zevairouter 1.0.148 → 1.0.149

package/cli/app/CHANGELOG.md

@@ -1,3 +1,10 @@
+# v1.0.149 (2026-07-27)
+
+## Fixes
+- **Accurate CodeBuddy CN restriction detection**: post-OTP sessions that retain Tencent's `login_risk_state` and repeatedly resolve to Keycloak login are now reported as `failed_restricted` instead of a generic API-key capture failure.
+- **CORS-independent console probing**: account-session checks prefer the browser context request API, preserving cookies, redirect URLs, response status, and login HTML even when in-page fetch is blocked or collapses to HTTP 0.
+- **Safe restricted-account termination**: confirmed restrictions stop OTP resubmission and skip API-key/manual fallback, while summaries count the terminal result correctly and browser resources close immediately.
+
 # v1.0.148 (2026-07-27)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.148",
+  "version": "1.0.149",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.148",
+  "version": "1.0.149",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.148",
+  "version": "1.0.149",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -83,6 +83,7 @@ const CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS = 3 * 60_000;
 const CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS = 5_000;
 const CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS = 12_000;
 const CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN = "CN_API_KEY_OUTCOME_UNKNOWN";
+const CODEBUDDY_CN_ACCOUNT_RESTRICTED = "CN_ACCOUNT_RESTRICTED";
 
 // Supported 5sim regions
 const SUPPORTED_REGIONS = new Set(["hongkong", "china", "any"]);
@@ -163,9 +164,125 @@ async function withTimeoutCleanup(
 }
 
 function isLoginHtmlProbe(probe) {
+  const raw = `${probe?.text || ""} ${probe?.data?._raw || ""} ${probe?.url || ""}`;
+  return /<!doctype html|<html|login-pf|\/auth\/realms\//i.test(raw);
+}
+
+function parseConsoleProbeBody(status, text, extras = {}) {
+  const rawText = String(text || "");
+  let data = null;
+  try {
+    data = rawText ? JSON.parse(rawText) : null;
+  } catch {
+    data = { _raw: rawText.slice(0, 240), _notJson: true };
+  }
+  return {
+    status: Number(status) || 0,
+    data,
+    text: rawText.slice(0, 240),
+    ...extras,
+  };
+}
+
+function hasRestrictedConsoleEvidence(probe, cookieNames = []) {
+  const names = cookieNames instanceof Set ? cookieNames : new Set(cookieNames);
   const raw = `${probe?.text || ""} ${probe?.data?._raw || ""}`;
-  return probe?.data?._notJson === true
-    || /<!doctype html|<html|login-pf|\/auth\/realms\//i.test(raw);
+  if (/账号访问受限|安全策略限制|访问受限|account restricted|access restricted/i.test(raw)) {
+    return true;
+  }
+  if (!names.has("login_risk_state")) return false;
+  return isLoginHtmlProbe(probe)
+    || probe?.status === 0
+    || probe?.status === 401
+    || probe?.status === 403;
+}
+
+async function probeCodeBuddyConsoleAccounts({
+  context,
+  page,
+  timeoutMs = CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS,
+}) {
+  const headers = {
+    Accept: "application/json, text/plain, */*",
+    "x-requested-with": "XMLHttpRequest",
+    "X-Domain": "www.codebuddy.cn",
+    "X-Product": "SaaS",
+  };
+
+  // The context request shares browser cookies but bypasses page-origin CORS.
+  let requestContext = null;
+  try {
+    requestContext = context?.request || null;
+  } catch {
+    requestContext = null;
+  }
+  if (requestContext && typeof requestContext.get === "function") {
+    try {
+      const response = await requestContext.get(
+        "https://www.codebuddy.cn/console/accounts",
+        { headers, timeout: timeoutMs, failOnStatusCode: false },
+      );
+      const text = await response.text().catch(() => "");
+      return parseConsoleProbeBody(response.status(), text, {
+        source: "context-request",
+        url: response.url(),
+        contentType: response.headers()?.["content-type"] || "",
+      });
+    } catch {
+      // Compatibility fallback for older CloakBrowser request contexts.
+    }
+  }
+
+  const probeTask = page.evaluate(async ({ requestTimeoutMs, requestHeaders }) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), requestTimeoutMs);
+    try {
+      const host = window.location.hostname || "www.codebuddy.cn";
+      const base = host === "www.codebuddy.cn"
+        ? `${window.location.origin}`
+        : "https://www.codebuddy.cn";
+      const response = await fetch(`${base}/console/accounts`, {
+        credentials: "include",
+        signal: controller.signal,
+        headers: requestHeaders,
+      });
+      const text = await response.text().catch(() => "");
+      let data = null;
+      try {
+        data = text ? JSON.parse(text) : null;
+      } catch {
+        data = { _raw: String(text || "").slice(0, 240), _notJson: true };
+      }
+      return {
+        status: response.status,
+        data,
+        text: String(text || "").slice(0, 240),
+        source: "page-fetch",
+        url: response.url,
+        contentType: response.headers.get("content-type") || "",
+      };
+    } catch (error) {
+      return {
+        status: 0,
+        timedOut: error?.name === "AbortError",
+        error: error?.message || String(error),
+        source: "page-fetch",
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  }, { requestTimeoutMs: timeoutMs, requestHeaders: headers });
+
+  return withTimeoutCleanup(probeTask, {
+    timeoutMs,
+    message: `Console account probe timed out after ${timeoutMs / 1000}s`,
+    code: "CN_CONSOLE_PROBE_TIMEOUT",
+  }).catch((error) => ({
+    status: 0,
+    timedOut: error?.code === "CN_CONSOLE_PROBE_TIMEOUT",
+    error: error?.message || String(error),
+    source: "page-fetch",
+  }));
 }
 
