zevairouter 1.0.149 → 1.0.150

package/cli/app/CHANGELOG.md

@@ -1,3 +1,10 @@
+# v1.0.150 (2026-07-27)
+
+## Fixes
+- **Coherent pasted-proxy browser identity**: CodeBuddy CN manual-proxy jobs now preserve CloakBrowser's binary-level exit IP, WebRTC, timezone, locale, and native viewport instead of overwriting them from the SMS number region.
+- **Safe sticky-egress preflight**: manual proxies are verified against multiple exit-IP services at launch and immediately before the 5sim purchase, so unverifiable, rotating, or changed exits fail before a phone number is ordered.
+- **Isolated manual registrations**: pasted-proxy jobs enforce one worker and recycle the complete CloakBrowser process between accounts, including cleanup after unexpected worker failures, without changing Proxy Pool selection or data.
+
 # v1.0.149 (2026-07-27)
 
 ## Fixes

package/cli/app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.149",
+  "version": "1.0.150",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter-cli",
-  "version": "1.0.149",
+  "version": "1.0.150",
   "description": "ZevaiRouter CLI - Start and manage ZevaiRouter server",
   "bin": {
     "zevai": "./cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zevairouter",
-  "version": "1.0.149",
+  "version": "1.0.150",
   "description": "Self-hosted AI router: many providers, one OpenAI-compatible /v1 endpoint and dashboard",
   "bin": {
     "zevai": "./cli/cli.js"

package/src/lib/oauth/services/bulkImportBrowserEngine.js

@@ -12,6 +12,7 @@ const requireFromHere = createRequire(import.meta.url);
 export const DEFAULT_BULK_IMPORT_ENGINE = "cloakbrowser";
 
 const SUPPORTED_ENGINES = new Set(["cloakbrowser"]);
+const CLOAK_PROXY_PROFILES = new WeakMap();
 
 export function normalizeBulkImportEngine(value) {
   if (typeof value !== "string" || !value.trim()) return DEFAULT_BULK_IMPORT_ENGINE;
@@ -212,7 +213,31 @@ export async function newStealthContext(browser, options = {}) {
  * Prefer headed (headless=false); Turnstile / Google bot checks often fail headless.
  * Auto-installs into ~/.zevai/runtime via cloakbrowserRuntime.
  */
-async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = null } = {}) {
+export function extractCloakProxyProfile(args = []) {
+  const readFlag = (name) => {
+    const prefix = `${name}=`;
+    const value = (args || []).find((arg) => String(arg).startsWith(prefix));
+    return value ? String(value).slice(prefix.length) : null;
+  };
+  return {
+    egressIp: readFlag("--fingerprint-webrtc-ip"),
+    timezone: readFlag("--fingerprint-timezone"),
+    locale: readFlag("--fingerprint-locale") || readFlag("--lang"),
+  };
+}
+
+export function getCloakProxyProfile(browser) {
+  return browser && typeof browser === "object"
+    ? CLOAK_PROXY_PROFILES.get(browser) || null
+    : null;
+}
+
+async function launchCloakbrowser({
+  proxyUrl,
+  headless = false,
+  windowSize = null,
+  requireProxyGeoip = false,
+} = {}) {
   const { ensureDisplayForHeadedBrowser } = await import("./displayEnv.js");
 
