granclaw 0.0.1-beta.37 → 0.0.1-beta.38

package/dist/backend/agent/captcha-detect.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * captcha-detect.ts
+ *
+ * A stringified IIFE we ship to `agent-browser eval` to decide whether the
+ * currently-open page is blocked behind some kind of bot/captcha wall. The
+ * runner polls this snippet after every navigation command so CapMonster and
+ * the stealth extension have a chance to clear the challenge before the
+ * agent starts reading the page.
+ *
+ * It covers:
+ *   - Cloudflare JS interstitials ("Just a moment...", "Checking your browser…",
+ *     "Attention Required"), including the common localised titles.
+ *   - Cloudflare managed-challenge DOM markers (#challenge-stage,
+ *     #challenge-running, .cf-browser-verification, .cf-im-under-attack).
+ *   - The classic widget iframes: reCaptcha, hCaptcha, Cloudflare Turnstile,
+ *     DataDome, Arkose/FunCaptcha.
+ *   - Inline widgets: .g-recaptcha, .h-captcha, [class*="captcha"].
+ *   - PerimeterX / HUMAN bot check: #px-captcha.
+ *
+ * IMPORTANT: this runs as a string inside Chrome, NOT in Node. No ES features
+ * newer than the detector's tested Chrome baseline, no TypeScript. Keep it
+ * ES5-flavoured so it stays safe if the agent-browser build ever targets an
+ * older chromium.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CAPTCHA_DETECT_JS = void 0;
+exports.CAPTCHA_DETECT_JS = `(function() {
+  var title = (document.title || '').toLowerCase();
+  var titlePatterns = [
+    'just a moment',           // Cloudflare interstitial (EN)
+    'un momento',              // CF Spanish
+    'un instant',              // CF French
+    'einen moment',            // CF German
+    'checking your browser',   // CF older / generic anti-bot
+    'attention required',      // CF WAF block page
+    'please wait',             // generic "please wait while we check"
+  ];
+  for (var i = 0; i < titlePatterns.length; i++) {
+    if (title.indexOf(titlePatterns[i]) !== -1) return 'captcha';
+  }
+
+  var selectors = [
+    // Widget iframes
+    'iframe[src*="captcha-delivery"]',        // DataDome
+    'iframe[src*="geo.captcha"]',             // DataDome geo
+    'iframe[src*="recaptcha"]',               // reCaptcha v2/v3
+    'iframe[src*="hcaptcha"]',                // hCaptcha
+    'iframe[src*="challenges.cloudflare"]',   // Cloudflare Turnstile
+    'iframe[src*="arkoselabs"]',              // Arkose FunCaptcha
+    'iframe[src*="funcaptcha"]',
+    // Inline widgets
+    '.g-recaptcha',
+    '.h-captcha',
+    '[class*="captcha"]',
+    // Cloudflare interstitial / managed challenge
+    '#challenge-stage',
+    '#challenge-running',
+    '#cf-challenge-running',
+    '.cf-browser-verification',
+    '.cf-im-under-attack',
+    // PerimeterX / HUMAN
+    '#px-captcha',
+  ];
+  for (var j = 0; j < selectors.length; j++) {
+    if (document.querySelector(selectors[j])) return 'captcha';
+  }
+  return 'clear';
+})()`;

