zevairouter 1.0.148 → 1.0.150

package/src/lib/oauth/services/codebuddyCnPhoneAutomation.js

@@ -118,6 +118,34 @@ const IFRAME_ERROR_SELECTORS = [
   ".kc-feedback-text",
 ];
 
+const RESTRICTION_COOKIE_NAMES = new Set([
+  "login_risk_state",
+]);
+
+const RESTRICTION_TEXT_MARKERS = [
+  "账号访问受限",
+  "安全策略限制",
+  "访问受限",
+  "account restricted",
+  "access restricted",
+];
+
+function hasRestrictionCookie(cookies = []) {
+  return cookies.some((cookie) => RESTRICTION_COOKIE_NAMES.has(cookie?.name));
+}
+
+function containsRestrictionText(value) {
+  const text = String(value || "").toLowerCase();
+  return RESTRICTION_TEXT_MARKERS.some((marker) => text.includes(marker.toLowerCase()));
+}
+
+function restrictedRegistrationResult(detail = "Tencent risk policy rejected the post-OTP session") {
+  return {
+    status: "failed_restricted",
+    error: `Account restricted after OTP (${detail}). Use a different residential CN/HK proxy with concurrency 1; do not retry this number on the same egress IP.`,
+  };
+}
+
 function shouldBlockCodeBuddyResource(url, resourceType) {
   const value = String(url || "");
   if (/googletagmanager|googleadservices|google-analytics|doubleclick|facebook|hotjar|clarity\.ms|hm\.baidu|google\.com\/rmkt/i.test(value)) {
@@ -467,10 +495,8 @@ export async function runCodeBuddyCnPhoneRegistration({
     await page.waitForTimeout(preSubmitPauseMs);
 
     // Step 9: Click submit (#kc-login)
-    // Retry a couple times if "account restricted" (账号访问受限) is shown —
-    // but do not thrash: datacenter/VPS IPs usually stay restricted until a real
-    // residential CN proxy is used. Keep the loop short so Chromium cannot pin RAM.
-    // After a clean submit, poll for Keycloak cookies (China proxy SPA shell lag).
+    // Retry a clean submit only when it had no effect. A confirmed restriction
+    // is terminal for this number/IP pair and must not be resubmitted.
     const MAX_SUBMIT_RETRIES = 2;
     const SESSION_WAIT_MS = Math.max(postSubmit, 12_000);
     let submitSuccess = false;
@@ -486,6 +512,10 @@ export async function runCodeBuddyCnPhoneRegistration({
           reportStep("cn_session_cookies", `Keycloak session after iframe detach (${earlySession.cookie})`);
           return { status: "success" };
         }
+        if (hasRestrictionCookie(earlySession.cookies)) {
+          reportStep("cn_account_restricted", "Tencent login_risk_state present after iframe detached");
+          return restrictedRegistrationResult("login_risk_state cookie present");
+        }
         return { status: "failed", error: "Lost phone iframe after submit" };
       }
 
@@ -530,30 +560,13 @@ export async function runCodeBuddyCnPhoneRegistration({
       currentFrame = (await getPhoneFrame(page)) || currentFrame;
 
       // Check for "account restricted" (账号访问受限)
-      const restrictionDetected = await checkAccountRestricted(currentFrame);
+      const restrictionDetected = await checkAccountRestricted(page, currentFrame);
       if (restrictionDetected) {
-        if (retry >= MAX_SUBMIT_RETRIES - 1) {
-          return {
-            status: "failed",
-            error:
-              "Account restricted (账号访问受限) after submit. Datacenter/VPS IP is usually blocked — use a residential CN/HK proxy (proxyPoolMode=single), concurrency 1, and retry. Chromium locale is zh-CN; bad egress IP still fails.",
-          };
-        }
-        // Cool-down before reload — immediate refresh+resubmit looks more automated
-        const coolMs = 2_500 + Math.floor(Math.random() * 2_000);
         reportStep(
           "cn_account_restricted",
-          `Account restricted (attempt ${retry + 1}) — cooling ${coolMs}ms then soft-reload`,
+          `Account restricted after submit (attempt ${retry + 1}) — stopping automatic retries`,
         );
-        await page.waitForTimeout(coolMs);
-        await page.reload({ waitUntil: "commit", timeout: nav }).catch(() => {});
-        await waitForAnyVisible(page, SPA_READY_SELECTORS, 12_000);
-        const phoneTabRetry = await waitForFirstVisibleLocator(page, PHONE_TAB_SELECTORS, { timeout: 8_000 });
-        if (phoneTabRetry) {
-          await phoneTabRetry.click().catch(() => {});
-          await page.locator(PHONE_IFRAME_SELECTOR).waitFor({ state: "attached", timeout: 8_000 }).catch(() => {});
-        }
-        continue; // Retry submit
+        return restrictedRegistrationResult("restriction message detected");
       }
 
