@fanboynz/network-scanner 2.0.50 → 2.0.52

package/lib/cloudflare.js

@@ -58,11 +58,76 @@ const FAST_TIMEOUTS = {
   ELEMENT_INTERACTION_DELAY: 250, // Fast element interactions
   SELECTOR_WAIT: 3000,            // Fast selector waits
   TURNSTILE_OPERATION: 6000,      // Fast Turnstile operations
-  JS_CHALLENGE: 19000,            // Fast JS challenge completion
+  JS_CHALLENGE: 10000,            // Fast JS challenge completion
   CHALLENGE_SOLVING: 30000,       // Fast overall challenge solving
   CHALLENGE_COMPLETION: 8000      // Fast completion check
 };
 
+/**
+ * Finds and clicks an element inside shadow DOM trees via page.evaluate
+ * Returns {found, clicked, x, y} - coordinates allow fallback mouse.click
+ */
+async function clickInShadowDOM(context, selectors, forceDebug = false, waitMs = 1500) {
+  // Try Puppeteer's pierce/ selector first � handles CLOSED shadow roots via CDP
+  for (const selector of selectors) {
+    try {
+      // Wait for element to appear (handles delayed rendering)
+      const start = Date.now();
+      const element = await context.waitForSelector(`pierce/${selector}`, { timeout: waitMs });
+      if (element) {
+        const box = await element.boundingBox();
+        if (box && box.width > 0 && box.height > 0) {
+          if (forceDebug) console.log(formatLogMessage('cloudflare', `pierce/${selector} matched in ${Date.now() - start}ms � box: ${box.width}x${box.height} at (${box.x},${box.y})`));
+          await element.click();
+          await element.dispose();
+          return { found: true, clicked: true, selector, x: box.x + box.width / 2, y: box.y + box.height / 2 };
+        }
+        if (forceDebug) console.log(formatLogMessage('cloudflare', `pierce/${selector} found but not visible (0x0)`));
+        await element.dispose();
+        // Element found but not visible
+        return { found: true, clicked: false, selector, x: 0, y: 0 };
+      }
+    } catch (e) {
+      if (forceDebug) console.log(formatLogMessage('cloudflare', `pierce/${selector} timeout after ${waitMs}ms`));
+      continue;
+    }
+  }
+
+  // Fallback: manual traversal for open shadow roots
+  const result = await context.evaluate((sels) => {
+    function deepQuery(root, selector) {
+      // Try direct query first
+      const el = root.querySelector(selector);
+      if (el) return el;
+
+      // Traverse shadow roots
+      const allElements = root.querySelectorAll('*');
+      for (const node of allElements) {
+        if (node.shadowRoot) {
+          const found = deepQuery(node.shadowRoot, selector);
+          if (found) return found;
+        }
+      }
+      return null;
+    }
+
+    for (const selector of sels) {
+      const el = deepQuery(document, selector);
+      if (el) {
+        const rect = el.getBoundingClientRect();
+        if (rect.width > 0 && rect.height > 0) {
+          el.click();
+          return { found: true, clicked: true, selector, x: rect.x + rect.width / 2, y: rect.y + rect.height / 2 };
+        }
+        return { found: true, clicked: false, selector, x: 0, y: 0 };
+      }
+    }
+    return { found: false, clicked: false, selector: null, x: 0, y: 0 };
+  }, selectors);
+
+  return result;
+}
+
 /**
  * Error categories for better handling
  */
@@ -306,12 +371,12 @@ function categorizeError(error) {
 /**
  * Implements exponential backoff delay
  */
-async function getRetryDelay(attempt) {
+function getRetryDelay(attempt) {
   const delay = Math.min(
     RETRY_CONFIG.baseDelay * Math.pow(RETRY_CONFIG.backoffMultiplier, attempt - 1),
     RETRY_CONFIG.maxDelay
   );
-  return new Promise(resolve => setTimeout(resolve, delay));
+  return delay;
 }
 
