zevairouter 1.0.147 → 1.0.149

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -64,12 +64,26 @@ const CODEBUDDY_CN_POLL_TIMEOUT_MS = 15 * 60_000;
 // input phone, click send code takes ~15-20s before SMS is actually requested).
 const CODEBUDDY_CN_SMS_TIMEOUT_MS = 90_000;
 
-// Hard wall-clock per account (nav + form + SMS + API key). Prevents infinite
-// Chromium can spin when proxy/nav blackholes and Playwright timeouts do not fire.
+// Hard wall-clock for phone registration (nav + form + SMS). Console/API work
+// has separate bounded operations below.
 const CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS = Number.parseInt(
   process.env.ZEVAI_CN_ACCOUNT_TIMEOUT_MS || "",
   10,
-) || 12 * 60_000;
+) || 5 * 60_000;
+
+const CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS = 90_000;
+const CODEBUDDY_CN_CONTEXT_TIMEOUT_MS = 30_000;
+const CODEBUDDY_CN_CONSOLE_NAV_TIMEOUT_MS = 18_000;
+const CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS = 10_000;
+const CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS = 60_000;
+const CODEBUDDY_CN_OIDC_MAX_ATTEMPTS = 6;
+const CODEBUDDY_CN_API_REHANDOFF_ROUNDS = 2;
+const CODEBUDDY_CN_MANUAL_TIMEOUT_MS = 8 * 60_000;
+const CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS = 3 * 60_000;
+const CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS = 5_000;
+const CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS = 12_000;
+const CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN = "CN_API_KEY_OUTCOME_UNKNOWN";
+const CODEBUDDY_CN_ACCOUNT_RESTRICTED = "CN_ACCOUNT_RESTRICTED";
 
 // Supported 5sim regions
 const SUPPORTED_REGIONS = new Set(["hongkong", "china", "any"]);
@@ -113,6 +127,199 @@ function clampCnConcurrency(value) {
   return Math.min(hardMax, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, parsed));
 }
 
