fix(CDPBrowser): address review on Obscura binary lookup and Kitesurf session release

Obscura._resolveBinary no longer shells out to `which`, which does not
exist on Windows, so an obscura.exe on PATH was never discovered. It now
walks PATH directly and tries every PATHEXT suffix on Windows, strips the
quotes Windows allows around PATH entries, and skips directories and
non-executable files.

Kitesurf._finishTest releases the Cloudflare session in a finally block.
If super._finishTest() rejected while closing the CDP connection the
DELETE was skipped and the browser session stayed alive until keepAlive
expired. The session id is cleared before the request so a repeated call
cannot release it twice.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: DavertMik

lib/helper/Kitesurf.js

@@ -116,16 +116,22 @@ class Kitesurf extends CDPBrowser {
   /**
    * Closes the target as `CDPBrowser._finishTest` does, then releases the cloud session acquired
    * in `_resolveEndpoint` via the Cloudflare API so it does not linger for the full `keepAlive`
-   * window.
+   * window. The release runs in a `finally` so a rejection while closing the CDP connection still
+   * frees the cloud session instead of leaving the browser alive until `keepAlive` expires; the
+   * session id is cleared before the request, so a repeated call never releases it twice.
    *
    * @protected
    */
   async _finishTest() {
-    await super._finishTest()
-    if (this.cloudSessionId) {
-      const url = `${this.options.apiBase}/accounts/${this.options.accountId}/browser-run/devtools/browser/${this.cloudSessionId}`
-      await axios.delete(url, { headers: { Authorization: `Bearer ${this.options.apiToken}` } }).catch(() => null)
-      this.cloudSessionId = null
+    try {
+      await super._finishTest()
+    } finally {
+      if (this.cloudSessionId) {
+        const sessionId = this.cloudSessionId
+        this.cloudSessionId = null
+        const url = `${this.options.apiBase}/accounts/${this.options.accountId}/browser-run/devtools/browser/${sessionId}`
+        await axios.delete(url, { headers: { Authorization: `Bearer ${this.options.apiToken}` } }).catch(() => null)
+      }
     }
   }
 }

lib/helper/Obscura.js

@@ -1,7 +1,10 @@
-import { spawn, execSync } from 'child_process'
+import { spawn } from 'child_process'
+import fs from 'fs'
 import net from 'net'
+import path from 'path'
 import axios from 'axios'
 import CDPBrowser from './CDPBrowser.js'
+import { isFile, isWindows } from '../utils.js'
 
 /**
  * ## Configuration
@@ -201,20 +204,33 @@ class Obscura extends CDPBrowser {
 
   /**
    * Resolves the `obscura` binary to spawn, in priority order: `options.binaryPath`, then the
-   * `OBSCURA_PATH` environment variable, then `obscura` on `PATH` (via `which`).
+   * `OBSCURA_PATH` environment variable, then `obscura` on `PATH`. The `PATH` lookup walks the
+   * directories itself instead of shelling out to `which`, which does not exist on Windows: on
+   * Windows every `PATHEXT` suffix is tried, so an `obscura.exe` on `PATH` is found too.
    *
    * @returns {string|null} an absolute or relative path to the binary, or null if none resolved.
    * @protected
    */
   _resolveBinary() {
     if (this.options.binaryPath) return this.options.binaryPath
     if (process.env.OBSCURA_PATH) return process.env.OBSCURA_PATH
-    try {
-      const found = execSync('which obscura', { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim()
-      return found || null
-    } catch (e) {
-      return null
+    const windows = isWindows()
+    const extensions = windows ? (process.env.PATHEXT || '.EXE;.CMD;.BAT;.COM').split(';') : ['']
+    for (const entry of (process.env.PATH || '').split(path.delimiter)) {
+      const dir = windows ? entry.replace(/^"|"$/g, '') : entry
+      if (!dir) continue
+      for (const extension of extensions) {
+        const candidate = path.join(dir, `obscura${extension}`)
+        if (!isFile(candidate)) continue
+        try {
+          fs.accessSync(candidate, fs.constants.X_OK)
+          return candidate
+        } catch (e) {
+          continue
+        }
+      }
     }
+    return null
   }
 
   /**