Upgrade GoLogin and Patchright for v0.2.0

.codex/skills/release/SKILL.md

@@ -6,7 +6,7 @@ description: Build, package and release anonymous-browser, or update its deploym
 # Package and release
 
 1. Use Node 22, run `npm ci` and `npm run build`.
-2. Run `npm pack` and inspect its file list. Install the tarball into a temporary consumer. Check CommonJS and ESM imports, HumanJS's pinned Patchright resolution and `ffmpeg-static` installation.
+2. Run `npm pack` and inspect its file list. Install the tarball into a temporary consumer. Check CommonJS and ESM imports, compile temporary consumers with strict NodeNext settings, and verify HumanJS's pinned Patchright resolution and `ffmpeg-static` installation.
 3. Build the Dockerfile on Linux amd64. Use temporary local diagnostic pages for browser validation; do not add tests unless requested. Do not use real posting, voting or private accounts as public fixtures.
 4. Keep README, examples and this skill aligned when lifecycle, releases or deployment behavior changes. Keep credentials and raw profile diagnostics outside this public repository.
 5. Bump package.json and package-lock.json together. Commit the reviewed change, then push a matching `vX.Y.Z` tag. The CI workflow builds and checks the installable tarball and Docker image before creating the GitHub release with SHA-256 checksums. No npm token is needed.
@@ -15,3 +15,5 @@ description: Build, package and release anonymous-browser, or update its deploym
 Consumers pin the release tarball URL and commit their npm lockfile. Use runtime secrets for GoLogin credentials. Compartment owns the consuming application; this package does not deploy itself or provide a remote browser server. Consumer rollouts follow the consuming repository's deployment procedure.
 
 The GoLogin/Patchright/HumanJS versions are deliberately pinned. Review the postinstall patch before upgrades. Never run an automatic major dependency upgrade to suppress audit findings. Keep compatibility limitations and validation evidence current in README.
+
+For GoLogin 3.0.4 / Patchright 1.63.0, retain the restored-session assignment, request-interception promise patch, safe Orbita downloader and owned-process shutdown. The SDK still ignores `restoreLastSession: false` in constructor options and does not wait for process exit when saving. Keep GoLogin types out of public declarations: its published declarations currently contain invalid imports. Recheck these facts before removing workarounds during a future upgrade.

.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
           const humanRequire = createRequire(packageRequire.resolve('@humanjs/playwright/package.json'));
           const driver = humanRequire('playwright/package.json');
           assert.equal(driver.name, 'patchright');
-          assert.equal(driver.version, '1.62.3');
+          assert.equal(driver.version, packageRequire('./package.json').dependencies.patchright);
           assert.equal(packageRequire('patchright').chromium, humanRequire('playwright').chromium);
           assert(fs.existsSync(humanRequire('ffmpeg-static')));
           NODE

README.md

@@ -9,12 +9,12 @@ A TypeScript library for GoLogin profiles controlled through Patchright, with Hu
 Requires Node.js 22 or later. Linux amd64 is the container target; macOS is available for local development. Automatic Orbita preparation supports Linux and macOS.
 
 ```sh
-npm install --save-exact https://github.com/lugovsky/anonymous-browser/releases/download/v0.1.0/lugovsky-anonymous-browser-0.1.0.tgz
+npm install --save-exact https://github.com/lugovsky/anonymous-browser/releases/download/v0.2.0/lugovsky-anonymous-browser-0.2.0.tgz
 ```
 
 Commit your application's `package-lock.json`. GitHub release assets are publicly downloadable without npm or GitHub credentials. This package is distributed as an npm-compatible tarball; it is not published to the npm registry.
 
-Installation runs a version-guarded Patchright patch and HumanJS installs `ffmpeg-static`, which downloads a platform-specific binary. Do not disable installation scripts. If your application already depends on `playwright`, set it to `npm:patchright@1.62.3` so HumanJS resolves the same driver. The installer checks this condition.
+Installation runs a version-guarded Patchright patch and HumanJS installs `ffmpeg-static`, which downloads a platform-specific binary. Do not disable installation scripts. If your application already depends on `playwright`, set it to `npm:patchright@1.63.0` so HumanJS resolves the same driver. The installer checks this condition.
 
 ## Use
 
@@ -68,7 +68,7 @@ Session options:
 - Downloads GoLogin's Orbita to `~/.gologin/browser` and reuses the cached version. `prepareOrbita()` can warm this cache. No separate Playwright browser distribution is installed.
 - Attaches with `noDefaults: true`, `isLocal: true` and a 30-second CDP deadline. Uses the existing default context without setting a viewport or replacing the profile's fingerprint or proxy.
 - Keeps the established container flags: `--no-sandbox`, `--disable-setuid-sandbox`, `--disable-dev-shm-usage`, `--disable-gpu`, plus `--headless=new` when headless. Extra flags can change browser behavior; keep them consistent across consumers.
-- Disables restored tabs for unattended headless sessions. GoLogin 2.2.8 ignores a constructor option of `false`, so the wrapper sets the instance property before launch.
+- Disables restored tabs for unattended headless sessions. GoLogin 3.0.4 still ignores a constructor option of `false`, so the wrapper sets the instance property before launch.
 - Closes task pages, sends browser-level CDP `Browser.close`, and waits five seconds for the owned process. If needed, signals only that child with SIGTERM and then SIGKILL, allowing five seconds each.
 - Restores saved window placement and calls GoLogin's profile-saving `stop()` only after process exit. If the process remains alive, skips profile saving and file removal. Driver disconnection is attempted in final cleanup.
 - Retries a connection failure once only after successful failed-launch cleanup. Never retries application operations.
@@ -105,11 +105,11 @@ This is an in-process library. It does not expose a remote browser-control serve
 
