zevairouter 1.0.147 → 1.0.149

package/src/lib/oauth/services/codebuddyCnPhoneAutomation.js

@@ -118,6 +118,47 @@ const IFRAME_ERROR_SELECTORS = [
   ".kc-feedback-text",
 ];
 
+const RESTRICTION_COOKIE_NAMES = new Set([
+  "login_risk_state",
+]);
+
+const RESTRICTION_TEXT_MARKERS = [
+  "账号访问受限",
+  "安全策略限制",
+  "访问受限",
+  "account restricted",
+  "access restricted",
+];
+
+function hasRestrictionCookie(cookies = []) {
+  return cookies.some((cookie) => RESTRICTION_COOKIE_NAMES.has(cookie?.name));
+}
+
+function containsRestrictionText(value) {
+  const text = String(value || "").toLowerCase();
+  return RESTRICTION_TEXT_MARKERS.some((marker) => text.includes(marker.toLowerCase()));
+}
+
+function restrictedRegistrationResult(detail = "Tencent risk policy rejected the post-OTP session") {
+  return {
+    status: "failed_restricted",
+    error: `Account restricted after OTP (${detail}). Use a different residential CN/HK proxy with concurrency 1; do not retry this number on the same egress IP.`,
+  };
+}
+
+function shouldBlockCodeBuddyResource(url, resourceType) {
+  const value = String(url || "");
+  if (/googletagmanager|googleadservices|google-analytics|doubleclick|facebook|hotjar|clarity\.ms|hm\.baidu|google\.com\/rmkt/i.test(value)) {
+    return true;
+  }
+  if (resourceType === "media") return true;
+  if (resourceType === "image") {
+    // Keep challenge imagery available for manual captcha assist.
+    return !/captcha|tcaptcha|challenge|verify|qrcode/i.test(value);
+  }
+  return false;
+}
+
 /**
  * Run the phone-number registration automation.
  *
@@ -180,8 +221,8 @@ export async function runCodeBuddyCnPhoneRegistration({
     // ponytail: China residential proxies hang on Google tracker CONNECT; abort them so SPA can boot
     try {
       await page.context().route("**/*", (route) => {
-        const u = route.request().url();
-        if (/googletagmanager|googleadservices|google-analytics|doubleclick|facebook|hotjar|clarity\.ms|hm\.baidu|google\.com\/rmkt/i.test(u)) {
+        const request = route.request();
+        if (shouldBlockCodeBuddyResource(request.url(), request.resourceType())) {
           return route.abort();
         }
         return route.continue();
@@ -454,10 +495,8 @@ export async function runCodeBuddyCnPhoneRegistration({
     await page.waitForTimeout(preSubmitPauseMs);
 
     // Step 9: Click submit (#kc-login)
-    // Retry a couple times if "account restricted" (账号访问受限) is shown —
-    // but do not thrash: datacenter/VPS IPs usually stay restricted until a real
-    // residential CN proxy is used. Keep the loop short so Chromium cannot pin RAM.
-    // After a clean submit, poll for Keycloak cookies (China proxy SPA shell lag).
+    // Retry a clean submit only when it had no effect. A confirmed restriction
+    // is terminal for this number/IP pair and must not be resubmitted.
     const MAX_SUBMIT_RETRIES = 2;
     const SESSION_WAIT_MS = Math.max(postSubmit, 12_000);
     let submitSuccess = false;
@@ -473,6 +512,10 @@ export async function runCodeBuddyCnPhoneRegistration({
           reportStep("cn_session_cookies", `Keycloak session after iframe detach (${earlySession.cookie})`);
           return { status: "success" };
         }
+        if (hasRestrictionCookie(earlySession.cookies)) {
+          reportStep("cn_account_restricted", "Tencent login_risk_state present after iframe detached");
+          return restrictedRegistrationResult("login_risk_state cookie present");
+        }
         return { status: "failed", error: "Lost phone iframe after submit" };
       }
 
@@ -517,30 +560,13 @@ export async function runCodeBuddyCnPhoneRegistration({
       currentFrame = (await getPhoneFrame(page)) || currentFrame;
 
       // Check for "account restricted" (账号访问受限)
-      const restrictionDetected = await checkAccountRestricted(currentFrame);
+      const restrictionDetected = await checkAccountRestricted(page, currentFrame);
       if (restrictionDetected) {
-        if (retry >= MAX_SUBMIT_RETRIES - 1) {
-          return {
-            status: "failed",
-            error:
-              "Account restricted (账号访问受限) after submit. Datacenter/VPS IP is usually blocked — use a residential CN/HK proxy (proxyPoolMode=single), concurrency 1, and retry. Chromium locale is zh-CN; bad egress IP still fails.",
-          };
-        }
-        // Cool-down before reload — immediate refresh+resubmit looks more automated
-        const coolMs = 2_500 + Math.floor(Math.random() * 2_000);
         reportStep(
           "cn_account_restricted",
-          `Account restricted (attempt ${retry + 1}) — cooling ${coolMs}ms then soft-reload`,
+          `Account restricted after submit (attempt ${retry + 1}) — stopping automatic retries`,
         );
-        await page.waitForTimeout(coolMs);
-        await page.reload({ waitUntil: "commit", timeout: nav }).catch(() => {});
-        await waitForAnyVisible(page, SPA_READY_SELECTORS, 12_000);
-        const phoneTabRetry = await waitForFirstVisibleLocator(page, PHONE_TAB_SELECTORS, { timeout: 8_000 });
-        if (phoneTabRetry) {
-          await phoneTabRetry.click().catch(() => {});
-          await page.locator(PHONE_IFRAME_SELECTOR).waitFor({ state: "attached", timeout: 8_000 }).catch(() => {});
-        }
-        continue; // Retry submit
+        return restrictedRegistrationResult("restriction message detected");
       }
 
       // Captcha
@@ -575,6 +601,10 @@ export async function runCodeBuddyCnPhoneRegistration({
         reportStep("cn_session_cookies", `Keycloak session cookies present (${session.cookie}) — registration success`);
         return { status: "success" };
       }
+      if (session.reason === "restricted") {
+        reportStep("cn_account_restricted", "Restriction detected while waiting for Keycloak session");
+        return restrictedRegistrationResult("restriction message detected during session handoff");
+      }
 
       // Still on login form? Click may not have submitted — retry
       const stillOnForm = await isLoginFormStillVisible(page);
@@ -592,6 +622,17 @@ export async function runCodeBuddyCnPhoneRegistration({
         reportStep("cn_session_cookies", `Keycloak session after home nudge (${sessionAfterHome.cookie})`);
         return { status: "success" };
       }
+      if (sessionAfterHome.reason === "restricted") {
+        reportStep("cn_account_restricted", "Restriction detected after home handoff");
+        return restrictedRegistrationResult("restriction message detected after OIDC handoff");
+      }
+      if (hasRestrictionCookie(sessionAfterHome.cookies)) {
+        reportStep(
+          "cn_account_restricted",
+          "Home handoff returned no authenticated session and login_risk_state is present",
+        );
+        return restrictedRegistrationResult("login_risk_state persisted after OIDC handoff");
+      }
 
       submitSuccess = true;
       break;
@@ -612,6 +653,13 @@ export async function runCodeBuddyCnPhoneRegistration({
       reportStep("cn_registration_success", `Phone registration completed (Keycloak session: ${sessionFinal.cookie})`);
       return { status: "success" };
     }
+    if (hasRestrictionCookie(sessionFinal.cookies)) {
+      reportStep(
+        "cn_account_restricted",
+        "No authenticated session and Tencent login_risk_state is present — account restricted",
+      );
+      return restrictedRegistrationResult("login_risk_state without an authenticated session");
+    }
 
     const success = await confirmRegistrationSuccess(page, phoneFrame, 10_000);
     if (success) {
@@ -932,15 +980,13 @@ async function waitForKeycloakSession(page, { timeoutMs = 20_000, reportStep, al
       // ignore
     }
 