+async function withTimeoutCleanup(
+  task,
+  {
+    timeoutMs,
+    message,
+    code,
+    onTimeout,
+    onLateResolve,
+  },
+) {
+  const operation = Promise.resolve(task);
+  let timer = null;
+  let timedOut = false;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        if (typeof onTimeout === "function") onTimeout();
+      } catch {
+        // Timeout reporting must not be replaced by cleanup callback failures.
+      }
+      reject(Object.assign(new Error(message), { code }));
+    }, timeoutMs);
+    if (typeof timer.unref === "function") timer.unref();
+  });
+
+  try {
+    return await Promise.race([operation, timeout]);
+  } finally {
+    if (timer) clearTimeout(timer);
+    if (timedOut && typeof onLateResolve === "function") {
+      void operation.then(onLateResolve).catch(() => null);
+    }
+  }
+}
+
+function isLoginHtmlProbe(probe) {
+  const raw = `${probe?.text || ""} ${probe?.data?._raw || ""} ${probe?.url || ""}`;
+  return /<!doctype html|<html|login-pf|\/auth\/realms\//i.test(raw);
+}
+
+function parseConsoleProbeBody(status, text, extras = {}) {
+  const rawText = String(text || "");
+  let data = null;
+  try {
+    data = rawText ? JSON.parse(rawText) : null;
+  } catch {
+    data = { _raw: rawText.slice(0, 240), _notJson: true };
+  }
+  return {
+    status: Number(status) || 0,
+    data,
+    text: rawText.slice(0, 240),
+    ...extras,
+  };
+}
+
+function hasRestrictedConsoleEvidence(probe, cookieNames = []) {
+  const names = cookieNames instanceof Set ? cookieNames : new Set(cookieNames);
+  const raw = `${probe?.text || ""} ${probe?.data?._raw || ""}`;
+  if (/账号访问受限|安全策略限制|访问受限|account restricted|access restricted/i.test(raw)) {
+    return true;
+  }
+  if (!names.has("login_risk_state")) return false;
+  return isLoginHtmlProbe(probe)
+    || probe?.status === 0
+    || probe?.status === 401
+    || probe?.status === 403;
+}
+
+async function probeCodeBuddyConsoleAccounts({
+  context,
+  page,
+  timeoutMs = CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS,
+}) {
+  const headers = {
+    Accept: "application/json, text/plain, */*",
+    "x-requested-with": "XMLHttpRequest",
+    "X-Domain": "www.codebuddy.cn",
+    "X-Product": "SaaS",
+  };
+
+  // The context request shares browser cookies but bypasses page-origin CORS.
+  let requestContext = null;
+  try {
+    requestContext = context?.request || null;
+  } catch {
+    requestContext = null;
+  }
+  if (requestContext && typeof requestContext.get === "function") {
+    try {
+      const response = await requestContext.get(
+        "https://www.codebuddy.cn/console/accounts",
+        { headers, timeout: timeoutMs, failOnStatusCode: false },
+      );
+      const text = await response.text().catch(() => "");
+      return parseConsoleProbeBody(response.status(), text, {
+        source: "context-request",
+        url: response.url(),
+        contentType: response.headers()?.["content-type"] || "",
+      });
+    } catch {
+      // Compatibility fallback for older CloakBrowser request contexts.
+    }
+  }
+
+  const probeTask = page.evaluate(async ({ requestTimeoutMs, requestHeaders }) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), requestTimeoutMs);
+    try {
+      const host = window.location.hostname || "www.codebuddy.cn";
+      const base = host === "www.codebuddy.cn"
+        ? `${window.location.origin}`
+        : "https://www.codebuddy.cn";
+      const response = await fetch(`${base}/console/accounts`, {
+        credentials: "include",
+        signal: controller.signal,
+        headers: requestHeaders,
+      });
+      const text = await response.text().catch(() => "");
+      let data = null;
+      try {
+        data = text ? JSON.parse(text) : null;
+      } catch {
+        data = { _raw: String(text || "").slice(0, 240), _notJson: true };
+      }
+      return {
+        status: response.status,
+        data,
+        text: String(text || "").slice(0, 240),
+        source: "page-fetch",
+        url: response.url,
+        contentType: response.headers.get("content-type") || "",
+      };
+    } catch (error) {
+      return {
+        status: 0,
+        timedOut: error?.name === "AbortError",
+        error: error?.message || String(error),
+        source: "page-fetch",
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  }, { requestTimeoutMs: timeoutMs, requestHeaders: headers });
+
+  return withTimeoutCleanup(probeTask, {
+    timeoutMs,
+    message: `Console account probe timed out after ${timeoutMs / 1000}s`,
+    code: "CN_CONSOLE_PROBE_TIMEOUT",
+  }).catch((error) => ({
+    status: 0,
+    timedOut: error?.code === "CN_CONSOLE_PROBE_TIMEOUT",
+    error: error?.message || String(error),
+    source: "page-fetch",
+  }));
+}
+
+async function closeResourceBounded(resource) {
+  if (!resource || typeof resource.close !== "function") return true;
+  try {
+    await withTimeoutCleanup(Promise.resolve().then(() => resource.close()), {
+      timeoutMs: CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS,
+      message: `Browser resource close timed out after ${CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS / 1000}s`,
+      code: "CN_RESOURCE_CLOSE_TIMEOUT",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function closeContextOrBrowser(context, job) {
+  if (await closeResourceBounded(context)) return;
+  if (!job?.browser) return;
+  const browser = job.browser;
+  job.browser = null;
+  await forceCloseBrowser(browser).catch(() => null);
+}
+
+async function settleFiveSimOrder(operation) {
+  try {
+    return await withTimeoutCleanup(Promise.resolve().then(operation), {
+      timeoutMs: CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS,
+      message: `5sim order settlement timed out after ${CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS / 1000}s`,
+      code: "CN_FIVESIM_SETTLE_TIMEOUT",
+    });
+  } catch {
+    // Finish/cancel/ban are best-effort and must not hold the browser worker.
+    return false;
+  }
+}
+
 /**
  * Save a CodeBuddy CN provider connection to the database.
  */
@@ -165,7 +372,10 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     // CloakBrowser-only: proxy on launch + geoip. Headed by default (Turnstile/Tencent).
     // Override: ZEVAI_CN_HEADLESS=0|1
     const cnBrowserLauncher = browserLauncher || (async (job) => {
-      const { launchBulkImportBrowser } = await import("./bulkImportBrowserEngine.js");
+      const {
+        forceCloseBrowser,
+        launchBulkImportBrowser,
+      } = await import("./bulkImportBrowserEngine.js");
       const proxyUrl = Array.isArray(job?.proxyUrls) && job.proxyUrls.length
         ? job.proxyUrls[0]
         : null;
@@ -173,12 +383,18 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       let headless = false;
       if (envHeadless === "0" || envHeadless === "false") headless = false;
       if (envHeadless === "1" || envHeadless === "true") headless = true;
-      return launchBulkImportBrowser({
+      const launchTask = launchBulkImportBrowser({
         engine: job?.engine || "cloakbrowser",
         proxyUrl,
         headless,
         windowSize: { width: 1280, height: 900 },
       });
+      return withTimeoutCleanup(launchTask, {
+        timeoutMs: CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS,
+        message: `CloakBrowser launch timed out after ${CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS / 1000}s`,
+        code: "CN_BROWSER_LAUNCH_TIMEOUT",
+        onLateResolve: (browser) => forceCloseBrowser(browser),
+      });
     });
     super({ browserLauncher: cnBrowserLauncher, storageName });
     this.requestDeviceCode = requestDeviceCodeFn;
@@ -358,10 +574,17 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // cause of 账号访问受限 right after OTP). Per-account fingerprint seed —
       // sticky residential IP alone still clusters if every session shares HW.
       if (!account.fingerprintSeed) account.fingerprintSeed = randomUUID();
-      const freshContext = await createFreshContext(job.browser, account.proxyUrl, {
+      const contextTask = createFreshContext(job.browser, account.proxyUrl, {
         profile: "codebuddy-cn",
         region: job.region || "hongkong",
         fingerprintSeed: account.fingerprintSeed,
+        lowMemory: isLowMemHost(),
+      });
+      const freshContext = await withTimeoutCleanup(contextTask, {
+        timeoutMs: CODEBUDDY_CN_CONTEXT_TIMEOUT_MS,
+        message: `Browser context creation timed out after ${CODEBUDDY_CN_CONTEXT_TIMEOUT_MS / 1000}s`,
+        code: "CN_CONTEXT_TIMEOUT",
+        onLateResolve: (session) => Promise.resolve(session?.context?.close?.()).catch(() => null),
       });
       context = freshContext.context;
       const page = freshContext.page;
@@ -470,24 +693,25 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // If automation failed early (e.g. page.goto timeout), the session won't be logged in
       // and API key creation will 401 — so don't waste time. Only try bypass if automation
       // reported "success" or "needs_manual" (meaning submit happened).
-      if (automationResult.status === "failed") {
+      if (String(automationResult.status || "").startsWith("failed")) {
         // Automation failed before submit — no point trying API key
         const errorMsg = automationResult.error || "Phone registration failed before submit";
-        this.finalizeAccount(account, "failed", {
+        const failureStatus = automationResult.status || "failed";
+        this.finalizeAccount(account, failureStatus, {
           error: errorMsg,
-          step: "failed",
+          step: failureStatus,
           message: errorMsg,
         });
         // Only touch 5sim if we actually bought a number (order is deferred until form ready)
         if (fiveSimClient && fiveSimOrderId) {
           if (smsReceived) {
-            await fiveSimClient.finishOrder(fiveSimOrderId);
+            await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
           } else {
-            await fiveSimClient.cancelOrder(fiveSimOrderId);
+            await settleFiveSimOrder(() => fiveSimClient.cancelOrder(fiveSimOrderId));
           }
         }
         account.runtimeSession = null;
-        await context.close().catch(() => null);
+        await closeContextOrBrowser(context, job);
         await this.persistJobSnapshot(job, { forcePreview: true });
         return;
       }
@@ -510,19 +734,23 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // 5sim hygiene on error
       if (fiveSimClient && fiveSimOrderId) {
         if (smsReceived) {
-          await fiveSimClient.finishOrder(fiveSimOrderId);
+          await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
         } else if (isSmsTimeout) {
-          // BAN: number didn't receive CodeBuddy SMS within 60s — it's a bad/burned number
-          await fiveSimClient.banOrder(fiveSimOrderId);
+          // BAN: number did not receive CodeBuddy SMS within the OTP window.
+          await settleFiveSimOrder(() => fiveSimClient.banOrder(fiveSimOrderId));
         } else {
-          await fiveSimClient.cancelOrder(fiveSimOrderId);
+          await settleFiveSimOrder(() => fiveSimClient.cancelOrder(fiveSimOrderId));
         }
       }
       account.runtimeSession = null;
-      if (context) await context.close().catch(() => null);
+      await closeContextOrBrowser(context, job);
       // Hard timeout / blackhole nav: kill the shared browser so the worker unblocks
       // and Chromium cannot pin 100% CPU on a 2GB VPS until reboot.
-      if (error?.code === "CN_ACCOUNT_HARD_TIMEOUT" || job.cancelRequested) {
+      if (
+        error?.code === "CN_ACCOUNT_HARD_TIMEOUT"
+        || error?.code === "CN_CONTEXT_TIMEOUT"
+        || job.cancelRequested
+      ) {
         if (job.browser) {
           const b = job.browser;
           job.browser = null;
@@ -592,34 +820,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         || names.has("qcmainCSRFToken")
         || names.has("x_host_key_access");
 
