FONTS=fonts DEST=dist"; exit 2; }
+ packaging/build-bundle.sh $(SRC) $(FONTS) $(DEST)
+
+clean: ## Remove local build/test caches
+ rm -rf .pytest_cache **/__pycache__ sdk/python/*.egg-info dist/*.tar.gz dist/SHA256SUMS
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..09e7c69
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,34 @@
+# Security Policy
+
+## What counts as what
+
+Fortress is a stealth Chromium engine, so please route two very different things to two
+different places:
+
+- **A detection vector** — a page or script that fingerprints Fortress and tells it apart from
+ real Chrome — is **not** a security vulnerability. It is exactly what the project wants, and it
+ belongs in a **public issue** (use the "Detection vector" template). The more reproducible, the
+ better.
+- **A vulnerability in Fortress itself** — a way to crash the binary, escape the sandbox, leak the
+ host (files, environment, real IP outside the configured proxy), or compromise a machine running
+ it — is a **security issue**. Report it **privately** (below), not in a public issue.
+
+## Reporting a vulnerability
+
+Please use **GitHub's private vulnerability reporting**: the **Security** tab of this repository →
+**Report a vulnerability**. That keeps the report private to the maintainers while it is triaged.
+
+Include, as far as you can:
+
+- affected version (Docker tag, `pip`/`npm` version, or bundle + Chromium version from `CHROMIUM_VERSION`),
+- the platform, and
+- a minimal reproduction and the impact.
+
+We aim to acknowledge a report within a few days and to keep you updated as we work on a fix.
+Please give us a reasonable window to release a fix before disclosing publicly.
+
+## Supported versions
+
+Fortress tracks stable Chromium and is released from the tip of `main`. Security fixes land on the
+**latest** release; older tagged releases are not maintained. Always verify a download against the
+release `SHA256SUMS` (the `pip`/`npm` SDKs do this automatically).
diff --git a/sdk/python/tilion_fortress.egg-info/PKG-INFO b/sdk/python/tilion_fortress.egg-info/PKG-INFO
deleted file mode 100644
index 936f193..0000000
--- a/sdk/python/tilion_fortress.egg-info/PKG-INFO
+++ /dev/null
@@ -1,91 +0,0 @@
-Metadata-Version: 2.4
-Name: tilion-fortress
-Version: 151.0.7908.0.post1
-Summary: Install and drive the Fortress stealth Chromium engine. Prebuilt binary, no source.
-Author: arham766
-License: BSD-3-Clause
-Project-URL: Homepage, https://github.com/tiliondev/fortress
-Project-URL: Source, https://github.com/tiliondev/fortress
-Keywords: chromium,stealth,browser,automation,anti-bot,fortress,tilion
-Requires-Python: >=3.8
-Description-Content-Type: text/markdown
-
-
- 
-
-
-tilion-fortress
-
-Drive the Fortress stealth Chromium engine with one line — no build, no Chromium source.
-
-
- 
- 
- 
- 
- 
-
-
----
-
-**Stop getting blocked — without `puppeteer-stealth`.** JavaScript stealth patches self-reveal: a detector checks whether a getter is native code and catches the override. Fortress compiles the fingerprint correction into Chromium's **C++**, so a page inspecting itself sees stock Chrome. It clears **CreepJS**, **Sannysoft**, **BrowserScan**, and live **Cloudflare** as a normal Chrome install.
-
-## Install
-
-```bash
-pip install tilion-fortress
-```
-
-On first use it downloads the prebuilt Fortress binary for your platform from the official GitHub Release (SHA-256 verified) and caches it. No Chromium source, no compilation.
-
-## Quick start
-
-```python
-from tilion_fortress import Fortress
-from playwright.sync_api import sync_playwright
-
-with Fortress() as f: # launches the stealth engine on a CDP endpoint
- with sync_playwright() as p:
- browser = p.chromium.connect_over_cdp(f.cdp_url)
- page = browser.new_page()
- page.goto("https://bot.sannysoft.com")
- page.screenshot(path="all-green.png")
-```
-
-Keep your existing Playwright / Puppeteer / CDP code — just point it at `f.cdp_url`. Works the same under **browser-use**, **Crawl4AI**, **Stagehand**, and **LangChain**.
-
-## Verified against live detectors
-
-| Suite | Result |
-|---|---|
-| **CreepJS** | 0% headless · 0% stealth |
-| **bot.sannysoft.com** | 0 failed · all green · WebGL = NVIDIA RTX 3060 / ANGLE D3D11 |
-| **browserscan.net** | "No bots detected, could be a human" |
-| **rebrowser bot-detector** | no `Runtime.enable` leak · `webdriver=false` |
-| **Cloudflare Turnstile** | cleared a live challenge |
-
-## Custom persona
-
-The default persona is a coherent Windows identity. Override any surface:
-
-```python
-Fortress(
- persona={"timezone": "America/Chicago", "languages": "en-GB,en",
- "hw_concurrency": 16, "webgl_renderer": "ANGLE (NVIDIA, RTX 3060 ...)"},
- extra_args=["--window-size=1280,800"],
-)
-```
-
-## Platform support
-
-Linux x64 has a native prebuilt binary. On macOS / Windows the package transparently runs Fortress via the official Docker image (`arham766/fortress`) — Docker is the cross-OS vehicle until native Win/Mac builds ship.
