zevairouter 1.0.134 → 1.0.136

package/src/lib/oauth/services/bulkImportBrowserEngine.js

@@ -3,15 +3,30 @@ import { createRequire } from "node:module";
 
 const requireFromHere = createRequire(import.meta.url);
 
-/** Engines: chromium (default) + cloakbrowser (Turnstile / CF / xAI). Camoufox stays retired. */
-const SUPPORTED_ENGINES = new Set(["chromium", "cloakbrowser"]);
-export const DEFAULT_BULK_IMPORT_ENGINE = "chromium";
+/**
+ * Automation browser engine: CloakBrowser only.
+ * Stock Playwright Chromium is retired for bulk import — CloakBrowser is a
+ * patched Chromium that passes Turnstile / bot checks (CF, Google, etc.).
+ * playwright-core remains a peer of cloakbrowser (drive API only; no stock browser).
+ */
+export const DEFAULT_BULK_IMPORT_ENGINE = "cloakbrowser";
+
+const SUPPORTED_ENGINES = new Set(["cloakbrowser"]);
 
 export function normalizeBulkImportEngine(value) {
-  if (typeof value !== "string") return DEFAULT_BULK_IMPORT_ENGINE;
+  if (typeof value !== "string" || !value.trim()) return DEFAULT_BULK_IMPORT_ENGINE;
   const lower = value.trim().toLowerCase();
-  // aliases + common typos
-  if (lower === "cloak" || lower === "cloackbrowser" || lower === "cloack" || lower === "cloak-browser") {
+  // Legacy aliases: everything maps to cloakbrowser (chromium/camoufox retired).
+  if (
+    lower === "cloak" ||
+    lower === "cloackbrowser" ||
+    lower === "cloack" ||
+    lower === "cloak-browser" ||
+    lower === "chromium" ||
+    lower === "chrome" ||
+    lower === "camoufox" ||
+    lower === "playwright"
+  ) {
     return "cloakbrowser";
   }
   return SUPPORTED_ENGINES.has(lower) ? lower : DEFAULT_BULK_IMPORT_ENGINE;
@@ -25,68 +40,14 @@ function loadRuntimeHelper(name) {
   }
 }
 
-function loadPlaywrightRuntime() {
-  return loadRuntimeHelper("playwrightRuntime");
-}
-
-async function importPlaywright() {
-  const playwright = await import("playwright");
-  return playwright.chromium ?? playwright.default?.chromium ?? null;
-}
-
-/**
- * WebGL / UA / platform must match. Spoofing Intel Iris on a Linux VPS UA is a
- * classic bot signal and triggers Google CAPTCHA even at high concurrency.
- * (Used to work when fingerprint was consistent or less checked.)
- */
-function getStealthPlatformProfile() {
-  const platform = typeof process !== "undefined" ? process.platform : "linux";
-  if (platform === "darwin") {
-    return {
-      platform,
-      languages: ["en-US", "en"],
-      webglVendor: "Google Inc. (Apple)",
-      webglRenderer: "ANGLE (Apple, ANGLE Metal Renderer: Apple M1, Unspecified Version)",
-      uaPlatform: "Macintosh; Intel Mac OS X 10_15_7",
-    };
-  }
-  if (platform === "win32") {
-    return {
-      platform,
-      languages: ["en-US", "en"],
-      webglVendor: "Google Inc. (NVIDIA)",
-      webglRenderer: "ANGLE (NVIDIA, NVIDIA GeForce GTX 1660 Direct3D11 vs_5_0 ps_5_0, D3D11)",
-      uaPlatform: "Windows NT 10.0; Win64; x64",
-    };
-  }
-  // Linux VPS / Xvfb — Mesa/SwiftShader style, NOT Mac Iris
-  return {
-    platform: "linux",
-    languages: ["en-US", "en"],
-    webglVendor: "Google Inc. (Google)",
-    webglRenderer: "ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver)",
-    uaPlatform: "X11; Linux x86_64",
-  };
-}
-
 /**
  * Seeded fingerprint so each account/session looks like a different real desktop
  * instead of the same 900x700 + identical navigator.* cluster (Tencent risk signal).
- * WebGL stays OS-native (spoofing Mac GPU on Linux UA is worse).
+ * Do NOT spoof WebGL (CloakBrowser already patches at binary level).
  *
  * @param {string|number} [seed]
- * @returns {{
- *   viewport: { width: number, height: number },
- *   deviceScaleFactor: number,
- *   hardwareConcurrency: number,
- *   deviceMemory: number,
- *   maxTouchPoints: number,
- *   screen: { width: number, height: number, availWidth: number, availHeight: number, colorDepth: number, pixelDepth: number },
- *   seed: string,
- * }}
  */
 export function buildAccountFingerprint(seed) {
-  // Deterministic byte stream from seed (stable retry of same account = same fingerprint).
   let buf = createHash("sha256").update(String(seed ?? `${Date.now()}-${Math.random()}`)).digest();
   let i = 0;
   const nextByte = () => {
@@ -99,7 +60,6 @@ export function buildAccountFingerprint(seed) {
   const next = () => nextByte() / 256;
   const pick = (arr) => arr[Math.floor(next() * arr.length) % arr.length];
 
