zevairouter 1.0.148 → 1.0.150

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -18,6 +18,7 @@
  */
 
 import { randomUUID } from "crypto";
+import net from "node:net";
 import {
   KiroBulkImportManager,
   buildLookupResponse,
@@ -40,7 +41,10 @@ import {
   defaultPollForToken,
   fetchCodeBuddyLoginAccount,
 } from "./codebuddyBulkImportManager.js";
-import { forceCloseBrowser } from "./bulkImportBrowserEngine.js";
+import {
+  forceCloseBrowser,
+  getCloakProxyProfile,
+} from "./bulkImportBrowserEngine.js";
 
 const CODEBUDDY_CN_PROVIDER_ID = "codebuddy-cn";
 const CODEBUDDY_CN_LABEL = "CodeBuddy CN";
@@ -82,7 +86,14 @@ const CODEBUDDY_CN_MANUAL_TIMEOUT_MS = 8 * 60_000;
 const CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS = 3 * 60_000;
 const CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS = 5_000;
 const CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS = 12_000;
+const CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS = 6_000;
 const CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN = "CN_API_KEY_OUTCOME_UNKNOWN";
+const CODEBUDDY_CN_ACCOUNT_RESTRICTED = "CN_ACCOUNT_RESTRICTED";
+const CODEBUDDY_CN_EGRESS_ECHO_URLS = [
+  "https://api.ipify.org",
+  "https://checkip.amazonaws.com",
+  "https://ifconfig.me/ip",
+];
 
 // Supported 5sim regions
 const SUPPORTED_REGIONS = new Set(["hongkong", "china", "any"]);
@@ -126,6 +137,96 @@ function clampCnConcurrency(value) {
   return Math.min(hardMax, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, parsed));
 }
 
+function resolveCnJobConcurrency(value, { manualProxy = false } = {}) {
+  return manualProxy ? 1 : clampCnConcurrency(value);
+}
+
+function parseEgressIp(value) {
+  const raw = String(value || "").trim();
+  if (net.isIP(raw)) return raw;
+  try {
+    const parsed = JSON.parse(raw);
+    const ip = String(parsed?.ip || parsed?.query || "").trim();
+    return net.isIP(ip) ? ip : null;
+  } catch {
+    return null;
+  }
+}
+
+async function probeCodeBuddyProxyEgress(
+  context,
+  { timeoutMs = CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS } = {},
+) {
+  let requestContext = null;
+  try {
+    requestContext = context?.request || null;
+  } catch {
+    requestContext = null;
+  }
+  if (!requestContext || typeof requestContext.get !== "function") {
+    return { ok: false, ip: null, ips: [], samples: 0, error: "context request unavailable" };
+  }
+
+  const results = await Promise.all(CODEBUDDY_CN_EGRESS_ECHO_URLS.map(async (url) => {
+    let response = null;
+    try {
+      response = await requestContext.get(url, {
+        timeout: timeoutMs,
+        failOnStatusCode: false,
+        headers: {
+          Accept: "text/plain, application/json;q=0.9, */*;q=0.1",
+          "Cache-Control": "no-cache",
+        },
+      });
+      if (response.status() < 200 || response.status() >= 300) return null;
+      return parseEgressIp(await response.text().catch(() => ""));
+    } catch {
+      return null;
+    } finally {
+      if (typeof response?.dispose === "function") {
+        await Promise.resolve(response.dispose()).catch(() => null);
+      }
+    }
+  }));
+
+  const successful = results.filter(Boolean);
+  const ips = [...new Set(successful)];
+  return {
+    ok: ips.length === 1,
+    ip: ips.length === 1 ? ips[0] : null,
+    ips,
+    samples: successful.length,
+    unstable: ips.length > 1,
+    error: ips.length === 0
+      ? "all exit-IP services failed"
+      : ips.length > 1
+        ? `proxy returned ${ips.length} exit IPs in one probe`
+        : null,
+  };
+}
+
+function requireStableProxyEgress(probe, expectedIp = null) {
+  if (probe?.unstable) {
+    throw Object.assign(
+      new Error("Manual proxy rotated between exit IPs during preflight; no phone number was purchased"),
+      { code: "CN_PROXY_EGRESS_UNSTABLE" },
+    );
+  }
+  if (!probe?.ok || !probe?.ip) {
+    throw Object.assign(
+      new Error(`Manual proxy exit IP could not be verified (${probe?.error || "no response"}); no phone number was purchased`),
+      { code: "CN_PROXY_EGRESS_UNVERIFIED" },
+    );
+  }
+  if (expectedIp && probe.ip !== expectedIp) {
+    throw Object.assign(
+      new Error("Manual proxy exit IP changed after CloakBrowser GeoIP alignment; no phone number was purchased"),
+      { code: "CN_PROXY_EGRESS_CHANGED" },
+    );
+  }
+  return probe.ip;
+}
+
 async function withTimeoutCleanup(
   task,
   {
@@ -163,9 +264,125 @@ async function withTimeoutCleanup(
 }
 
 function isLoginHtmlProbe(probe) {
+  const raw = `${probe?.text || ""} ${probe?.data?._raw || ""} ${probe?.url || ""}`;
+  return /<!doctype html|<html|login-pf|\/auth\/realms\//i.test(raw);
+}
+
+function parseConsoleProbeBody(status, text, extras = {}) {
+  const rawText = String(text || "");
+  let data = null;
+  try {
+    data = rawText ? JSON.parse(rawText) : null;
+  } catch {
+    data = { _raw: rawText.slice(0, 240), _notJson: true };
+  }
+  return {
+    status: Number(status) || 0,
+    data,
+    text: rawText.slice(0, 240),
+    ...extras,
+  };
+}
+
+function hasRestrictedConsoleEvidence(probe, cookieNames = []) {
+  const names = cookieNames instanceof Set ? cookieNames : new Set(cookieNames);
   const raw = `${probe?.text || ""} ${probe?.data?._raw || ""}`;
-  return probe?.data?._notJson === true
-    || /<!doctype html|<html|login-pf|\/auth\/realms\//i.test(raw);
+  if (/账号访问受限|安全策略限制|访问受限|account restricted|access restricted/i.test(raw)) {
+    return true;
+  }
+  if (!names.has("login_risk_state")) return false;
+  return isLoginHtmlProbe(probe)
+    || probe?.status === 0
+    || probe?.status === 401
+    || probe?.status === 403;
+}
+
+async function probeCodeBuddyConsoleAccounts({
+  context,
+  page,
+  timeoutMs = CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS,
+}) {
+  const headers = {
+    Accept: "application/json, text/plain, */*",
+    "x-requested-with": "XMLHttpRequest",
+    "X-Domain": "www.codebuddy.cn",
+    "X-Product": "SaaS",
+  };
+
+  // The context request shares browser cookies but bypasses page-origin CORS.
+  let requestContext = null;
+  try {
+    requestContext = context?.request || null;
+  } catch {
+    requestContext = null;
+  }
+  if (requestContext && typeof requestContext.get === "function") {
+    try {
+      const response = await requestContext.get(
+        "https://www.codebuddy.cn/console/accounts",
+        { headers, timeout: timeoutMs, failOnStatusCode: false },
+      );
+      const text = await response.text().catch(() => "");
+      return parseConsoleProbeBody(response.status(), text, {
+        source: "context-request",
+        url: response.url(),
+        contentType: response.headers()?.["content-type"] || "",
+      });
+    } catch {
+      // Compatibility fallback for older CloakBrowser request contexts.
+    }
+  }
+
+  const probeTask = page.evaluate(async ({ requestTimeoutMs, requestHeaders }) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), requestTimeoutMs);
+    try {
+      const host = window.location.hostname || "www.codebuddy.cn";
+      const base = host === "www.codebuddy.cn"
+        ? `${window.location.origin}`
+        : "https://www.codebuddy.cn";
+      const response = await fetch(`${base}/console/accounts`, {
+        credentials: "include",
+        signal: controller.signal,
+        headers: requestHeaders,
+      });
+      const text = await response.text().catch(() => "");
+      let data = null;
+      try {
+        data = text ? JSON.parse(text) : null;
+      } catch {
+        data = { _raw: String(text || "").slice(0, 240), _notJson: true };
+      }
+      return {
+        status: response.status,
+        data,
+        text: String(text || "").slice(0, 240),
+        source: "page-fetch",
+        url: response.url,
+        contentType: response.headers.get("content-type") || "",
+      };
+    } catch (error) {
+      return {
+        status: 0,
+        timedOut: error?.name === "AbortError",
+        error: error?.message || String(error),
+        source: "page-fetch",
+      };
+    } finally {
+      clearTimeout(timer);
+    }
+  }, { requestTimeoutMs: timeoutMs, requestHeaders: headers });
+
+  return withTimeoutCleanup(probeTask, {
+    timeoutMs,
+    message: `Console account probe timed out after ${timeoutMs / 1000}s`,
+    code: "CN_CONSOLE_PROBE_TIMEOUT",
+  }).catch((error) => ({
+    status: 0,
+    timedOut: error?.code === "CN_CONSOLE_PROBE_TIMEOUT",
+    error: error?.message || String(error),
+    source: "page-fetch",
+  }));
 }
 
 async function closeResourceBounded(resource) {
@@ -271,6 +488,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         proxyUrl,
         headless,
         windowSize: { width: 1280, height: 900 },
+        requireProxyGeoip: job?.proxyPoolMode === "manual" && Boolean(proxyUrl),
       });
       return withTimeoutCleanup(launchTask, {
         timeoutMs: CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS,
@@ -355,7 +573,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     const job = {
       jobId,
       status: "running",
-      concurrency: clampCnConcurrency(concurrency),
+      concurrency: resolveCnJobConcurrency(concurrency, { manualProxy: Boolean(manualProxy) }),
       proxyPoolMode: manualProxy ? "manual" : (proxyPoolMode || "none"),
       proxyUrls,
       region: resolvedRegion,
@@ -379,6 +597,9 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         // Unique Chromium fingerprint seed per account (viewport/HW/screen noise).
         fingerprintSeed: randomUUID(),
         proxyUrl: null,
+        egressIp: null,
+        proxyTimezone: null,
+        proxyLocale: null,
         abortController: new AbortController(),
         status: "queued",
         error: null,
@@ -427,6 +648,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     let fiveSimOrderId = null;
     let smsReceived = false;
     let context = null;
+    let verifiedEgressIp = null;
 
     try {
       // Step 1: Get 5sim API key from settings
@@ -452,16 +674,14 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // Step 2: Create browser context FIRST — if proxy/browser fails, we never buy a number.
       this.setAccountStep(account, "creating_browser", "Creating browser context (before 5sim order)");
       await this.persistJobSnapshot(job, { forcePreview: true });
-      // CloakBrowser stack: zh-CN locale + HK/CN timezone so Tencent risk
-      // scoring does not see EN-US browser on residential CN/HK egress (common
-      // cause of 账号访问受限 right after OTP). Per-account fingerprint seed —
-      // sticky residential IP alone still clusters if every session shares HW.
-      if (!account.fingerprintSeed) account.fingerprintSeed = randomUUID();
+      // CloakBrowser owns the process-wide fingerprint, timezone, locale, and
+      // WebRTC profile. Playwright context overrides would reintroduce CDP tells.
       const contextTask = createFreshContext(job.browser, account.proxyUrl, {
         profile: "codebuddy-cn",
         region: job.region || "hongkong",
         fingerprintSeed: account.fingerprintSeed,
         lowMemory: isLowMemHost(),
+        nativeCloakProfile: job.proxyPoolMode === "manual",
       });
       const freshContext = await withTimeoutCleanup(contextTask, {
         timeoutMs: CODEBUDDY_CN_CONTEXT_TIMEOUT_MS,
@@ -473,6 +693,27 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       const page = freshContext.page;
       account.runtimeSession = { context, page };
 
+      if (job.proxyPoolMode === "manual" && account.proxyUrl) {
+        this.setAccountStep(
+          account,
+          "checking_proxy_egress",
+          "Verifying pasted proxy exit IP before opening the registration form",
+        );
+        await this.persistJobSnapshot(job, { forcePreview: false });
+        const launchProfile = getCloakProxyProfile(job.browser);
+        const egressProbe = await probeCodeBuddyProxyEgress(context);
+        verifiedEgressIp = requireStableProxyEgress(egressProbe, launchProfile?.egressIp || null);
+        account.egressIp = verifiedEgressIp;
+        account.proxyTimezone = launchProfile?.timezone || null;
+        account.proxyLocale = launchProfile?.locale || null;
+        this.setAccountStep(
+          account,
+          "proxy_egress_ready",
+          `Manual proxy verified: ${verifiedEgressIp} (${egressProbe.samples} checks, ${account.proxyTimezone || "timezone unknown"}, ${account.proxyLocale || "locale unknown"})`,
+        );
+        await this.persistJobSnapshot(job, { forcePreview: false });
+      }
+
       if (job.cancelRequested) {
         throw new Error("Job cancelled before ordering phone number");
       }
@@ -519,6 +760,22 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
               if (job.cancelRequested) {
                 throw new Error("Job cancelled before ordering phone number");
               }
+              if (job.proxyPoolMode === "manual" && account.proxyUrl) {
+                this.setAccountStep(
+                  account,
+                  "rechecking_proxy_egress",
+                  "Registration form is ready — confirming the pasted proxy stayed sticky",
+                );
+                await this.persistJobSnapshot(job, { forcePreview: false });
+                const secondProbe = await probeCodeBuddyProxyEgress(context);
+                requireStableProxyEgress(secondProbe, verifiedEgressIp);
+                this.setAccountStep(
+                  account,
+                  "proxy_egress_confirmed",
+                  `Manual proxy remained on ${verifiedEgressIp}; safe to purchase one phone number`,
+                );
+                await this.persistJobSnapshot(job, { forcePreview: false });
+              }
               this.setAccountStep(
                 account,
                 "ordering_number",
@@ -576,12 +833,13 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // If automation failed early (e.g. page.goto timeout), the session won't be logged in
       // and API key creation will 401 — so don't waste time. Only try bypass if automation
       // reported "success" or "needs_manual" (meaning submit happened).
-      if (automationResult.status === "failed") {
+      if (String(automationResult.status || "").startsWith("failed")) {
         // Automation failed before submit — no point trying API key
         const errorMsg = automationResult.error || "Phone registration failed before submit";
-        this.finalizeAccount(account, "failed", {
+        const failureStatus = automationResult.status || "failed";
+        this.finalizeAccount(account, failureStatus, {
           error: errorMsg,
-          step: "failed",
+          step: failureStatus,
           message: errorMsg,
         });
         // Only touch 5sim if we actually bought a number (order is deferred until form ready)
@@ -702,55 +960,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         || names.has("qcmainCSRFToken")
         || names.has("x_host_key_access");
 
-      const probeConsoleAccounts = async () => {
-        const probeTask = page.evaluate(async ({ timeoutMs }) => {
-          const controller = new AbortController();
-          const timer = setTimeout(() => controller.abort(), timeoutMs);
-          try {
-            // Relative /console/accounts fails on Tencent/Keycloak login hosts.
-            const host = window.location.hostname || "www.codebuddy.cn";
-            const base = host === "www.codebuddy.cn"
-              ? `${window.location.origin}`
-              : "https://www.codebuddy.cn";
-            const res = await fetch(`${base}/console/accounts`, {
-              credentials: "include",
-              signal: controller.signal,
-              headers: {
-                Accept: "application/json, text/plain, */*",
-                "x-requested-with": "XMLHttpRequest",
-                "X-Domain": "www.codebuddy.cn",
-                "X-Product": "SaaS",
-              },
-            });
-            const text = await res.text().catch(() => "");
-            let data = null;
-            try {
-              data = text ? JSON.parse(text) : null;
-            } catch {
-              data = { _raw: String(text || "").slice(0, 240), _notJson: true };
-            }
-            return { status: res.status, data, text: String(text || "").slice(0, 240) };
-          } catch (error) {
-            return {
-              status: 0,
-              timedOut: error?.name === "AbortError",
-              error: error?.message || String(error),
-            };
-          } finally {
-            clearTimeout(timer);
-          }
-        }, { timeoutMs: CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS });
-
-        return withTimeoutCleanup(probeTask, {
-          timeoutMs: CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS,
-          message: `Console account probe timed out after ${CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS / 1000}s`,
-          code: "CN_CONSOLE_PROBE_TIMEOUT",
-        }).catch((error) => ({
-          status: 0,
-          timedOut: error?.code === "CN_CONSOLE_PROBE_TIMEOUT",
-          error: error?.message || String(error),
-        }));
-      };
+      const probeConsoleAccounts = () => probeCodeBuddyConsoleAccounts({ context, page });
 
       const extractAccountList = (probe) => {
         const d = probe?.data;
@@ -825,6 +1035,8 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       let accountsProbe = null;
       let sessionReady = false;
       let lastPayloadSnippet = "";
+      let lastMeaningfulProbe = null;
+      let restrictedProbeCount = 0;
 
