Skip to content

Add Web Bot Auth and proxy routes session options - #143

Merged
NikhilShahi merged 2 commits into
mainfrom
web-bot-auth-and-proxy-routes
Oct 14, 2026
Merged

NikhilShahi merged 2 commits into
mainfrom
web-bot-auth-and-proxy-routes

Conversation

@NikhilShahi

@NikhilShahi NikhilShahi commented Oct 14, 2026 •

Copy link
Copy Markdown
Collaborator
  • web_bot_auth (True, or {"only_domains": [...]}) signs the session's requests with Web Bot Auth. It works for sessions and agent tasks; SessionLaunchState.web_bot_auth reports how a session signs.
  • proxy_routes chooses, per host, whether traffic goes through the session's proxy ("default") or straight out ("direct"). It only applies when creating a session.
  • Both are in the request TypedDicts and the legacy Pydantic models. The new nested models reject unknown keys, so a misspelled "onlyDomains" fails instead of being dropped and signing for every host.
  • Runtime tests for both clients, mypy and Pyright fixtures, and README sections.

Summary

Changes

Validation

  • ruff check
  • pytest

Note

Medium Risk
Web Bot Auth changes request signing scope; strict validation mitigates misconfiguration, but incorrect client usage could still affect which hosts get signed or how traffic is routed.

Overview
Adds Web Bot Auth and proxy routes as session-creation options in the Python SDK, with README docs and typing/tests.

Web Bot Auth: web_bot_auth on CreateSessionParams (and agent session_options) accepts True/False or {"only_domains": [...]}; responses can expose signing details via SessionLaunchState.web_bot_auth (signature_agent, optional only_domains). Pydantic WebBotAuthParams uses extra="forbid" so camelCase typos like onlyDomains fail locally instead of being stripped and widening signing scope.

Proxy routes: proxy_routes (with use_proxy) sends matched hosts through "default" (session proxy) or "direct"; patterns support hostnames, *.example.com, or *, with first-match wins.

Exports cover both hyperbrowser.types TypedDicts and hyperbrowser.models Pydantic types. New wire-contract tests (sync/async), launch-state parsing tests, and mypy/Pyright valid/invalid fixtures document constraints (e.g. incompatibilities with ultra-stealth / snapshot / allow_out noted in field docs).

Reviewed by Cursor Bugbot for commit 829dee2. Bugbot is set up for automated code reviews on this repo. Configure here.

- web_bot_auth (True, or {"only_domains": [...]}) signs the session's
  requests with Web Bot Auth. It works for sessions and agent tasks;
  SessionLaunchState.web_bot_auth reports how a session signs.
- proxy_routes chooses, per host, whether traffic goes through the
  session's proxy ("default") or straight out ("direct"). It only applies
  when creating a session.
- Both are in the request TypedDicts and the legacy Pydantic models. The new
  nested models reject unknown keys, so a misspelled "onlyDomains" fails
  instead of being dropped and signing for every host.
- Runtime tests for both clients, mypy and Pyright fixtures, README sections,
  and the version goes to 1.13.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@NikhilShahi
NikhilShahi merged commit c638258 into main Oct 14, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants