🌐 Nazak Browser Studio

Hardware-Isolated Anti-Detect Browser • Local CDP Automation API • Action Synchronizer • Scenario Warmup • YouTube Shorts Autoposter

Free Dolphin{anty}-style Alternative • Local CDP Automation REST API • Batch Cookie Import/Export • Real-Time Action Synchronizer • Autonomous Scenario Warmup • Live 2FA TOTP RFC 6238 Generator • User-Selectable Secrets Encryption • FFmpeg Video Uniqueizer • Stealth Bezier Motorics

📥 Download Portable EXE (v1.15.1 Release) • 📖 Architecture & Features • 🌐 Complete REST API & Swagger Docs • 💻 CLI Reference (GUI parity, AI-agent friendly) • 🤖 Local Automation API • 🚀 Quick Start • 🧪 Tests

---

📌 Architecture and Features

Nazak Browser Studio is an enterprise-grade desktop suite for Windows combining deep Chromium hardware spoofing, multi-account Google/YouTube farm management, local CDP automation REST API for Playwright/Puppeteer/Selenium, real-time action synchronization, and autonomous stealth content publishing.

flowchart TD
    A[Purchased Accounts / Batch Cookies / Proxies] -->|Batch Import & Farm Generator| B(Nazak Provisioning & Mass Generator)
    B -->|Hardware Fingerprint Synthesis| C[Isolated Chromium Profile]

    subgraph Hardware Isolation Shield
        C --> D1[GPU & WebGPU: RTX 4090 / 3080]
        C --> D2[Native Function Cloaking & Proxy toString]
        C --> D3[Canvas, OffscreenCanvas & WebAudio Noise]
        C --> D4[Local Fonts & SpeechSynthesis Matching]
        C --> D5[WebRTC Candidate Sanitizer & Timezone TZ]
        C --> D6[Organic Profile History Seeder SQLite]
    end

    subgraph External Automation & Scripting
        C --> F1[Dolphin-Compatible Local REST API]
        F1 --> F2[Playwright / Puppeteer connect_over_cdp]
        F1 --> F3[Real-time Action Synchronizer & Win32 Grid]
    end

    subgraph Automation & Autoposter
        C --> E1[Google Login + 2FA TOTP RFC 6238]
        E1 --> E2[Autonomous Scenario Warmup & Trust Booster]
        E2 --> E3[FFmpeg Video Uniqueizer -map_metadata]
        E3 --> E4[Stealth CDP Upload with Bezier Motorics]
        E4 --> E5[Live YouTube Shorts Published 🚀]
    end

Loading

---

🤖 1. Local Automation API & Dolphin{anty} Parity

Enables external automation scripts in Python, Node.js, Go, or C# to connect directly to warmed profiles with unique hardware footprints using the standard Chrome DevTools Protocol (CDP).

📘 Interactive Swagger UI: http://127.0.0.1:8899/docs or http://127.0.0.1:8899/swagger 📖 Full REST API Documentation: docs/API_REFERENCE.md

🔗 Dolphin{anty} Compatible Local Endpoints:

• GET /v1.0/browser_profiles — list all profiles with live statuses, proxy info, and tags.
• GET /v1.0/browser_profiles/{profile_id}/start — start browser profile, dynamically allocate a free CDP port, and return { "success": true, "automation": { "port": 9222, "wsEndpoint": "ws://...", "ws_endpoint": "ws://..." } }.
• GET /v1.0/browser_profiles/{profile_id}/stop — gracefully terminate browser instance.
• GET /v1.0/browser_profiles/active — inspect all actively running browsers and their CDP ports.

💡 Playwright Connection Example (Python):

import requests
from playwright.sync_api import sync_playwright

# 1. Launch isolated profile via Nazak Local API
resp = requests.get("http://localhost:8899/v1.0/browser_profiles/prof_01/start").json()
ws_endpoint = resp["automation"]["wsEndpoint"]

# 2. Connect Playwright directly over CDP
with sync_playwright() as p:
    browser = p.chromium.connect_over_cdp(ws_endpoint)
    context = browser.contexts[0]
    page = context.pages[0] if context.pages else context.new_page()

    # Fully operating with isolated cookies, proxy, and hardware fingerprints!
    page.goto("https://www.google.com")
    print(page.title())

---

🍪 2. Batch Cookie Management (Import / Export)

• Universal Multi-Format Parser:
  • Auto-detection of profile delimiters: === Profile 01 ===, --- Name ---, [Profile Name].
  • JSON maps { "Account_1": [...], "Account_2": [...] }.
  • Auto-creation of new isolated browser profiles on the fly for unmapped sessions.
• Folder and ZIP Archive Ingestion:
  • Ingest folders containing .json or .txt (Netscape format) files.
  • Decompress and batch-load multi-profile .zip archives.
  • Bulk export selected or all profile cookies into a structured portable ZIP archive.