 /**
@@ -341,32 +406,6 @@ async function safePageEvaluate(page, func, timeout = TIMEOUTS.PAGE_EVALUATION_S
         throw new Error('Page URL access failed - likely detached');
       }
 
-      // Quick execution context validation with timeout
-      const contextValid = await Promise.race([
-        page.evaluate(() => {
-          try {
-            // Quick context validation
-            if (typeof window === 'undefined' || !document) {
-              return false;
-            }
-            // Check if document is ready for interaction
-            if (document.readyState === 'uninitialized') {
-              return false;
-            }
-            return true;
-          } catch (e) {
-            return false;
-          }
-        }),
-        new Promise((_, reject) => {
-          setTimeout(() => reject(new Error('Context validation timeout')), 3500);
-        })
-      ]).catch(() => false);
-
-      if (!contextValid) {
-        throw new Error('Page execution context is invalid');
-      }
-
       const result = await Promise.race([
         page.evaluate(func),
         new Promise((_, reject) => {
@@ -418,7 +457,7 @@ async function safePageEvaluate(page, func, timeout = TIMEOUTS.PAGE_EVALUATION_S
       }
       
       // Wait before retrying with exponential backoff
-      await getRetryDelay(attempt);
+      await new Promise(resolve => setTimeout(resolve, getRetryDelay(attempt)));
     }
   }
   
@@ -440,15 +479,18 @@ async function safePageEvaluate(page, func, timeout = TIMEOUTS.PAGE_EVALUATION_S
  * Safe element clicking with timeout protection
  */
 async function safeClick(page, selector, timeout = TIMEOUTS.CLICK_TIMEOUT) {
+  let timeoutId;
   try {
     return await Promise.race([
       page.click(selector, { timeout: timeout }),
       new Promise((_, reject) => {
-        setTimeout(() => reject(new Error('Click timeout')), timeout + TIMEOUTS.CLICK_TIMEOUT_BUFFER);
+        timeoutId = setTimeout(() => reject(new Error('Click timeout')), timeout + TIMEOUTS.CLICK_TIMEOUT_BUFFER);
       })
     ]);
   } catch (error) {
     throw new Error(`Click failed: ${error.message}`);
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
   }
 }
 
@@ -456,16 +498,18 @@ async function safeClick(page, selector, timeout = TIMEOUTS.CLICK_TIMEOUT) {
  * Safe navigation waiting with timeout protection
  */
 async function safeWaitForNavigation(page, timeout = TIMEOUTS.NAVIGATION_TIMEOUT) {
+  let timeoutId;
   try {
     return await Promise.race([
       page.waitForNavigation({ waitUntil: 'domcontentloaded', timeout: timeout }),
       new Promise((_, reject) => {
-        setTimeout(() => reject(new Error('Navigation timeout')), timeout + TIMEOUTS.NAVIGATION_TIMEOUT_BUFFER);
+        timeoutId = setTimeout(() => reject(new Error('Navigation timeout')), timeout + TIMEOUTS.NAVIGATION_TIMEOUT_BUFFER);
       })
     ]);
   } catch (error) {
     console.warn(formatLogMessage('cloudflare', `Navigation wait failed: ${error.message}`));
-    // Don't throw - just continue
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
   }
 }
 
@@ -563,7 +607,14 @@ async function quickCloudflareDetection(page, forceDebug = false) {
  */
 async function analyzeCloudflareChallenge(page) {
   try {
-    return await safePageEvaluate(page, () => {
+    // CDP-level frame check � bypasses closed shadow roots
+    const frames = page.frames();
+    const hasChallengeFrame = frames.some(f => {
+      const url = f.url();
+      return url.includes('challenges.cloudflare.com') || url.includes('/cdn-cgi/challenge-platform/');
+    });
+
+    const result = await safePageEvaluate(page, () => {
       const title = document.title || '';
       const bodyText = document.body ? document.body.textContent : '';
       
