halo-agent 1.3.0 → 1.3.2

package/captcha.js

@@ -17,49 +17,56 @@ const CAPSOLVER_API = 'https://api.capsolver.com';
  * Returns { detected, type, sitekey, pageUrl }
  */
 async function detectCaptcha(page) {
+  // The pageUrl CapSolver wants is the top-level URL the user sees, not an
+  // inner iframe URL. Anchor it here so every branch returns the same thing.
+  const pageUrl = page.url();
+
   // First try the top-level frame via evaluate
   const topResult = await page.evaluate(() => {
-    // reCAPTCHA v2 via iframe src
+    // reCAPTCHA v2 via iframe src — also check size=invisible in the URL
     const rcFrame = document.querySelector('iframe[src*="recaptcha/api2"], iframe[src*="google.com/recaptcha"]');
     if (rcFrame) {
-      const match = (rcFrame.src || '').match(/[?&]k=([^&]+)/);
-      return { detected: true, type: 'recaptcha_v2', sitekey: match?.[1] || null, pageUrl: location.href };
+      const src = rcFrame.src || '';
+      const match = src.match(/[?&]k=([^&]+)/);
+      const isInvisible = /[?&]size=invisible/.test(src);
+      return { detected: true, type: 'recaptcha_v2', sitekey: match?.[1] || null, isInvisible };
     }
-    // reCAPTCHA via data-sitekey
+    // reCAPTCHA via data-sitekey — check data-size="invisible" on the element
     const rcEl = document.querySelector('.g-recaptcha[data-sitekey], [data-sitekey]:not(.h-captcha)');
     if (rcEl) {
-      return { detected: true, type: 'recaptcha_v2', sitekey: rcEl.getAttribute('data-sitekey'), pageUrl: location.href };
+      const isInvisible = rcEl.getAttribute('data-size') === 'invisible';
+      return { detected: true, type: 'recaptcha_v2', sitekey: rcEl.getAttribute('data-sitekey'), isInvisible };
     }
     // hCAPTCHA
     const hcEl = document.querySelector('.h-captcha[data-sitekey]');
     if (hcEl) {
-      return { detected: true, type: 'hcaptcha', sitekey: hcEl.getAttribute('data-sitekey'), pageUrl: location.href };
+      return { detected: true, type: 'hcaptcha', sitekey: hcEl.getAttribute('data-sitekey'), isInvisible: false };
     }
     const hcFrame = document.querySelector('iframe[src*="hcaptcha.com"]');
     if (hcFrame) {
       const match = (hcFrame.src || '').match(/[?&]sitekey=([^&]+)/);
-      return { detected: true, type: 'hcaptcha', sitekey: match?.[1] || null, pageUrl: location.href };
+      return { detected: true, type: 'hcaptcha', sitekey: match?.[1] || null, isInvisible: false };
     }
     // Cloudflare
     if (document.getElementById('cf-challenge-running') || document.querySelector('.cf-browser-verification')) {
-      return { detected: true, type: 'cloudflare', sitekey: null, pageUrl: location.href };
+      return { detected: true, type: 'cloudflare', sitekey: null, isInvisible: false };
     }
     return null;
   });
 
-  if (topResult) return topResult;
+  if (topResult) return { ...topResult, pageUrl };
 
-  // Search all frames for reCAPTCHA (Ashby loads it inside a sandboxed iframe)
-  const pageUrl = page.url();
+  // Search all frames for reCAPTCHA (Ashby/Greenhouse load it inside a sandboxed iframe)
   for (const frame of page.frames()) {
     if (frame === page.mainFrame()) continue;
     const frameSrc = frame.url();
 
-    // If the frame itself is a reCAPTCHA anchor frame, extract sitekey from its URL
+    // If the frame itself is a reCAPTCHA anchor frame, extract sitekey + invisible from URL
     if (frameSrc.includes('recaptcha/api2/anchor') || frameSrc.includes('recaptcha/enterprise/anchor')) {
       const match = frameSrc.match(/[?&]k=([^&]+)/);
+      const isInvisible = /[?&]size=invisible/.test(frameSrc);
       if (match) {
-        return { detected: true, type: 'recaptcha_v2', sitekey: match[1], pageUrl };
+        return { detected: true, type: 'recaptcha_v2', sitekey: match[1], pageUrl, isInvisible };
       }
     }
 