-      const probeConsoleAccounts = async () => page.evaluate(async () => {
-        try {
-          // Absolute URL — relative /console/accounts fails if we are still on login.tencent or keycloak host.
-          const host = window.location.hostname || "www.codebuddy.cn";
-          const base = host.endsWith("codebuddy.cn")
-            ? `${window.location.origin}`
-            : "https://www.codebuddy.cn";
-          const res = await fetch(`${base}/console/accounts`, {
-            credentials: "include",
-            headers: {
-              Accept: "application/json, text/plain, */*",
-              "x-requested-with": "XMLHttpRequest",
-              "X-Domain": "www.codebuddy.cn",
-              "X-Product": "SaaS",
-            },
-          });
-          const text = await res.text().catch(() => "");
-          let data = null;
-          try {
-            data = text ? JSON.parse(text) : null;
-          } catch {
-            data = { _raw: String(text || "").slice(0, 240), _notJson: true };
-          }
-          return { status: res.status, data, text: String(text || "").slice(0, 240) };
-        } catch (error) {
-          return { status: 0, error: error?.message || String(error) };
-        }
-      }).catch(() => null);
+      const probeConsoleAccounts = () => probeCodeBuddyConsoleAccounts({ context, page });
 
       const extractAccountList = (probe) => {
         const d = probe?.data;
@@ -642,45 +843,63 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         return [];
       };
 
-      // After goto: wait for accounts XHR or Keycloak cookie — not a fixed sleep.
-      const waitAfterNav = async () => {
-        await Promise.race([
-          page.waitForResponse(
-            (r) => /\/console\/accounts/i.test(r.url()) && r.status() < 500,
-            { timeout: 10_000 },
-          ).catch(() => null),
-          page.waitForResponse(
-            (r) => /\/console\/api\//i.test(r.url()) && r.status() < 500,
-            { timeout: 10_000 },
-          ).catch(() => null),
-          waitUntil(async () => {
-            const snap = await cookieSnapshot();
-            return hasStrongKeycloak(snap.names);
-          }, { timeout: 10_000, interval: 200 }),
-          new Promise((r) => setTimeout(r, 2_500)), // hard cap only
-        ]);
+      // A committed response is enough to start session probes. Waiting for the
+      // full SPA DOM is expensive and frequently stalls on small VPS hosts.
+      const waitAfterNav = async (timeoutMs = 2_500) => {
+        let settled = false;
+        let timer = null;
+        try {
+          await Promise.race([
+            page.waitForLoadState("domcontentloaded", { timeout: timeoutMs }).catch(() => null),
+            waitUntil(async () => {
+              if (settled) return true;
+              const snap = await cookieSnapshot();
+              return hasStrongKeycloak(snap.names);
+            }, { timeout: timeoutMs, interval: 200 }),
+            new Promise((resolve) => {
+              timer = setTimeout(resolve, timeoutMs);
+            }),
+          ]);
+        } finally {
+          settled = true;
+          if (timer) clearTimeout(timer);
+        }
+      };
+
+      const navigateConsole = async (path) => {
+        const startedAt = Date.now();
+        try {
+          await page.goto(path, {
+            waitUntil: "commit",
+            timeout: CODEBUDDY_CN_CONSOLE_NAV_TIMEOUT_MS,
+          });
+          const remainingMs = CODEBUDDY_CN_CONSOLE_NAV_TIMEOUT_MS - (Date.now() - startedAt);
+          if (remainingMs > 0) await waitAfterNav(Math.min(2_500, remainingMs));
+          return true;
+        } catch {
+          return false;
+        }
       };
 