@@ -635,6 +686,15 @@ async function analyzeCloudflareChallenge(page) {
         bodySnippet: bodyText.substring(0, 200)
       };
     }, TIMEOUTS.PAGE_EVALUATION);
+
+    // Merge CDP frame detection � catches iframes behind closed shadow roots
+    if (hasChallengeFrame && !result.hasTurnstileIframe) {
+      result.hasTurnstileIframe = true;
+      result.isTurnstile = true;
+      result.isChallengePresent = true;
+    }
+
+    return result;
   } catch (error) {
     return {
       isChallengePresent: false,
@@ -842,7 +902,7 @@ async function handleVerificationChallengeWithRetries(page, currentUrl, siteConf
       
       // If this wasn't the last attempt, wait before retrying
       if (attempt < retryConfig.maxAttempts) {
-        const delay = await getRetryDelay(attempt);
+        const delay = getRetryDelay(attempt);
         if (forceDebug) {
           console.log(formatLogMessage('cloudflare', `Challenge attempt ${attempt} failed, retrying in ${delay}ms: ${result.error}`));
         }
@@ -884,7 +944,7 @@ async function handleVerificationChallengeWithRetries(page, currentUrl, siteConf
       
       // Wait before retrying with exponential backoff
       if (attempt < retryConfig.maxAttempts) {
-        await getRetryDelay(attempt);
+        await new Promise(resolve => setTimeout(resolve, getRetryDelay(attempt)));
       }
     }
   }
@@ -925,7 +985,7 @@ async function handlePhishingWarningWithRetries(page, currentUrl, siteConfig, fo
       
       // If this wasn't the last attempt, wait before retrying
       if (attempt < retryConfig.maxAttempts) {
-        const delay = await getRetryDelay(attempt);
+        const delay = getRetryDelay(attempt);
         if (forceDebug) {
           console.log(formatLogMessage('cloudflare', `Phishing warning attempt ${attempt} failed, retrying in ${delay}ms: ${result.error}`));
         }
@@ -955,7 +1015,7 @@ async function handlePhishingWarningWithRetries(page, currentUrl, siteConfig, fo
       
       // Wait before retrying with exponential backoff
       if (attempt < retryConfig.maxAttempts) {
-        await getRetryDelay(attempt);
+        await new Promise(resolve => setTimeout(resolve, getRetryDelay(attempt)));
       }
     }
   }
@@ -1026,6 +1086,23 @@ async function attemptChallengeSolve(page, currentUrl, challengeInfo, forceDebug
       
       const jsResult = await waitForJSChallengeCompletion(page, forceDebug);
       if (jsResult.success) {
+        // Wait for redirect after challenge completion
+        try {
+          const startUrl = await page.url();
+          await page.waitForFunction(
+            (origUrl) => {
+              const bodyText = document.body?.textContent || '';
+              return document.title !== 'Just a moment...' ||
+                     window.location.href !== origUrl ||
+                     bodyText.includes('Verification successful');
+            },
+            { timeout: 10000 },
+            startUrl
+          );
+          if (forceDebug) console.log(formatLogMessage('cloudflare', `Challenge page cleared for ${currentUrl}`));
+        } catch (_) {
+          if (forceDebug) console.log(formatLogMessage('cloudflare', `Challenge page not cleared after 10s � continuing`));
+        }
         result.success = true;
         result.method = 'js_challenge_wait';
         if (forceDebug) console.log(formatLogMessage('cloudflare', `JS challenge completed successfully for ${currentUrl}`));
@@ -1034,6 +1111,8 @@ async function attemptChallengeSolve(page, currentUrl, challengeInfo, forceDebug
     } catch (jsError) {
       if (forceDebug) console.log(formatLogMessage('cloudflare', `JS challenge wait failed for ${currentUrl}: ${jsError.message}`));
     }
+  } else if (forceDebug) {
+    console.log(formatLogMessage('cloudflare', `Skipping JS challenge method (not detected)`));
   }
 