       // Event-driven OIDC settle: bounded attempts and no blind multi-second sleeps.
       for (let attempt = 0; attempt < CODEBUDDY_CN_OIDC_MAX_ATTEMPTS; attempt += 1) {
@@ -861,8 +1073,36 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
 
         accountsProbe = await probeConsoleAccounts();
         accountList = extractAccountList(accountsProbe);
-        lastPayloadSnippet = JSON.stringify(accountsProbe?.data ?? accountsProbe?.text ?? null).slice(0, 180);
+        if (
+          accountsProbe?.status > 0
+          || accountsProbe?.text
+          || accountsProbe?.data
+        ) {
+          lastMeaningfulProbe = accountsProbe;
+        }
+        lastPayloadSnippet = JSON.stringify(
+          accountsProbe?.data
+          ?? accountsProbe?.text
+          ?? accountsProbe?.error
+          ?? null,
+        ).slice(0, 180);
         const loginHtml = isLoginHtmlProbe(accountsProbe);
+        const probeSnap = await cookieSnapshot();
+        const probeStrong = hasStrongKeycloak(probeSnap.names);
+        if (!probeStrong && hasRestrictedConsoleEvidence(accountsProbe, probeSnap.names)) {
+          restrictedProbeCount += 1;
+        } else {
+          restrictedProbeCount = 0;
+        }
+
+        if (restrictedProbeCount >= 2) {
+          throw Object.assign(
+            new Error(
+              `Tencent restricted the post-OTP session (${restrictedProbeCount} console probes returned login/risk evidence; source=${accountsProbe?.source || "unknown"})`,
+            ),
+            { code: CODEBUDDY_CN_ACCOUNT_RESTRICTED },
+          );
+        }
 
         if (
           accountsProbe?.status === 200
@@ -904,15 +1144,23 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         this.setAccountStep(
           account,
           "resolving_enterprise",
-          `Console not ready (HTTP ${accountsProbe?.status || 0}, accounts=${accountList.length}${loginHtml ? ", login HTML" : ""}) — ${attempt + 1}/${CODEBUDDY_CN_OIDC_MAX_ATTEMPTS} body=${lastPayloadSnippet.slice(0, 80)}`,
+          `Console not ready (HTTP ${accountsProbe?.status || 0}, accounts=${accountList.length}${loginHtml ? ", login HTML" : ""}, source=${accountsProbe?.source || "unknown"}) — ${attempt + 1}/${CODEBUDDY_CN_OIDC_MAX_ATTEMPTS} body=${lastPayloadSnippet.slice(0, 80)}`,
         );
         await this.persistJobSnapshot(job, { forcePreview: false });
       }
 
       if (!sessionReady) {
         const snap = await cookieSnapshot();
-        throw new Error(
-          `Console accounts unavailable after login (HTTP ${accountsProbe?.status || 0}; cookies: ${snap.list.slice(0, 18).join(",") || "(none)"}; body=${lastPayloadSnippet.slice(0, 120)}) — session not accepted for API key`,
+        const diagnosticProbe = lastMeaningfulProbe || accountsProbe;
+        const restricted = hasRestrictedConsoleEvidence(diagnosticProbe, snap.names)
+          || (snap.names.has("login_risk_state") && restrictedProbeCount > 0);
+        throw Object.assign(
+          new Error(
+            restricted
+              ? `Tencent restricted the post-OTP session (HTTP ${diagnosticProbe?.status || 0}; login_risk_state present; source=${diagnosticProbe?.source || "unknown"})`
+              : `Console accounts unavailable after login (HTTP ${diagnosticProbe?.status || 0}; cookies: ${snap.list.slice(0, 18).join(",") || "(none)"}; body=${lastPayloadSnippet.slice(0, 120)}; probeError=${accountsProbe?.error || "none"}) — session not accepted for API key`,
+          ),
+          { code: restricted ? CODEBUDDY_CN_ACCOUNT_RESTRICTED : "CN_CONSOLE_SESSION_UNAVAILABLE" },
         );
       }
 