@@ -67,22 +74,29 @@ async function detectCaptcha(page) {
     try {
       const frameResult = await frame.evaluate(() => {
         const rcEl = document.querySelector('.g-recaptcha[data-sitekey], [data-sitekey]:not(.h-captcha)');
-        if (rcEl) return { sitekey: rcEl.getAttribute('data-sitekey'), type: 'recaptcha_v2' };
+        if (rcEl) {
+          return {
+            sitekey: rcEl.getAttribute('data-sitekey'),
+            type: 'recaptcha_v2',
+            isInvisible: rcEl.getAttribute('data-size') === 'invisible',
+          };
+        }
         const rcFrame = document.querySelector('iframe[src*="recaptcha"]');
         if (rcFrame) {
-          const match = (rcFrame.src || '').match(/[?&]k=([^&]+)/);
-          return match ? { sitekey: match[1], type: 'recaptcha_v2' } : null;
+          const src = rcFrame.src || '';
+          const match = src.match(/[?&]k=([^&]+)/);
+          return match ? { sitekey: match[1], type: 'recaptcha_v2', isInvisible: /[?&]size=invisible/.test(src) } : null;
         }
         return null;
       }).catch(() => null);
 
       if (frameResult?.sitekey) {
-        return { detected: true, type: frameResult.type, sitekey: frameResult.sitekey, pageUrl };
+        return { detected: true, type: frameResult.type, sitekey: frameResult.sitekey, pageUrl, isInvisible: !!frameResult.isInvisible };
       }
     } catch {}
   }
 
-  return { detected: false, type: null, sitekey: null, pageUrl };
+  return { detected: false, type: null, sitekey: null, pageUrl, isInvisible: false };
 }
 
 /**
@@ -101,21 +115,26 @@ async function solveCaptcha(captchaInfo, apiKey) {
     ? 'HCaptchaTaskProxyless'
     : 'ReCaptchaV2TaskProxyless';
 
-  console.log(`[captcha] Submitting ${taskType} task to CapSolver (sitekey: ${captchaInfo.sitekey.slice(0, 12)}...)`);
+  // CapSolver requires `isInvisible: true` for invisible reCAPTCHA — sending
+  // a normal v2 task for an invisible sitekey returns
+  // "Invalid input, please check captcha type or pageUrl and invisible".
+  const task = {
+    type: taskType,
+    websiteURL: captchaInfo.pageUrl,
+    websiteKey: captchaInfo.sitekey,
+  };
+  if (captchaInfo.type === 'recaptcha_v2' && captchaInfo.isInvisible) {
+    task.isInvisible = true;
+  }
+
+  console.log(`[captcha] Submitting ${taskType}${task.isInvisible ? ' (invisible)' : ''} task to CapSolver (sitekey: ${captchaInfo.sitekey.slice(0, 12)}..., url: ${captchaInfo.pageUrl})`);
 
   let taskId;
   try {
     const createRes = await fetch(`${CAPSOLVER_API}/createTask`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        clientKey: apiKey,
-        task: {
-          type: taskType,
-          websiteURL: captchaInfo.pageUrl,
-          websiteKey: captchaInfo.sitekey,
-        },
-      }),
+      body: JSON.stringify({ clientKey: apiKey, task }),
     });
     const createData = await createRes.json();
     if (createData.errorId !== 0) {

package/orchestrator.js

@@ -381,13 +381,51 @@ async function runJob(queueItem, chromeConn, config, reportStatus) {
     const confirmScreenshot = await page.screenshot({ type: 'jpeg', quality: 70 });
     const confirmKey = await uploadScreenshot(config, confirmScreenshot, `confirm_${queueId}.jpg`);
 