-    if (alsoCheckFrame) {
-      const frame = await alsoCheckFrame().catch(() => null);
-      if (frame) {
-        if (await checkAccountRestricted(frame)) {
-          return { ok: false, cookies, reason: "restricted" };
-        }
+    const frame = alsoCheckFrame ? await alsoCheckFrame().catch(() => null) : null;
+    if (await checkAccountRestricted(page, frame)) {
+      return { ok: false, cookies, reason: "restricted" };
+    }
+    if (frame) {
         const err = await checkIframeError(frame);
         if (err) return { ok: false, cookies, reason: `form_error:${err}` };
-      }
     }
 
     if (reportStep && Date.now() - lastReport > 4_000) {
@@ -1022,18 +1068,15 @@ async function collectPostLoginDiagnostics(page) {
  * Check for "account restricted" message in the iframe (and main page).
  * Tencent shows "账号访问受限" when a virtual number / risk policy blocks login.
  */
-async function checkAccountRestricted(frame) {
-  try {
-    const bodyText = await frame.evaluate(() => document.body?.innerText || "");
-    if (
-      bodyText.includes("账号访问受限")
-      || bodyText.includes("安全策略限制")
-      || bodyText.includes("访问受限")
-    ) {
-      return true;
+async function checkAccountRestricted(page, frame) {
+  for (const target of [frame, page]) {
+    if (!target) continue;
+    try {
+      const bodyText = await target.evaluate(() => document.body?.innerText || "");
+      if (containsRestrictionText(bodyText)) return true;
+    } catch {
+      // Try the other document.
     }
-  } catch {
-    // Ignore
   }
   return false;
 }
@@ -1119,14 +1162,18 @@ async function detectCaptcha(page, frame, timeout = 5_000) {
  * API key capture then hard-failed on missing KEYCLOAK_IDENTITY.
  */
 async function confirmRegistrationSuccess(page, frame, timeout = 15_000) {
-  // Strong: real Keycloak identity cookies
+  let cookies = [];
   try {
-    const cookies = await page.context().cookies().catch(() => []);
+    cookies = await page.context().cookies().catch(() => []);
     if (findKeycloakSessionCookie(cookies)) return true;
   } catch {
     // Ignore
   }
 
+  // Never let generic app chrome override a Tencent restriction signal.
+  if (hasRestrictionCookie(cookies)) return false;
+  if (await isLoginFormStillVisible(page).catch(() => false)) return false;
+
   // Strong: logged-in UI chrome (avatar / logout)
   for (const sel of LOGGED_IN_SELECTORS) {
     try {
@@ -1141,7 +1188,6 @@ async function confirmRegistrationSuccess(page, frame, timeout = 15_000) {
   // Soft-but-useful: left /login AND has qcloud_uid (Tencent account cookie)
   try {
     const url = page.url();
-    const cookies = await page.context().cookies().catch(() => []);
     const names = new Set(cookies.map((c) => c.name));
     if (
       url
@@ -1181,4 +1227,8 @@ export const __test__ = {
   CAPTCHA_SELECTORS,
   LOGGED_IN_SELECTORS,
   KEYCLOAK_SESSION_COOKIE_NAMES,
+  containsRestrictionText,
+  hasRestrictionCookie,
+  restrictedRegistrationResult,
+  shouldBlockCodeBuddyResource,
 };

package/src/lib/oauth/services/kiroBulkImportManager.js

@@ -412,10 +412,16 @@ export async function createFreshContext(browser, proxy, opts = {}) {
   let fingerprint = null;
   if (wantFingerprint) {
     try {
-      const { buildAccountFingerprint } = await import("./bulkImportBrowserEngine.js");
+      const {
+        buildAccountFingerprint,
+        compactAccountFingerprint,
+      } = await import("./bulkImportBrowserEngine.js");
       fingerprint = buildAccountFingerprint(
         opts.fingerprintSeed ?? randomUUID(),
       );
+      if (opts.lowMemory === true) {
+        fingerprint = compactAccountFingerprint(fingerprint);
+      }
       contextOptions.viewport = { ...fingerprint.viewport };
       contextOptions.deviceScaleFactor = fingerprint.deviceScaleFactor;
       contextOptions.fingerprint = {