---

⚡ 3. Action Synchronizer & Window Grid

• Real-Time Action Replication:
  • Control a single primary profile (Master) — all mouse clicks, keystrokes, navigation events, and scrolls can be broadcasted to dozens of secondary profiles (Workers).
• Anti-Detection Randomization (Humanizer):
  • Sub-pixel randomized cursor coordinate jitter.
  • Micro-delays (20–80 ms) eliminating robotic machine synchronicity.
• Win32 Window Grid Tiling:
  • 1-click automatic arrangement of all active browser windows into a balanced 2×2, 3×3, or 4×4 monitor grid.

---

🔥 4. Scenario Builder & Autonomous Warmup

• Pre-Built Multi-Step Warmup Scenarios:
  • E-Commerce & Google Ads Trust Booster: organic Google searches, SERP dwell time, product browsing on marketplaces, cookie consent dialog acceptance.
  • YouTube & Shorts Audience Warmup: feed scrolling, preview dwell, organic video viewing sessions.
  • Crypto & Web3 Investor Farming: CoinMarketCap browsing, DeFi protocol exploration, crypto whitepaper dwell.
  • Finance & High-CPC Banking Footprint: accumulation of premium Tier-1 financial advertising cookies.
• Concurrent Execution Pool:
  • Batch launch scenarios across profile clusters with fine-grained concurrency control (max_concurrency).

---

📦 5. Mass Farm Generator & Portable Bundles (.nazak)

• Mass Profile Generation:
  • Create 1 to 100+ fully isolated profiles in 1 click.
  • Automatic Round-Robin proxy assignment across the pool.
  • Authentic OS distribution (Windows 10/11, macOS Sequoia, Linux Ubuntu).
• Portable .nazak Bundles:
  • Export complete browser profile state (hardware fingerprints, storage sessions, cookies, extensions) into a single portable .nazak package.
  • Instant one-click import on any workstation with zip-slip traversal protection.

---

📱 6. Mobile Proxies & IP Rotation Links

• Support for rotation URLs in multiple formats: host:port:user:pass:http://change-ip, host:port:user:pass|http://change-ip, [proxy]#[rotation_url].
• Direct "Rotate IP" trigger button in GUI tables and via REST endpoint POST /api/profiles/{id}/rotate-proxy.