       // Navigate sequence to finish OIDC handoff when only AUTH_SESSION_ID is present.
-      // Order matters: home → console → keys (login/ last — re-triggering login can wipe soft session).
+      // Never revisit /login here: it can wipe a valid partial OIDC session.
       const oIDCNudgePaths = [
         "https://www.codebuddy.cn/",
         "https://www.codebuddy.cn/console",
         "https://www.codebuddy.cn/console/",
         "https://www.codebuddy.cn/profile",
         "https://www.codebuddy.cn/profile/keys",
-        // only if still empty after console probes
-        "https://www.codebuddy.cn/login/",
       ];
 
       let accountList = [];
       let accountsProbe = null;
       let sessionReady = false;
       let lastPayloadSnippet = "";
+      let lastMeaningfulProbe = null;
+      let restrictedProbeCount = 0;
 
-      // Event-driven OIDC settle: more attempts but each wait is response-driven, not blind multi-sec sleep.
-      const OIDC_MAX_ATTEMPTS = 10;
-      for (let attempt = 0; attempt < OIDC_MAX_ATTEMPTS; attempt += 1) {
+      // Event-driven OIDC settle: bounded attempts and no blind multi-second sleeps.
+      for (let attempt = 0; attempt < CODEBUDDY_CN_OIDC_MAX_ATTEMPTS; attempt += 1) {
         if (job.cancelRequested) {
           throw new Error("Job cancelled while establishing session");
         }
@@ -697,31 +916,60 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
           this.setAccountStep(
             account,
             "waiting_session",
-            `OIDC handoff ${attempt + 1}/${OIDC_MAX_ATTEMPTS} → ${path.replace("https://www.codebuddy.cn", "")} (${strong ? "KEYCLOAK" : soft ? "soft-session" : "weak"})`,
+            `OIDC handoff ${attempt + 1}/${CODEBUDDY_CN_OIDC_MAX_ATTEMPTS} → ${path.replace("https://www.codebuddy.cn", "")} (${strong ? "KEYCLOAK" : soft ? "soft-session" : "weak"})`,
           );
           await this.persistJobSnapshot(job, { forcePreview: false });
-          await page.goto(path, { waitUntil: "domcontentloaded", timeout: 25_000 }).catch(() => null);
-          await waitAfterNav();
+          await navigateConsole(path);
         } else {
           // Soft session present — short yield then re-probe (no blind multi-second sleep).
           await new Promise((r) => setTimeout(r, 300));
         }
 
         // Prefer landing on console for the API probe (absolute host)
-        const onCodebuddy = /codebuddy\.cn/i.test(page.url?.() || "");
-        if (!onCodebuddy || (!String(page.url() || "").includes("/console") && attempt >= 1)) {
-          await page.goto("https://www.codebuddy.cn/console", {
-            waitUntil: "domcontentloaded",
-            timeout: 25_000,
-          }).catch(() => null);
-          await waitAfterNav();
+        const onCodebuddy = /^https:\/\/www\.codebuddy\.cn(?:[/:]|$)/i.test(page.url?.() || "");
+        if (!onCodebuddy) {
+          await navigateConsole("https://www.codebuddy.cn/console");
         }
 
         accountsProbe = await probeConsoleAccounts();
         accountList = extractAccountList(accountsProbe);
-        lastPayloadSnippet = JSON.stringify(accountsProbe?.data ?? accountsProbe?.text ?? null).slice(0, 180);
+        if (
+          accountsProbe?.status > 0
+          || accountsProbe?.text
+          || accountsProbe?.data
+        ) {
+          lastMeaningfulProbe = accountsProbe;
+        }
+        lastPayloadSnippet = JSON.stringify(
+          accountsProbe?.data
+          ?? accountsProbe?.text
+          ?? accountsProbe?.error
+          ?? null,
+        ).slice(0, 180);
+        const loginHtml = isLoginHtmlProbe(accountsProbe);
+        const probeSnap = await cookieSnapshot();
+        const probeStrong = hasStrongKeycloak(probeSnap.names);
+        if (!probeStrong && hasRestrictedConsoleEvidence(accountsProbe, probeSnap.names)) {
+          restrictedProbeCount += 1;
+        } else {
+          restrictedProbeCount = 0;
+        }
+
+        if (restrictedProbeCount >= 2) {
+          throw Object.assign(
+            new Error(
+              `Tencent restricted the post-OTP session (${restrictedProbeCount} console probes returned login/risk evidence; source=${accountsProbe?.source || "unknown"})`,
+            ),
+            { code: CODEBUDDY_CN_ACCOUNT_RESTRICTED },
+          );
+        }
 
