channel-worker 2.5.139 → 2.5.141

package/lib/command-poller.js

@@ -347,8 +347,11 @@ class CommandPoller {
       });
       if (res.status === 'needs_verify') {
         // Anti-bot bounce — báo sạch, KHÔNG thử lại để khỏi đâm thêm captcha.
-        console.warn(`[shopee] lấy link: needs_verify — ${res.reason}`);
-        await this.api.updateCommand(command._id, { status: 'done', result: { needs_verify: true, reason: res.reason } });
+        // Ghi kèm tên profile: có hai phiên (Shopee1, Shopee2) và người xử lý
+        // phải biết mở đúng cái nào để kéo captcha.
+        const reason = `${res.reason} [${profileName}]`;
+        console.warn(`[shopee] lấy link: needs_verify — ${reason}`);
+        await this.api.updateCommand(command._id, { status: 'done', result: { needs_verify: true, reason } });
         return;
       }
       if (res.status !== 'ok') {

package/lib/nst-manager.js

@@ -21,6 +21,43 @@ function nstLaunchError(response, { profileId = '', runningCount = 0 } = {}) {
   return error;
 }
 
+// Every proxy in the fleet exits through Viettel VN, and GeoIP answers
+// "Vietnam / Asia/Bangkok" for those IPs — so letting NST derive locale from
+// the proxy turned every new profile into a Thai browser (th-TH, Asia/Bangkok).
+// Measured 2026-09-25 on win-worker: 6/6 running profiles, FB login page in
+// Thai for Vietnamese accounts. Pin what a Vietnamese user actually runs.
+// If a non-VN proxy is ever added, this has to follow the proxy's country.
+const VN_LOCALIZATION = {
+  basedOnProxy: false,
+  locale: 'vi-VN',
+  languages: ['vi-VN', 'vi', 'en-US', 'en'],
+  timezone: 'Asia/Ho_Chi_Minh',
+};
+
+// Only pin the noise flags and the locale. CPU count, RAM, kernel version and
+// UA stay with Nstbrowser's own randomiser: hard-coding hardwareConcurrency=8 /
+// deviceMemory=8 / kernel 132 for EVERY profile made 22/22 running browsers
+// identical (win-worker, 2026-08-22), which is exactly what lets a platform
+// cluster a fleet of accounts. All FB/YT selectors are bilingual (vi + en).
+function profileCreateBody(name, platform) {
+  return {
+    name,
+    platform,
+    fingerprint: {
+      flags: {
+        audio: 'Noise',
+        canvas: 'Noise',
+        fonts: 'Masked',
+        gpu: 'Allow',
+        webgl: 'Noise',
+        localization: 'Custom',
+        timezone: 'Custom',
+      },
+      localization: VN_LOCALIZATION,
+    },
+  };
+}
+
 class NstManager {
   constructor(apiKey, options = {}) {
     this.apiKey = apiKey;
@@ -232,32 +269,9 @@ class NstManager {
 
     const platform = (options.os || 'windows').toLowerCase() === 'mac' ? 'MacOS' : 'Windows';
     console.log(`[nst] WARNING: Profile "${name}" NOT FOUND after 3 retries — creating new profile (${platform})...`);
-    // Only pin the noise flags. Everything else (CPU count, RAM, kernel
-    // version, UA, locale/timezone) is left to Nstbrowser's own randomiser.
-    // Previously this hard-coded hardwareConcurrency=8 / deviceMemory=8 /
-    // kernel 132 / en-US for EVERY profile, and NST honoured it — measured
-    // 2026-08-22 on win-worker: 22 running browsers, 22/22 identical on
-    // (chrome, cpu, ram, language, timezone, screen). Same machine fingerprint
-    // across a fleet of accounts is exactly what lets a platform cluster them.
-    // localization 'BasedOnProxy' lets NST derive locale + timezone from the
-    // proxy's geo, so a VN account on a VN proxy stops claiming it only speaks
-    // English. All FB/YT selectors are already bilingual (vi + en).
     const res = await this.api('/profiles', {
       method: 'POST',
-      body: JSON.stringify({
-        name,
-        platform,
-        fingerprint: {
-          flags: {
-            audio: 'Noise',
-            canvas: 'Noise',
-            fonts: 'Masked',
-            gpu: 'Allow',
-            webgl: 'Noise',
-            localization: 'BasedOnProxy',
-          },
-        },
-      }),
+      body: JSON.stringify(profileCreateBody(name, platform)),
     });
 
     const profileId = res?.data?.profileId || res?.data?._id;
@@ -446,4 +460,4 @@ class NstManager {
   }
 }
 
-module.exports = { NstManager, nstLaunchError };
+module.exports = { NstManager, nstLaunchError, profileCreateBody };

package/lib/shopee-report.js

@@ -1,4 +1,4 @@
-const { findAffiliatePage, isBlockedState } = require('./shopee-scraper');
+const { findAffiliatePage, isBlockedState, isAntiBotBody, ANTI_BOT_REASON } = require('./shopee-scraper');
 
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
@@ -72,7 +72,10 @@ async function fetchConversionReport(ctx, {
         }
       }, { pageSize, pageNum, start: window.start, end: window.end });
 