+    // Verify-then-DONE: trusting waitForURL alone was wrong (the Chalk bug —
+    // Ashby rendered "Missing entry for required field: Name, Email, ..."
+    // inline without a URL change, and we marked DONE on a failed submit).
+    // The backend re-fetches the page through Firecrawl + extract and tells
+    // us if the submit actually went through. On Firecrawl failure or no
+    // key, the endpoint returns submitted:true so we don't deadlock — we're
+    // strictly more correct than before, not less.
+    const verdictUrl = page.url();
+    console.log(`[orchestrator] Verifying submission at ${verdictUrl}...`);
+    let verdict = { submitted: true, error_message: null, confirmation_text: null, source: 'unavailable' };
+    try {
+      const vRes = await fetch(`${config.apiUrl}/agent/verify-submit`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${config.token}` },
+        body: JSON.stringify({ queue_id: queueId, page_url: verdictUrl }),
+      });
+      if (vRes.ok) verdict = await vRes.json();
+    } catch (e) {
+      console.warn(`[orchestrator] verify-submit unavailable: ${e.message}`);
+    }
+
+    if (!verdict.submitted) {
+      const reason = verdict.error_message || 'Submission did not confirm — form may still have errors';
+      console.warn(`[orchestrator] Submission NOT verified. Reason: ${reason}`);
+      await reportStatus('NEEDS_ATTENTION', {
+        review_screenshot_r2_key: confirmKey || null,
+        needs_attention_reason: `Submit clicked but not confirmed: ${reason}`,
+        intervention_type: 'submit_failed',
+        step: 'VERIFY',
+        step_detail: reason.slice(0, 200),
+        fields_filled: cumulativeFilled,
+      });
+      // Do NOT clearCheckpoint — user may dismiss + re-queue, and a stale
+      // checkpoint would resume into the same failed state. The dismiss flow
+      // clears it (DELETE /apply-queue/:id sets form_checkpoint_json = NULL).
+      throw new Error(`Submission failed verification: ${reason}`);
+    }
+
     await reportStatus('DONE', {
       confirmation_screenshot_r2_key: confirmKey || null,
       fields_filled: cumulativeFilled,
     });
     await clearCheckpoint(config, queueId);
 
-    console.log(`[orchestrator] Done: ${queueItem.company} - ${queueItem.title}`);
+    console.log(`[orchestrator] Done (verified): ${queueItem.company} - ${queueItem.title}${verdict.source === 'firecrawl' ? ' · firecrawl-verified' : ' · unverified'}`);
 
     // Post fill session data to backend for learning loop
     await postFillSession(config, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "halo-agent",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "HALO local apply agent — auto-fills job applications using your real Chrome session",
   "main": "index.js",
   "bin": {

package/scanPage.js

@@ -207,8 +207,27 @@ const CONSENT_PATTERNS = [
   /privacy\s*policy/i,
 ];
 
+// Normalize a label so trailing decorations don't break strict regex matches.
+// Ashby/Greenhouse often render labels like "Name *", "Email (required)",
+// "LinkedIn Profile — Required", "Phone *Required". Without this, the
+// PROFILE_PATTERNS (which use ^anchored regexes for short fields like name)
+// silently miss and the field falls through to 'custom', which means the
+// agent skips filling it with profile data.
+function normalizeLabel(raw) {
+  if (!raw) return '';
+  return raw
+    .toLowerCase()
+    .replace(/[*†‡]/g, ' ')                              // markers
+    .replace(/\((required|optional|mandatory)\)/g, ' ')   // "(required)"
+    .replace(/\b(required|optional|mandatory)\b/g, ' ')   // "required"
+    .replace(/[—–-]+\s*(required|optional)\s*$/g, ' ')   // "— required"
+    .replace(/[:?]+$/g, '')                               // trailing : ?
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
 function classifyField(field) {
-  const label = field.label.toLowerCase().trim();
+  const label = normalizeLabel(field.label);
 
   // Consent checkboxes
   if (field.inputType === 'checkbox' && CONSENT_PATTERNS.some(r => r.test(label))) {
@@ -222,7 +241,7 @@ function classifyField(field) {
     if (regex.test(label)) return 'profile:' + name;
   }
 
-  // Ashby system fields by name attribute
+  // Ashby system fields by name attribute (legacy form schema)
   if (field.name && field.name.startsWith('_systemfield_')) {
     const sfName = field.name.replace('_systemfield_', '');
     if (['name', 'email', 'phone', 'resume', 'linkedin', 'website'].includes(sfName)) {
@@ -323,11 +342,12 @@ async function scanAshby(page) {
       if (sfField === 'resume' || f.inputType === 'file') return { ...f, category: 'file:resume' };
       if (profileMap[sfField] !== undefined) return { ...f, category: 'profile:' + profileMap[sfField] };
     }
-    // UUID-named fields are custom questions
-    if (f.name && /^[0-9a-f-]{36}$/.test(f.name)) {
-      return { ...f, category: 'custom' };
-    }
     if (f.inputType === 'file') return { ...f, category: 'file:resume' };
+    // Modern Ashby uses UUID names for ALL fields (Name, Email, Phone, custom).
+    // Classify by LABEL first — that's the only signal that distinguishes
+    // a profile field from a custom question when the name attr is opaque.
+    // Don't shortcut UUID-named fields to 'custom' — that's exactly the
+    // Chalk bug where Name/Email/Phone/LinkedIn all fell through unfilled.
     return { ...f, category: classifyField(f) };
   }).filter(f => f.category !== 'ignore');
 }