halo-agent 1.1.0

package/README.md

@@ -0,0 +1,43 @@
+# halo-agent
+
+Local apply agent for [HALO](https://halo-apply-os.amoghi2tb.workers.dev). Auto-fills job applications in **your real Chrome session** — your cookies, your IP, your logged-in tabs — so it bypasses the bot-detection that blocks cloud headless browsers on sites like Workday and LinkedIn.
+
+## Install + pair
+
+In the HALO dashboard, open **Profile → Auto-apply agent → Get pairing code**. Then on your machine:
+
+```
+npx halo-agent pair <CODE>
+npx halo-agent install-autostart   # optional: run continuously at every login
+npx halo-agent start               # connect now
+```
+
+That's it. The dashboard's "Agent connected" pill should flip on within 30 seconds.
+
+## How it works
+
+- Polls `GET /apply-queue/next` for queued jobs.
+- Launches your real Chrome via Playwright (CDP on port 9222, your default profile) — *not* a headless browser.
+- Fills the application with materials you prepped + signed off on in HALO (tailored resume PDF, reviewed cover letter, per-field answers).
+- Defaults to **review-first**: agent fills, then pauses for your sign-off. Per-job auto-submit toggle in HALO if you want it to submit directly.
+- CAPTCHA: CapSolver if configured, vision fallback via Anthropic if not.
+- Heartbeats every 15s so the dashboard knows you're online.
+
+## Commands
+
+| | |
+|---|---|
+| `halo-agent pair <code>` | One-click pair with HALO (recommended) |
+| `halo-agent start` | Connect + start polling |
+| `halo-agent install-autostart` | Run at every login (macOS / Windows / Linux) |
+| `halo-agent uninstall-autostart` | Remove the autostart entry |
+| `halo-agent init` | Legacy: manual token paste |
+| `halo-agent token <value>` | Update the saved auth token |
+
+## Config
+
+Lives at `~/.halo-agent/config.json`. Set `HALO_API_URL` to point at a self-hosted Worker.
+
+## License
+
+MIT

