Tabs

Every page target the profile has open, newest last, chrome:// pages included. The ids are what every other tab and page route takes as tabId.

Opens a URL in a new tab. The browser navigates it itself, so this returns as soon as the tab exists rather than when the page has loaded — wait for it with POST /profiles/:id/page/wait or read it with a page route, which do wait.

Closes one tab. Closing the last one stops the profile, a couple of seconds later, through the same clean shutdown POST /profiles/:id/stop runs — cookies flushed, session written, exit marked clean. It used to leave the browser running: macOS keeps an application alive with no windows, so what was left was four processes, a Dock tile with nothing under it, and GET /running still reporting the profile. Opening another tab inside that couple of seconds cancels it, so close-then-open is not a race. A one-time profile retires to the trash, exactly as it would have on stop.

Navigates an existing tab and waits for its load event.

The visible text of the page, its title, its URL and its links. Uses innerText rather than textContent, so it is what a person sees rather than the contents of every <script> and <style> — which on a detection site is the collector’s own source.

A PNG of the tab, base64, for when the text is not the answer.

Evaluates a JavaScript expression in the page’s own world and returns its value, so it sees the page’s variables and the fingerprint exactly as the page does. An await is fine; the result is awaited. Return something JSON can carry. For the invisible world, and for refs, use POST /profiles/:id/page/evaluate.

Clicks the element a CSS selector names, as a real mouse event at its centre. Deliberately not element.click(), which dispatches an untrusted event with no preceding move. POST /profiles/:id/page/click is the fuller version: it scrolls with a real wheel first and moves along a human trajectory.

Records every request the tab makes for a number of seconds and returns them. Answers what a screenshot cannot: which third party a page really calls, whether a request went out at all, where a detector posted its verdict. The recording domain is enabled only for the window you ask for and turned off again. For recording that spans several actions, use POST /profiles/:id/page/network/start.

What the site has stored in this profile: cookies, localStorage and sessionStorage. The cookie jar is the profile’s real identity — more of what re-identifies a returning visitor lives here than in any fingerprint field.

Sets or removes localStorage or sessionStorage keys for the tab’s origin. A null value removes the key.