fix: support proxy authentication credentials in URL (closes #4)

Parse user:pass from proxy URLs into separate Playwright username/password
fields. Puppeteer wrapper strips credentials from --proxy-server and
auto-calls page.authenticate(). Bump Python 0.1.6, JS 0.1.3.

js/src/playwright.ts

@@ -7,6 +7,7 @@ import type { Browser, BrowserContext } from "playwright-core";
 import type { LaunchOptions, LaunchContextOptions } from "./types.js";
 import { getDefaultStealthArgs } from "./config.js";
 import { ensureBinary } from "./download.js";
+import { parseProxyUrl } from "./proxy.js";
 
 /**
  * Launch stealth Chromium browser via Playwright.
@@ -32,7 +33,7 @@ export async function launch(options: LaunchOptions = {}): Promise<Browser> {
     headless: options.headless ?? true,
     args,
     ignoreDefaultArgs: ["--enable-automation"],
-    ...(options.proxy ? { proxy: { server: options.proxy } } : {}),
+    ...(options.proxy ? { proxy: parseProxyUrl(options.proxy) } : {}),
     ...options.launchOptions,
   });
 

js/src/proxy.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared proxy URL parsing for Playwright and Puppeteer wrappers.
+ */
+
+export interface ParsedProxy {
+  server: string;
+  username?: string;
+  password?: string;
+}
+
+/**
+ * Parse a proxy URL, extracting credentials into separate fields.
+ *
+ * Handles: "http://user:pass@host:port" -> { server: "http://host:port", username: "user", password: "pass" }
+ * Also handles: no credentials, URL-encoded special chars, socks5://, missing port.
+ */
+export function parseProxyUrl(proxy: string): ParsedProxy {
+  let url: URL;
+  try {
+    url = new URL(proxy);
+  } catch {
+    // Not a parseable URL (e.g. bare "host:port") — pass through as-is
+    return { server: proxy };
+  }
+
+  if (!url.username) {
+    return { server: proxy };
+  }
+
+  // Rebuild server URL without credentials
+  const server = `${url.protocol}//${url.hostname}${url.port ? `:${url.port}` : ""}`;
+
+  const result: ParsedProxy = {
+    server,
+    username: decodeURIComponent(url.username),
+  };
+  if (url.password) {
+    result.password = decodeURIComponent(url.password);
+  }
+
+  return result;
+}

js/src/puppeteer.ts

@@ -7,6 +7,7 @@ import type { Browser } from "puppeteer-core";
 import type { LaunchOptions } from "./types.js";
 import { getDefaultStealthArgs } from "./config.js";
 import { ensureBinary } from "./download.js";
+import { parseProxyUrl } from "./proxy.js";
 
 /**
  * Launch stealth Chromium browser via Puppeteer.
@@ -27,9 +28,16 @@ export async function launch(options: LaunchOptions = {}): Promise<Browser> {
   const binaryPath = process.env.CLOAKBROWSER_BINARY_PATH || (await ensureBinary());
   const args = buildArgs(options);
 
-  // Puppeteer handles proxy via CLI args, not a separate option
+  // Puppeteer handles proxy via CLI args, not a separate option.
+  // Chromium's --proxy-server does NOT support inline credentials,
+  // so we strip them and use page.authenticate() instead.
+  let proxyAuth: { username: string; password: string } | undefined;
   if (options.proxy) {
-    args.push(`--proxy-server=${options.proxy}`);
+    const { server, username, password } = parseProxyUrl(options.proxy);
+    args.push(`--proxy-server=${server}`);
+    if (username) {
+      proxyAuth = { username, password: password || "" };
+    }
   }
 
   const browser = await puppeteer.default.launch({
@@ -40,6 +48,17 @@ export async function launch(options: LaunchOptions = {}): Promise<Browser> {
     ...options.launchOptions,
   });
 
+  // Monkey-patch newPage() to auto-authenticate proxy credentials
+  if (proxyAuth) {
+    const origNewPage = browser.newPage.bind(browser);
+    const auth = proxyAuth;
+    browser.newPage = async (...pageArgs: Parameters<typeof origNewPage>) => {
+      const page = await origNewPage(...pageArgs);
+      await page.authenticate(auth);
+      return page;
+    };
+  }
+
   return browser;
 }