-        if (accountsProbe?.status === 200 && Array.isArray(accountList) && accountList.length > 0) {
+        if (
+          accountsProbe?.status === 200
+          && !loginHtml
+          && Array.isArray(accountList)
+          && accountList.length > 0
+        ) {
           sessionReady = true;
           this.setAccountStep(
             account,
@@ -737,9 +985,11 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         if (
           soft
           && accountsProbe?.status === 200
+          && !loginHtml
+          && accountsProbe?.data?._notJson !== true
           && Array.isArray(accountList)
           && accountList.length === 0
-          && attempt >= 4
+          && attempt >= 3
         ) {
           this.setAccountStep(
             account,
@@ -754,15 +1004,23 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         this.setAccountStep(
           account,
           "resolving_enterprise",
-          `Console not ready (HTTP ${accountsProbe?.status || 0}, accounts=${accountList.length}) — ${attempt + 1}/${OIDC_MAX_ATTEMPTS} body=${lastPayloadSnippet.slice(0, 80)}`,
+          `Console not ready (HTTP ${accountsProbe?.status || 0}, accounts=${accountList.length}${loginHtml ? ", login HTML" : ""}, source=${accountsProbe?.source || "unknown"}) — ${attempt + 1}/${CODEBUDDY_CN_OIDC_MAX_ATTEMPTS} body=${lastPayloadSnippet.slice(0, 80)}`,
         );
         await this.persistJobSnapshot(job, { forcePreview: false });
       }
 
       if (!sessionReady) {
         const snap = await cookieSnapshot();
-        throw new Error(
-          `Console accounts unavailable after login (HTTP ${accountsProbe?.status || 0}; cookies: ${snap.list.slice(0, 18).join(",") || "(none)"}; body=${lastPayloadSnippet.slice(0, 120)}) — session not accepted for API key`,
+        const diagnosticProbe = lastMeaningfulProbe || accountsProbe;
+        const restricted = hasRestrictedConsoleEvidence(diagnosticProbe, snap.names)
+          || (snap.names.has("login_risk_state") && restrictedProbeCount > 0);
+        throw Object.assign(
+          new Error(
+            restricted
+              ? `Tencent restricted the post-OTP session (HTTP ${diagnosticProbe?.status || 0}; login_risk_state present; source=${diagnosticProbe?.source || "unknown"})`
+              : `Console accounts unavailable after login (HTTP ${diagnosticProbe?.status || 0}; cookies: ${snap.list.slice(0, 18).join(",") || "(none)"}; body=${lastPayloadSnippet.slice(0, 120)}; probeError=${accountsProbe?.error || "none"}) — session not accepted for API key`,
+          ),
+          { code: restricted ? CODEBUDDY_CN_ACCOUNT_RESTRICTED : "CN_CONSOLE_SESSION_UNAVAILABLE" },
         );
       }
 
@@ -780,82 +1038,150 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       this.setAccountStep(account, "creating_api_key", `Creating API key (enterprise=${userEnterpriseId}, accounts=${accountList.length})`);
       await this.persistJobSnapshot(job, { forcePreview: true });
 
-      const createKeyOnPage = async (enterpriseId) => page.evaluate(async ({ enterpriseId: entId }) => {
-        const host = window.location.hostname || "www.codebuddy.cn";
-        const base = host.endsWith("codebuddy.cn")
-          ? window.location.origin
-          : "https://www.codebuddy.cn";
-        const res = await fetch(`${base}/console/api/client/v1/api-keys`, {
-          method: "POST",
-          credentials: "include",
-          headers: {
-            "Content-Type": "application/json",
-            Accept: "application/json, text/plain, */*",
-            "x-requested-with": "XMLHttpRequest",
-            "X-Domain": "www.codebuddy.cn",
-            "X-Product": "SaaS",
-          },
-          body: JSON.stringify({
-            name: `zevai-router-${Date.now()}`,
-            expire_in_days: 365,
-            user_enterprise_id: entId,
-          }),
-        });
-        const text = await res.text().catch(() => "");
-        let data = null;
+      // Keep one name for every safe retry in this capture attempt. A timed-out
+      // POST has an unknown outcome and must never be sent again automatically.
+      const apiKeyName = `zevai-router-${account.workerId || "account"}-${Date.now()}`;
+      const createKeyOnPage = async (enterpriseId) => page.evaluate(async ({
+        enterpriseId: entId,
+        keyName,
+        timeoutMs,
+      }) => {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
         try {
-          data = text ? JSON.parse(text) : null;
-        } catch {
-          data = { _raw: String(text || "").slice(0, 200) };
+          const host = window.location.hostname || "www.codebuddy.cn";
+          const base = host === "www.codebuddy.cn"
+            ? window.location.origin
+            : "https://www.codebuddy.cn";
+          const res = await fetch(`${base}/console/api/client/v1/api-keys`, {
+            method: "POST",
+            credentials: "include",
+            signal: controller.signal,
+            headers: {
+              "Content-Type": "application/json",
+              Accept: "application/json, text/plain, */*",
+              "x-requested-with": "XMLHttpRequest",
+              "X-Domain": "www.codebuddy.cn",
+              "X-Product": "SaaS",
+            },
+            body: JSON.stringify({
+              name: keyName,
+              expire_in_days: 365,
+              user_enterprise_id: entId,
+            }),
+          });
+          const text = await res.text().catch(() => "");
+          let data = null;
+          try {
+            data = text ? JSON.parse(text) : null;
+          } catch {
+            data = { _raw: String(text || "").slice(0, 200) };
+          }
+          return { ok: res.ok, status: res.status, data };
+        } catch (error) {
+          // Fetch/network failures after a POST starts are ambiguous: the server
+          // may have created the key even if the browser lost the response.
+          return {
+            ok: false,
+            status: 0,
+            outcomeUnknown: true,
+            timedOut: error?.name === "AbortError",
+            error: error?.message || String(error),
+          };
+        } finally {
+          clearTimeout(timer);
         }
-        return { ok: res.ok, status: res.status, data };
-      }, { enterpriseId });
+      }, {
+        enterpriseId,
+        keyName: apiKeyName,
+        timeoutMs: CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS,
+      });
+
+      const requestApiKey = async (enterpriseId, label) => {
+        const startedAt = Date.now();
+        let heartbeatPromise = null;
+        const heartbeat = setInterval(() => {
+          if (heartbeatPromise) return;
+          const elapsedSeconds = Math.max(5, Math.round((Date.now() - startedAt) / 1000));
+          this.setAccountStep(
+            account,
+            "creating_api_key",
+            `${label} — waiting for CodeBuddy (${elapsedSeconds}s)`,
+          );
+          heartbeatPromise = this.persistJobSnapshot(job, { forcePreview: false })
+            .catch(() => null)
+            .finally(() => {
+              heartbeatPromise = null;
+            });
+        }, 5_000);
+        if (typeof heartbeat.unref === "function") heartbeat.unref();
+
+        let result;
+        try {
+          result = await withTimeoutCleanup(createKeyOnPage(enterpriseId), {
+            timeoutMs: CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS,
+            message: `API key request timed out after ${CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS / 1000}s; creation outcome is unknown`,
+            code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN,
+          });
+        } catch (error) {
+          if (error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN) throw error;
+          throw Object.assign(
+            new Error(`API key request lost its response; creation outcome is unknown: ${error?.message || String(error)}`),
+            { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
+          );
+        } finally {
+          clearInterval(heartbeat);
+          if (heartbeatPromise) await heartbeatPromise.catch(() => null);
+        }
+
+        if (result?.outcomeUnknown) {
+          const reason = result.timedOut
+            ? `timed out after ${CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS / 1000}s`
+            : `lost its response (${result.error || "network error"})`;
+          throw Object.assign(
+            new Error(`API key request ${reason}; creation outcome is unknown`),
+            { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
+          );
+        }
+        return result;
+      };
 