-      if (isBlockedState(page.url(), result) || result.json?.code === 90309999) {
+      if (isAntiBotBody(result.json)) {
+        return { status: 'needs_verify', rows, reason: ANTI_BOT_REASON };
+      }
+      if (isBlockedState(page.url(), result)) {
         return { status: 'needs_verify', rows, reason: `blocked while reading report (http ${result.status}, code ${result.json?.code})` };
       }
       if (result.status !== 200 || result.json?.code !== 0) {
@@ -146,7 +149,10 @@ async function fetchClickReport(ctx, {
         }
       }, { pageSize, pageNum, start: window.start, end: window.end });
 
-      if (isBlockedState(page.url(), result) || result.json?.code === 90309999) {
+      if (isAntiBotBody(result.json)) {
+        return { status: 'needs_verify', rows, reason: ANTI_BOT_REASON };
+      }
+      if (isBlockedState(page.url(), result)) {
         return { status: 'needs_verify', rows, reason: `blocked while reading click report (http ${result.status}, code ${result.json?.code})` };
       }
       if (result.status !== 200 || result.json?.code !== 0) {
@@ -228,7 +234,10 @@ async function fetchSocialMediaAccounts(ctx, { timeoutMs = 45000, log = null } =
       }
     });
 
-    if (isBlockedState(page.url(), result) || result.json?.code === 90309999) {
+    if (isAntiBotBody(result.json)) {
+      return { status: 'needs_verify', accounts: [], reason: ANTI_BOT_REASON };
+    }
+    if (isBlockedState(page.url(), result)) {
       return { status: 'needs_verify', accounts: [], reason: `blocked while reading media info (http ${result.status}, code ${result.json?.code})` };
     }
     if (result.status !== 200 || result.json?.code !== 0) {

package/lib/shopee-scraper.js

@@ -183,6 +183,21 @@ function isBlockedState(pageUrl, res) {
   return false;
 }
 
+// Thân phản hồi mang mã chặn chống bot của Shopee.
+//
+// 25/09/2026, lượt lấy link thật trên Shopee2: http 200, thân
+// `{ error: 90309999, is_customized: false, is_login: true }`, rồi tab affiliate
+// bị đẩy sang verify/traffic → verify/captcha. Mã nằm ở `error`, KHÔNG ở `code`
+// — các chỗ so `json.code === 90309999` trước đây trượt hết, nên lấy link ra
+// `failed` với lỗi thô "error 90309999" và cửa nghỉ captcha của ShopeeRate
+// (chỉ đọc `result.needs_verify`) không đóng. Xét cả hai chỗ cho chắc.
+const ANTI_BOT_CODE = 90309999;
+function isAntiBotBody(json) {
+  if (!json || typeof json !== 'object') return false;
+  return Number(json.error) === ANTI_BOT_CODE || Number(json.code) === ANTI_BOT_CODE;
+}
+const ANTI_BOT_REASON = `Shopee chặn chống bot (error ${ANTI_BOT_CODE}) — mở profile kéo captcha rồi thử lại`;
+
 // Tab affiliate nào đang mở — so bằng HOSTNAME, không bằng chuỗi con.
 //
 // 11/09/2026, đo trên profile Shopee1 thật: tab captcha cũ
@@ -385,7 +400,10 @@ async function scrapeOffers(ctx, {
           } catch (e) { return { status: 0, error: String(e.message) }; }
         }, { st, offset, page_limit, mid, listType, kw, ft: filter_types });
 
-        if (isBlockedState(page.url(), res) || res.json?.code === 90309999) {
+        if (isAntiBotBody(res.json)) {
+          return { status: 'needs_verify', products: [...byId.values()], raw_count: rawCount, reason: ANTI_BOT_REASON };
+        }
+        if (isBlockedState(page.url(), res)) {
           return { status: 'needs_verify', products: [...byId.values()], raw_count: rawCount, reason: `blocked mid-scrape (http ${res.status}, code ${res.json?.code})` };
         }
         if (res.status !== 200 || res.json?.code !== 0) {
@@ -501,6 +519,9 @@ async function generateOfferLink(ctx, { items = [], subIds = [], timeoutMs = 450
       } catch (e) { return { status: 0, error: String(e.message) }; }
     }, { list, subs });
 
+    if (isAntiBotBody(res.json)) {
+      return { status: 'needs_verify', links: [], reason: ANTI_BOT_REASON };
+    }
     if (isBlockedState(page.url(), res)) {
       return { status: 'needs_verify', links: [], reason: `blocked (http ${res.status})` };
     }
@@ -555,4 +576,4 @@ function parseProductUrl(url = '') {
   return null;
 }
 
-module.exports = { ingestProduct, scrapeOffers, generateOfferLink, linkFailureReason, cleanSubId, parseProductUrl, parseOfferRow, parsePdpItem, categoryGroup, pctToNumber, AFFILIATE_CATEGORIES, applyFilters, isBlockedState, findAffiliatePage, pruneTabs, isJunkTab };
+module.exports = { ingestProduct, scrapeOffers, generateOfferLink, linkFailureReason, cleanSubId, parseProductUrl, parseOfferRow, parsePdpItem, categoryGroup, pctToNumber, AFFILIATE_CATEGORIES, applyFilters, isBlockedState, isAntiBotBody, ANTI_BOT_REASON, findAffiliatePage, pruneTabs, isJunkTab };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "channel-worker",
-  "version": "2.5.139",
+  "version": "2.5.141",
   "description": "Channel Manager worker daemon — runs on remote machines to execute video pipeline jobs",
   "main": "lib/daemon.js",
   "bin": {