   const runtime = loadRuntimeHelper("cloakbrowserRuntime");
@@ -259,18 +284,65 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
     launchOpts.geoip = true;
   }
   if (windowSize?.width && windowSize?.height) {
-    launchOpts.viewport = { width: windowSize.width, height: windowSize.height };
+    // Keep headed contexts at viewport:null so dimensions follow the real Xvfb
+    // window. A Playwright viewport here overrides CloakBrowser's coherent window.
+    launchOpts.args = [`--window-size=${windowSize.width},${windowSize.height}`];
+  }
+
+  let effectiveLaunchOpts = launchOpts;
+  let proxyProfile = null;
+  if (proxyUrl && requireProxyGeoip) {
+    if (typeof cloak.buildLaunchOptions !== "function") {
+      const error = new Error("CloakBrowser runtime cannot verify proxy GeoIP before launch");
+      error.code = "CLOAKBROWSER_PROXY_GEOIP_UNSUPPORTED";
+      throw error;
+    }
+    // Slow residential CONNECT handshakes regularly exceed CloakBrowser's 5s
+    // default. Resolve once with a bounded 12s budget, then reuse those flags.
+    const previousGeoipTimeout = process.env.CLOAKBROWSER_GEOIP_TIMEOUT_SECONDS;
+    if (!previousGeoipTimeout) process.env.CLOAKBROWSER_GEOIP_TIMEOUT_SECONDS = "12";
+    let resolved;
+    try {
+      resolved = await cloak.buildLaunchOptions(launchOpts);
+    } finally {
+      if (previousGeoipTimeout === undefined) {
+        delete process.env.CLOAKBROWSER_GEOIP_TIMEOUT_SECONDS;
+      } else {
+        process.env.CLOAKBROWSER_GEOIP_TIMEOUT_SECONDS = previousGeoipTimeout;
+      }
+    }
+    proxyProfile = extractCloakProxyProfile(resolved?.args || []);
+    if (!proxyProfile.egressIp || !proxyProfile.timezone || !proxyProfile.locale) {
+      const error = new Error(
+        "Manual proxy exit GeoIP could not be verified; no phone number was purchased",
+      );
+      error.code = "CLOAKBROWSER_PROXY_GEOIP_UNAVAILABLE";
+      throw error;
+    }
+    effectiveLaunchOpts = {
+      ...launchOpts,
+      args: resolved.args || launchOpts.args,
+      geoip: false,
+    };
   }
 
   try {
     // Do not wrap with stock stealth scripts — CloakBrowser patches at binary level.
-    return await cloak.launch(launchOpts);
+    const browser = await cloak.launch(effectiveLaunchOpts);
+    if (proxyProfile) {
+      CLOAK_PROXY_PROFILES.set(browser, Object.freeze({ ...proxyProfile }));
+    }
+    return browser;
   } catch (error) {
     const msg = String(error?.message || error || "");
     if (!useHeadless && /XServer|DISPLAY|Missing X server|headed browser|no DISPLAY/i.test(msg)) {
       const display = ensureDisplayForHeadedBrowser();
       if (display.ok) {
-        return cloak.launch(launchOpts);
+        const browser = await cloak.launch(effectiveLaunchOpts);
+        if (proxyProfile) {
+          CLOAK_PROXY_PROFILES.set(browser, Object.freeze({ ...proxyProfile }));
+        }
+        return browser;
       }
       const friendly = new Error(
         `${msg}\n\nVPS has no display. Install a virtual screen then retry:\n` +
@@ -299,6 +371,7 @@ export async function launchBulkImportBrowser({
   proxyUrl,
   headless = false,
   windowSize = null,
+  requireProxyGeoip = false,
 } = {}) {
   // engine arg kept for API compatibility; always cloakbrowser.
   void normalizeBulkImportEngine(engine);
@@ -306,6 +379,7 @@ export async function launchBulkImportBrowser({
     proxyUrl,
     headless: headless === true,
     windowSize,
+    requireProxyGeoip,
   });
 }
 

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -18,6 +18,7 @@
  */
 
 import { randomUUID } from "crypto";
+import net from "node:net";
 import {
   KiroBulkImportManager,
   buildLookupResponse,
@@ -40,7 +41,10 @@ import {
   defaultPollForToken,
   fetchCodeBuddyLoginAccount,
 } from "./codebuddyBulkImportManager.js";
-import { forceCloseBrowser } from "./bulkImportBrowserEngine.js";
+import {
+  forceCloseBrowser,
+  getCloakProxyProfile,
+} from "./bulkImportBrowserEngine.js";
 