 ## Compatibility and releases
 
-The initial compatibility baseline is GoLogin `2.2.8`, Patchright `1.62.3`, HumanJS Playwright `0.11.0`, with `playwright` aliased to `npm:patchright@1.62.3`. Patchright does not officially support GoLogin; this is a maintained integration, not a guarantee of anonymity or undetectability. The pinned GoLogin dependency tree includes npm audit advisories; dependency upgrades need separate compatibility review.
+The current compatibility baseline is GoLogin `3.0.4`, Patchright `1.63.0`, HumanJS Playwright `0.11.0`, with `playwright` aliased to `npm:patchright@1.63.0`. Patchright does not officially support GoLogin; this is a maintained integration, not a guarantee of anonymity or undetectability. The pinned GoLogin dependency tree includes npm audit advisories; dependency upgrades need separate compatibility review.
 
 The postinstall patch joins Patchright's request-interception initialization promise to page initialization. This prevents a closed CDP session from producing an unhandled rejection during startup. It does not repair an unresponsive restored tab. Version and source checks deliberately fail when an upgrade needs review.
 
-CI compiles the package, installs its tarball in a fresh consumer, checks CommonJS/ESM imports and driver resolution, and builds the Linux Docker image. See [initial validation](docs/validation.md) for the Linux browser diagnostic and its limits. Browser/profile compatibility requires separate diagnostics with disposable profiles; CI does not contain GoLogin credentials or run live website actions.
+CI compiles the package, installs its tarball in a fresh consumer, checks CommonJS/ESM imports and driver resolution, and builds the Linux Docker image. See [release validation](docs/validation.md) for the Linux browser diagnostic and its limits. Browser/profile compatibility requires separate diagnostics with disposable profiles; CI does not contain GoLogin credentials or run live website actions.
 
 To release, update the package and lockfile version, commit and push, then push the matching `vX.Y.Z` tag. The [workflow](.github/workflows/ci.yml) waits for package and container checks and creates a public GitHub release containing the tarball and `SHA256SUMS`. Consumers upgrade by changing their pinned URL and lockfile through their normal review/deployment flow. Roll back by restoring the previous dependency version.
 

THIRD_PARTY.md

@@ -2,8 +2,8 @@
 
 This package's source is MIT licensed. Dependencies retain their own licenses:
 
-- GoLogin Node SDK 2.2.8: GPL-3.0.
-- Patchright 1.62.3, derived from Playwright: Apache-2.0.
+- GoLogin Node SDK 3.0.4: GPL-3.0.
+- Patchright 1.63.0, derived from Playwright: Apache-2.0.
 - HumanJS Playwright 0.11.0 and HumanJS Core: MIT.
 - `ffmpeg-static`, installed by HumanJS: GPL-3.0-or-later; downloaded FFmpeg binaries have their own build-specific licensing. See that dependency's documentation before redistributing binaries.
 - Orbita is downloaded from GoLogin separately at runtime and remains subject to GoLogin's terms. It is not included in the release tarball.

docs/validation.md

@@ -1,4 +1,22 @@
-# Initial release validation
+# Release validation
+
+## v0.2.0 — dependency upgrade
+
+Validated on 2026-09-09 with Node 22.23.2, Linux amd64, Orbita 151, GoLogin 3.0.4, Patchright 1.63.0 and HumanJS Playwright 0.11.0. These were the latest npm releases of the three libraries at validation time.
+
+- Compilation, packed-package CommonJS/ESM imports and HumanJS's Patchright driver identity passed. Fresh TypeScript consumers compiled with strict NodeNext settings without `skipLibCheck`.
+- The Docker build, Linux runtime imports and FFmpeg executable passed.
+- The local browser diagnostic retained the existing default context, null viewport override and sampled fingerprint values from v0.1.0. Offscreen shadow-DOM clearing, accented multiline typing, emoji paste and PNG capture passed.
+- Owned-process shutdown completed before SDK cleanup; operation results were preserved and repeated closure remained idempotent.
+- A forced CDP initialization timeout retried once and failed with `BrowserLaunchError`, with zero unhandled rejections and clean process exit. The same diagnostic using unpatched Patchright 1.63.0 produced two unhandled request-interception rejections. The startup patch remains necessary.
+- A disposable GoLogin profile completed a real save/restart cycle. A locally intercepted page wrote a persistent cookie and local storage; both were present after profile upload and a fresh launch. Both shutdowns completed before SDK saving, and the disposable profile was deleted. No live website actions were performed.
+- GoLogin's `restoreLastSession: false` constructor option still evaluated to `true`. Its built-in archive extractor failed against a temporary cache path containing spaces. Retain the instance assignment and safe downloader.
+
+Removed the ambient GoLogin declaration shim and duplicate constructor definition. Constructor options now use the SDK declarations. A small internal lifecycle interface remains because the SDK omits process-ownership fields and its published declarations contain invalid imports; those declarations do not leak into this package's consumer types.
+
+The dependency tree decreased by 37 installed packages, including removal of `request` and `requestretry`. npm audit findings fell from 34 to 28 (2 low, 16 moderate, 8 high, 2 critical). The remaining advisories require separate dependency remediation. Headed mode, ARM execution and application-specific workflows are outside this upgrade's diagnostics.
+
+## v0.1.0 validation
 
 Validated on 2026-09-09 with Node 22.23.2, Linux amd64, Orbita 151, GoLogin 2.2.8, Patchright 1.62.3 and HumanJS Playwright 0.11.0.