-  // Common real desktop resolutions (avoid Playwright default 900x700 bot shape).
   const base = pick([
     { width: 1366, height: 768 },
     { width: 1440, height: 900 },
@@ -111,21 +71,17 @@ export function buildAccountFingerprint(seed) {
     { width: 1680, height: 1050 },
     { width: 2560, height: 1440 },
   ]);
-  // Tiny noise so two accounts with same base size still differ slightly.
   const width = base.width - (nextByte() % 17);
   const height = base.height - (nextByte() % 13);
   const taskbar = pick([0, 30, 40, 48]);
   const colorDepth = pick([24, 30, 32]);
-  const hardwareConcurrency = pick([4, 6, 8, 8, 12, 16]);
-  const deviceMemory = pick([4, 8, 8, 16]);
-  const deviceScaleFactor = pick([1, 1, 1.25, 1.5, 2]);
 
   return {
     seed: String(seed ?? ""),
     viewport: { width, height },
-    deviceScaleFactor,
-    hardwareConcurrency,
-    deviceMemory,
+    deviceScaleFactor: pick([1, 1, 1.25, 1.5, 2]),
+    hardwareConcurrency: pick([4, 6, 8, 8, 12, 16]),
+    deviceMemory: pick([4, 8, 8, 16]),
     maxTouchPoints: 0,
     screen: {
       width,
@@ -138,31 +94,24 @@ export function buildAccountFingerprint(seed) {
   };
 }
 
-function buildStealthInitScript(overrides = {}) {
-  const p = getStealthPlatformProfile();
-  const languages = Array.isArray(overrides.languages) && overrides.languages.length
-    ? overrides.languages
-    : p.languages;
-  const fp = overrides.fingerprint && typeof overrides.fingerprint === "object"
-    ? overrides.fingerprint
-    : null;
-  // Inject as JSON so quotes in renderer strings stay safe.
+/**
+ * Light init script for per-account HW/screen noise.
+ * Avoids webdriver/WebGL patches that conflict with CloakBrowser binary stealth.
+ */
+export function buildFingerprintInitScript({ languages, fingerprint } = {}) {
   return `
   (() => {
     const profile = ${JSON.stringify({
-      languages,
-      webglVendor: p.webglVendor,
-      webglRenderer: p.webglRenderer,
-      hardwareConcurrency: fp?.hardwareConcurrency ?? null,
-      deviceMemory: fp?.deviceMemory ?? null,
-      maxTouchPoints: fp?.maxTouchPoints ?? null,
-      screen: fp?.screen ?? null,
+      languages: Array.isArray(languages) ? languages : null,
+      hardwareConcurrency: fingerprint?.hardwareConcurrency ?? null,
+      deviceMemory: fingerprint?.deviceMemory ?? null,
+      maxTouchPoints: fingerprint?.maxTouchPoints ?? null,
+      screen: fingerprint?.screen ?? null,
     })};
     try {
-      Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
-    } catch {}
-    try {
-      Object.defineProperty(navigator, 'languages', { get: () => profile.languages.slice() });
+      if (Array.isArray(profile.languages) && profile.languages.length) {
+        Object.defineProperty(navigator, 'languages', { get: () => profile.languages.slice() });
+      }
     } catch {}
     try {
       if (typeof profile.hardwareConcurrency === 'number') {
@@ -189,242 +138,42 @@ function buildStealthInitScript(overrides = {}) {
         }
       }
     } catch {}
-    try {
-      Object.defineProperty(navigator, 'plugins', {
-        get: () => {
-          const plugins = [
-            { name: 'Chrome PDF Plugin', filename: 'internal-pdf-viewer', description: 'Portable Document Format' },
-            { name: 'Chrome PDF Viewer', filename: 'mhjfbmdgcfjbbpaeojofohoefgiehjai', description: '' },
-            { name: 'Native Client', filename: 'internal-nacl-plugin', description: '' },
-          ];
-          plugins.length = 3;
-          return plugins;
-        }
-      });
-    } catch {}
-    try {
-      const _origQuery = window.navigator.permissions.query.bind(window.navigator.permissions);
-      window.navigator.permissions.query = (parameters) =>
-        parameters && parameters.name === 'notifications'
-          ? Promise.resolve({ state: Notification.permission })
-          : _origQuery(parameters);
-    } catch {}
-    try {
-      if (!window.chrome) window.chrome = {};
-      if (!window.chrome.runtime) window.chrome.runtime = {};
-      window.chrome.runtime.connect = window.chrome.runtime.connect || function() {};
-      window.chrome.runtime.sendMessage = window.chrome.runtime.sendMessage || function() {};
-    } catch {}
-    try {
-      const patch = (Proto) => {
-        if (!Proto || !Proto.prototype || !Proto.prototype.getParameter) return;
-        const orig = Proto.prototype.getParameter;
-        Proto.prototype.getParameter = function(parameter) {
-          // UNMASKED_VENDOR_WEBGL / UNMASKED_RENDERER_WEBGL
-          if (parameter === 37445) return profile.webglVendor;
-          if (parameter === 37446) return profile.webglRenderer;
-          return orig.call(this, parameter);
-        };
-      };
-      patch(WebGLRenderingContext);
-      if (typeof WebGL2RenderingContext !== 'undefined') patch(WebGL2RenderingContext);
-    } catch {}
   })();
 `;
 }
 