   // Method 2: Handle Turnstile challenges (interactive)
@@ -1051,6 +1130,8 @@ async function attemptChallengeSolve(page, currentUrl, challengeInfo, forceDebug
     } catch (turnstileError) {
       if (forceDebug) console.log(formatLogMessage('cloudflare', `Turnstile method failed for ${currentUrl}: ${turnstileError.message}`));
     }
+  } else if (forceDebug) {
+    console.log(formatLogMessage('cloudflare', `Skipping Turnstile method (not detected)`));
   }
 
   // Method 3: Legacy checkbox interaction (fallback)
@@ -1068,10 +1149,23 @@ async function attemptChallengeSolve(page, currentUrl, challengeInfo, forceDebug
     } catch (legacyError) {
       if (forceDebug) console.log(formatLogMessage('cloudflare', `Legacy checkbox method failed for ${currentUrl}: ${legacyError.message}`));
     }
+  } else if (forceDebug) {
+    console.log(formatLogMessage('cloudflare', `Skipping legacy checkbox method (not detected)`));
   }
 
   if (!result.success) {
     result.error = result.error || 'All challenge bypass methods failed';
+    if (forceDebug) {
+      try {
+        const postState = await page.evaluate(() => ({
+          title: document.title,
+          url: window.location.href,
+          body: (document.body?.textContent || '').substring(0, 300)
+        }));
+        console.log(formatLogMessage('cloudflare', `Post-attempt page state: title="${postState.title}" url=${postState.url}`));
+        console.log(formatLogMessage('cloudflare', `Post-attempt body: ${postState.body}`));
+      } catch (_) {}
+    }
   }
 
   return result;
@@ -1089,88 +1183,57 @@ async function handleEmbeddedIframeChallenge(page, forceDebug = false) {
   try {
     if (forceDebug) console.log(formatLogMessage('cloudflare', `Checking for embedded iframe challenges`));
 
-    // Enhanced iframe selectors including challenges.cloudflare.com
-    const iframeSelectors = [
-      'iframe[src*="challenges.cloudflare.com"]',
-      'iframe[title*="Verify you are human"]',
-      'iframe[title*="Cloudflare security challenge"]',
-      'iframe[title*="Widget containing a Cloudflare"]'
-    ];
-
-    // Wait for iframe to appear
-    let iframeFound = false;
-    for (const selector of iframeSelectors) {
-      try {
-        await Promise.race([
-          page.waitForSelector(selector, { timeout: FAST_TIMEOUTS.SELECTOR_WAIT }),
-          new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), FAST_TIMEOUTS.SELECTOR_WAIT + 1000))
-        ]);
-        iframeFound = true;
-        if (forceDebug) console.log(formatLogMessage('cloudflare', `Found iframe: ${selector}`));
-        break;
-      } catch (e) {
-        continue;
+    // Use CDP-level frame detection � bypasses closed shadow roots
+    const frames = page.frames();
+    if (forceDebug) {
+      console.log(formatLogMessage('cloudflare', `Available frames (${frames.length}):`));
+      for (const f of frames) {
+        console.log(formatLogMessage('cloudflare', `  ${f.url()}`));
       }
     }
-
-    if (!iframeFound) {
-      result.error = 'No embedded iframe found';
-      return result;
-    }
-
-    // Find challenge frame using existing frame detection logic
-    const frames = await page.frames();
     const challengeFrame = frames.find(frame => {
       const frameUrl = frame.url();
       return frameUrl.includes('challenges.cloudflare.com') ||
+             frameUrl.includes('/cdn-cgi/challenge-platform/') ||
              frameUrl.includes('/turnstile/if/') ||
-             frameUrl.includes('captcha-delivery.com') ||
-             frameUrl.includes('/challenge-platform/') ||
              frameUrl.includes('turnstile');
     });
 
     if (!challengeFrame) {
-      result.error = 'Challenge iframe not accessible';
+      result.error = 'No challenge frame found via CDP';
       return result;
     }
 
     if (forceDebug) console.log(formatLogMessage('cloudflare', `Interacting with iframe: ${challengeFrame.url()}`));
 
