更新日志

If you passed a negative validate to /api/auto (like {data: {fail: ['"Due to legal reasons"']}}), a Cloudflare 'Just a moment' interstitial could slip through as a cached success because the fail-list didn't happen to match its text. Auto now rejects challenge pages before applying your validate rules, and it swaps the bad exit and re-solves instead of scoring it.

If you set a long timeout on foura_auto through the hosted MCP server, the request could time out at the edge before your call finished. That's fixed. Full-budget auto calls now run their 180-second budget end to end.

If you've been hitting 429s when firing many concurrent Auto calls at one target, those calls used to funnel onto a single cached exit because the warm path picked the score-favourite and replayed once. Auto now opens additional sessions on demand and routes each call to the least-loaded exit, so a burst fans out across multiple proxy IDs instead of hammering one. Measured locally: a 100-call burst on a no-cookie portable host now spreads across the grown pool within seconds.

Cloudflare injects a passive script even on pages that pass cleanly, and Auto used to treat any reference to it as an active challenge and run a full browser solve anyway. Now only true interstitial markers (the 'just a moment' page and friends) trigger the browser path; a clean 200 comes back from the cheaper proxy rung. Auto also follows up to 5 redirects by default (configurable via followRedirects).

When a Cloudflare-protected target served a real geo-block page (451) after the challenge passed, the Browser product was reporting it as a 200 because the watcher hardcoded the cleared status. The watcher now reads the actual post-clearance Document, so a 200 stays 200, a 451 surfaces as 451, and Auto rejects the wrong content and keeps searching for an exit that genuinely matches your validate rules.

The Cmd+K (Ctrl+K) shortcut now opens the command palette and search modal regardless of keyboard layout. We were matching the typed character (к on a Cyrillic layout), so anyone on a non-Latin layout got nothing. Now we match the physical key. Fixed across the main site, the blog, and the docs.

A cold Auto solve can run several minutes (proxy grind plus a browser solve). Our HTTP edge was capping requests at 2 minutes and returning a plain HTML 504, so the longest solves looked like a gateway failure even when the orchestrator was still working. We extended the edge timeout past Auto's worst-case run and switched /api/ error pages to JSON, so any error from any layer reads as JSON your client can parse.

Cookie-reusable sites (bet365 was the canary) were sticking on the expensive browser solve at 15 credits per request instead of dropping to the cheap 2-credit replay after the first solve. Two bugs: the latch fired on any transient transport error, and a successful browser replay never refreshed the session cookies. Fixed both. Repeat requests on a cookie-reusable site now cost 2 credits after the first solve, exactly as the pricing implies.

我们已收紧跨域访问权限，仅允许 foura.ai 携带凭证调用 API。我们还加强了 metrics endpoint 的输入过滤器，并移除了一个仅用于开发环境的备用密钥。现有的集成不受影响。

如果你在 request 中设置了 validate.status.accept，引擎会将接受的非 200 状态码视为完全成功。Activity 之前仍将这些标记为失败，从而干扰了你的使用统计数据。现在，结果将遵循你的 validate 判定，因此你接受的 403 将显示为成功，而不是 App Fail。

如果您之前通过 Single 抓取西里尔文、中文、日文或其他非 UTF-8 页面，返回的 body 往往会显示为乱码。在您看到原始字节之前，我们曾将每个 response 强制解码为 UTF-8。现在，我们从 response 中读取字符集（依次通过 Content-Type、<meta charset>，最后回退至 UTF-8）并进行正确解码。感谢 Alexandar Kanchev (Sensika) 反馈此问题。

公开网络中的一些 proxy 实际上并没有转发您的 request。它们将其作为纯文本服务器转储回显，并试图窃取其中的内容。我们现在能在 response 到达您的代码之前识别出这种模式，因此 Single、Browser 和 Proxy Finder 都会返回明确的失败（或重试），而不是垃圾数据。

我们修复了一个导致新发现的 proxy 在验证前需要等待的延迟问题。Proxy Finder 现在会立即对它们进行检测，从而使 proxy 池保持最新状态，并有更多活跃、可用的 proxy 处于轮换中。

Host-only cookies 之前会泄露到子域名。我们现在正确追踪 Domain 属性，并在 Parsed 视图中针对（不常见的）host-only 情况添加了 HO 徽章。Raw 视图与上游发送的内容一致：domain cookies 显示为 Domain=.example.com，host-only 则没有 Domain= 行。

Browser endpoint 仅接受八个输入（url, userAgent, headers, cookies, proxy, timeout_ms, checkStatus, checkText）。Playground 之前显示了 wait_selector 和 viewport 等额外字段，这些字段在网络传输中会被静默丢弃。现在每个字段都已与 schema 对齐：Browser 强制使用 GET，隐藏 body 文本框，且 Raw 标签页显示请求 API 的精确 JSON 以及 curl 重现命令。