---

🛡️ 7. Total Hardware Shield v2.6 & Enterprise Stealth Architecture

• Native Function Cloaking (makeNative / toString Proxy): All hooked functions, getters, and prototype descriptors (including navigator.webdriver getter) are shielded through a proxy of Function.prototype.toString. Anti-fraud verification scripts (CreepJS, DataDome, Cloudflare Turnstile) receive pristine function () { [native code] } reflection strings without tampering signals.
• Hardware Emulation (WebGL & WebGPU):
  • WebGL: UNMASKED_VENDOR/RENDERER plus ~25 limit constants (texture units, vertex/fragment uniform vectors, attribs, cube-map sizes, aliased ranges) matching a coherent desktop-GPU profile; the WEBGL_debug_info extension getter is wrapped so the host GPU cannot leak through ext.getParameter.
  • WebGPU: Intercepts navigator.gpu.requestAdapter() to synchronize requestAdapterInfo() and adapter.info with the spoofed GPU vendor and architecture.
• Platform-Aligned Font, Speech & Plugin Spoofing:
  • queryLocalFonts: Emulates the Font Access API with authentic OS font family lists (Windows: Segoe UI, Calibri; macOS: San Francisco, Helvetica; Linux: DejaVu Sans, Liberation).
  • speechSynthesis.getVoices: Voice pools match real distributions (Windows 12 SAPI voices, macOS 12, Linux 8) with a per-profile seeded subset.
  • navigator.plugins / mimeTypes: The exact desktop-Chrome shape (5 PDF plugin entries, 2 mime types each, real PluginArray/MimeTypeArray prototypes) — an empty array is a headless tell.
• Sub-Perceptual Deterministic Noise Injection:
  • Canvas 2D & OffscreenCanvas Noise: LCG pseudo-random perturbation across the FULL canvas surface (toDataURL/toBlob included), re-seeded per read so two reads never cancel out.
  • WebAudio & OfflineAudioContext Noise: Deterministic jitter across live AudioBuffer and OfflineAudioContext.startRendering; sampleRate/baseLatency/numberOfChannels pinned to the profile (host sound-card values leak otherwise).
  • Sub-pixel Font Measurement & DOM Jitter: Micro-jitter added to CanvasRenderingContext2D.prototype.measureText metrics and Element.prototype.getBoundingClientRect, re-derived per call.
  • performance.now(): Per-profile sub-100µs jitter decorrelates the host scheduler's timing signature while keeping the timer monotonic.
• Network & Runtime Leak Protection:
  • WebRTC Candidate Sanitizer: Automatically strips RFC 1918 private IPv4 addresses (10.x, 192.168.x, 172.16-31.x) and IPv6 mDNS candidates from SDP payloads — including trickle-ICE candidates and createAnswer.
  • Timezone Synchronization: The CDP stealth injector applies Emulation.setTimezoneOverride to every page session (live-verified — JavaScript Intl stays locked to the profile timezone, with full NumberFormat/DateTimeFormat locale consistency), backed by the --time-zone-for-testing={timezone} flag and the TZ process environment for C++-side alignment. Offsets are always resolved DST-aware.
  • matchMedia: prefers-color-scheme / prefers-reduced-motion / DPR queries answer from the profile, not the host.
  • Anti-Port Scanning Shield: Blocks every loopback fetch target from the page except the local API port — the profile's own DevTools endpoint is unreachable.
• Cluster-Signature Hygiene (farm-level anti-detect):
  • Window position randomized per launch (never a farm-wide constant), history host-sets unique per profile (110-URL pool: popular core + long tail), media-device labels drawn from realistic pools, battery states that actually vary, GREASE brands keyed to the browser major, and the CDP binding name randomized per profile.
• Organic Profile History Seeder (SQLite):
  • Eliminates "empty bot profile" heuristics by injecting authentic WebKit microsecond timestamps into Chromium's native Default/History database across the past 14 days with realistic visit frequencies and a per-profile host-set (popular core shared, long tail unique).
  • 1-click execution via REST API (POST /api/profiles/{id}/seed-history?entries_count=25).
• DevToolsActivePort Handshake: Zero-race CDP connection resolving ephemeral ports and GUID paths directly from Chromium runtime state, with automatic stale port lock cleanup.

---

🔑 8. Account Provisioner & Built-In RFC 6238 2FA TOTP Engine

• Batch Import from All Major Marketplaces (DarkStore, Retriv, AccsMarket): login:pass:2fa:recovery.
• Integrated RFC 6238 TOTP Engine: Base32 secret decoding with dynamic auto-padding and real-time OTP calculation.
• Autonomous End-to-End Authentication: Automated Google sign-in and dismissal of YouTube Studio onboarding prompts.

---

🎬 9. YouTube Shorts & Instagram Reels Stealth Autoposter & Video Uniqueizer

• Deep FFmpeg Video Uniqueization: Strips metadata (-map_metadata -1), applies 3% micro-crop, 1080×1920 vertical conform, imperceptible frame noise, and subtle audio pitch/tempo shift.
• Spintax Title & Description Generator: {Best|Top} Shorts/Reels for {Tech|Crypto} ⚡ {tg} {promo}.
• Unified Multi-Platform Pipeline: Single workflow orchestrating autonomous uploads for both YouTube Shorts and Instagram Reels with humanized Bezier mouse trajectory motorics and character-by-character typing.

---

🔐 10. Secrets Storage — User-Selectable Encryption Mode

• User Choice Principle: Credentials (passwords, TOTP seeds) storage mode is chosen exclusively by the user:
  • plain — Readable plaintext (default, zero setup). nazak account import prints an explicit warning when this mode is active, because passwords and 2FA seeds then live unencrypted in data/profiles.json.
  • dpapi — Windows DPAPI user-scoped hardware-bound encryption.
  • passphrase — Fernet (AES-128-CBC + HMAC) with PBKDF2-HMAC-SHA256 (600,000 iterations). Passphrase is never stored on disk.
• Automatic Masking: API and GUI endpoints always return masked tokens (ab...yz) to prevent accidental leaks — and so does the CLI (profile get, proxy test): full plaintext only with the explicit global flag --reveal (or NAZAK_REVEAL=1).
• Local API perimeter: the server only accepts requests whose Host/Origin/Sec-Fetch-Site say "local". Binding to a non-loopback host (--host 0.0.0.0, Docker) now refuses to start without NAZAK_API_TOKEN, because a client can always send Host: 127.0.0.1. The token is then passed as X-API-Key (CLI: --api-key).