-function normalizeChromeVersion(browserVersion) {
-  const raw = String(browserVersion || "131.0.0.0");
-  // Playwright returns "131.0.6778.33" or sometimes "Chrome/131.0.6778.33"
-  const m = raw.match(/(\d+\.\d+\.\d+\.\d+|\d+\.\d+\.\d+)/);
-  return m ? m[1] : "131.0.0.0";
-}
-
-function getStealthUserAgent(browserVersion) {
-  const ver = normalizeChromeVersion(browserVersion);
-  const { uaPlatform } = getStealthPlatformProfile();
-  return `Mozilla/5.0 (${uaPlatform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${ver} Safari/537.36`;
-}
-
-function wrapBrowserWithStealth(browser) {
-  const origNewContext = browser.newContext.bind(browser);
-  browser.newContext = async function (options = {}) {
-    // Fix HeadlessChrome in User-Agent — Google detects this server-side
-    if (!options.userAgent) {
-      let ver = "131.0.0.0";
-      try {
-        ver = typeof browser.version === "function" ? browser.version() : ver;
-      } catch {
-        /* ignore */
-      }
-      options.userAgent = getStealthUserAgent(ver);
-    }
-    // Default en-US; CodeBuddy CN / other regional flows pass locale+languages explicitly.
-    if (!options.locale) options.locale = "en-US";
-    // Keep navigator.languages aligned with context locale (mismatch is a common bot signal).
-    let languages = options.languages;
-    if (!Array.isArray(languages) || !languages.length) {
-      if (String(options.locale).toLowerCase().startsWith("zh")) {
-        languages = ["zh-CN", "zh", "en-US", "en"];
-      } else {
-        languages = ["en-US", "en"];
-      }
-    }
-    // `fingerprint` / `languages` are ours — strip before Playwright newContext.
-    const { languages: _drop, fingerprint, ...pwOptions } = { ...options, languages };
-    const stealthScript = buildStealthInitScript({ languages, fingerprint });
-    const ctx = await origNewContext(pwOptions);
-    await ctx.addInitScript(stealthScript);
-    return ctx;
-  };
-  return browser;
-}
-
 /**
- * Headed Chromium needs a display on Linux VPS.
- * Auto-start Xvfb via displayEnv when available.
+ * Strip non-Playwright keys from newContext options and attach fingerprint init.
+ * CloakBrowser is Playwright-compatible — `languages` / `fingerprint` are ours only.
+ *
+ * @param {import('playwright-core').Browser} browser
+ * @param {object} options
  */
-async function ensureHeadedDisplayOrThrow() {
-  const { ensureDisplayForHeadedBrowser } = await import("./displayEnv.js");
-  const display = ensureDisplayForHeadedBrowser();
-  if (!display.ok) {
-    const err = display.error || new Error("No display for headed browser");
-    err.code = err.code || "NO_DISPLAY";
-    throw err;
-  }
-  return display;
-}
-
-async function launchChromium({ proxyUrl, headless = true, windowSize = null } = {}) {
-  const wantHeadless = headless !== false;
-  if (!wantHeadless) {
-    await ensureHeadedDisplayOrThrow();
-  }
-
-  // Prefer runtime helper first — under Next/webpack, dynamic import("playwright")
-  // often fails even when ~/.zevai/runtime has the package (Kiro mass-fail).
-  let chromium = null;
-  let importErr = null;
-  const runtime = loadPlaywrightRuntime();
-  if (runtime?.ensurePlaywrightRuntime) {
-    const ready = runtime.ensurePlaywrightRuntime({ silent: false });
-    if (ready.ok) {
-      const mod = ready.module || runtime.loadPlaywrightModule?.() || runtime.tryRequirePlaywright?.();
-      chromium = mod?.chromium ?? null;
-    } else if (ready.error) {
-      importErr = ready.error;
-    }
-  }
-  if (!chromium) {
+export async function newStealthContext(browser, options = {}) {
+  const {
+    languages,
+    fingerprint,
+    ...pwOptions
+  } = options || {};
+  const context = await browser.newContext(pwOptions);
+  if (
+    (Array.isArray(languages) && languages.length) ||
+    (fingerprint && typeof fingerprint === "object")
+  ) {
     try {
-      chromium = await importPlaywright();
-    } catch (err) {