package/dist/backend/agent/runner-pi.js

@@ -51,6 +51,7 @@ const schedules_db_js_1 = require("../schedules-db.js");
 const cron_parser_1 = require("cron-parser");
 const session_manager_js_1 = require("../browser/session-manager.js");
 const stealth_js_1 = require("../browser/stealth.js");
+const captcha_detect_js_1 = require("./captcha-detect.js");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 /**
  * Resolve the templates directory.
@@ -683,27 +684,19 @@ async function runAgent(agent, message, onChunk, options) {
         // Privileged commands (record, close, tab close for session 0,
         // session management) are rejected — the runtime owns those.
         /**
-         * After a navigation command, check if a CAPTCHA is blocking the page.
-         * Waits up to 30s for the CapMonster extension to auto-solve it.
+         * After a navigation command, check whether the page is blocked by any
+         * bot/captcha wall (widget captcha OR Cloudflare-style JS interstitial)
+         * and poll until CapMonster + the stealth extension have cleared it.
+         *
+         * Budget is 45s — Cloudflare's "Just a moment..." managed challenge often
+         * takes 15–20s on a cold datacenter IP, and CapMonster-solved widgets can
+         * take another pass, so shorter deadlines were causing real unblocks to
+         * be reported as "unsolved" (regression verified on mariados 2026-04-15).
+         *
          * Returns 'clear' (no captcha / solved), 'unsolved' (still blocked after timeout).
          */
         async function waitForCaptchaResolution(bin, sessionId) {
-            const CAPTCHA_JS = `(function() {
-        var patterns = [
-          'iframe[src*="captcha-delivery"]',
-          'iframe[src*="geo.captcha"]',
-          'iframe[src*="recaptcha"]',
-          'iframe[src*="hcaptcha"]',
-          'iframe[src*="challenges.cloudflare"]',
-          '.g-recaptcha',
-          '.h-captcha',
-          '[class*="captcha"]',
-        ];
-        return patterns.some(function(s) {
-          return !!document.querySelector(s);
-        }) ? 'captcha' : 'clear';
-      })()`;
-            const evalArgv = (id) => ['--session', id, 'eval', CAPTCHA_JS];
+            const evalArgv = (id) => ['--session', id, 'eval', captcha_detect_js_1.CAPTCHA_DETECT_JS];
             const check = async () => {
                 try {
                     const { stdout } = await execFileAsync(bin, evalArgv(sessionId), { timeout: 8_000 });
@@ -717,8 +710,8 @@ async function runAgent(agent, message, onChunk, options) {
             await new Promise(r => setTimeout(r, 1500));
             if (!await check())
                 return 'clear';
-            // CAPTCHA detected — wait up to 30s for auto-solve
-            const deadline = Date.now() + 30_000;
+            // Challenge detected — poll every 2s until the page clears or 45s elapses.
+            const deadline = Date.now() + 45_000;
             while (Date.now() < deadline) {
                 await new Promise(r => setTimeout(r, 2_000));
                 if (!await check())
@@ -756,7 +749,7 @@ async function runAgent(agent, message, onChunk, options) {
                     'Do not call `record start`, `record stop`, `close`, or `session` — the runtime manages those.',
                     'You do not need to screenshot for audit — the whole session is recorded as video automatically.',
                     'Saved logins persist automatically when the user has set up a profile via the dashboard Browser view.',
-                    'CAPTCHA handling: if a page returns a CAPTCHA, wait — the browser has an automatic solver extension. If it is not resolved after ~30 seconds, use request_human_browser_takeover to let the user solve it.',
+                    'CAPTCHA & Cloudflare handling: the browser ships an automatic CapMonster extension plus a stealth extension. After `open` or `reload` the runtime automatically polls for up to ~45 seconds while any captcha widget OR Cloudflare JS interstitial ("Just a moment...", "Checking your browser…", "Attention Required") clears — do NOT bail out early, do NOT call request_human_browser_takeover just because the first snapshot shows the interstitial. If, after your tool call returns, the response still contains the "CAPTCHA detected and not auto-solved" warning, THEN call request_human_browser_takeover.',
                     'Examples: {"command":"open","args":["https://example.com"]}, {"command":"click","args":["--ref","e12"]}, {"command":"fill","args":["--ref","e5","Alice"]}',
                 ],
                 parameters: {
@@ -831,7 +824,7 @@ async function runAgent(agent, message, onChunk, options) {
                                 return {
                                     content: [{
                                             type: 'text',
-                                            text: out + '\n\n⚠️ CAPTCHA detected and not auto-solved after 30s. ' +
+                                            text: out + '\n\n⚠️ CAPTCHA detected and not auto-solved after 45s. ' +
                                                 'Use request_human_browser_takeover to let the user solve it, or try a different URL.',
                                         }],
                                 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "granclaw",
-  "version": "0.0.1-beta.37",
+  "version": "0.0.1-beta.38",
   "description": "A personal AI assistant you run on your own machine.",
   "license": "MIT",
   "repository": {