 const CODEBUDDY_CN_PROVIDER_ID = "codebuddy-cn";
 const CODEBUDDY_CN_LABEL = "CodeBuddy CN";
@@ -82,8 +86,14 @@ const CODEBUDDY_CN_MANUAL_TIMEOUT_MS = 8 * 60_000;
 const CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS = 3 * 60_000;
 const CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS = 5_000;
 const CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS = 12_000;
+const CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS = 6_000;
 const CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN = "CN_API_KEY_OUTCOME_UNKNOWN";
 const CODEBUDDY_CN_ACCOUNT_RESTRICTED = "CN_ACCOUNT_RESTRICTED";
+const CODEBUDDY_CN_EGRESS_ECHO_URLS = [
+  "https://api.ipify.org",
+  "https://checkip.amazonaws.com",
+  "https://ifconfig.me/ip",
+];
 
 // Supported 5sim regions
 const SUPPORTED_REGIONS = new Set(["hongkong", "china", "any"]);
@@ -127,6 +137,96 @@ function clampCnConcurrency(value) {
   return Math.min(hardMax, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, parsed));
 }
 
+function resolveCnJobConcurrency(value, { manualProxy = false } = {}) {
+  return manualProxy ? 1 : clampCnConcurrency(value);
+}
+
+function parseEgressIp(value) {
+  const raw = String(value || "").trim();
+  if (net.isIP(raw)) return raw;
+  try {
+    const parsed = JSON.parse(raw);
+    const ip = String(parsed?.ip || parsed?.query || "").trim();
+    return net.isIP(ip) ? ip : null;
+  } catch {
+    return null;
+  }
+}
+
+async function probeCodeBuddyProxyEgress(
+  context,
+  { timeoutMs = CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS } = {},
+) {
+  let requestContext = null;
+  try {
+    requestContext = context?.request || null;
+  } catch {
+    requestContext = null;
+  }
+  if (!requestContext || typeof requestContext.get !== "function") {
+    return { ok: false, ip: null, ips: [], samples: 0, error: "context request unavailable" };
+  }
+
+  const results = await Promise.all(CODEBUDDY_CN_EGRESS_ECHO_URLS.map(async (url) => {
+    let response = null;
+    try {
+      response = await requestContext.get(url, {
+        timeout: timeoutMs,
+        failOnStatusCode: false,
+        headers: {
+          Accept: "text/plain, application/json;q=0.9, */*;q=0.1",
+          "Cache-Control": "no-cache",
+        },
+      });
+      if (response.status() < 200 || response.status() >= 300) return null;
+      return parseEgressIp(await response.text().catch(() => ""));
+    } catch {
+      return null;
+    } finally {
+      if (typeof response?.dispose === "function") {
+        await Promise.resolve(response.dispose()).catch(() => null);
+      }
+    }
+  }));
+
+  const successful = results.filter(Boolean);
+  const ips = [...new Set(successful)];
+  return {
+    ok: ips.length === 1,
+    ip: ips.length === 1 ? ips[0] : null,
+    ips,
+    samples: successful.length,
+    unstable: ips.length > 1,
+    error: ips.length === 0
+      ? "all exit-IP services failed"
+      : ips.length > 1
+        ? `proxy returned ${ips.length} exit IPs in one probe`
+        : null,
+  };
+}
+
+function requireStableProxyEgress(probe, expectedIp = null) {
+  if (probe?.unstable) {
+    throw Object.assign(
+      new Error("Manual proxy rotated between exit IPs during preflight; no phone number was purchased"),
+      { code: "CN_PROXY_EGRESS_UNSTABLE" },
+    );
+  }
+  if (!probe?.ok || !probe?.ip) {
+    throw Object.assign(
+      new Error(`Manual proxy exit IP could not be verified (${probe?.error || "no response"}); no phone number was purchased`),
+      { code: "CN_PROXY_EGRESS_UNVERIFIED" },
+    );
+  }
+  if (expectedIp && probe.ip !== expectedIp) {
+    throw Object.assign(
+      new Error("Manual proxy exit IP changed after CloakBrowser GeoIP alignment; no phone number was purchased"),
+      { code: "CN_PROXY_EGRESS_CHANGED" },
+    );
+  }
+  return probe.ip;
+}
+
 async function withTimeoutCleanup(
   task,
   {
@@ -388,6 +488,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         proxyUrl,
         headless,
         windowSize: { width: 1280, height: 900 },
+        requireProxyGeoip: job?.proxyPoolMode === "manual" && Boolean(proxyUrl),
       });
       return withTimeoutCleanup(launchTask, {
         timeoutMs: CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS,
@@ -472,7 +573,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     const job = {
       jobId,
       status: "running",
-      concurrency: clampCnConcurrency(concurrency),
+      concurrency: resolveCnJobConcurrency(concurrency, { manualProxy: Boolean(manualProxy) }),
       proxyPoolMode: manualProxy ? "manual" : (proxyPoolMode || "none"),
       proxyUrls,
       region: resolvedRegion,
@@ -496,6 +597,9 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         // Unique Chromium fingerprint seed per account (viewport/HW/screen noise).
         fingerprintSeed: randomUUID(),
         proxyUrl: null,
+        egressIp: null,
+        proxyTimezone: null,
+        proxyLocale: null,
         abortController: new AbortController(),
         status: "queued",
         error: null,
@@ -544,6 +648,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     let fiveSimOrderId = null;
     let smsReceived = false;
     let context = null;
+    let verifiedEgressIp = null;
 