package/browser.js

@@ -0,0 +1,157 @@
+'use strict';
+
+const { chromium } = require('playwright');
+const { execSync, spawnSync, spawn } = require('child_process');
+const fs = require('fs');
+
+const CDP_PORT = 9222;
+const CDP_URL = `http://localhost:${CDP_PORT}`;
+
+/**
+ * Check if Chrome is already running with remote debugging on CDP_PORT.
+ */
+async function isChromeDebuggable() {
+  try {
+    const res = await fetch(`${CDP_URL}/json/version`, { signal: AbortSignal.timeout(1500) });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Find the Chrome executable path on macOS.
+ * Checks multiple common install locations.
+ */
+function findChromeMac() {
+  const paths = [
+    '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+    '/Applications/Chromium.app/Contents/MacOS/Chromium',
+    `${process.env.HOME}/Applications/Google Chrome.app/Contents/MacOS/Google Chrome`,
+  ];
+  for (const p of paths) {
+    if (fs.existsSync(p)) return p;
+  }
+  return null;
+}
+
+/**
+ * Launch Chrome with remote debugging enabled, preserving the user's real profile.
+ * Uses shell: true on macOS to correctly handle spaces in the path.
+ * navigator.webdriver is NOT set because Playwright did not launch the browser.
+ */
+function launchChrome() {
+  const platform = process.platform;
+  const flags = [
+    `--remote-debugging-port=${CDP_PORT}`,
+    '--profile-directory=Default',
+    '--no-first-run',
+    '--no-default-browser-check',
+  ].join(' ');
+
+  if (platform === 'darwin') {
+    const chromePath = findChromeMac();
+    if (!chromePath) {
+      console.error('[halo-agent] Chrome not found. Install Google Chrome from https://www.google.com/chrome/');
+      return;
+    }
+    // Use shell:true so the path with spaces is handled correctly by the shell
+    spawn(`"${chromePath}" ${flags}`, [], {
+      shell: true,
+      detached: true,
+      stdio: 'ignore',
+    }).unref();
+  } else if (platform === 'win32') {
+    const chromePaths = [
+      'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe',
+      'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe',
+      `${process.env.LOCALAPPDATA}\\Google\\Chrome\\Application\\chrome.exe`,
+    ];
+    const chromePath = chromePaths.find(p => { try { fs.accessSync(p); return true; } catch { return false; } });
+    if (!chromePath) { console.error('[halo-agent] Chrome not found on Windows.'); return; }
+    spawn(`"${chromePath}" ${flags}`, [], { shell: true, detached: true, stdio: 'ignore' }).unref();
+  } else {
+    // Linux
+    spawn(`google-chrome ${flags}`, [], { shell: true, detached: true, stdio: 'ignore' }).unref();
+  }
+}
+
+/**
+ * Connect to the user's real Chrome via CDP.
+ * Returns { browser, context, newPage }.
+ * All requests use the user's real session — cookies, IP, fingerprint, extensions.
+ */
+async function connectToChrome(retries = 10) {
+  for (let i = 0; i < retries; i++) {
+    const debuggable = await isChromeDebuggable();
+    if (debuggable) {
+      try {
+        const browser = await chromium.connectOverCDP(CDP_URL);
+        const context = browser.contexts()[0] || await browser.newContext();
+        console.log('[halo-agent] Connected to Chrome.');
+
+        const conn = {
+          browser,
+          context,
+          async newPage(url) {
+            // Re-fetch context in case it went stale
+            let ctx;
+            try {
+              ctx = conn.browser.contexts()[0];
+              if (!ctx) throw new Error('no context');
+            } catch {
+              // Reconnect entirely
+              console.warn('[halo-agent] Chrome context lost — reconnecting...');
+              const fresh = await chromium.connectOverCDP(CDP_URL);
+              conn.browser = fresh;
+              ctx = fresh.contexts()[0] || await fresh.newContext();
+              conn.context = ctx;
+            }
+            const page = await ctx.newPage();
+            if (url) {
+              try {
+                await page.goto(url, { waitUntil: 'domcontentloaded', timeout: 60000 });
+              } catch (e) {
+                if (!e.message.includes('Timeout')) throw e;
+                // Slow page — try commit (just wait for server response, no JS wait)
+                console.warn('[halo-agent] Navigation slow — falling back to commit wait...');
+                try {
+                  await page.goto(url, { waitUntil: 'commit', timeout: 60000 });
+                  await page.waitForTimeout(5000); // give JS time to render
+                } catch (e2) {
+                  if (!e2.message.includes('Timeout')) throw e2;
+                  // Last resort — page may already be partially loaded, just wait
+                  console.warn('[halo-agent] Still slow — waiting for current page state...');
+                  await page.waitForTimeout(8000);
+                }
+              }
+            }
+            return page;
+          },
+        };
+        return conn;
+      } catch (e) {
+        console.warn(`[halo-agent] CDP connect attempt ${i + 1} failed: ${e.message}`);
+      }
+    }
+
+    if (i === 0) {
+      console.log('[halo-agent] Chrome not found on port 9222. Launching...');
+      launchChrome();
+      console.log('[halo-agent] Waiting for Chrome to start...');
+    } else {
+      process.stdout.write('.');
+    }
+
+    await new Promise(r => setTimeout(r, 3000));
+  }
+
+  console.log(''); // newline after dots
+  throw new Error(
+    `Could not connect to Chrome after ${retries} attempts.\n` +
+    `Run this manually in a separate terminal, then try again:\n\n` +
+    `  "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" --remote-debugging-port=9222 --user-data-dir=/tmp/halo-chrome\n`
+  );
+}
+
+module.exports = { connectToChrome, isChromeDebuggable };