 async function closeResourceBounded(resource) {
@@ -576,12 +693,13 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // If automation failed early (e.g. page.goto timeout), the session won't be logged in
       // and API key creation will 401 — so don't waste time. Only try bypass if automation
       // reported "success" or "needs_manual" (meaning submit happened).
-      if (automationResult.status === "failed") {
+      if (String(automationResult.status || "").startsWith("failed")) {
         // Automation failed before submit — no point trying API key
         const errorMsg = automationResult.error || "Phone registration failed before submit";
-        this.finalizeAccount(account, "failed", {
+        const failureStatus = automationResult.status || "failed";
+        this.finalizeAccount(account, failureStatus, {
           error: errorMsg,
-          step: "failed",
+          step: failureStatus,
           message: errorMsg,
         });
         // Only touch 5sim if we actually bought a number (order is deferred until form ready)
@@ -702,55 +820,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         || names.has("qcmainCSRFToken")
         || names.has("x_host_key_access");
 
-      const probeConsoleAccounts = async () => {
-        const probeTask = page.evaluate(async ({ timeoutMs }) => {
-          const controller = new AbortController();
-          const timer = setTimeout(() => controller.abort(), timeoutMs);
-          try {
-            // Relative /console/accounts fails on Tencent/Keycloak login hosts.
-            const host = window.location.hostname || "www.codebuddy.cn";
-            const base = host === "www.codebuddy.cn"
-              ? `${window.location.origin}`
-              : "https://www.codebuddy.cn";
-            const res = await fetch(`${base}/console/accounts`, {
-              credentials: "include",
-              signal: controller.signal,
-              headers: {
-                Accept: "application/json, text/plain, */*",
-                "x-requested-with": "XMLHttpRequest",
-                "X-Domain": "www.codebuddy.cn",
-                "X-Product": "SaaS",
-              },
-            });
-            const text = await res.text().catch(() => "");
-            let data = null;
-            try {
-              data = text ? JSON.parse(text) : null;
-            } catch {
-              data = { _raw: String(text || "").slice(0, 240), _notJson: true };
-            }
-            return { status: res.status, data, text: String(text || "").slice(0, 240) };
-          } catch (error) {
-            return {
-              status: 0,
-              timedOut: error?.name === "AbortError",
-              error: error?.message || String(error),
-            };
-          } finally {
-            clearTimeout(timer);
-          }
-        }, { timeoutMs: CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS });
-
-        return withTimeoutCleanup(probeTask, {
-          timeoutMs: CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS,
-          message: `Console account probe timed out after ${CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS / 1000}s`,
-          code: "CN_CONSOLE_PROBE_TIMEOUT",
-        }).catch((error) => ({
-          status: 0,
-          timedOut: error?.code === "CN_CONSOLE_PROBE_TIMEOUT",
-          error: error?.message || String(error),
-        }));
-      };
+      const probeConsoleAccounts = () => probeCodeBuddyConsoleAccounts({ context, page });
 
       const extractAccountList = (probe) => {
         const d = probe?.data;
@@ -825,6 +895,8 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       let accountsProbe = null;
       let sessionReady = false;
       let lastPayloadSnippet = "";
+      let lastMeaningfulProbe = null;
+      let restrictedProbeCount = 0;
 