     try {
       // Step 1: Get 5sim API key from settings
@@ -569,16 +674,14 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // Step 2: Create browser context FIRST — if proxy/browser fails, we never buy a number.
       this.setAccountStep(account, "creating_browser", "Creating browser context (before 5sim order)");
       await this.persistJobSnapshot(job, { forcePreview: true });
-      // CloakBrowser stack: zh-CN locale + HK/CN timezone so Tencent risk
-      // scoring does not see EN-US browser on residential CN/HK egress (common
-      // cause of 账号访问受限 right after OTP). Per-account fingerprint seed —
-      // sticky residential IP alone still clusters if every session shares HW.
-      if (!account.fingerprintSeed) account.fingerprintSeed = randomUUID();
+      // CloakBrowser owns the process-wide fingerprint, timezone, locale, and
+      // WebRTC profile. Playwright context overrides would reintroduce CDP tells.
       const contextTask = createFreshContext(job.browser, account.proxyUrl, {
         profile: "codebuddy-cn",
         region: job.region || "hongkong",
         fingerprintSeed: account.fingerprintSeed,
         lowMemory: isLowMemHost(),
+        nativeCloakProfile: job.proxyPoolMode === "manual",
       });
       const freshContext = await withTimeoutCleanup(contextTask, {
         timeoutMs: CODEBUDDY_CN_CONTEXT_TIMEOUT_MS,
@@ -590,6 +693,27 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       const page = freshContext.page;
       account.runtimeSession = { context, page };
 
+      if (job.proxyPoolMode === "manual" && account.proxyUrl) {
+        this.setAccountStep(
+          account,
+          "checking_proxy_egress",
+          "Verifying pasted proxy exit IP before opening the registration form",
+        );
+        await this.persistJobSnapshot(job, { forcePreview: false });
+        const launchProfile = getCloakProxyProfile(job.browser);
+        const egressProbe = await probeCodeBuddyProxyEgress(context);
+        verifiedEgressIp = requireStableProxyEgress(egressProbe, launchProfile?.egressIp || null);
+        account.egressIp = verifiedEgressIp;
+        account.proxyTimezone = launchProfile?.timezone || null;
+        account.proxyLocale = launchProfile?.locale || null;
+        this.setAccountStep(
+          account,
+          "proxy_egress_ready",
+          `Manual proxy verified: ${verifiedEgressIp} (${egressProbe.samples} checks, ${account.proxyTimezone || "timezone unknown"}, ${account.proxyLocale || "locale unknown"})`,
+        );
+        await this.persistJobSnapshot(job, { forcePreview: false });
+      }
+
       if (job.cancelRequested) {
         throw new Error("Job cancelled before ordering phone number");
       }
@@ -636,6 +760,22 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
               if (job.cancelRequested) {
                 throw new Error("Job cancelled before ordering phone number");
               }
+              if (job.proxyPoolMode === "manual" && account.proxyUrl) {
+                this.setAccountStep(
+                  account,
+                  "rechecking_proxy_egress",
+                  "Registration form is ready — confirming the pasted proxy stayed sticky",
+                );
+                await this.persistJobSnapshot(job, { forcePreview: false });
+                const secondProbe = await probeCodeBuddyProxyEgress(context);
+                requireStableProxyEgress(secondProbe, verifiedEgressIp);
+                this.setAccountStep(
+                  account,
+                  "proxy_egress_confirmed",
+                  `Manual proxy remained on ${verifiedEgressIp}; safe to purchase one phone number`,
+                );
+                await this.persistJobSnapshot(job, { forcePreview: false });
+              }
               this.setAccountStep(
                 account,
                 "ordering_number",
@@ -1483,6 +1623,62 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     job.manualFollowups.add(followupPromise);
   }
 