-      importErr = err;
-    }
-  }
-
-  if (!chromium) {
-    const friendly = new Error(
-      `Playwright is not installed. Run "npm install -g playwright && npx playwright install chromium" or restart the bulk import to auto-install.`
-    );
-    friendly.code = "PLAYWRIGHT_PACKAGE_MISSING";
-    friendly.cause = importErr;
-    throw friendly;
-  }
-
-  const width = windowSize?.width || (wantHeadless ? 1920 : 900);
-  const height = windowSize?.height || (wantHeadless ? 1080 : 700);
-  // Force bundled Chromium — never Google Chrome channel (/opt/google/chrome),
-  // which is missing on most VPS and caused "distribution 'chrome' is not found".
-  const options = {
-    headless: wantHeadless,
-    channel: undefined,
-    args: [
-      "--disable-blink-features=AutomationControlled",
-      "--disable-features=IsolateOrigins,site-per-process,AutomationControlled",
-      "--disable-infobars",
-      "--no-first-run",
-      "--no-default-browser-check",
-      "--disable-extensions",
-      "--disable-popup-blocking",
-      "--disable-backgrounding-occluded-windows",
-      "--disable-renderer-backgrounding",
-      "--disable-background-timer-throttling",
-      "--disable-ipc-flooding-protection",
-      "--password-store=basic",
-      "--use-mock-keychain",
-      `--window-size=${width},${height}`,
-      ...(wantHeadless ? [] : ["--window-position=80,80"]),
-    ],
-    ignoreDefaultArgs: ["--enable-automation"],
-  };
-  // Explicit bundled Chromium path when it exists (avoids channel=chrome hijack)
-  try {
-    const { existsSync } = await import("node:fs");
-    const exePath = typeof chromium.executablePath === "function" ? chromium.executablePath() : null;
-    if (exePath && existsSync(exePath)) options.executablePath = exePath;
-  } catch {
-    // ignore
-  }
-  let effectiveProxy = proxyUrl;
-  let socksBridge = null;
-  if (proxyUrl) {
-    const { ensureSocksHttpBridge, isSocksProxyUrl } = await import("./socksHttpBridge.js");
-    if (isSocksProxyUrl(proxyUrl)) {
-      socksBridge = await ensureSocksHttpBridge(proxyUrl);
-      if (socksBridge?.httpProxyUrl) effectiveProxy = socksBridge.httpProxyUrl;
-    }
-    const { parsePlaywrightProxy } = await import("./proxyUtils.js");
-    options.proxy = parsePlaywrightProxy(effectiveProxy) || { server: effectiveProxy };
-  }
-
-  let bridgeOwnedByBrowser = false;
-  const wrapLaunchedBrowser = (browser) => {
-    if (socksBridge) {
-      bridgeOwnedByBrowser = true;
-      const close = browser.close.bind(browser);
-      browser.close = async () => {
-        try {
-          return await close();
-        } finally {
-          await socksBridge.release();
-        }
-      };
-    }
-    return wrapBrowserWithStealth(browser);
-  };
-
-  try {
-    const browser = await chromium.launch(options);
-    return wrapLaunchedBrowser(browser);
-  } catch (error) {
-    const msg = String(error?.message || error || "");
-    if (!wantHeadless && /XServer|DISPLAY|Missing X server|headed browser|no DISPLAY/i.test(msg)) {
-      await ensureHeadedDisplayOrThrow();
-      const browser = await chromium.launch(options);
-      return wrapLaunchedBrowser(browser);
-    }
-    // Retry without executablePath if channel/chrome confusion remains
-    if (/distribution ['\"]chrome['\"]|Executable doesn't exist|chrome-headless-shell/i.test(msg)) {
-      try {
-        const retryOpts = { ...options };
-        delete retryOpts.channel;
-        delete retryOpts.executablePath;
-        const browser = await chromium.launch(retryOpts);
-        return wrapLaunchedBrowser(browser);
-      } catch {
-        // fall through
-      }
+      await context.addInitScript(
+        buildFingerprintInitScript({ languages, fingerprint }),
+      );
+    } catch {
+      // older drivers may not support addInitScript
     }
-    if (!bridgeOwnedByBrowser) await socksBridge?.release();
-    throw error;
   }
+  return context;
 }
 