---

🗂 Project Layout (v1.15.1)

The v1.15.1 tree keeps the decomposed layout introduced in v1.12.0 (two former monoliths split into routers and a profiles package, one task runner for the GUI) and layers a shared secret masker (nazak/core/secret_masking.py) used by both the API and the CLI. Compatibility is preserved: every old import path and patch() target still works.

Area	Where it lives now
REST API	nazak/api/server.py is a thin composition root; endpoints live in nazak/api/routers/ (system, profiles, automation, proxies, cookies, warmup, synchronizer, autopost), request bodies in nazak/api/schemas.py, the Host/Origin/token/CSP perimeter in nazak/api/security.py, the WebSocket hub in nazak/api/realtime.py, lazy singletons in nazak/api/deps.py. All profile writes go through the service (no unlocked dict writes)
Profiles & storage	nazak/core/profile_manager.py is a facade over nazak/core/profiles/ (store_json / store_sqlite, service, bundles, files, merge, constants, presets) — persisted delete-tombstones, mark_seen_empty_store (a delete-all is never reseeded), stale-snapshot resurrection guard
Desktop UI	nazak/gui/task_bridge.py (one QThread, busy-guard, cancel(), headless inline mode) + nazak/gui/tasks.py (Qt-free tasks with a per-profile finally-sweep in the autopost batch); nazak/gui/workers.py keeps the original worker classes and signal names — every cancel path now delivers its completion signal
Launcher safety	nazak/core/browser_launcher.py — stored pids are re-validated against the process image before is_profile_running()/stop() trust them (a rebooted pid can never get an innocent process killed)
Configuration	nazak/config.py — paths only; ensure_data_dirs() provisions data/ and is called by the real entry points, not at import time

Full map, storage-backend details and the operations/hardening notes: API reference § Code Map · § Storage Backends · § Operations & Hardening.

---

🚀 Quick Start

🪟 Windows: Pre-Built Binary (Recommended)

1. Download the latest release from the Releases section.
2. Extract the archive and launch NazakBrowserStudio.exe (or start_app.bat).

---

🐍 Running from Source (Python 3.10+)

# Install requirements
pip install -r requirements.txt
playwright install chromium

# Launch Native Windows 11 Fluent GUI
python -m nazak.main --mode gui

# Or launch headless REST API and Web Studio
python -m nazak.main --mode web

# Or use the full CLI (1:1 parity with the GUI, `--json` for AI agents)
python -m nazak.cli system doctor --json
python -m nazak.cli profile list --json
python -m nazak.cli cdp start prof_01 --json

📖 Full CLI documentation: docs/CLI_REFERENCE.md — 61 commands in 12 groups (profile, cookie, proxy, warmup, scenario, sync, autopost, account, cdp, secrets, system, legacy aliases), machine-readable system schema, stable exit codes 0/1/2/4, secrets masked by default (--reveal to show them).

---

🐳 Docker / Compose (optional)

The image runs the headless API + Web Studio (--mode web). Because a published port is reachable on every host interface, the server requires NAZAK_API_TOKEN whenever it binds a non-loopback host (inside a container it always does):

# .env next to docker-compose.yml
NAZAK_API_TOKEN=change-me-to-a-long-random-secret

docker compose up -d --build      # publishes 127.0.0.1:8899:8899 only
curl -H "X-API-Key: change-me-to-a-long-random-secret" http://127.0.0.1:8899/api/system/info

docker compose up fails fast with an explicit message if NAZAK_API_TOKEN is missing. To reach the API from another machine, change the port mapping to "8899:8899" and keep the token — that combination is the only supported exposed setup. Runtime profiles/cookies live in the bind-mounted ./data (never baked into the image: .dockerignore excludes data/ and .git). .github/workflows/docker.yml builds the image and checks the runtime contract on every change to the Docker files; the same scenario was verified locally against Docker 29.8.2 (docker build → 16/16 runtime checks → docker compose up -d --build).

The image is multi-stage and runs as the unprivileged user nazak (uid/gid 10001) with a HEALTHCHECK that probes /api/system/info. Since the app writes into the bind mount, make sure ./data is writable by that uid — once, on the host:

sudo chown -R 10001:10001 ./data

Profile storage is selectable in the container too: NAZAK_PROFILE_STORE=json (default) or sqlite (profiles.db in the same ./data, with a one-shot migration that keeps profiles.pre-sqlite.<ts>.bak).

