h4ckf0r0day/obscura

Obscura is a Rust-based headless browser engine designed for programmatic web automation and high-fidelity rendering. It provides a comprehensive suite of capabilities including a Chrome DevTools Protocol (CDP) server, a command-line interface for scraping and fetching, and a native Rust API for controlling browser instances. The system features a custom DOM and CSS layout engine that supports modern web standards like Grid and Flexbox, alongside a V8-based JavaScript runtime for executing page scripts. It also includes robust security measures such as SSRF protection, stealth modes, and bounded resource limits to ensure stability during automated tasks.

A new example file demonstrates how to launch a stealth browser, navigate to a page, wait for a selector, and retrieve element attributes.

crates/obscura/examples · high confidence

Introduces a new \tools/live-view.mjs\ script that streams screenshots from a headless Obscura browser to a local web interface. This allows users to visually monitor agent activity (such as MCP, Puppeteer, or Playwright sessions) in real time. The tool features adaptive pacing to optimize CPU usage and automatically spawns the Obscura serve process if one is not already running, ensuring a zero-config experience for watching browser interactions.

tools · high confidence

A new representative test suite has been added to validate rendering behavior across a curated list of 15 modern web sites (including React, Vue, Angular, Tailwind, and Bootstrap). The suite supports two distinct capture modes: 'fidelity' (default, deterministic with a 3-second settle time) and 'latency' (zero-settle, cold-load performance). It allows users to configure capture parameters such as viewport dimensions (1440x1000), scroll position, and animation freezing, while enforcing strict validation for settle times and capture modes to ensure consistent test results.

render-repros/representative-suite · high confidence

This change introduces the initial implementation of several Chrome DevTools Protocol (CDP) domains within the \obscura-cdp\ crate, enabling core browser automation capabilities. The Accessibility domain now supports \getFullAXTree\ to expose the page's accessibility tree. The Browser domain provides version information and window management stubs. The DOM domain implements node resolution (including \objectId\ fallbacks), querying, and file input handling. Emulation allows device metrics overrides, user-agent spoofing, and reduced-motion emulation. The Fetch domain enables request interception, while the Input domain handles mouse and keyboard events with proper text selection and surrogate pair support. Finally, the IO domain provides bounded streaming for large response bodies to prevent memory leaks.

crates/obscura-cdp/src/domains · high confidence

This change introduces the core DOM implementation for the Obscura engine, providing the foundational tree structure, HTML parsing via html5ever, CSS selector matching (including :has() and pseudo-classes), and serialization. The DOM tree supports native shadow roots, declarative shadow templates, and namespace-aware attributes. To ensure stability and performance, the implementation uses iterative algorithms for serialization and traversal to prevent stack overflows, includes bounds checking to neutralize cyclic tree attacks (mXSS), and adds tests to verify that selector and slot queries do not allocate memory proportional to unrelated DOM payloads.

crates/obscura-dom · high confidence

This change introduces the foundational browser engine components in \crates/obscura-browser/src\, including the \BrowserContext\ for managing cookies, proxies, and stealth profiles; the \Page\ implementation for handling navigation, lifecycle states, and security gates (such as restricting \file://\ access and private network SSRF); and a \profiles\ module that allows rotating User-Agent identities via environment variables. It also adds a \fork\_virtual\_url\ module to synchronize Single Page Application (SPA) routes with the Rust-side URL state, an \idle\_deadline\ module for precise macOS timer handling, and a \pdf\ module for raster-based PDF export with bounded memory limits.

crates/obscura-browser/src · high confidence

The \crates/obscura-cdp/src\ directory is now populated with the core implementation of the CDP server, including the main server entry points, request dispatching logic, and protocol type definitions. This release introduces cookie parsing that adheres to RFC 6265 default-path scoping, a hardened security boundary that gates \file://\ navigation behind the \--allow-file-access\ flag, and a connection limit mechanism (defaulting to 128) to prevent resource exhaustion. It also adds utilities for safe string truncation and object ID literal escaping to improve stability and prevent crashes from malformed inputs.