 /**
- * CloakBrowser — patched stealth Chromium. Needed for Cloudflare Turnstile
- * (dash.cloudflare.com / Workers AI harvest) and similar bot checks.
- * Prefer headed (headless=false); Turnstile usually fails headless.
+ * CloakBrowser — sole bulk-import engine (patched stealth Chromium).
+ * Prefer headed (headless=false); Turnstile / Google bot checks often fail headless.
  * Auto-installs into ~/.zevai/runtime via cloakbrowserRuntime.
  */
 async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = null } = {}) {
@@ -433,7 +182,6 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
   const runtime = loadRuntimeHelper("cloakbrowserRuntime");
   let cloak = null;
   if (runtime?.ensureCloakbrowserRuntime) {
-    // Also installs mmdb-lib (required when geoip: true for proxy timezone match)
     const ready = runtime.ensureCloakbrowserRuntime({ silent: false });
     if (!ready.ok && ready.error) throw ready.error;
     cloak = ready.module || runtime.loadCloakbrowserModule?.();
@@ -444,7 +192,7 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
       cloak = mod?.default || mod;
     } catch (err) {
       const friendly = new Error(
-        `cloakbrowser is not installed. Cloudflare AI bulk will auto-install on next run, or run: cd ~/.zevai/runtime && npm install cloakbrowser mmdb-lib`,
+        `cloakbrowser is not installed. Bulk import will auto-install on next run, or run: cd ~/.zevai/runtime && npm install cloakbrowser mmdb-lib playwright-core`,
       );
       friendly.code = "CLOAKBROWSER_PACKAGE_MISSING";
       friendly.cause = err;
@@ -457,11 +205,10 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
     throw err;
   }
 