-    // Reuse existing checkbox interaction logic
-    const checkboxSelectors = [
+    await waitForTimeout(page, 500);
+
+    let checkboxInteractionSuccess = false;
+    try {
+      const shadowResult = await clickInShadowDOM(challengeFrame, [
       'input[type="checkbox"]',
       '.ctp-checkbox',
-      'input.ctp-checkbox',
-      '.cf-turnstile input',
-      '.ctp-checkbox-label'
-    ];
-    
-    let checkboxInteractionSuccess = false;
-    for (const selector of checkboxSelectors) {
-      try {
-        await Promise.race([
-          challengeFrame.waitForSelector(selector, { timeout: FAST_TIMEOUTS.SELECTOR_WAIT }),
-          new Promise((_, reject) => setTimeout(() => reject(new Error('Timeout')), FAST_TIMEOUTS.SELECTOR_WAIT + 1000))
-        ]);
-        
-        await waitForTimeout(page, FAST_TIMEOUTS.ELEMENT_INTERACTION_DELAY);
-        await challengeFrame.click(selector);
-        
-        if (forceDebug) console.log(formatLogMessage('cloudflare', `Clicked iframe element: ${selector}`));
+        '.ctp-checkbox-label',
+        '[role="checkbox"]',
+        'label.cb-lb',
+        'label'
+      ], forceDebug);
+
+      if (shadowResult.clicked) {
         checkboxInteractionSuccess = true;
-        break;
-      } catch (e) {
-        continue;
+        if (forceDebug) console.log(formatLogMessage('cloudflare', `Shadow DOM click succeeded: ${shadowResult.selector}`));
+      } else if (shadowResult.found && shadowResult.x > 0) {
+        await page.mouse.click(shadowResult.x, shadowResult.y);
+        checkboxInteractionSuccess = true;
+        if (forceDebug) console.log(formatLogMessage('cloudflare', `Shadow DOM mouse fallback at (${shadowResult.x}, ${shadowResult.y})`));
       }
+    } catch (shadowErr) {
+      if (forceDebug) console.log(formatLogMessage('cloudflare', `Shadow DOM click failed: ${shadowErr.message}`));
     }
 
-    // Try alternative interaction only if standard selectors failed
     if (!checkboxInteractionSuccess) {
-      if (forceDebug) console.log(formatLogMessage('cloudflare', `Checkbox interactions failed, trying container fallback`));
-      await waitForTimeout(page, 1000);
 
       try {
-        // Try clicking on the iframe container itself as fallback
         const iframeElement = await page.$('iframe[src*="challenges.cloudflare.com"]');
         if (iframeElement) {
           await iframeElement.click();
@@ -1179,8 +1242,6 @@ async function handleEmbeddedIframeChallenge(page, forceDebug = false) {
       } catch (containerClickError) {
         if (forceDebug) console.log(formatLogMessage('cloudflare', `Container click failed: ${containerClickError.message}`));
       }
-    } else {
-      if (forceDebug) console.log(formatLogMessage('cloudflare', `Checkbox interaction successful, skipping container fallback`));
     }
 
     // Reuse existing completion check pattern with error handling
@@ -1237,8 +1298,10 @@ async function waitForJSChallengeCompletion(page, forceDebug = false) {
     await Promise.race([
       page.waitForFunction(
         () => {
-          return !document.body.textContent.includes('Checking your browser') &&
-                 !document.body.textContent.includes('Please wait while we verify') &&
+          const bodyText = document.body.textContent;
+          if (bodyText.includes('Verification successful')) return true;
+          return !bodyText.includes('Checking your browser') &&
+                 !bodyText.includes('Please wait while we verify') &&
                  !document.querySelector('.cf-challenge-running') &&
                  !document.querySelector('[data-cf-challenge]');
         },
@@ -1322,28 +1385,26 @@ async function handleTurnstileChallenge(page, forceDebug = false) {
         console.log(formatLogMessage('cloudflare', `Found Turnstile iframe with URL: ${turnstileFrame.url()}`));
       }
       