+  /**
+   * A pasted proxy is intentionally single-worker. Recycle the whole CloakBrowser
+   * process between accounts so its binary fingerprint and GeoIP profile cannot
+   * leak from one registration into the next.
+   */
+  async runWorker(job, workerId) {
+    if (job.proxyPoolMode !== "manual") {
+      return super.runWorker(job, workerId);
+    }
+
+    while (!job.cancelRequested) {
+      const account = this.dequeueAccount(job, workerId);
+      if (!account) return;
+
+      if (!job.browser) {
+        try {
+          job.browser = await this.browserLauncher({
+            ...job,
+            proxyUrls: account.proxyUrl ? [account.proxyUrl] : job.proxyUrls,
+          });
+        } catch (error) {
+          this.finalizeAccount(account, "failed", {
+            error: error?.message || "Manual proxy browser launch failed",
+            step: "failed",
+            message: error?.message || "Manual proxy browser launch failed",
+          });
+          await this.persistJobSnapshot(job, { forcePreview: true });
+          continue;
+        }
+      }
+
+      try {
+        await this.processAccount(job, account, workerId);
+      } catch (error) {
+        if (account.status === "running") {
+          this.finalizeAccount(account, "failed", {
+            error: error?.message || "Unexpected manual proxy worker failure",
+            step: "failed",
+            message: error?.message || "Unexpected manual proxy worker failure",
+          });
+          await this.persistJobSnapshot(job, { forcePreview: true });
+        }
+      } finally {
+        if (job.manualFollowups.size > 0) {
+          await Promise.allSettled([...job.manualFollowups]);
+        }
+
+        if (job.browser) {
+          const browser = job.browser;
+          job.browser = null;
+          await forceCloseBrowser(browser).catch(() => null);
+        }
+      }
+    }
+  }
+
   /**
    * Override cancelJob to abort in-flight 5sim polls AND force-close the browser.
    * Previous CN override only aborted controllers — Chromium kept spinning (VPS hang).
@@ -1589,6 +1785,9 @@ function sanitizeCnJob(job, extras = {}) {
       phone: account.phone,
       fiveSimOrderId: account.fiveSimOrderId,
       proxyUrl: account.proxyUrl ? maskProxyUrl(account.proxyUrl) : null,
+      egressIp: account.egressIp || null,
+      proxyTimezone: account.proxyTimezone || null,
+      proxyLocale: account.proxyLocale || null,
       status: account.status,
       error: account.error,
       connectionId: account.connectionId,
@@ -1643,14 +1842,18 @@ export {
 
 export const __test__ = {
   clampCnConcurrency,
+  resolveCnJobConcurrency,
   sanitizeCnJob,
   defaultPhoneFormatter,
   defaultSaveCodeBuddyCnConnection,
   buildCnSummary,
   hasRestrictedConsoleEvidence,
   isLoginHtmlProbe,
+  parseEgressIp,
   parseConsoleProbeBody,
+  probeCodeBuddyProxyEgress,
   probeCodeBuddyConsoleAccounts,
+  requireStableProxyEgress,
   withTimeoutCleanup,
   AUTOMATION_LIMITS: {
     registrationHardTimeoutMs: CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS,
@@ -1665,5 +1868,6 @@ export const __test__ = {
     lowMemoryManualTimeoutMs: CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS,
     resourceCloseTimeoutMs: CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS,
     fiveSimSettleTimeoutMs: CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS,
+    egressProbeTimeoutMs: CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS,
   },
 };