-
-> **Still blocked?** ~90% of the time it's your **IP**, not your fingerprint — datacenter ranges are flagged before any page script runs. Route egress through a residential or mobile proxy and retry.
-
-## Links
-
-- **Source & docs:** https://github.com/tiliondev/fortress
-- **Agent guide:** https://github.com/tiliondev/fortress/blob/main/AGENTS.md
-- **Docker image:** https://hub.docker.com/r/arham766/fortress
-
-BSD-3-Clause · reproducible from source · monthly Chromium rebase · **Blink · V8 · BoringSSL** patched in-tree.
diff --git a/sdk/python/tilion_fortress.egg-info/SOURCES.txt b/sdk/python/tilion_fortress.egg-info/SOURCES.txt
deleted file mode 100644
index 1bfbbfc..0000000
--- a/sdk/python/tilion_fortress.egg-info/SOURCES.txt
+++ /dev/null
@@ -1,9 +0,0 @@
-README.md
-pyproject.toml
-tilion_fortress/__init__.py
-tilion_fortress/__main__.py
-tilion_fortress.egg-info/PKG-INFO
-tilion_fortress.egg-info/SOURCES.txt
-tilion_fortress.egg-info/dependency_links.txt
-tilion_fortress.egg-info/entry_points.txt
-tilion_fortress.egg-info/top_level.txt
\ No newline at end of file
diff --git a/sdk/python/tilion_fortress.egg-info/dependency_links.txt b/sdk/python/tilion_fortress.egg-info/dependency_links.txt
deleted file mode 100644
index 8b13789..0000000
--- a/sdk/python/tilion_fortress.egg-info/dependency_links.txt
+++ /dev/null
@@ -1 +0,0 @@
-
diff --git a/sdk/python/tilion_fortress.egg-info/entry_points.txt b/sdk/python/tilion_fortress.egg-info/entry_points.txt
deleted file mode 100644
index fac1db7..0000000
--- a/sdk/python/tilion_fortress.egg-info/entry_points.txt
+++ /dev/null
@@ -1,2 +0,0 @@
-[console_scripts]
-tilion-fortress = tilion_fortress.__main__:main
diff --git a/sdk/python/tilion_fortress.egg-info/top_level.txt b/sdk/python/tilion_fortress.egg-info/top_level.txt
deleted file mode 100644
index f6400c4..0000000
--- a/sdk/python/tilion_fortress.egg-info/top_level.txt
+++ /dev/null
@@ -1 +0,0 @@
-tilion_fortress
diff --git a/tools/gauntlet.py b/tools/gauntlet.py
index 805b72d..2751954 100755
--- a/tools/gauntlet.py
+++ b/tools/gauntlet.py
@@ -12,7 +12,7 @@
No third-party deps — raw CDP over a hand-rolled WebSocket so it runs anywhere
Python 3 does.
"""
-import argparse, base64, json, os, socket, struct, subprocess, sys, time, http.client
+import argparse, base64, json, os, shutil, socket, struct, subprocess, sys, tempfile, time, http.client
def ws_eval(port, expr, timeout=20):
@@ -68,16 +68,21 @@ def main():
ap.add_argument("--keep", action="store_true", help="leave the browser running")
args = ap.parse_args()
- launcher = os.path.join(args.bundle, "tilion")
+ launcher = os.path.join(args.bundle, "tilion.cmd" if os.name == "nt" else "tilion")
if not os.path.exists(launcher):
sys.exit(f"no launcher at {launcher}")
+ # Isolated, OS-appropriate temp dirs (not a hardcoded /tmp, which doesn't exist on Windows).
+ profile = tempfile.mkdtemp(prefix="fortress-gauntlet-")
+ home = tempfile.mkdtemp(prefix="fortress-gauntlet-home-")
+ cmd = [launcher, "--headless=new", "--no-sandbox", "--disable-gpu",
+ f"--remote-debugging-port={args.port}",
+ f"--user-data-dir={profile}", "about:blank"]
+ if os.name == "nt":
+ cmd = ["cmd", "/c", *cmd] # a .cmd launcher must run through the shell interpreter
proc = subprocess.Popen(
- [launcher, "--headless=new", "--no-sandbox", "--disable-gpu",
- f"--remote-debugging-port={args.port}",
- "--user-data-dir=/tmp/fortress-gauntlet", "about:blank"],
- stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
- env={**os.environ, "HOME": "/tmp/fortress-gauntlet-home"})
+ cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+ env={**os.environ, "HOME": home})
try:
for _ in range(60):
try:
@@ -119,6 +124,12 @@ def main():
finally:
if not args.keep:
proc.terminate()
+ try:
+ proc.wait(timeout=10)
+ except Exception:
+ proc.kill()
+ shutil.rmtree(profile, ignore_errors=True)
+ shutil.rmtree(home, ignore_errors=True)
if __name__ == "__main__":