       // Captcha
@@ -588,6 +601,10 @@ export async function runCodeBuddyCnPhoneRegistration({
         reportStep("cn_session_cookies", `Keycloak session cookies present (${session.cookie}) — registration success`);
         return { status: "success" };
       }
+      if (session.reason === "restricted") {
+        reportStep("cn_account_restricted", "Restriction detected while waiting for Keycloak session");
+        return restrictedRegistrationResult("restriction message detected during session handoff");
+      }
 
       // Still on login form? Click may not have submitted — retry
       const stillOnForm = await isLoginFormStillVisible(page);
@@ -605,6 +622,17 @@ export async function runCodeBuddyCnPhoneRegistration({
         reportStep("cn_session_cookies", `Keycloak session after home nudge (${sessionAfterHome.cookie})`);
         return { status: "success" };
       }
+      if (sessionAfterHome.reason === "restricted") {
+        reportStep("cn_account_restricted", "Restriction detected after home handoff");
+        return restrictedRegistrationResult("restriction message detected after OIDC handoff");
+      }
+      if (hasRestrictionCookie(sessionAfterHome.cookies)) {
+        reportStep(
+          "cn_account_restricted",
+          "Home handoff returned no authenticated session and login_risk_state is present",
+        );
+        return restrictedRegistrationResult("login_risk_state persisted after OIDC handoff");
+      }
 
       submitSuccess = true;
       break;
@@ -625,6 +653,13 @@ export async function runCodeBuddyCnPhoneRegistration({
       reportStep("cn_registration_success", `Phone registration completed (Keycloak session: ${sessionFinal.cookie})`);
       return { status: "success" };
     }
+    if (hasRestrictionCookie(sessionFinal.cookies)) {
+      reportStep(
+        "cn_account_restricted",
+        "No authenticated session and Tencent login_risk_state is present — account restricted",
+      );
+      return restrictedRegistrationResult("login_risk_state without an authenticated session");
+    }
 
     const success = await confirmRegistrationSuccess(page, phoneFrame, 10_000);
     if (success) {
@@ -945,15 +980,13 @@ async function waitForKeycloakSession(page, { timeoutMs = 20_000, reportStep, al
       // ignore
     }
 
-    if (alsoCheckFrame) {
-      const frame = await alsoCheckFrame().catch(() => null);
-      if (frame) {
-        if (await checkAccountRestricted(frame)) {
-          return { ok: false, cookies, reason: "restricted" };
-        }
+    const frame = alsoCheckFrame ? await alsoCheckFrame().catch(() => null) : null;
+    if (await checkAccountRestricted(page, frame)) {
+      return { ok: false, cookies, reason: "restricted" };
+    }
+    if (frame) {
         const err = await checkIframeError(frame);
         if (err) return { ok: false, cookies, reason: `form_error:${err}` };
-      }
     }
 
     if (reportStep && Date.now() - lastReport > 4_000) {
@@ -1035,18 +1068,15 @@ async function collectPostLoginDiagnostics(page) {
  * Check for "account restricted" message in the iframe (and main page).
  * Tencent shows "账号访问受限" when a virtual number / risk policy blocks login.
  */
-async function checkAccountRestricted(frame) {
-  try {
-    const bodyText = await frame.evaluate(() => document.body?.innerText || "");
-    if (
-      bodyText.includes("账号访问受限")
-      || bodyText.includes("安全策略限制")
-      || bodyText.includes("访问受限")
-    ) {
-      return true;
+async function checkAccountRestricted(page, frame) {
+  for (const target of [frame, page]) {
+    if (!target) continue;
+    try {
+      const bodyText = await target.evaluate(() => document.body?.innerText || "");
+      if (containsRestrictionText(bodyText)) return true;
+    } catch {
+      // Try the other document.
     }
-  } catch {
-    // Ignore
   }
   return false;
 }
@@ -1132,14 +1162,18 @@ async function detectCaptcha(page, frame, timeout = 5_000) {
  * API key capture then hard-failed on missing KEYCLOAK_IDENTITY.
  */
 async function confirmRegistrationSuccess(page, frame, timeout = 15_000) {
-  // Strong: real Keycloak identity cookies
+  let cookies = [];
   try {
-    const cookies = await page.context().cookies().catch(() => []);
+    cookies = await page.context().cookies().catch(() => []);
     if (findKeycloakSessionCookie(cookies)) return true;
   } catch {
     // Ignore
   }
 