-      const checkboxSelectors = [
-        'input[type="checkbox"].ctp-checkbox',
-        '.ctp-checkbox-label',
-        '.ctp-checkbox'
-      ];
-      
-      for (const selector of checkboxSelectors) {
-        try {
-          await Promise.race([
-            turnstileFrame.waitForSelector(selector, { timeout: FAST_TIMEOUTS.SELECTOR_WAIT }),
-            new Promise((_, reject) => setTimeout(() => reject(new Error('Checkbox timeout')), FAST_TIMEOUTS.SELECTOR_WAIT + 500))
-          ]);
-          
-          await waitForTimeout(page, FAST_TIMEOUTS.ELEMENT_INTERACTION_DELAY);
-          await turnstileFrame.click(selector);
-          
-          if (forceDebug) console.log(formatLogMessage('cloudflare', `Clicked Turnstile checkbox: ${selector}`));
-          break;
-        } catch (e) {
-          if (forceDebug) console.log(formatLogMessage('cloudflare', `Checkbox selector ${selector} not found or failed to click`));
-          continue;
+      await waitForTimeout(page, FAST_TIMEOUTS.ELEMENT_INTERACTION_DELAY);
+
+      try {
+        const shadowResult = await clickInShadowDOM(turnstileFrame, [
+          'input[type="checkbox"]',
+          '.ctp-checkbox',
+          '.ctp-checkbox-label',
+          '[role="checkbox"]',
+          'label.cb-lb',
+          'label'
+        ], forceDebug);
+
+        if (shadowResult.clicked) {
+          if (forceDebug) console.log(formatLogMessage('cloudflare', `Turnstile shadow DOM click succeeded: ${shadowResult.selector}`));
+        } else if (shadowResult.found && shadowResult.x > 0) {
+          await page.mouse.click(shadowResult.x, shadowResult.y);
+          if (forceDebug) console.log(formatLogMessage('cloudflare', `Turnstile shadow DOM mouse fallback at (${shadowResult.x}, ${shadowResult.y})`));
         }
+      } catch (shadowErr) {
+        if (forceDebug) console.log(formatLogMessage('cloudflare', `Shadow DOM fallback failed: ${shadowErr.message}`));
       }
       
       // Wait for Turnstile completion with reduced timeout
@@ -1531,7 +1592,11 @@ async function checkChallengeCompletion(page) {
  * }
  */
 async function handleCloudflareProtection(page, currentUrl, siteConfig, forceDebug = false) {
-  if (forceDebug) {
+  const cfDebug = forceDebug || siteConfig.cloudflare_bypass === 'debug' || siteConfig.cloudflare_phish === 'debug';
+  const cfBypassEnabled = siteConfig.cloudflare_bypass === true || siteConfig.cloudflare_bypass === 'debug';
+  const cfPhishEnabled = siteConfig.cloudflare_phish === true || siteConfig.cloudflare_phish === 'debug';
+
+  if (cfDebug) {
     console.log(formatLogMessage('cloudflare', `Using Cloudflare module v${CLOUDFLARE_MODULE_VERSION} for ${currentUrl}`));
   }
   
@@ -1561,7 +1626,7 @@ async function handleCloudflareProtection(page, currentUrl, siteConfig, forceDeb
   // Sets attempted: false, success: true for both protection types
  
   // Only proceed if we have indicators OR explicit config enables Cloudflare handling
-  if (!quickDetection.hasIndicators && !siteConfig.cloudflare_phish && !siteConfig.cloudflare_bypass) {
+  if (!quickDetection.hasIndicators && !cfPhishEnabled && !cfBypassEnabled) {
     if (forceDebug) console.log(formatLogMessage('cloudflare', `No Cloudflare indicators found and no explicit config, skipping protection handling for ${currentUrl}`));
     if (forceDebug) console.log(formatLogMessage('cloudflare', `Quick detection details: title="${quickDetection.title}", bodySnippet="${quickDetection.bodySnippet}"`));
     return {
@@ -1586,7 +1651,7 @@ async function handleCloudflareProtection(page, currentUrl, siteConfig, forceDeb
   try {
     // Adaptive timeout based on detection results and explicit config
     let adaptiveTimeout;
-    if (siteConfig.cloudflare_phish || siteConfig.cloudflare_bypass) {
+    if (cfPhishEnabled || cfBypassEnabled) {
       // Explicit config - give more time
       adaptiveTimeout = quickDetection.hasIndicators ? TIMEOUTS.ADAPTIVE_TIMEOUT_WITH_INDICATORS : TIMEOUTS.ADAPTIVE_TIMEOUT_WITHOUT_INDICATORS;
     } else {
@@ -1599,7 +1664,7 @@ async function handleCloudflareProtection(page, currentUrl, siteConfig, forceDeb
     }
     