🪟 Windows note: Docker Desktop uses the WSL2 backend, so wsl --install (in an administrative PowerShell) plus a restart is required before the engine can start on a machine where WSL is absent.

---

🧪 Test Coverage

The project is backed by a comprehensive regression and unit test suite comprising 1096 collected tests (1090 selected; 6 live tests are deselected by default, and the opt-in live Chromium job in CI runs them against a real browser). Every previously xfail-documented bug has been fixed — the suite is fully green with no known open defects.

python -m pytest tests -q

========================== 1090 passed, 6 deselected ===========================

The suite is green with all dependencies installed (PyQt6/qfluentwidgets, playwright, ffmpeg). CI runs the full matrix (Windows + Ubuntu × Python 3.10–3.13) with a coverage floor of 65 %, then re-runs the backend-agnostic API/store suites with NAZAK_PROFILE_STORE=sqlite — see CHANGELOG and API reference § Storage Backends.

New in v1.12.0: tests/test_p0_api_split.py (routes/exports/handler identity after the API monolith split), tests/test_p0_sqlite_store.py (SQLite roundtrip, JSON→SQLite migration, single-row upserts, corrupt-JSON survival, bare-list format), tests/test_p0_task_bridge.py (TaskBridge inline sync/async, busy-guard, cancel, error, progress) and tests/test_p1_platform_hardening.py (import purity, log rotation, dependency drift, container and CI contracts, version consistency across the release artefacts, documentation links and English-only docs).

Anti-detect hardening (v1.12.2): tests/test_human_cursor.py (cursor overshoot rate, asymmetric speed peak, no teleport jumps) and tests/test_noise_freshness.py (per-call reseed of canvas/audio/rect noise, all hooks intact).

Reliability & anti-detect cleanup (v1.13.0): tests/test_launcher_registry_concurrency.py (thread-hammer stop/is_running, 50 parallel registrations vs a sweeping monitor, RLock reentrancy, DevTools-poll early return), tests/test_frozen_build_contract.py (every nazak module reachable from main.py via static imports; spec excludes never shadow a module), tests/test_secret_masking.py (one masking contract for the CLI and API surfaces) and tests/test_synchronizer_stop_contract.py (pump-join on stop/restart).

Full anti-detect audit closure (v1.14.0): the battery/device/voice distribution contracts, per-profile binding names, loopback fetch-shield, and the generated stealth.js passing node --check on all three platforms are pinned in the existing suites (test_hardware_isolation_fuzzing, test_services_and_parsers_deep, test_synchronizer_engine, test_round3b_stealth_and_sync, test_browser_cdp_resilience).

Concurrency hunt (v1.15.0): the synchronizer stop/restart contract (a stuck pump's late cleanup is session-scoped), the eager per-profile binding name on the injector handle, the bounded per-client WebSocket send ceiling and the GUI batch finally-sweep are pinned in test_synchronizer_stop_contract, test_synchronizer_engine, test_cdp_injector, test_api_routers_deep (test_s03_*) and test_runtime_and_cli_deep (test_g01_*).

Store & API integrity (v1.15.1): tests/test_store_integrity_round7.py (deliberate delete-all never reseeded, stale snapshots cannot resurrect deleted profiles on either backend, bounded sync-command queue, stale commands answered), tests/test_api_write_paths_round8.py (unlocked dict writes cannot crash concurrent saves; the check endpoint never rewrites the spoofed fingerprint) and the updated test_api_routers_deep.py health-check contract (geo lookup recorded on the result, fingerprint untouched).

New in v1.10.0: tests/test_cli_parity.py (12 tests) and tests/test_cli_agent_comfort.py (7 tests) cover the CLI contract — every GUI group, --json output, exit codes, and the machine-readable system schema.

Round-3 audit regressions: tests/test_round3_api_fixes.py, tests/test_round3_cli_fixes.py and tests/test_round3_publish_fixes.py (29 tests together: secret masking with --reveal, honest account totp, @file/--out hardening, publish-uncertain retry policy, warmup clamps, API perimeter), tests/test_web_ui_injection_guards.py (5 tests: HTML-injection guards) and the second-pass suites tests/test_round3b_api_bounds.py (12), tests/test_round3b_stealth_and_sync.py (16), tests/test_round3b_storage_and_packaging.py (9), tests/test_round3b_cli_background.py (4), tests/test_web_assets_hardening.py (7) and tests/test_gui_and_tools_hardening.py (8).