+  // Never let generic app chrome override a Tencent restriction signal.
+  if (hasRestrictionCookie(cookies)) return false;
+  if (await isLoginFormStillVisible(page).catch(() => false)) return false;
+
   // Strong: logged-in UI chrome (avatar / logout)
   for (const sel of LOGGED_IN_SELECTORS) {
     try {
@@ -1154,7 +1188,6 @@ async function confirmRegistrationSuccess(page, frame, timeout = 15_000) {
   // Soft-but-useful: left /login AND has qcloud_uid (Tencent account cookie)
   try {
     const url = page.url();
-    const cookies = await page.context().cookies().catch(() => []);
     const names = new Set(cookies.map((c) => c.name));
     if (
       url
@@ -1194,5 +1227,8 @@ export const __test__ = {
   CAPTCHA_SELECTORS,
   LOGGED_IN_SELECTORS,
   KEYCLOAK_SESSION_COOKIE_NAMES,
+  containsRestrictionText,
+  hasRestrictionCookie,
+  restrictedRegistrationResult,
   shouldBlockCodeBuddyResource,
 };

package/src/lib/oauth/services/kiroBulkImportManager.js

@@ -384,10 +384,13 @@ export { parsePlaywrightProxy };
  * @param {"hongkong"|"china"|string} [opts.region]  Used by codebuddy-cn profile
  * @param {string|number} [opts.fingerprintSeed]  Per-account seed for viewport/HW fingerprint
  * @param {boolean} [opts.randomizeFingerprint]   Force fingerprint even outside codebuddy-cn
+ * @param {boolean} [opts.nativeCloakProfile]     Keep CloakBrowser's binary profile untouched
  */
 export async function createFreshContext(browser, proxy, opts = {}) {
   let effectiveProxy = proxy;
   let socksBridge = null;
+  const useNativeCloakProfile =
+    opts.profile === "codebuddy-cn" && opts.nativeCloakProfile === true;
 
   // Chromium cannot authenticate SOCKS5 — bridge to local HTTP proxy first
   if (proxy) {
@@ -406,9 +409,8 @@ export async function createFreshContext(browser, proxy, opts = {}) {
   // Per-account fingerprint (viewport + navigator.* + screen) via init script.
   // Sticky residential IP alone still clusters if every session shares the same HW profile.
   const wantFingerprint =
-    opts.profile === "codebuddy-cn" ||
-    opts.randomizeFingerprint === true ||
-    opts.fingerprintSeed != null;
+    !useNativeCloakProfile
+    && (opts.randomizeFingerprint === true || opts.fingerprintSeed != null);
   let fingerprint = null;
   if (wantFingerprint) {
     try {
@@ -434,22 +436,20 @@ export async function createFreshContext(browser, proxy, opts = {}) {
       fingerprint = null;
     }
   }
-  if (!contextOptions.viewport) {
+  if (!contextOptions.viewport && !useNativeCloakProfile) {
     contextOptions.viewport = { width: 1280, height: 900 };
   }
   // Ignore HTTPS errors common through residential proxies / MITM chains
   contextOptions.ignoreHTTPSErrors = true;
 
-  // Regional profile — CodeBuddy CN / Tencent risk engine scores EN-US + CN IP heavily.
-  if (opts.profile === "codebuddy-cn") {
+  if (opts.profile === "codebuddy-cn" && !useNativeCloakProfile) {
     const isChinaMainland = String(opts.region || "").toLowerCase() === "china";
     contextOptions.locale = "zh-CN";
     contextOptions.languages = ["zh-CN", "zh", "en-US", "en"];
     contextOptions.timezoneId = isChinaMainland ? "Asia/Shanghai" : "Asia/Hong_Kong";
-    // Approximate city coords matching default 5sim regions (HK vs mainland)
     contextOptions.geolocation = isChinaMainland
-      ? { longitude: 121.4737, latitude: 31.2304 } // Shanghai
-      : { longitude: 114.1694, latitude: 22.3193 }; // Hong Kong
+      ? { longitude: 121.4737, latitude: 31.2304 }
+      : { longitude: 114.1694, latitude: 22.3193 };
     contextOptions.permissions = ["geolocation"];
     contextOptions.extraHTTPHeaders = {
       ...(contextOptions.extraHTTPHeaders || {}),
@@ -457,6 +457,9 @@ export async function createFreshContext(browser, proxy, opts = {}) {
     };
   }
 
+  // A pasted proxy inherits CloakBrowser's binary-level locale/timezone/WebRTC
+  // profile. Phone country and residential proxy country may legitimately differ.
+
   // Allow callers to override any field
   if (opts.locale) contextOptions.locale = opts.locale;
   if (opts.timezoneId) contextOptions.timezoneId = opts.timezoneId;