crates/obscura-cdp/src · high confidence

This entry introduces the \obscura-net\ crate, providing the core HTTP client, cookie management, and security infrastructure for the engine. It includes a robust cookie jar that implements RFC 6265 compliance (including SameSite normalization, path scoping, and domain canonicalization), a charset-aware response decoder that correctly handles non-UTF-8 encodings (e.g., GBK, Shift-JIS) via HTML meta sniffing and Content-Type headers, and a tracker blocklist loaded from the PGL domain list to prevent fingerprinting. The crate also enforces strict SSRF protections by blocking loopback, private, link-local, and special-purpose IP ranges (including CGNAT and cloud metadata endpoints) during DNS resolution and direct access, while offering an opt-out for local development via the \--allow-private-network\ flag or \OBSCURA\_ALLOW\_PRIVATE\_NETWORK\ environment variable. Additionally, it features a bounded robots.txt cache and an interceptor API for request modification.

crates/obscura-net · high confidence

Adds the \obscura\ command-line interface, providing subcommands for \serve\ (a CDP-compatible server), \fetch\ (single or batch URL retrieval with various dump formats), and \scrape\ (concurrent page extraction). The tool supports stealth mode, proxy configuration, robots.txt compliance, and V8 flag customization, enabling programmatic web interaction and automation via a Rust-based headless browser engine.

crates/obscura-cli/src · high confidence

This change adds the \obscura\ crate, providing a Rust API to control a headless browser. Users can now create \Browser\ instances with configurable proxy, stealth mode, and user-agent settings, and manage \Page\ sessions for navigation, JavaScript evaluation, and DOM querying. The API includes a \CookieStore\ for managing cookies across sessions, support for intercepting network requests and responses, and safe borrowing of DOM \Element\ handles to prevent dangling references.

crates/obscura/src · high confidence

This release adds a shared V8 watchdog thread that bounds every CDP command with a deadline, terminating hung isolates to prevent hangs and isolate leaks. It also introduces child frame realms, allowing iframes to have their own JavaScript contexts and DOM trees within the same isolate, which enables same-origin cross-frame scripting and proper lifecycle event delivery. Additionally, the module loader now supports import maps for ES module resolution, and a new markdown extraction feature allows converting page content to markdown via CDP or CLI.

crates/obscura-js/src · high confidence

The file \crates/obscura-js/js/bootstrap.js\ has been added to establish the initial JavaScript execution context. This script captures the host-provided \Deno.core\ bridge, pre-declares internal and WebIDL globals as non-enumerable to prevent fingerprinting detection, and sets up the core event handling and DOM mutation tracking infrastructure that subsequent page scripts rely on.

crates/obscura-js/js · high confidence

Adds a new optional render layer to Obscura, activated via feature flags, that provides real CSS box geometry (enabling accurate \getBoundingClientRect\ and \IntersectionObserver\ results) and rasterized PNG screenshots. This includes a complete CSS cascade engine for selector matching, a layout core using Taffy, and a paint engine using tiny-skia and cosmic-text for text and image rendering, along with a CLI tool for offline file painting.

crates/obscura-render/src · high confidence

Added three new CI scripts in the \scripts/ci\ directory to harden the pull request validation process. \pr\_policy.py\ enforces security and scope policies by checking for pinned actions, blocking privileged workflow additions, preventing symlinks in control paths, and warning on large changes or missing tests. \compare\_obstacle.py\ compares obstacle-course correctness and latency between a base and candidate build, failing the release if regressions occur. \perf\_smoke.py\ runs interleaved latency and peak-RSS comparisons across DOM-build and storage scenarios to detect performance regressions exceeding defined thresholds.

scripts · high confidence

The MCP HTTP transport now enforces strict security boundaries to prevent denial-of-service attacks and unauthorized access. Request bodies are capped at 1 MiB, and headers, lines, and batch sizes are limited to prevent memory exhaustion. A 30-second timeout prevents slow-read attacks, while an optional Origin allowlist restricts cross-origin requests. Access is secured via a mandatory 32-byte \OBSCURA\_MCP\_TOKEN\ using constant-time comparison to prevent timing attacks.

crates/obscura-mcp/src · high confidence

The Taffy layout engine has been restructured to improve code reuse and maintainability. New shared modules have been introduced: \compute/common/alignment.rs\ provides generic CSS alignment logic (including safe/unsafe overflow fallbacks and offset calculations) used by both Flexbox and Grid algorithms, while \compute/common/content\_size.rs\ handles generic content size contributions. Additionally, \geometry.rs\ now defines core layout primitives like \Rect\, \Size\, and \AbsoluteAxis\, and \style\_helpers.rs\ offers convenience functions for grid templates and style values. These changes refactor existing layout computation logic into reusable components without altering the external API or layout behavior.

vendor/taffy/src, vendor/taffy/src/compute/common, vendor/taffy/src/util · high confidence

The CLI build process has been updated to automatically append the short Git commit hash to the version string for local, non-tagged builds (e.g., \1.0.0-dev+abc1234\). This allows users to distinguish between different local checkouts of the same version. Tagged releases and builds without Git access continue to use the standard version number.

crates/obscura-cli · high confidence

The build process now embeds a more specific version string into the binary. For local development builds, the version includes the short Git commit hash (e.g., \1.0.0-dev+abc1234\), allowing users to distinguish between different local checkouts. For release builds, the version is derived from the Git tag. This version information is exposed via the MCP server info, enabling users to verify exactly which code version is running.

crates/obscura-mcp · high confidence

The layout engine in \vendor/taffy/src/compute\ has been replaced with a new implementation that introduces dedicated modules for block, flexbox, grid, and float layouts. This change adds support for CSS floats and block formatting contexts, refines flexbox sizing to transfer aspect ratios through final sizes, and aligns grid sizing semantics with the specification. Users will see updated layout behavior for floated elements, improved handling of intrinsic sizing and collapsed margins, and more accurate constraint enforcement for shrink-wrapped grid items.

vendor/taffy/src/compute · high confidence

The grid layout computation in vendor/taffy has been completely rewritten to better align with the CSS Grid Level 1 specification. This change introduces new modules for handling explicit and implicit grid sizing, item placement, track sizing, and alignment. Key behavioral improvements include respecting auto margins on overflowing grid items, matching fit-content and replaced element sizing semantics, and constraining shrink-wrapped grid items. The new implementation also separates contained grid contributions from stretch alignment and improves Playwright compatibility and engine performance through optimized allocation strategies and more accurate intrinsic size calculations.

vendor/taffy/src/compute/grid · high confidence

The Taffy layout engine in vendor/taffy/src/tree has been updated to improve responsive layout, retained rendering, and Playwright compatibility. This update introduces a new cache system (cache.rs) to store layout computation results, enhancing performance. It also refines intrinsic sizing to preserve collapsed margins and constrains shrink-wrapped grid items for more accurate layout. The update includes changes to the layout input/output structures (layout.rs) and the TaffyTree implementation (taffy\_tree.rs) to support these improvements.

vendor/taffy/src/tree · medium confidence

The vendored cosmic-text library has been updated to align text layout with CSS semantics, including support for CSS \word-break\ and \overflow-wrap\ properties via the new \CssLineBreak\ struct, and to honor variable font instances. The text editor component now correctly applies word spacing during layout and painting, and the font fallback system has been refined to better resolve variations on fallback faces.

vendor/cosmic-text · high confidence

The vendored Taffy library in vendor/taffy/src/style has been updated to a new version that replaces the previous enum-based style definitions with a struct-based system (e.g., separating position keywords from overflow safety modifiers in alignment). This update introduces new style modules for alignment, available space, block layout, flexbox, floats, and grid, along with a compact length representation for memory efficiency. The change aligns the layout engine with updated CSS Grid sizing semantics, specifically constraining shrink-wrapped grid items and separating contained grid contributions from stretch, which may alter how grid layouts are computed and rendered.

vendor/taffy/src/style · high confidence

The build process for the JavaScript runtime now detects when cross-compiling and uses a target-specific \mksnapshot\ tool to generate V8 snapshots compatible with the target architecture. Previously, using the host V8 for snapshotting caused crashes on the target device due to architecture-specific heap layout differences. This change ensures that the embedded JavaScript environment starts correctly on cross-compiled targets (such as Android ARM64) by patching the snapshot version and combining the target-specific V8 blob with the architecture-independent deno\_core sidecar data.

crates/obscura-js · high confidence

Added regression tests for CDP concurrency, accessibility, and input handling; Added regression tests for browser engine parity and stability fixes; Added regression tests for layout performance, word spacing, and text decoration; Added render-repro fixtures and verification harness for CSS layout and rendering parity; Added tests for MCP HTTP server security and stability; Added tests for binary fetch, input accept attribute, and unhandled promise rejections; Added tests for media query lifecycle, isolate teardown, and reduced-motion emulation; Expanded test coverage for CLI rendering, networking, and worker stability.