-  let useHeadless = headless === true; // default headed for Turnstile
+  let useHeadless = headless === true;
   if (!useHeadless) {
     const display = ensureDisplayForHeadedBrowser();
     if (!display.ok) {
-      // Prefer failing with install steps over silent headless Turnstile failure
       throw display.error;
     }
   }
@@ -471,8 +218,7 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
     humanize: true,
   };
   if (proxyUrl) {
-    // CloakBrowser docs: string or { server, username, password }; geoip aligns
-    // timezone/locale to proxy IP (critical for Turnstile / abusive-pattern checks).
+    // geoip aligns timezone/locale to proxy IP (Turnstile / abusive-pattern checks).
     launchOpts.proxy = proxyUrl;
     launchOpts.geoip = true;
   }
@@ -481,10 +227,8 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
   }
 
   try {
-    const browser = await cloak.launch(launchOpts);
-    // Do not wrap with stealth init script — CloakBrowser patches at binary level;
-    // extra webdriver spoofing can conflict with its fingerprint.
-    return browser;
+    // Do not wrap with stock stealth scripts — CloakBrowser patches at binary level.
+    return await cloak.launch(launchOpts);
   } catch (error) {
     const msg = String(error?.message || error || "");
     if (!useHeadless && /XServer|DISPLAY|Missing X server|headed browser|no DISPLAY/i.test(msg)) {
@@ -495,7 +239,7 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
       const friendly = new Error(
         `${msg}\n\nVPS has no display. Install a virtual screen then retry:\n` +
           `  sudo apt-get update && sudo apt-get install -y xvfb\n` +
-          `  sudo systemctl restart zevairouter   # or restart zevai\n` +
+          `  sudo systemctl restart zevairouter\n` +
           `ZevaiRouter auto-starts Xvfb when installed.`,
       );
       friendly.code = "NO_DISPLAY";
@@ -506,32 +250,35 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
   }
 }
 
+/**
+ * Launch the automation browser (CloakBrowser only).
+ * @param {object} [opts]
+ * @param {string} [opts.engine] ignored (always cloakbrowser; kept for API compat)
+ * @param {string|null} [opts.proxyUrl]
+ * @param {boolean} [opts.headless] default false (headed — Turnstile/Google)
+ * @param {{width:number,height:number}|null} [opts.windowSize]
+ */
 export async function launchBulkImportBrowser({
   engine = DEFAULT_BULK_IMPORT_ENGINE,
   proxyUrl,
-  headless = true,
+  headless = false,
   windowSize = null,
 } = {}) {
-  const normalized = normalizeBulkImportEngine(engine);
-  if (normalized === "cloakbrowser") {
-    // Turnstile needs a real window unless caller forces headless
-    return launchCloakbrowser({
-      proxyUrl,
-      headless: headless === true,
-      windowSize,
-    });
-  }
-  return launchChromium({ proxyUrl, headless, windowSize });
+  // engine arg kept for API compatibility; always cloakbrowser.
+  void normalizeBulkImportEngine(engine);
+  return launchCloakbrowser({
+    proxyUrl,
+    headless: headless === true,
+    windowSize,
+  });
 }
 
-export function makeBrowserLauncher({ engine, proxyUrl, headless = true, windowSize = null } = {}) {
+export function makeBrowserLauncher({ engine, proxyUrl, headless = false, windowSize = null } = {}) {
   return () => launchBulkImportBrowser({ engine, proxyUrl, headless, windowSize });
 }
 
 /**
- * Force-close a Playwright Chromium browser. Graceful close can hang forever when
- * the browser is stuck on a blackholed proxy / spinning renderer — on a 2GB VPS
- * that pins CPU until reboot. Always race close() with a kill of the process tree.
+ * Force-close browser. Graceful close can hang on blackholed proxy / spinning renderer.
  */
 export async function forceCloseBrowser(browser, { timeoutMs = 4_000 } = {}) {
   if (!browser) return;
@@ -556,11 +303,9 @@ export async function forceCloseBrowser(browser, { timeoutMs = 4_000 } = {}) {
   }
 
   if (pid && Number.isFinite(pid) && pid > 1) {
-    // Still alive? SIGTERM then SIGKILL. Also try process-group kill (negative pid)
-    // so Chromium helper children die with the parent.
     for (const signal of ["SIGTERM", "SIGKILL"]) {
       try {
-        process.kill(pid, 0); // throws ESRCH if gone
+        process.kill(pid, 0);
       } catch {
         break;
       }
@@ -572,7 +317,7 @@ export async function forceCloseBrowser(browser, { timeoutMs = 4_000 } = {}) {
       try {
         process.kill(-pid, signal);
       } catch {
-        // ignore (no process group / permission)
+        // ignore
       }
       if (signal === "SIGTERM") {
         await new Promise((r) => setTimeout(r, 400));

package/src/lib/oauth/services/cloudflareAiBulkImportManager.js

@@ -255,21 +255,12 @@ async function defaultSaveCloudflareAiConnection({ apiKey, accountId, email, acc
 }
 