@@ -1160,7 +1408,20 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // If API key capture fails after registration, the account is registered
       // but we don't have a key. Surface as needs_manual so the operator can
       // create the key manually in the opened browser — number is NOT re-bought.
+      const restricted = error?.code === CODEBUDDY_CN_ACCOUNT_RESTRICTED;
       const outcomeUnknown = error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN;
+      if (restricted) {
+        this.finalizeAccount(account, "failed_restricted", {
+          error: `${error.message}. Use a different residential CN/HK proxy with concurrency 1.`,
+          step: "failed_restricted",
+          message: "Tencent restricted the post-OTP session; API-key capture was not attempted",
+        });
+        await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
+        account.runtimeSession = null;
+        await closeContextOrBrowser(context, job);
+        await this.persistJobSnapshot(job, { forcePreview: true });
+        return;
+      }
       const failureMessage = outcomeUnknown
         ? `${error.message}. Check the CodeBuddy keys page before creating another key.`
         : error.message;
@@ -1362,6 +1623,62 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     job.manualFollowups.add(followupPromise);
   }
 
+  /**
+   * A pasted proxy is intentionally single-worker. Recycle the whole CloakBrowser
+   * process between accounts so its binary fingerprint and GeoIP profile cannot
+   * leak from one registration into the next.
+   */
+  async runWorker(job, workerId) {
+    if (job.proxyPoolMode !== "manual") {
+      return super.runWorker(job, workerId);
+    }
+
+    while (!job.cancelRequested) {
+      const account = this.dequeueAccount(job, workerId);
+      if (!account) return;
+
+      if (!job.browser) {
+        try {
+          job.browser = await this.browserLauncher({
+            ...job,
+            proxyUrls: account.proxyUrl ? [account.proxyUrl] : job.proxyUrls,
+          });
+        } catch (error) {
+          this.finalizeAccount(account, "failed", {
+            error: error?.message || "Manual proxy browser launch failed",
+            step: "failed",
+            message: error?.message || "Manual proxy browser launch failed",
+          });
+          await this.persistJobSnapshot(job, { forcePreview: true });
+          continue;
+        }
+      }
+
+      try {
+        await this.processAccount(job, account, workerId);
+      } catch (error) {
+        if (account.status === "running") {
+          this.finalizeAccount(account, "failed", {
+            error: error?.message || "Unexpected manual proxy worker failure",
+            step: "failed",
+            message: error?.message || "Unexpected manual proxy worker failure",
+          });
+          await this.persistJobSnapshot(job, { forcePreview: true });
+        }
+      } finally {
+        if (job.manualFollowups.size > 0) {
+          await Promise.allSettled([...job.manualFollowups]);
+        }
+
+        if (job.browser) {
+          const browser = job.browser;
+          job.browser = null;
+          await forceCloseBrowser(browser).catch(() => null);
+        }
+      }
+    }
+  }
+
   /**
    * Override cancelJob to abort in-flight 5sim polls AND force-close the browser.
    * Previous CN override only aborted controllers — Chromium kept spinning (VPS hang).
@@ -1431,7 +1748,7 @@ function buildCnSummary(accounts = []) {
     if (status === "success") {
       summary.success += 1;
       summary.completed += 1;
-    } else if (status === "failed" || status === "failed_exchange") {
+    } else if (status.startsWith("failed")) {
       summary.failed += 1;
       summary.completed += 1;
     } else if (status === "needs_manual") {
@@ -1468,6 +1785,9 @@ function sanitizeCnJob(job, extras = {}) {
       phone: account.phone,
       fiveSimOrderId: account.fiveSimOrderId,
       proxyUrl: account.proxyUrl ? maskProxyUrl(account.proxyUrl) : null,
+      egressIp: account.egressIp || null,
+      proxyTimezone: account.proxyTimezone || null,
+      proxyLocale: account.proxyLocale || null,
       status: account.status,
       error: account.error,
       connectionId: account.connectionId,
@@ -1522,10 +1842,18 @@ export {
 
 export const __test__ = {
   clampCnConcurrency,
+  resolveCnJobConcurrency,
   sanitizeCnJob,
   defaultPhoneFormatter,
   defaultSaveCodeBuddyCnConnection,
+  buildCnSummary,
+  hasRestrictedConsoleEvidence,
   isLoginHtmlProbe,
+  parseEgressIp,
+  parseConsoleProbeBody,
+  probeCodeBuddyProxyEgress,
+  probeCodeBuddyConsoleAccounts,
+  requireStableProxyEgress,
   withTimeoutCleanup,
   AUTOMATION_LIMITS: {
     registrationHardTimeoutMs: CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS,
@@ -1540,5 +1868,6 @@ export const __test__ = {
     lowMemoryManualTimeoutMs: CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS,
     resourceCloseTimeoutMs: CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS,
     fiveSimSettleTimeoutMs: CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS,
+    egressProbeTimeoutMs: CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS,
   },
 };