       // Always open keys page first (SPA hydrates CSRF / host-key there).
-      await page.goto("https://www.codebuddy.cn/profile/keys", {
-        waitUntil: "domcontentloaded",
-        timeout: 45_000,
-      }).catch(() => null);
-      await waitAfterNav();
+      const keysPageReady = await navigateConsole("https://www.codebuddy.cn/profile/keys");
+      if (!keysPageReady) {
+        throw Object.assign(
+          new Error(`Keys page navigation timed out after ${CODEBUDDY_CN_CONSOLE_NAV_TIMEOUT_MS / 1000}s`),
+          { code: "CN_CONSOLE_NAV_TIMEOUT" },
+        );
+      }
 
-      let apiKeyResult = await createKeyOnPage(userEnterpriseId).catch(() => null);
+      let apiKeyResult = await requestApiKey(userEnterpriseId, "Creating API key");
 
-      // Retry personal id if enterprise id failed or accounts were empty.
+      // A confirmed 400 can safely retry with the personal enterprise id. Do
+      // not retry 5xx/network failures because the POST outcome is ambiguous.
       if (
-        (!apiKeyResult || !apiKeyResult.ok)
+        apiKeyResult?.status === 400
         && userEnterpriseId !== PERSONAL_ENTERPRISE_ID
       ) {
         this.setAccountStep(account, "retrying_api_key", "Retrying with personal-edition enterprise id");
         await this.persistJobSnapshot(job, { forcePreview: false });
-        apiKeyResult = await createKeyOnPage(PERSONAL_ENTERPRISE_ID).catch(() => null);
-      }
-
-      // Retry from console root if keys page POST failed.
-      if (!apiKeyResult || !apiKeyResult.ok) {
-        this.setAccountStep(account, "retrying_api_key", "Retrying API key from /console");
-        await this.persistJobSnapshot(job, { forcePreview: true });
-        await page.goto("https://www.codebuddy.cn/console", {
-          waitUntil: "domcontentloaded",
-          timeout: 45_000,
-        }).catch(() => null);
-        await waitAfterNav();
-        await page.goto("https://www.codebuddy.cn/profile/keys", {
-          waitUntil: "domcontentloaded",
-          timeout: 45_000,
-        }).catch(() => null);
-        await waitAfterNav();
-        apiKeyResult = await createKeyOnPage(PERSONAL_ENTERPRISE_ID).catch(() => null);
+        apiKeyResult = await requestApiKey(PERSONAL_ENTERPRISE_ID, "Retrying personal API key");
       }
 
       // Retry loop on 401/403 — openresty edge blocks create-key when Keycloak
       // cookies are half-synced (common on slow proxies). Nudge OIDC handoff,
-      // wait for strong session, then retry. Up to 3 rounds with backoff.
-      const isAuthBlocked = (r) => !r?.ok && (r?.status === 401 || r?.status === 403 || r?.status === 0 || !r);
-      for (let round = 1; round <= 3 && isAuthBlocked(apiKeyResult); round += 1) {
+      // wait for strong session, then retry with a strict round cap.
+      const isAuthBlocked = (result) =>
+        result?.ok === false && (result.status === 401 || result.status === 403);
+      for (
+        let round = 1;
+        round <= CODEBUDDY_CN_API_REHANDOFF_ROUNDS && isAuthBlocked(apiKeyResult);
+        round += 1
+      ) {
         this.setAccountStep(
           account,
           "retrying_api_key",
-          `API key 401/403 — OIDC re-handoff round ${round}/3 (waiting strong session)`,
+          `API key 401/403 — OIDC re-handoff round ${round}/${CODEBUDDY_CN_API_REHANDOFF_ROUNDS} (waiting strong session)`,
         );
         await this.persistJobSnapshot(job, { forcePreview: true });
         for (const path of [
@@ -863,15 +1189,17 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
           "https://www.codebuddy.cn/console",
           "https://www.codebuddy.cn/profile/keys",
         ]) {
-          await page.goto(path, { waitUntil: "domcontentloaded", timeout: 45_000 }).catch(() => null);
-          await waitAfterNav();
+          await navigateConsole(path);
         }
         // Wait for strong Keycloak cookie — openresty accepts api-keys only after full session.
         await waitUntil(async () => {
           const snap = await cookieSnapshot();
           return hasStrongKeycloak(snap.names);
         }, { timeout: 8_000 * round, interval: 300 }).catch(() => null);
-        apiKeyResult = await createKeyOnPage(PERSONAL_ENTERPRISE_ID).catch(() => null);
+        apiKeyResult = await requestApiKey(
+          PERSONAL_ENTERPRISE_ID,
+          `Retrying API key after OIDC handoff ${round}/${CODEBUDDY_CN_API_REHANDOFF_ROUNDS}`,
+        );
       }
 
