST_OUTPUT=$(go test -v -race -count=1 ./... 2>&1)
           echo "$TEST_OUTPUT"
           TEST_COUNT=$(echo "$TEST_OUTPUT" | grep -c '^--- PASS:' || true)
           echo "test_count=$TEST_COUNT" >> "$GITHUB_OUTPUT"

.github/workflows/release.yml

@@ -57,7 +57,7 @@ jobs:
           grep 'var version' main.go
 
       - name: Run tests
-        run: go test -tags all -race -count=1 ./...
+        run: go test -race -count=1 ./...
 
       - name: Cross-compile binaries
         run: |
@@ -71,7 +71,7 @@ jobs:
               OUTPUT="${OUTPUT}.exe"
             fi
             echo "Building $OUTPUT"
-            GOOS=$GOOS GOARCH=$GOARCH go build -tags all -ldflags="-s -w" -o "$OUTPUT" .
+            GOOS=$GOOS GOARCH=$GOARCH go build -ldflags="-s -w" -o "$OUTPUT" .
           done
           ls -lh dist/
 

README.md

@@ -11,21 +11,10 @@ Single Go binary. No runtime downloads, no external services, no AI, no search.
 ## Install
 
 ```bash
-# Default — Tier 1 only (plain HTTP, no AV issues)
 go install github.com/RandomCodeSpace/rawdoc@latest
-
-# With all tiers (Tier 1 + TLS spoofing + headless Chrome)
-go install -tags all github.com/RandomCodeSpace/rawdoc@latest
 ```
 
-| Build | Size | Tiers | AV Safe |
-|-------|------|-------|---------|
-| Default | ~7MB | Tier 1 | Yes |
-| `-tags tier2` | ~10MB | Tier 1+2 | May flag |
-| `-tags tier3` | ~10MB | Tier 1+3 | Yes |
-| `-tags all` | ~13MB | All | May flag |
-
-Tier 2 uses TLS fingerprint spoofing (`utls`) which triggers Windows Defender false positives (`Trojan:Win32/Bearfoos.B!ml`). The default build excludes it.
+Single binary, no AV flags, no runtime deps.
 
 ---
 
@@ -58,12 +47,11 @@ rawdoc https://www.baeldung.com/spring-kafka -v
 
 ## How It Works
 
-Three-tier fetch strategy — auto-escalates until a clean response is obtained:
+Two-tier fetch strategy — auto-escalates when needed:
 
 ```
 Tier 1: Plain HTTP (~50ms)     — works for most doc sites
-Tier 2: TLS Spoofing (~100ms)  — bypasses basic Cloudflare
-Tier 3: Headless Chrome (~2s)  — JS-rendered pages (needs Chrome installed)
+Tier 2: Headless Chrome (~2s)  — JS-rendered pages, Cloudflare (needs Chrome installed)
 ```
 
 Processing pipeline: **Fetch → Strip noise → Extract content → Convert to Markdown**
@@ -105,7 +93,6 @@ rawdoc [flags] <url>
 | `--max-time duration` | `10m` | Total runtime ceiling |
 | `--max-retries int` | `3` | Per-URL retries |
 | `--header K=V` | — | Extra header (repeatable) |
-| `--no-tls-spoof` | — | Disable utls fingerprint mimicry |
 | `--no-headless` | — | Disable Chrome fallback tier |
 
 ### Info
@@ -241,22 +228,5 @@ GOOS=darwin GOARCH=arm64 go build -o rawdoc-darwin-arm64 .
 | Requirement | Notes |
 |-------------|-------|
 | Go 1.24+ | Required to build from source |
-| Chrome / Chromium | Optional — only needed for Tier 3 (JS-rendered pages) |
-
-## Windows Antivirus Note
-
-Windows Defender may flag `rawdoc.exe` as a false positive. This happens because:
+| Chrome / Chromium | Optional — only needed for Tier 2 (JS-rendered pages, Cloudflare) |
 
-- Go statically links everything into one large binary (triggers heuristic scanners)
-- `utls` dependency spoofs TLS fingerprints (anti-detection technique)
-- `go-rod` automates headless Chrome (browser automation flagged by behavior analysis)
-
-**The code is fully open source — inspect it yourself.** To work around this:
-
-```powershell
-# Option 1: Exclude the build directory
-Add-MpPreference -ExclusionPath "D:\Development\rawdoc"
-
-# Option 2: Build with stripped symbols (smaller, fewer flags)
-go build -ldflags="-s -w" -o rawdoc.exe .
-```

crawl.go

@@ -187,7 +187,6 @@ func runCrawl(cfg *config, seedURL *url.URL) error {
 		maxRetries: cfg.maxRetries,
 		verbose:    cfg.verbose,
 		quiet:      cfg.quiet,
-		noTLSSpoof: cfg.noTLSSpoof,
 		noHeadless: cfg.noHeadless,
 		headers:    []string(cfg.headers),
 	}

fetch.go

@@ -14,7 +14,6 @@ type fetchOptions struct {
 	maxRetries int
 	verbose    bool
 	quiet      bool
-	noTLSSpoof bool
 	noHeadless bool
 	headers    []string
 }
@@ -60,17 +59,9 @@ func fetch(rawURL string, opts *fetchOptions) (*fetchResult, error) {
 		return result, nil
 	}
 