package/captcha.js

@@ -0,0 +1,217 @@
+'use strict';
+
+/**
+ * CAPTCHA detection and solving via CapSolver API.
+ * API key stored locally in ~/.halo-agent/config.json.
+ *
+ * Supported: reCAPTCHA v2, hCAPTCHA, Cloudflare Turnstile
+ *
+ * Key fix: Ashby and many modern ATS load reCAPTCHA inside nested iframes.
+ * We search all frames on the page, not just document.querySelector on the top frame.
+ */
+
+const CAPSOLVER_API = 'https://api.capsolver.com';
+
+/**
+ * Detect if a CAPTCHA is present anywhere on the page (including nested iframes).
+ * Returns { detected, type, sitekey, pageUrl }
+ */
+async function detectCaptcha(page) {
+  // First try the top-level frame via evaluate
+  const topResult = await page.evaluate(() => {
+    // reCAPTCHA v2 via iframe src
+    const rcFrame = document.querySelector('iframe[src*="recaptcha/api2"], iframe[src*="google.com/recaptcha"]');
+    if (rcFrame) {
+      const match = (rcFrame.src || '').match(/[?&]k=([^&]+)/);
+      return { detected: true, type: 'recaptcha_v2', sitekey: match?.[1] || null, pageUrl: location.href };
+    }
+    // reCAPTCHA via data-sitekey
+    const rcEl = document.querySelector('.g-recaptcha[data-sitekey], [data-sitekey]:not(.h-captcha)');
+    if (rcEl) {
+      return { detected: true, type: 'recaptcha_v2', sitekey: rcEl.getAttribute('data-sitekey'), pageUrl: location.href };
+    }
+    // hCAPTCHA
+    const hcEl = document.querySelector('.h-captcha[data-sitekey]');
+    if (hcEl) {
+      return { detected: true, type: 'hcaptcha', sitekey: hcEl.getAttribute('data-sitekey'), pageUrl: location.href };
+    }
+    const hcFrame = document.querySelector('iframe[src*="hcaptcha.com"]');
+    if (hcFrame) {
+      const match = (hcFrame.src || '').match(/[?&]sitekey=([^&]+)/);
+      return { detected: true, type: 'hcaptcha', sitekey: match?.[1] || null, pageUrl: location.href };
+    }
+    // Cloudflare
+    if (document.getElementById('cf-challenge-running') || document.querySelector('.cf-browser-verification')) {
+      return { detected: true, type: 'cloudflare', sitekey: null, pageUrl: location.href };
+    }
+    return null;
+  });
+
+  if (topResult) return topResult;
+
+  // Search all frames for reCAPTCHA (Ashby loads it inside a sandboxed iframe)
+  const pageUrl = page.url();
+  for (const frame of page.frames()) {
+    if (frame === page.mainFrame()) continue;
+    const frameSrc = frame.url();
+
+    // If the frame itself is a reCAPTCHA anchor frame, extract sitekey from its URL
+    if (frameSrc.includes('recaptcha/api2/anchor') || frameSrc.includes('recaptcha/enterprise/anchor')) {
+      const match = frameSrc.match(/[?&]k=([^&]+)/);
+      if (match) {
+        return { detected: true, type: 'recaptcha_v2', sitekey: match[1], pageUrl };
+      }
+    }
+
+    // Check inside the frame's DOM
+    try {
+      const frameResult = await frame.evaluate(() => {
+        const rcEl = document.querySelector('.g-recaptcha[data-sitekey], [data-sitekey]:not(.h-captcha)');
+        if (rcEl) return { sitekey: rcEl.getAttribute('data-sitekey'), type: 'recaptcha_v2' };
+        const rcFrame = document.querySelector('iframe[src*="recaptcha"]');
+        if (rcFrame) {
+          const match = (rcFrame.src || '').match(/[?&]k=([^&]+)/);
+          return match ? { sitekey: match[1], type: 'recaptcha_v2' } : null;
+        }
+        return null;
+      }).catch(() => null);
+
+      if (frameResult?.sitekey) {
+        return { detected: true, type: frameResult.type, sitekey: frameResult.sitekey, pageUrl };
+      }
+    } catch {}
+  }
+
+  return { detected: false, type: null, sitekey: null, pageUrl };
+}
+
+/**
+ * Solve a CAPTCHA using CapSolver API.
+ * Returns the solution token string, or null if solving failed.
+ */
+async function solveCaptcha(captchaInfo, apiKey) {
+  if (!apiKey) return null;
+  if (captchaInfo.type === 'cloudflare') return null;
+  if (!captchaInfo.sitekey) {
+    console.warn('[captcha] No sitekey found — cannot solve automatically');
+    return null;
+  }
+
+  const taskType = captchaInfo.type === 'hcaptcha'
+    ? 'HCaptchaTaskProxyless'
+    : 'ReCaptchaV2TaskProxyless';
+
+  console.log(`[captcha] Submitting ${taskType} task to CapSolver (sitekey: ${captchaInfo.sitekey.slice(0, 12)}...)`);
+
+  let taskId;
+  try {
+    const createRes = await fetch(`${CAPSOLVER_API}/createTask`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        clientKey: apiKey,
+        task: {
+          type: taskType,
+          websiteURL: captchaInfo.pageUrl,
+          websiteKey: captchaInfo.sitekey,