This change introduces the initial dependency manifest (Cargo.lock) and workspace configuration for the Obscura project, establishing the Rust 2021 edition baseline. It defines the core crate structure (obscura-browser, obscura-net, obscura-render, etc.) and pins key libraries including the Taffy layout engine, tiny-skia rasterizer, ab\_glyph text shaping, and the Deno Core JavaScript runtime. The configuration also sets up the reqwest HTTP client with rustls-tls and specific compression features, while vendoring local patches for Taffy and cosmic-text to support grid and variable-font rendering.

(dependencies) · high confidence

The vendored copy of the cosmic-text library has been updated to version 0.14.2, and the taffy layout library has been added to the vendor directory. These updates bring in the latest text shaping, layout, and rendering capabilities from these upstream Rust crates.

vendor · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• First survey — no prior run to compare against. CAI 44.

• Code Health 50
• Architecture 97
• Maturity 55
• Readiness 53
• Security 83
• Domain Modelling 100
• Accessibility 30
• Performance 60

• 300 commits — 89 feature/other, 211 fixes

• (repo) — 160 commits
• crates/obscura-js — 47 commits
• crates/obscura-cdp — 26 commits
• crates/obscura-render — 14 commits
• crates/obscura-browser — 11 commits
• crates/obscura-net — 11 commits
• (root) — 9 commits
• crates/obscura-cli — 8 commits
• crates/obscura-mcp — 3 commits
• scripts/ci — 2 commits
• .github/workflows — 1 commit
• assets/sponsors — 1 commit
• crates/obscura — 1 commit
• crates/obscura-dom — 1 commit
• docs/Build-from-source.md — 1 commit
• docs/Environment-variables.md — 1 commit
• render-repros/capture-media-emulation.py — 1 commit
• skills/obscura — 1 commit
• vendor/taffy — 1 commit

• fix: Fix Origin on same-origin non-GET requests
• fix: Merge branch 'fix/mcp-shutdown-cookie-save' into pr-1117
• fix: Merge branch 'fix/mcp-shutdown-cookie-save' into pr-1233
• fix: Merge branch 'fix/ready-timer-yield-20260930' into fix/awaited-routing-20260930
• fix: Merge branch 'fix/ready-timer-yield-20260930' into fix/focus-scroll-20260930
• fix: Merge branch 'fix/ready-timer-yield-20260930' into fix/frame-watchdog-20260930
• fix: Merge branch 'fix/ready-timer-yield-20260930' into fix/heap-statistics-20260930
• fix: Merge branch 'fix/ready-timer-yield-20260930' into fix/navigation-recording-20260930
• fix: Merge branch 'fix/ready-timer-yield-20260930' into fix/scheduler-fairness-20260930
• fix: Merge branch 'main' into fix/mcp-font-directory
• fix: Merge main into trusted CI dependency cache fix
• fix: Merge pull request #1000 from Yubo-Cao/fix/999-webidl-operations-enumerable
• fix: Merge pull request #1004 from Railly/fix/accessible-names-and-visibility
• fix: Merge pull request #1006 from mnaza/fix/backspace-surrogate-pair-1005
• fix: Merge pull request #1009 from mnaza/fix/url-setter-conformance-1008
• fix: Merge pull request #1010 from lisa0314/fix/995-stealth-tracker-opt-out
• fix: Merge pull request #1014 from mnaza/fix/remove-attribute-id-index-1013
• fix: Merge pull request #1016 from mnaza/fix/mcp-search-unicode-offsets-1015
• fix: Merge pull request #1020 from mnaza/fix/transform-layer-paint-resilience-1019
• fix: Merge pull request #1022 from zorahrel/fix/canvas-stroke-and-gradients
• …and 280 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

h4ckf0r0day/obscura was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.