       // Event-driven OIDC settle: bounded attempts and no blind multi-second sleeps.
       for (let attempt = 0; attempt < CODEBUDDY_CN_OIDC_MAX_ATTEMPTS; attempt += 1) {
@@ -861,8 +933,36 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
 
         accountsProbe = await probeConsoleAccounts();
         accountList = extractAccountList(accountsProbe);
-        lastPayloadSnippet = JSON.stringify(accountsProbe?.data ?? accountsProbe?.text ?? null).slice(0, 180);
+        if (
+          accountsProbe?.status > 0
+          || accountsProbe?.text
+          || accountsProbe?.data
+        ) {
+          lastMeaningfulProbe = accountsProbe;
+        }
+        lastPayloadSnippet = JSON.stringify(
+          accountsProbe?.data
+          ?? accountsProbe?.text
+          ?? accountsProbe?.error
+          ?? null,
+        ).slice(0, 180);
         const loginHtml = isLoginHtmlProbe(accountsProbe);
+        const probeSnap = await cookieSnapshot();
+        const probeStrong = hasStrongKeycloak(probeSnap.names);
+        if (!probeStrong && hasRestrictedConsoleEvidence(accountsProbe, probeSnap.names)) {
+          restrictedProbeCount += 1;
+        } else {
+          restrictedProbeCount = 0;
+        }
+
+        if (restrictedProbeCount >= 2) {
+          throw Object.assign(
+            new Error(
+              `Tencent restricted the post-OTP session (${restrictedProbeCount} console probes returned login/risk evidence; source=${accountsProbe?.source || "unknown"})`,
+            ),
+            { code: CODEBUDDY_CN_ACCOUNT_RESTRICTED },
+          );
+        }
 
         if (
           accountsProbe?.status === 200
@@ -904,15 +1004,23 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         this.setAccountStep(
           account,
           "resolving_enterprise",
-          `Console not ready (HTTP ${accountsProbe?.status || 0}, accounts=${accountList.length}${loginHtml ? ", login HTML" : ""}) — ${attempt + 1}/${CODEBUDDY_CN_OIDC_MAX_ATTEMPTS} body=${lastPayloadSnippet.slice(0, 80)}`,
+          `Console not ready (HTTP ${accountsProbe?.status || 0}, accounts=${accountList.length}${loginHtml ? ", login HTML" : ""}, source=${accountsProbe?.source || "unknown"}) — ${attempt + 1}/${CODEBUDDY_CN_OIDC_MAX_ATTEMPTS} body=${lastPayloadSnippet.slice(0, 80)}`,
         );
         await this.persistJobSnapshot(job, { forcePreview: false });
       }
 
       if (!sessionReady) {
         const snap = await cookieSnapshot();
-        throw new Error(
-          `Console accounts unavailable after login (HTTP ${accountsProbe?.status || 0}; cookies: ${snap.list.slice(0, 18).join(",") || "(none)"}; body=${lastPayloadSnippet.slice(0, 120)}) — session not accepted for API key`,
+        const diagnosticProbe = lastMeaningfulProbe || accountsProbe;
+        const restricted = hasRestrictedConsoleEvidence(diagnosticProbe, snap.names)
+          || (snap.names.has("login_risk_state") && restrictedProbeCount > 0);
+        throw Object.assign(
+          new Error(
+            restricted
+              ? `Tencent restricted the post-OTP session (HTTP ${diagnosticProbe?.status || 0}; login_risk_state present; source=${diagnosticProbe?.source || "unknown"})`
+              : `Console accounts unavailable after login (HTTP ${diagnosticProbe?.status || 0}; cookies: ${snap.list.slice(0, 18).join(",") || "(none)"}; body=${lastPayloadSnippet.slice(0, 120)}; probeError=${accountsProbe?.error || "none"}) — session not accepted for API key`,
+          ),
+          { code: restricted ? CODEBUDDY_CN_ACCOUNT_RESTRICTED : "CN_CONSOLE_SESSION_UNAVAILABLE" },
         );
       }
 