+        },
+      }),
+    });
+    const createData = await createRes.json();
+    if (createData.errorId !== 0) {
+      console.error('[captcha] CapSolver create error:', createData.errorDescription);
+      return null;
+    }
+    taskId = createData.taskId;
+    console.log(`[captcha] Task created: ${taskId}`);
+  } catch (e) {
+    console.error('[captcha] CapSolver request failed:', e.message);
+    return null;
+  }
+
+  // Poll for result (up to 90 seconds)
+  for (let i = 0; i < 45; i++) {
+    await new Promise(r => setTimeout(r, 2000));
+    try {
+      const resultRes = await fetch(`${CAPSOLVER_API}/getTaskResult`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ clientKey: apiKey, taskId }),
+      });
+      const resultData = await resultRes.json();
+      if (resultData.status === 'ready') {
+        const token = resultData.solution?.gRecaptchaResponse || resultData.solution?.token || null;
+        console.log(`[captcha] Solved! Token length: ${token?.length || 0}`);
+        return token;
+      }
+      if (resultData.status === 'failed') {
+        console.error('[captcha] CapSolver solve failed:', resultData.errorDescription);
+        return null;
+      }
+    } catch {}
+  }
+  console.warn('[captcha] CapSolver timed out after 90s');
+  return null;
+}
+
+/**
+ * Inject a solved CAPTCHA token into the page and trigger the framework callback.
+ * Handles reCAPTCHA v2 in main frame and nested iframes.
+ */
+async function injectCaptchaToken(page, token, type) {
+  // Try injecting in the main frame first
+  await page.evaluate(({ token, type }) => {
+    const injectIntoDoc = (doc) => {
+      const responseEl = doc.querySelector(
+        '[name="g-recaptcha-response"], [name="h-captcha-response"], textarea[id*="captcha"]'
+      );
+      if (responseEl) {
+        const setter = Object.getOwnPropertyDescriptor(HTMLTextAreaElement.prototype, 'value')?.set;
+        if (setter) setter.call(responseEl, token);
+        else responseEl.value = token;
+        responseEl.dispatchEvent(new Event('input', { bubbles: true }));
+        responseEl.dispatchEvent(new Event('change', { bubbles: true }));
+      }
+    };
+
+    injectIntoDoc(document);
+
+    // Trigger reCAPTCHA callback
+    try {
+      if (type === 'recaptcha_v2') {
+        if (window.___grecaptcha_cfg?.clients) {
+          for (const k of Object.keys(window.___grecaptcha_cfg.clients)) {
+            const client = window.___grecaptcha_cfg.clients[k];
+            for (const ck of Object.keys(client)) {
+              if (client[ck] && typeof client[ck].callback === 'function') {
+                client[ck].callback(token);
+              }
+            }
+          }
+        }
+        // Also try direct grecaptcha callback
+        if (typeof window.grecaptcha?.execute === 'function') {
+          // v3 style — set token in all response textareas
+        }
+      }
+    } catch {}
+  }, { token, type });
+
+  // Also try injecting into child frames that contain the captcha widget
+  for (const frame of page.frames()) {
+    if (frame === page.mainFrame()) continue;
+    try {
+      await frame.evaluate(({ token }) => {
+        const responseEl = document.querySelector(
+          '[name="g-recaptcha-response"], [name="h-captcha-response"]'
+        );
+        if (responseEl) {
+          responseEl.value = token;
+          responseEl.dispatchEvent(new Event('input', { bubbles: true }));
+        }
+      }, { token }).catch(() => {});
+    } catch {}
+  }
+}
+
+module.exports = { detectCaptcha, solveCaptcha, injectCaptchaToken };

package/config.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+const CONFIG_DIR = path.join(os.homedir(), '.halo-agent');
+const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
+
+function loadConfig() {
+  if (!fs.existsSync(CONFIG_FILE)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function saveConfig(config) {
+  if (!fs.existsSync(CONFIG_DIR)) fs.mkdirSync(CONFIG_DIR, { recursive: true });
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
+}
+
+// Build headers required for Cloudflare Access service token auth.
+// Returns empty object if no CF Access credentials are configured.
+function cfAccessHeaders(config) {
+  if (config && config.cfAccessClientId && config.cfAccessClientSecret) {
+    return {
+      'CF-Access-Client-Id': config.cfAccessClientId,
+      'CF-Access-Client-Secret': config.cfAccessClientSecret,
+    };
+  }
+  return {};
+}
+
+module.exports = { loadConfig, saveConfig, CONFIG_DIR, cfAccessHeaders };