package/src/lib/oauth/services/kiroBulkImportManager.js

@@ -384,10 +384,13 @@ export { parsePlaywrightProxy };
  * @param {"hongkong"|"china"|string} [opts.region]  Used by codebuddy-cn profile
  * @param {string|number} [opts.fingerprintSeed]  Per-account seed for viewport/HW fingerprint
  * @param {boolean} [opts.randomizeFingerprint]   Force fingerprint even outside codebuddy-cn
+ * @param {boolean} [opts.nativeCloakProfile]     Keep CloakBrowser's binary profile untouched
  */
 export async function createFreshContext(browser, proxy, opts = {}) {
   let effectiveProxy = proxy;
   let socksBridge = null;
+  const useNativeCloakProfile =
+    opts.profile === "codebuddy-cn" && opts.nativeCloakProfile === true;
 
   // Chromium cannot authenticate SOCKS5 — bridge to local HTTP proxy first
   if (proxy) {
@@ -406,9 +409,8 @@ export async function createFreshContext(browser, proxy, opts = {}) {
   // Per-account fingerprint (viewport + navigator.* + screen) via init script.
   // Sticky residential IP alone still clusters if every session shares the same HW profile.
   const wantFingerprint =
-    opts.profile === "codebuddy-cn" ||
-    opts.randomizeFingerprint === true ||
-    opts.fingerprintSeed != null;
+    !useNativeCloakProfile
+    && (opts.randomizeFingerprint === true || opts.fingerprintSeed != null);
   let fingerprint = null;
   if (wantFingerprint) {
     try {
@@ -434,22 +436,20 @@ export async function createFreshContext(browser, proxy, opts = {}) {
       fingerprint = null;
     }
   }
-  if (!contextOptions.viewport) {
+  if (!contextOptions.viewport && !useNativeCloakProfile) {
     contextOptions.viewport = { width: 1280, height: 900 };
   }
   // Ignore HTTPS errors common through residential proxies / MITM chains
   contextOptions.ignoreHTTPSErrors = true;
 
-  // Regional profile — CodeBuddy CN / Tencent risk engine scores EN-US + CN IP heavily.
-  if (opts.profile === "codebuddy-cn") {
+  if (opts.profile === "codebuddy-cn" && !useNativeCloakProfile) {
     const isChinaMainland = String(opts.region || "").toLowerCase() === "china";
     contextOptions.locale = "zh-CN";
     contextOptions.languages = ["zh-CN", "zh", "en-US", "en"];
     contextOptions.timezoneId = isChinaMainland ? "Asia/Shanghai" : "Asia/Hong_Kong";
-    // Approximate city coords matching default 5sim regions (HK vs mainland)
     contextOptions.geolocation = isChinaMainland
-      ? { longitude: 121.4737, latitude: 31.2304 } // Shanghai
-      : { longitude: 114.1694, latitude: 22.3193 }; // Hong Kong
+      ? { longitude: 121.4737, latitude: 31.2304 }
+      : { longitude: 114.1694, latitude: 22.3193 };
     contextOptions.permissions = ["geolocation"];
     contextOptions.extraHTTPHeaders = {
       ...(contextOptions.extraHTTPHeaders || {}),
@@ -457,6 +457,9 @@ export async function createFreshContext(browser, proxy, opts = {}) {
     };
   }
 
+  // A pasted proxy inherits CloakBrowser's binary-level locale/timezone/WebRTC
+  // profile. Phone country and residential proxy country may legitimately differ.
+
   // Allow callers to override any field
   if (opts.locale) contextOptions.locale = opts.locale;
   if (opts.timezoneId) contextOptions.timezoneId = opts.timezoneId;