@@ -1160,7 +1268,20 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // If API key capture fails after registration, the account is registered
       // but we don't have a key. Surface as needs_manual so the operator can
       // create the key manually in the opened browser — number is NOT re-bought.
+      const restricted = error?.code === CODEBUDDY_CN_ACCOUNT_RESTRICTED;
       const outcomeUnknown = error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN;
+      if (restricted) {
+        this.finalizeAccount(account, "failed_restricted", {
+          error: `${error.message}. Use a different residential CN/HK proxy with concurrency 1.`,
+          step: "failed_restricted",
+          message: "Tencent restricted the post-OTP session; API-key capture was not attempted",
+        });
+        await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
+        account.runtimeSession = null;
+        await closeContextOrBrowser(context, job);
+        await this.persistJobSnapshot(job, { forcePreview: true });
+        return;
+      }
       const failureMessage = outcomeUnknown
         ? `${error.message}. Check the CodeBuddy keys page before creating another key.`
         : error.message;
@@ -1431,7 +1552,7 @@ function buildCnSummary(accounts = []) {
     if (status === "success") {
       summary.success += 1;
       summary.completed += 1;
-    } else if (status === "failed" || status === "failed_exchange") {
+    } else if (status.startsWith("failed")) {
       summary.failed += 1;
       summary.completed += 1;
     } else if (status === "needs_manual") {
@@ -1525,7 +1646,11 @@ export const __test__ = {
   sanitizeCnJob,
   defaultPhoneFormatter,
   defaultSaveCodeBuddyCnConnection,
+  buildCnSummary,
+  hasRestrictedConsoleEvidence,
   isLoginHtmlProbe,
+  parseConsoleProbeBody,
+  probeCodeBuddyConsoleAccounts,
   withTimeoutCleanup,
   AUTOMATION_LIMITS: {
     registrationHardTimeoutMs: CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS,

package/src/lib/oauth/services/codebuddyCnPhoneAutomation.js

@@ -118,6 +118,34 @@ const IFRAME_ERROR_SELECTORS = [
   ".kc-feedback-text",
 ];
 
+const RESTRICTION_COOKIE_NAMES = new Set([
+  "login_risk_state",
+]);
+
+const RESTRICTION_TEXT_MARKERS = [
+  "账号访问受限",
+  "安全策略限制",
+  "访问受限",
+  "account restricted",
+  "access restricted",
+];
+
+function hasRestrictionCookie(cookies = []) {
+  return cookies.some((cookie) => RESTRICTION_COOKIE_NAMES.has(cookie?.name));
+}
+
+function containsRestrictionText(value) {
+  const text = String(value || "").toLowerCase();
+  return RESTRICTION_TEXT_MARKERS.some((marker) => text.includes(marker.toLowerCase()));
+}
+
+function restrictedRegistrationResult(detail = "Tencent risk policy rejected the post-OTP session") {
+  return {
+    status: "failed_restricted",
+    error: `Account restricted after OTP (${detail}). Use a different residential CN/HK proxy with concurrency 1; do not retry this number on the same egress IP.`,
+  };
+}
+
 function shouldBlockCodeBuddyResource(url, resourceType) {
   const value = String(url || "");
   if (/googletagmanager|googleadservices|google-analytics|doubleclick|facebook|hotjar|clarity\.ms|hm\.baidu|google\.com\/rmkt/i.test(value)) {
@@ -467,10 +495,8 @@ export async function runCodeBuddyCnPhoneRegistration({
     await page.waitForTimeout(preSubmitPauseMs);
 