     return await Promise.race([
-      performCloudflareHandling(page, currentUrl, siteConfig, forceDebug),
+      performCloudflareHandling(page, currentUrl, siteConfig, cfDebug),
       new Promise((resolve) => {
         setTimeout(() => {
         console.warn(formatLogMessage('cloudflare', `Adaptive timeout (${adaptiveTimeout}ms) for ${currentUrl} - continuing with scan`));
@@ -1631,6 +1696,9 @@ async function handleCloudflareProtection(page, currentUrl, siteConfig, forceDeb
  * @returns {Promise<Object>} Same structure as handleCloudflareProtection()
  */
 async function performCloudflareHandling(page, currentUrl, siteConfig, forceDebug = false) {
+  const cfBypassEnabled = siteConfig.cloudflare_bypass === true || siteConfig.cloudflare_bypass === 'debug';
+  const cfPhishEnabled = siteConfig.cloudflare_phish === true || siteConfig.cloudflare_phish === 'debug';
+
   const result = {
     phishingWarning: { attempted: false, success: false },
     verificationChallenge: { attempted: false, success: false },
@@ -1643,7 +1711,7 @@ async function performCloudflareHandling(page, currentUrl, siteConfig, forceDebu
   // Handle phishing warnings first - updates result.phishingWarning
   // Only runs if siteConfig.cloudflare_phish === true
   // Handle phishing warnings if enabled
-  if (siteConfig.cloudflare_phish === true) {
+  if (cfPhishEnabled) {
     if (forceDebug) console.log(formatLogMessage('cloudflare', `Phishing warning bypass enabled for ${currentUrl}`));
     
     const phishingResult = await handlePhishingWarningWithRetries(page, currentUrl, siteConfig, forceDebug);
@@ -1678,7 +1746,7 @@ async function performCloudflareHandling(page, currentUrl, siteConfig, forceDebu
   // Only runs if siteConfig.cloudflare_bypass === true
   // Sets requiresHuman: true if CAPTCHA detected (no bypass attempted)
   // Handle verification challenges if enabled
-  if (siteConfig.cloudflare_bypass === true) {
+  if (cfBypassEnabled) {
     if (forceDebug) console.log(formatLogMessage('cloudflare', `Challenge bypass enabled for ${currentUrl}`));
     