       const businessCode = apiKeyResult?.data?.code;
@@ -904,8 +1232,9 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         apiKeyResult.data.secret;
 
       if (!apiKey || typeof apiKey !== "string") {
-        throw new Error(
-          `API key response did not contain a key field: ${JSON.stringify(apiKeyResult.data).slice(0, 300)}`,
+        throw Object.assign(
+          new Error(`API key response did not contain a key field; creation outcome is unknown: ${JSON.stringify(apiKeyResult.data).slice(0, 300)}`),
+          { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
         );
       }
 
@@ -925,7 +1254,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       });
 
       // Step 10: Finish 5sim order + finalize
-      await fiveSimClient.finishOrder(fiveSimOrderId);
+      await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
 
       this.finalizeAccount(account, "success", {
         connectionId: connection.id,
@@ -933,21 +1262,48 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         message: `CodeBuddy CN connection saved (phone: ${account.phone})`,
       });
       account.runtimeSession = null;
-      await context.close().catch(() => null);
+      await closeContextOrBrowser(context, job);
       await this.persistJobSnapshot(job, { forcePreview: true });
     } catch (error) {
       // If API key capture fails after registration, the account is registered
       // but we don't have a key. Surface as needs_manual so the operator can
       // create the key manually in the opened browser — number is NOT re-bought.
+      const restricted = error?.code === CODEBUDDY_CN_ACCOUNT_RESTRICTED;
+      const outcomeUnknown = error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN;
+      if (restricted) {
+        this.finalizeAccount(account, "failed_restricted", {
+          error: `${error.message}. Use a different residential CN/HK proxy with concurrency 1.`,
+          step: "failed_restricted",
+          message: "Tencent restricted the post-OTP session; API-key capture was not attempted",
+        });
+        await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
+        account.runtimeSession = null;
+        await closeContextOrBrowser(context, job);
+        await this.persistJobSnapshot(job, { forcePreview: true });
+        return;
+      }
+      const failureMessage = outcomeUnknown
+        ? `${error.message}. Check the CodeBuddy keys page before creating another key.`
+        : error.message;
       this.finalizeAccount(account, "needs_manual", {
-        error: `Registration succeeded but API key capture failed: ${error.message}`,
-        step: "awaiting_manual",
-        message: `Registration done, API key capture failed: ${error.message}`,
+        error: `Registration succeeded but API key capture failed: ${failureMessage}`,
+        step: outcomeUnknown ? "api_key_outcome_unknown" : "awaiting_manual",
+        message: outcomeUnknown
+          ? `Registration done; API key request outcome is unknown. Check existing keys before retrying.`
+          : `Registration done, API key capture failed: ${error.message}`,
       });
       // The 5sim order was successful (SMS received) — finish it (no re-order)
-      await fiveSimClient.finishOrder(fiveSimOrderId).catch(() => null);
+      await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
       await this.persistJobSnapshot(job, { forcePreview: true });
 
+      if (outcomeUnknown) {
+        // Closing the page aborts any late browser work. Automatic/manual POST
+        // retries are intentionally disabled because the key may already exist.
+        account.runtimeSession = null;
+        await closeContextOrBrowser(context, job);
+        return;
+      }
+
       // Start manual followup for API key capture (reuse same browser session)
       await this.runCnManualFollowup(job, account, account.workerId, context, page, fiveSimClient, fiveSimOrderId);
     }
@@ -963,18 +1319,21 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         const ms = account.manualSession;
         const ctx = ms?.context || context;
         const headed = ms?.headedBrowser || null;
-        if (ctx) await ctx.close().catch(() => null);
-        if (headed) await headed.close().catch(() => null);
+        await closeContextOrBrowser(ctx, job);
+        if (headed) await forceCloseBrowser(headed).catch(() => null);
       };
 
       try {
         this.setAccountStep(account, "manual_waiting", "Waiting for operator to complete in headed browser");
         await this.persistJobSnapshot(job, { forcePreview: true });
 
-        // Wait for the operator to complete — poll for the API keys page being loaded
-        // and an API key being available. Give them up to 15 minutes.
-        const deadline = Date.now() + 15 * 60_000;
+        // Wait up to 3 minutes on low-memory hosts, otherwise 8 minutes.
+        const manualTimeoutMs = isLowMemHost()
+          ? CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS
+          : CODEBUDDY_CN_MANUAL_TIMEOUT_MS;
+        const deadline = Date.now() + manualTimeoutMs;
         let apiKey = null;
+        const manualApiKeyName = `zevai-router-manual-${account.workerId || "account"}-${Date.now()}`;
 
         while (Date.now() < deadline && !job.cancelRequested) {
           await new Promise((r) => setTimeout(r, 10_000)); // Check every 10s
@@ -985,28 +1344,60 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
             if (!currentUrl.includes("codebuddy.cn")) continue;
 
