Stop leaking the API key; make --fingerprint apply the fingerprint

[jehrr]

Four defects found while building the newest repo in this family against the same shared core. All present here unchanged.

🔴 The API key could reach a log

fingerprint_client.py sends the key as a query parameter, and requests puts the full URL — query string included — into the text of HTTPError and of every connection error. A 400 from the fingerprint endpoint therefore prints a live key. It did, on a real call.

Everything raised or logged from that module, and from captcha_solver.py's v1 polling GET (the other place the key rides in a URL rather than a body or header), now goes through a redactor. The endpoint and status survive; the key becomes key=***. The other key-carrying calls were checked and are safe — createTask/getTaskResult use the JSON body.

--fingerprint was applying almost none of the fingerprint

What	Was	Now
User agent	never set — read from userAgent.value, a key the API returns in neither format	userAgent.userAgent / data.ua
Locale	f"en-{country}" → en-DE for a German fingerprint	intl.contentLocale → de-DE
Timezone	not applied at all	intl.timeZone
Window size	guessed as screen height − 120	the response's own outerWidth/outerHeight

The UA one matters most: the flag left the browser on its own user agent while replacing the screen and locale around it — a fingerprint's identity wearing the local Chromium's UA, which is exactly the mismatch this family warns about when it says never to stack a second identity on a remote browser.

Verified against a live browser on the newest repo: with a German Windows fingerprint applied, the page reports that UA, de-DE, Europe/Berlin and a window smaller than its screen.

The documented --tags example always returned 400

"Windows,Chrome,Desktop" is rejected every time. Measured against the live API:

Accepted	Rejected (400)
Windows, Microsoft Windows, Android	Chrome, Desktop, Mobile, Unknown, and every combination with any separator

tags takes one OS-family value. The plural name — and a returned fingerprint's own multi-valued data.tags — are what make the list form look plausible.

The Docker image was broken on every invocation

Including --help, its own CMD. The Dockerfile COPYs an explicit module list (correct — the image should carry no test suite and no stray .env) and the list had fallen behind: proxy_pool.py was missing while the entrypoint imports it at module level. Nothing noticed, because CI never builds the image.

Verified by assembling the image's exact file set in a temporary directory and running the entrypoint from there; no container runtime was available here.

Deliberately NOT changed: the captcha detectors

The newest repo had to stop treating extension-injected markers as challenges, because the Scraping Browser's auto-solve extension puts cf-turnstile into every page it loads. This repo's marker set contains nothing that extension injects — checked — so the same guard here would be dead code. The hazard is recorded in the family CLAUDE.md instead, for whoever broadens a marker set next.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Wp7ctnpMGb5gi67Dco7C5V