     // Step 9: Click submit (#kc-login)
-    // Retry a couple times if "account restricted" (账号访问受限) is shown —
-    // but do not thrash: datacenter/VPS IPs usually stay restricted until a real
-    // residential CN proxy is used. Keep the loop short so Chromium cannot pin RAM.
-    // After a clean submit, poll for Keycloak cookies (China proxy SPA shell lag).
+    // Retry a clean submit only when it had no effect. A confirmed restriction
+    // is terminal for this number/IP pair and must not be resubmitted.
     const MAX_SUBMIT_RETRIES = 2;
     const SESSION_WAIT_MS = Math.max(postSubmit, 12_000);
     let submitSuccess = false;
@@ -486,6 +512,10 @@ export async function runCodeBuddyCnPhoneRegistration({
           reportStep("cn_session_cookies", `Keycloak session after iframe detach (${earlySession.cookie})`);
           return { status: "success" };
         }
+        if (hasRestrictionCookie(earlySession.cookies)) {
+          reportStep("cn_account_restricted", "Tencent login_risk_state present after iframe detached");
+          return restrictedRegistrationResult("login_risk_state cookie present");
+        }
         return { status: "failed", error: "Lost phone iframe after submit" };
       }
 
@@ -530,30 +560,13 @@ export async function runCodeBuddyCnPhoneRegistration({
       currentFrame = (await getPhoneFrame(page)) || currentFrame;
 
       // Check for "account restricted" (账号访问受限)
-      const restrictionDetected = await checkAccountRestricted(currentFrame);
+      const restrictionDetected = await checkAccountRestricted(page, currentFrame);
       if (restrictionDetected) {
-        if (retry >= MAX_SUBMIT_RETRIES - 1) {
-          return {
-            status: "failed",
-            error:
-              "Account restricted (账号访问受限) after submit. Datacenter/VPS IP is usually blocked — use a residential CN/HK proxy (proxyPoolMode=single), concurrency 1, and retry. Chromium locale is zh-CN; bad egress IP still fails.",
-          };
-        }
-        // Cool-down before reload — immediate refresh+resubmit looks more automated
-        const coolMs = 2_500 + Math.floor(Math.random() * 2_000);
         reportStep(
           "cn_account_restricted",
-          `Account restricted (attempt ${retry + 1}) — cooling ${coolMs}ms then soft-reload`,
+          `Account restricted after submit (attempt ${retry + 1}) — stopping automatic retries`,
         );
-        await page.waitForTimeout(coolMs);
-        await page.reload({ waitUntil: "commit", timeout: nav }).catch(() => {});
-        await waitForAnyVisible(page, SPA_READY_SELECTORS, 12_000);
-        const phoneTabRetry = await waitForFirstVisibleLocator(page, PHONE_TAB_SELECTORS, { timeout: 8_000 });
-        if (phoneTabRetry) {
-          await phoneTabRetry.click().catch(() => {});
-          await page.locator(PHONE_IFRAME_SELECTOR).waitFor({ state: "attached", timeout: 8_000 }).catch(() => {});
-        }
-        continue; // Retry submit
+        return restrictedRegistrationResult("restriction message detected");
       }
 
       // Captcha
@@ -588,6 +601,10 @@ export async function runCodeBuddyCnPhoneRegistration({
         reportStep("cn_session_cookies", `Keycloak session cookies present (${session.cookie}) — registration success`);
         return { status: "success" };
       }
+      if (session.reason === "restricted") {
+        reportStep("cn_account_restricted", "Restriction detected while waiting for Keycloak session");
+        return restrictedRegistrationResult("restriction message detected during session handoff");
+      }
 
       // Still on login form? Click may not have submitted — retry
       const stillOnForm = await isLoginFormStillVisible(page);
@@ -605,6 +622,17 @@ export async function runCodeBuddyCnPhoneRegistration({
         reportStep("cn_session_cookies", `Keycloak session after home nudge (${sessionAfterHome.cookie})`);
         return { status: "success" };
       }
+      if (sessionAfterHome.reason === "restricted") {
+        reportStep("cn_account_restricted", "Restriction detected after home handoff");
+        return restrictedRegistrationResult("restriction message detected after OIDC handoff");
+      }
+      if (hasRestrictionCookie(sessionAfterHome.cookies)) {
+        reportStep(
+          "cn_account_restricted",
+          "Home handoff returned no authenticated session and login_risk_state is present",
+        );
+        return restrictedRegistrationResult("login_risk_state persisted after OIDC handoff");
+      }
 