 async function defaultBrowserLauncher(job) {
-  const { launchBulkImportBrowser, normalizeBulkImportEngine } = await import(
-    "./bulkImportBrowserEngine.js"
-  );
-  // Cloudflare Turnstile on dash.cloudflare.com routinely blocks plain Playwright
-  // Chromium. CloakBrowser (patched Chromium) is the engine that used to pass it.
-  const engine = normalizeBulkImportEngine(
-    job?.engine || process.env.ZEVAI_CLOUDFLARE_ENGINE || "cloakbrowser",
-  );
+  const { launchBulkImportBrowser } = await import("./bulkImportBrowserEngine.js");
+  // All automation uses CloakBrowser (stock Chromium dropped). Headed by default.
   const envHeadless = process.env.ZEVAI_CLOUDFLARE_HEADLESS ?? process.env.ZEVAI_KIRO_HEADLESS;
-  let headless;
-  if (envHeadless === "1" || envHeadless === "true") headless = true;
-  else if (envHeadless === "0" || envHeadless === "false") headless = false;
-  else headless = false; // headed — Turnstile fails headless almost always
+  const headless = envHeadless === "1" || envHeadless === "true";
   return launchBulkImportBrowser({
-    engine,
+    engine: job?.engine || "cloakbrowser",
     headless,
     windowSize: { width: 1280, height: 900 },
   });

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -162,9 +162,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     pollIntervalMs = CODEBUDDY_CN_CONFIG.pollInterval,
     storageName = "codebuddy-cn-bulk-import",
   } = {}) {
-    // Chromium needs proxy on browser launch (not context-only).
-    // Linux VPS: default headless to cut RAM/CPU (2GB boxes OOM on headed+Xvfb).
-    // Desktop (macOS/Windows): headed so the operator can watch / solve captcha.
+    // CloakBrowser-only: proxy on launch + geoip. Headed by default (Turnstile/Tencent).
     // Override: ZEVAI_CN_HEADLESS=0|1
     const cnBrowserLauncher = browserLauncher || (async (job) => {
       const { launchBulkImportBrowser } = await import("./bulkImportBrowserEngine.js");
@@ -172,13 +170,14 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         ? job.proxyUrls[0]
         : null;
       const envHeadless = process.env.ZEVAI_CN_HEADLESS;
-      let headless = process.platform === "linux";
+      let headless = false;
       if (envHeadless === "0" || envHeadless === "false") headless = false;
       if (envHeadless === "1" || envHeadless === "true") headless = true;
       return launchBulkImportBrowser({
+        engine: job?.engine || "cloakbrowser",
         proxyUrl,
         headless,
-        windowSize: { width: 900, height: 700 },
+        windowSize: { width: 1280, height: 900 },
       });
     });
     super({ browserLauncher: cnBrowserLauncher, storageName });
@@ -354,11 +353,10 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // Step 2: Create browser context FIRST — if proxy/browser fails, we never buy a number.
       this.setAccountStep(account, "creating_browser", "Creating browser context (before 5sim order)");
       await this.persistJobSnapshot(job, { forcePreview: true });
-      // Chromium-only stack: use zh-CN locale + HK/CN timezone so Tencent risk
+      // CloakBrowser stack: zh-CN locale + HK/CN timezone so Tencent risk
       // scoring does not see EN-US browser on residential CN/HK egress (common
-      // cause of 账号访问受限 right after OTP). Engine stays Playwright Chromium.
-      // Also apply a unique per-account fingerprint seed — sticky residential IP
-      // alone still clusters if every session shares the same 900x700 + HW profile.
+      // cause of 账号访问受限 right after OTP). Per-account fingerprint seed —
+      // sticky residential IP alone still clusters if every session shares HW.
       if (!account.fingerprintSeed) account.fingerprintSeed = randomUUID();
       const freshContext = await createFreshContext(job.browser, account.proxyUrl, {
         profile: "codebuddy-cn",

package/src/lib/oauth/services/codebuddyCnPhoneAutomation.js

@@ -122,7 +122,7 @@ const IFRAME_ERROR_SELECTORS = [
  * Run the phone-number registration automation.
  *
  * @param {object} opts
- * @param {import('playwright').Page} opts.page             Playwright page (from createFreshContext)
+ * @param {import('playwright-core').Page} opts.page        Browser page (from createFreshContext)
  * @param {string} [opts.phone]                             Pre-ordered phone (legacy). Prefer resolvePhone.
  * @param {function} [opts.resolvePhone]                    async () => phone — called ONLY after login form
  *   is ready so 5sim is not billed if proxy/nav fails.