     const challengeResult = await handleVerificationChallengeWithRetries(page, currentUrl, siteConfig, forceDebug);
@@ -1731,55 +1799,28 @@ async function performCloudflareHandling(page, currentUrl, siteConfig, forceDebu
  * Performs parallel detection of multiple challenge types for better performance
  */
 async function parallelChallengeDetection(page, forceDebug = false) {
-  const detectionPromises = [];
-  
-  // Check for JS challenge
-  detectionPromises.push(
-    page.evaluate(() => {
-      return {
-        type: 'js',
-        detected: document.querySelector('script[src*="/cdn-cgi/challenge-platform/"]') !== null ||
-                  document.body?.textContent?.includes('Checking your browser') ||
-                  document.body?.textContent?.includes('Please wait while we verify')
-      };
-    }).catch(err => ({ type: 'js', detected: false, error: err.message }))
-  );
-  
-  // Check for Turnstile
-  detectionPromises.push(
-    page.evaluate(() => {
-      return {
-        type: 'turnstile',
-        detected: document.querySelector('.cf-turnstile') !== null ||
-                  document.querySelector('iframe[src*="challenges.cloudflare.com"]') !== null ||
-                  document.querySelector('.ctp-checkbox-container') !== null
-      };
-    }).catch(err => ({ type: 'turnstile', detected: false, error: err.message }))
-  );
-  
-  // Check for phishing warning
-  detectionPromises.push(
-    page.evaluate(() => {
-      return {
-        type: 'phishing',
-        detected: document.body?.textContent?.includes('This website has been reported for potential phishing') ||
-                  document.querySelector('a[href*="continue"]') !== null
-      };
-    }).catch(err => ({ type: 'phishing', detected: false, error: err.message }))
-  );
-  
-  // Check for managed challenge
-  detectionPromises.push(
-    page.evaluate(() => {
-      return {
-        type: 'managed',
-        detected: document.querySelector('.cf-managed-challenge') !== null ||
-                  document.querySelector('[data-cf-managed]') !== null
-      };
-    }).catch(err => ({ type: 'managed', detected: false, error: err.message }))
-  );
-  
-  const results = await Promise.all(detectionPromises);
+  let results;
+  try {
+    results = await page.evaluate(() => {
+      const bodyText = document.body?.textContent || '';
+      return [
+        { type: 'js', detected: document.querySelector('script[src*="/cdn-cgi/challenge-platform/"]') !== null ||
+            bodyText.includes('Checking your browser') || bodyText.includes('Please wait while we verify') },
+        { type: 'turnstile', detected: document.querySelector('.cf-turnstile') !== null ||
+            document.querySelector('iframe[src*="challenges.cloudflare.com"]') !== null ||
+            document.querySelector('.ctp-checkbox-container') !== null },
+        { type: 'phishing', detected: bodyText.includes('This website has been reported for potential phishing') ||
+            document.querySelector('a[href*="continue"]') !== null },
+        { type: 'managed', detected: document.querySelector('.cf-managed-challenge') !== null ||
+            document.querySelector('[data-cf-managed]') !== null }
+      ];
+    });
+  } catch (err) {
+    results = [
+      { type: 'js', detected: false }, { type: 'turnstile', detected: false },
+      { type: 'phishing', detected: false }, { type: 'managed', detected: false }
+    ];
+  }
   
   const detectedChallenges = results.filter(r => r.detected).map(r => r.type);
   

package/lib/fingerprint.js

@@ -843,7 +843,28 @@ async function applyUserAgentSpoofing(page, siteConfig, forceDebug, currentUrl)
           }
         }, 'WebGL spoofing');
 
-        // Permissions API spoofing
+        // WebGL null-context safety net � prevents ad script crashes in headless
+        safeExecute(() => {
+          const originalGetContext = HTMLCanvasElement.prototype.getContext;
+          HTMLCanvasElement.prototype.getContext = function(type, attrs) {
+            const ctx = originalGetContext.call(this, type, attrs);
+            if (ctx !== null || (type !== 'webgl' && type !== 'experimental-webgl' && type !== 'webgl2')) return ctx;
+            // Return minimal mock so scripts calling getShaderPrecisionFormat etc. don't crash
+            const noop = () => {};
+            return new Proxy({}, {
+              get(_, prop) {
+                if (prop === 'getShaderPrecisionFormat') return () => ({ rangeMin: 127, rangeMax: 127, precision: 23 });
+                if (prop === 'getParameter') return (p) => ({ 37445: 'Intel Inc.', 37446: 'Intel(R) UHD Graphics 630' }[p] || 0);
+                if (prop === 'getSupportedExtensions') return () => [];
+                if (prop === 'getExtension') return () => null;
+                if (prop === 'canvas') return this;
+                if (prop === 'drawingBufferWidth') return 1920;
+                if (prop === 'drawingBufferHeight') return 1080;
+                return noop;
+              }
+            });
+          };
+        }, 'WebGL null-context safety net');        // Permissions API spoofing
         //
         safeExecute(() => {
           if (navigator.permissions?.query) {