             // Try to create an API key via the console API (include enterprise id)
-            const result = await page.evaluate(async () => {
-              const res = await fetch("/console/api/client/v1/api-keys", {
-                method: "POST",
-                headers: {
-                  "Content-Type": "application/json",
-                  Accept: "application/json, text/plain, */*",
-                  "x-requested-with": "XMLHttpRequest",
-                  "X-Domain": window.location.hostname || "www.codebuddy.cn",
-                  "X-Product": "SaaS",
-                },
-                credentials: "include",
-                body: JSON.stringify({
-                  name: "zevai-router-manual-" + Date.now(),
-                  expire_in_days: 365,
-                  user_enterprise_id: "personal-edition-user-id",
-                }),
-              });
-              const data = await res.json().catch(() => null);
-              return { ok: res.ok, status: res.status, data };
+            const result = await withTimeoutCleanup(page.evaluate(async ({ keyName, timeoutMs }) => {
+              const controller = new AbortController();
+              const timer = setTimeout(() => controller.abort(), timeoutMs);
+              try {
+                const host = window.location.hostname || "www.codebuddy.cn";
+                const base = host === "www.codebuddy.cn"
+                  ? window.location.origin
+                  : "https://www.codebuddy.cn";
+                const res = await fetch(`${base}/console/api/client/v1/api-keys`, {
+                  method: "POST",
+                  headers: {
+                    "Content-Type": "application/json",
+                    Accept: "application/json, text/plain, */*",
+                    "x-requested-with": "XMLHttpRequest",
+                    "X-Domain": "www.codebuddy.cn",
+                    "X-Product": "SaaS",
+                  },
+                  credentials: "include",
+                  signal: controller.signal,
+                  body: JSON.stringify({
+                    name: keyName,
+                    expire_in_days: 365,
+                    user_enterprise_id: "personal-edition-user-id",
+                  }),
+                });
+                const data = await res.json().catch(() => null);
+                return { ok: res.ok, status: res.status, data };
+              } catch (error) {
+                return {
+                  ok: false,
+                  status: 0,
+                  outcomeUnknown: true,
+                  error: error?.message || String(error),
+                };
+              } finally {
+                clearTimeout(timer);
+              }
+            }, {
+              keyName: manualApiKeyName,
+              timeoutMs: CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS,
+            }), {
+              timeoutMs: CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS,
+              message: "Manual API key request timed out; creation outcome is unknown",
+              code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN,
             });
 
-            if (result?.ok && result.data) {
+            if (result?.outcomeUnknown) {
+              throw Object.assign(
+                new Error(`Manual API key request lost its response; creation outcome is unknown: ${result.error || "network error"}`),
+                { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
+              );
+            }
+
+            if (result?.ok) {
               const payload = result.data?.data || result.data;
               apiKey =
                 payload?.apiKey ||
@@ -1016,8 +1407,13 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
                 payload?.api_key ||
                 (typeof payload === "string" ? payload : null);
               if (apiKey && typeof apiKey === "string") break;
+              throw Object.assign(
+                new Error("Manual API key response was successful but did not contain the key; creation outcome is unknown"),
+                { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
+              );
             }
-          } catch {
+          } catch (error) {
+            if (error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN) throw error;
             // Operator might still be completing — keep waiting
           }
         }
@@ -1061,6 +1457,12 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
             step: "cancelled",
             message: "Job cancelled while waiting for manual completion",
           });
+        } else if (error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN) {
+          this.finalizeAccount(account, "needs_manual", {
+            error: `${error.message}. Check existing CodeBuddy keys before retrying.`,
+            step: "api_key_outcome_unknown",
+            message: "Manual API key request outcome is unknown; automatic retries stopped",
+          });
         } else {
           this.finalizeAccount(account, "failed", {
             error: error.message || "Manual assist flow failed",
@@ -1150,7 +1552,7 @@ function buildCnSummary(accounts = []) {
     if (status === "success") {
       summary.success += 1;
       summary.completed += 1;
-    } else if (status === "failed" || status === "failed_exchange") {
+    } else if (status.startsWith("failed")) {
       summary.failed += 1;
       summary.completed += 1;
     } else if (status === "needs_manual") {
@@ -1244,4 +1646,24 @@ export const __test__ = {
   sanitizeCnJob,
   defaultPhoneFormatter,
   defaultSaveCodeBuddyCnConnection,
+  buildCnSummary,
+  hasRestrictedConsoleEvidence,
+  isLoginHtmlProbe,
+  parseConsoleProbeBody,
+  probeCodeBuddyConsoleAccounts,
+  withTimeoutCleanup,
+  AUTOMATION_LIMITS: {
+    registrationHardTimeoutMs: CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS,
+    browserLaunchTimeoutMs: CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS,
+    contextTimeoutMs: CODEBUDDY_CN_CONTEXT_TIMEOUT_MS,
+    consoleNavTimeoutMs: CODEBUDDY_CN_CONSOLE_NAV_TIMEOUT_MS,
+    consoleProbeTimeoutMs: CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS,
+    apiKeyRequestTimeoutMs: CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS,
+    oidcMaxAttempts: CODEBUDDY_CN_OIDC_MAX_ATTEMPTS,
+    apiRehandoffRounds: CODEBUDDY_CN_API_REHANDOFF_ROUNDS,
+    manualTimeoutMs: CODEBUDDY_CN_MANUAL_TIMEOUT_MS,
+    lowMemoryManualTimeoutMs: CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS,
+    resourceCloseTimeoutMs: CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS,
+    fiveSimSettleTimeoutMs: CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS,
+  },
 };