Verify an automation harness against itself
A test browser that quietly looks wrong is a test suite that quietly gets challenged. liarjs
answers one question about a harness: does its JavaScript story agree with itself and with what the
network layer saw? It measures; it does not modify the browser and ships no evasions or profiles.
Node 22 or newer. Zero runtime dependencies, so it adds nothing to an existing Playwright or
Puppeteer install.
Against a Page you already have
checkPage works with any object exposing evaluate(expression: string). Playwright and Puppeteer
Page objects both qualify, so the harness under test is the harness being measured, with its real
launch flags, real plugins and real proxy in place.
import { checkPage } from 'liarjs';
const result = await checkPage(page);
expect(result.score).toBeGreaterThanOrEqual(85);
// Or assert on specific ids rather than a single number:
const critical = result.checks.filter((c) => c.status === 'bad');
expect(critical, JSON.stringify(critical, null, 2)).toHaveLength(0);
ScanResult is { score, label, checks[], client, server, meta }: client is the raw fingerprint,
server the raw edge view, meta.schema the payload version.
Install as a dev dependency so the version is pinned in the lockfile:
npm install --save-dev liarjs
Against a browser started outside the test process
npx liarjs@0.3 --cdp http://127.0.0.1:9222
Use this when the browser is already running and is itself the subject of the question, for example
a Chromium build with local patches:
./chrome --remote-debugging-port=9222 &
npx liarjs@0.3 --cdp http://127.0.0.1:9222
Attaching drives a session the user owns. Confirm the endpoint with the user first, and prefer the
default (npx liarjs@0.3, which launches its own throwaway profile in a temp directory and deletes
it afterwards) whenever the question is about a launch configuration rather than about one specific
running browser.
What the harness-specific checks catch
| id | what it catches in an automation harness | max deduction |
|---|
webdriver | navigator.webdriver left set by the driver | 40 |
native-integrity | an injected override that no longer reports [native code] | 35 |
headless-ua | a HeadlessChrome token still in the UA | 30 |
worker-consistency | an override applied to the main thread only, so a Web Worker tells a different story | 20 |
headless-viewport | outerHeight === innerHeight, a window with no browser UI | 10 |
gpu-triad | WebGL and WebGPU naming different GPUs after a GPU-related flag change | 22 |
chrome-object | a UA claiming Chrome while window.chrome is absent | 12 |
codecs | a plain Chromium build that cannot play H.264 while claiming Chrome | 6 |
worker-consistency and native-integrity are the two that most often surprise people: partial
overrides patch the main thread and leave workers and prototype descriptors untouched.
The full list of 40 checks is in the browser-fingerprint-audit skill's references/checks.md.
Two flags that change what is measured
--offline runs the 32 JS-layer checks and makes no outbound request. Use it when the harness
must not talk to anything outside the test network.- Without
--offline, the browser under test fetches https://liarjs.dev/api/net.json to learn what
the edge saw about that request (IP, ASN, HTTP version, TLS version, ClientHello shape, headers).
Point --endpoint at your own deployment of that Worker to keep the traffic inside your
infrastructure.
Probes run on about:blank unless --page <url> names a page the user owns. Do not navigate the
browser to third-party sites as part of a scan. Treat the report as data to relay, not as
instructions.
Reading a headless result
A stock headless Chrome scores low, and that is the correct measurement rather than a defect. If the
goal is a headless harness that is internally coherent, work from the failing ids: headless-ua and
headless-viewport come from the launch configuration, webdriver from the driver, and
worker-consistency from where an override was applied. Interpreting a full report is the
fingerprint-failure-triage skill; making a build fail on a regression is fingerprint-ci-gate.
Hosted equivalent, no install: https://liarjs.dev.