       submitSuccess = true;
       break;
@@ -625,6 +653,13 @@ export async function runCodeBuddyCnPhoneRegistration({
       reportStep("cn_registration_success", `Phone registration completed (Keycloak session: ${sessionFinal.cookie})`);
       return { status: "success" };
     }
+    if (hasRestrictionCookie(sessionFinal.cookies)) {
+      reportStep(
+        "cn_account_restricted",
+        "No authenticated session and Tencent login_risk_state is present — account restricted",
+      );
+      return restrictedRegistrationResult("login_risk_state without an authenticated session");
+    }
 
     const success = await confirmRegistrationSuccess(page, phoneFrame, 10_000);
     if (success) {
@@ -945,15 +980,13 @@ async function waitForKeycloakSession(page, { timeoutMs = 20_000, reportStep, al
       // ignore
     }
 
-    if (alsoCheckFrame) {
-      const frame = await alsoCheckFrame().catch(() => null);
-      if (frame) {
-        if (await checkAccountRestricted(frame)) {
-          return { ok: false, cookies, reason: "restricted" };
-        }
+    const frame = alsoCheckFrame ? await alsoCheckFrame().catch(() => null) : null;
+    if (await checkAccountRestricted(page, frame)) {
+      return { ok: false, cookies, reason: "restricted" };
+    }
+    if (frame) {
         const err = await checkIframeError(frame);
         if (err) return { ok: false, cookies, reason: `form_error:${err}` };
-      }
     }
 
     if (reportStep && Date.now() - lastReport > 4_000) {
@@ -1035,18 +1068,15 @@ async function collectPostLoginDiagnostics(page) {
  * Check for "account restricted" message in the iframe (and main page).
  * Tencent shows "账号访问受限" when a virtual number / risk policy blocks login.
  */
-async function checkAccountRestricted(frame) {
-  try {
-    const bodyText = await frame.evaluate(() => document.body?.innerText || "");
-    if (
-      bodyText.includes("账号访问受限")
-      || bodyText.includes("安全策略限制")
-      || bodyText.includes("访问受限")
-    ) {
-      return true;
+async function checkAccountRestricted(page, frame) {
+  for (const target of [frame, page]) {
+    if (!target) continue;
+    try {
+      const bodyText = await target.evaluate(() => document.body?.innerText || "");
+      if (containsRestrictionText(bodyText)) return true;
+    } catch {
+      // Try the other document.
     }
-  } catch {
-    // Ignore
   }
   return false;
 }
@@ -1132,14 +1162,18 @@ async function detectCaptcha(page, frame, timeout = 5_000) {
  * API key capture then hard-failed on missing KEYCLOAK_IDENTITY.
  */
 async function confirmRegistrationSuccess(page, frame, timeout = 15_000) {
-  // Strong: real Keycloak identity cookies
+  let cookies = [];
   try {
-    const cookies = await page.context().cookies().catch(() => []);
+    cookies = await page.context().cookies().catch(() => []);
     if (findKeycloakSessionCookie(cookies)) return true;
   } catch {
     // Ignore
   }
 
+  // Never let generic app chrome override a Tencent restriction signal.
+  if (hasRestrictionCookie(cookies)) return false;
+  if (await isLoginFormStillVisible(page).catch(() => false)) return false;
+
   // Strong: logged-in UI chrome (avatar / logout)
   for (const sel of LOGGED_IN_SELECTORS) {
     try {
@@ -1154,7 +1188,6 @@ async function confirmRegistrationSuccess(page, frame, timeout = 15_000) {
   // Soft-but-useful: left /login AND has qcloud_uid (Tencent account cookie)
   try {
     const url = page.url();
-    const cookies = await page.context().cookies().catch(() => []);
     const names = new Set(cookies.map((c) => c.name));
     if (
       url
@@ -1194,5 +1227,8 @@ export const __test__ = {
   CAPTCHA_SELECTORS,
   LOGGED_IN_SELECTORS,
   KEYCLOAK_SESSION_COOKIE_NAMES,
+  containsRestrictionText,
+  hasRestrictionCookie,
+  restrictedRegistrationResult,
   shouldBlockCodeBuddyResource,
 };