-	if isEscalatable(err) && !opts.noTLSSpoof {
-		logVerbose(opts, "[tier1] %s → %v, escalating to tier2", rawURL, err)
-		result, err = fetchTier2(rawURL, opts)
-		if err == nil {
-			return result, nil
-		}
-	}
-
 	if isEscalatable(err) && !opts.noHeadless {
-		logVerbose(opts, "[tier2] %s → %v, escalating to tier3", rawURL, err)
-		result, err = fetchTier3(rawURL, opts)
+		logVerbose(opts, "[tier1] %s → %v, escalating to tier2 (Chrome)", rawURL, err)
+		result, err = fetchTier2(rawURL, opts)
 		if err == nil {
 			return result, nil
 		}

fetch_tier3.go fetch_chrome.gofetch_tier3.go renamed to fetch_chrome.go

@@ -1,5 +1,3 @@
-//go:build tier3 || all
-
 package main
 
 import (
@@ -13,53 +11,53 @@ import (
 	"github.com/go-rod/rod/lib/proto"
 )
 
-func fetchTier3(rawURL string, opts *fetchOptions) (*fetchResult, error) {
+func fetchTier2(rawURL string, opts *fetchOptions) (*fetchResult, error) {
 	chromePath := findChrome()
 	if chromePath == "" {
-		logVerbose(opts, "[tier3] Chrome not found at any known path")
+		logVerbose(opts, "[tier2] Chrome not found at any known path")
 		return nil, &httpError{statusCode: 0, message: "Chrome not installed"}
 	}
 
-	logVerbose(opts, "[tier3] %s → using Chrome at %s", rawURL, chromePath)
+	logVerbose(opts, "[tier2] %s → using Chrome at %s", rawURL, chromePath)
 
 	l := launcher.New().Bin(chromePath).Headless(true)
 	controlURL, err := l.Launch()
 	if err != nil {
-		logVerbose(opts, "[tier3] %s → Chrome launch failed: %v", rawURL, err)
+		logVerbose(opts, "[tier2] %s → Chrome launch failed: %v", rawURL, err)
 		return nil, fmt.Errorf("chrome launch: %w", err)
 	}
 
 	browser := rod.New().ControlURL(controlURL)
 	if err := browser.Connect(); err != nil {
-		logVerbose(opts, "[tier3] %s → browser connect failed: %v", rawURL, err)
+		logVerbose(opts, "[tier2] %s → browser connect failed: %v", rawURL, err)
 		return nil, fmt.Errorf("browser connect: %w", err)
 	}
 	defer browser.Close()
 
 	page, err := browser.Page(proto.TargetCreateTarget{URL: rawURL})
 	if err != nil {
-		logVerbose(opts, "[tier3] %s → page open failed: %v", rawURL, err)
+		logVerbose(opts, "[tier2] %s → page open failed: %v", rawURL, err)
 		return nil, fmt.Errorf("browser open page: %w", err)
 	}
 
 	if err := page.WaitStable(1 * time.Second); err != nil {
-		logVerbose(opts, "[tier3] %s → page did not stabilize: %v", rawURL, err)
+		logVerbose(opts, "[tier2] %s → page did not stabilize: %v", rawURL, err)
 	}
 	page.MustWaitLoad()
 
 	html, err := page.HTML()
 	if err != nil {
-		logVerbose(opts, "[tier3] %s → failed to get HTML: %v", rawURL, err)
+		logVerbose(opts, "[tier2] %s → failed to get HTML: %v", rawURL, err)
 		return nil, fmt.Errorf("page html: %w", err)
 	}
 
 	if isCaptchaPage(html) {
-		logVerbose(opts, "[tier3] %s → CAPTCHA detected", rawURL)
+		logVerbose(opts, "[tier2] %s → CAPTCHA detected", rawURL)
 		return nil, &httpError{statusCode: 0, message: "site requires interactive challenge (CAPTCHA)"}
 	}
 
-	logVerbose(opts, "[tier3] %s → 200 (headless Chrome, %d bytes)", rawURL, len(html))
-	return &fetchResult{html: html, tier: 3, url: rawURL}, nil
+	logVerbose(opts, "[tier2] %s → 200 (headless Chrome, %d bytes)", rawURL, len(html))
+	return &fetchResult{html: html, tier: 2, url: rawURL}, nil
 }
 
 func findChrome() string {

fetch_test.go

@@ -115,7 +115,7 @@ func TestTierEscalationOn403(t *testing.T) {
 	opts := &fetchOptions{
 		timeout:    5 * time.Second,
 		maxRetries: 3,
-		noTLSSpoof: true,
+
 		noHeadless: true,
 	}
 	_, err := fetch(ts.URL, opts)
@@ -133,7 +133,7 @@ func TestTier3SkipsWhenNoChrome(t *testing.T) {
 	opts := &fetchOptions{
 		timeout:    5 * time.Second,
 		maxRetries: 1,
-		noTLSSpoof: true,
+
 		noHeadless: false, // allow tier3, but Chrome likely not found in test env
 	}
 	_, err := fetch(server.URL, opts)