• test_cdp_injector.py — CDP stealth injector: UA/Client-Hints rebuilt from the real running Chrome version, per-session timezone override, Fetch.authRequired proxy credential answering (regression: handleAuthRequests must be enabled or 407 challenges never fire), injector handle lifecycle.
• tests/live/ — opt-in live suite (pytest -m live): real Chromium stealth launch (applied=True), synchronizer master→worker replication, and a real-browser XSS check of the dashboard (test_dashboard_xss_live.py — drives Chromium against the live Web Studio, feeds attacker-controlled health.ip/country/city values, and fails if the injected script executes or reaches the local API); deselected by default in regular runs.
• test_advanced_stealth_and_seeder.py — WebGPU hardware emulation, native function makeNative/toString Proxy cloaking, local font spoofing (queryLocalFonts), platform-aligned speechSynthesis.getVoices, OffscreenCanvas & toBlob canvas noise, OfflineAudioContext audio noise injection, sub-pixel measureText font measurement jitter, WebRTC private IP/candidate filtering, CDP timezone/UA overrides (Emulation.setTimezoneOverride, setUserAgentOverride), organic SQLite history seeder with unique visit timestamps and valid Chromium transition constants.
• test_v170_fixes_verification.py — Manifest V3 extension syntax, asyncBlocking proxy authentication, W3C WebDriver property descriptor retention, sub-pixel DOM jitter, LCG canvas noise with toDataURL patch, DevToolsActivePort connection handshake, safe symlink deletion.
• test_deep_security_and_traversal.py — 25 security tests: validate_pid path traversal defense, Zip-Slip vulnerability protection, CORS localhost regex restrictions, CLI credential masking.
• test_secrets_store.py — secrets-storage tests: all three user-selectable modes (plain / dpapi / passphrase), Fernet envelope roundtrip, wrong-passphrase rejection, PBKDF2 key derivation, DPAPI roundtrip, notes-level masking, legacy plaintext readability, mode persistence (passphrase never on disk).
• test_api_secrets_mode.py — API tests: GET/POST /api/security/secrets-mode, mode switching validation, masked account_password/totp_secret in profile responses.
• test_oauth_state_security.py — OAuth security tests: single-use state tokens, TLS-only callback URL validation, HTML escaping, per-instance state isolation.
• test_upload_queue_cdp_and_cancel.py — dynamic CDP port allocation plus cancel-cleanup sweep (no leaked Chrome processes) and platform normalization.
• test_server_bind_security.py — GUI/API server defaults to loopback binding (127.0.0.1), with an explicit warning for 0.0.0.0.
• test_extension_generator_security.py — hostile proxy credentials stay JSON-escaped in the generated extension (background.js).
• test_deep_storage_and_concurrency.py — 25 concurrency & persistence tests: atomic profiles.json write via RLock & unique tmp files, batch save coalescing, process lifecycle monitor transitions.
• test_deep_fingerprint_and_stealth.py — 25 fingerprint & stealth tests: json.dumps escaping in stealth.js, MAIN world content script execution context, Canvas, WebGL, WebRTC, Audio, Battery, Client Hints emulation.
• test_deep_api_and_scenarios.py — 28 API & scenario integration tests: bidirectional Netscape cookie roundtrip fidelity, warmup scenario aliases, Dolphin{anty} Local API parity, asynchronous httpx synchronizer.
• test_audit_regression.py — regression tests covering security, validation, and storage fixes.
• test_local_automation_cdp_api.py — Dolphin{anty} parity API and CDP port tests.
• test_cookie_bulk_manager.py — batch cookie import, folder/zip handling, and Netscape parser tests.
• test_synchronizer_engine.py — session synchronizer and Win32 grid layout tests.
• test_scenario_engine_and_warmup.py — multi-step warmup scenarios and concurrency tests.
• test_mass_profile_generator.py — mass generation and hardware uniqueization tests.
• test_profile_bundle_portability.py — portable .nazak bundle export/import tests.
• test_proxy_rotation_and_mobile.py — mobile proxy rotation link tests.
• test_account_provisioner_edge_cases.py — RFC 6238 TOTP engine and OAuth tests.
• test_browser_cdp_resilience.py — Chrome parameter synthesis and stealth extension tests.

---

📄 License

Distributed under the MIT License. Engineered for high-throughput traffic arbitrage, account farm orchestration, local CDP browser automation, and stealth content publishing.