zevairouter 1.0.149 → 1.0.151

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -40,7 +40,12 @@ import {
   defaultPollForToken,
   fetchCodeBuddyLoginAccount,
 } from "./codebuddyBulkImportManager.js";
-import { forceCloseBrowser } from "./bulkImportBrowserEngine.js";
+import {
+  forceCloseBrowser,
+  getCloakProxyProfile,
+  parseProxyEgressIp,
+  PROXY_EGRESS_ECHO_URLS,
+} from "./bulkImportBrowserEngine.js";
 
 const CODEBUDDY_CN_PROVIDER_ID = "codebuddy-cn";
 const CODEBUDDY_CN_LABEL = "CodeBuddy CN";
@@ -82,6 +87,7 @@ const CODEBUDDY_CN_MANUAL_TIMEOUT_MS = 8 * 60_000;
 const CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS = 3 * 60_000;
 const CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS = 5_000;
 const CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS = 12_000;
+const CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS = 6_000;
 const CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN = "CN_API_KEY_OUTCOME_UNKNOWN";
 const CODEBUDDY_CN_ACCOUNT_RESTRICTED = "CN_ACCOUNT_RESTRICTED";
 
@@ -127,6 +133,105 @@ function clampCnConcurrency(value) {
   return Math.min(hardMax, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, parsed));
 }
 
+function resolveCnJobConcurrency(value, { manualProxy = false } = {}) {
+  return manualProxy ? 1 : clampCnConcurrency(value);
+}
+
+function parseEgressIp(value) {
+  return parseProxyEgressIp(value);
+}
+
+async function probeCodeBuddyProxyEgress(
+  context,
+  { timeoutMs = CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS } = {},
+) {
+  let requestContext = null;
+  try {
+    requestContext = context?.request || null;
+  } catch {
+    requestContext = null;
+  }
+  if (!requestContext || typeof requestContext.get !== "function") {
+    return { ok: false, ip: null, ips: [], samples: 0, error: "context request unavailable" };
+  }
+
+  const attemptedUrls = [];
+  let lastError = null;
+  for (const url of PROXY_EGRESS_ECHO_URLS) {
+    attemptedUrls.push(url);
+    let response = null;
+    try {
+      response = await requestContext.get(url, {
+        timeout: timeoutMs,
+        failOnStatusCode: false,
+        headers: {
+          Accept: "text/plain, application/json;q=0.9, */*;q=0.1",
+          "Cache-Control": "no-cache",
+        },
+      });
+      if (response.status() < 200 || response.status() >= 300) {
+        lastError = `HTTP ${response.status()}`;
+        continue;
+      }
+      const ip = parseEgressIp(await response.text().catch(() => ""));
+      if (!ip) {
+        lastError = "exit-IP response was not recognized";
+        continue;
+      }
+      return {
+        ok: true,
+        ip,
+        ips: [ip],
+        samples: 1,
+        attempts: attemptedUrls.length,
+        attemptedUrls,
+        unstable: false,
+        error: null,
+      };
+    } catch (error) {
+      lastError = error?.name === "TimeoutError"
+        ? `timed out after ${timeoutMs}ms`
+        : "request failed";
+    } finally {
+      if (typeof response?.dispose === "function") {
+        await Promise.resolve(response.dispose()).catch(() => null);
+      }
+    }
+  }
+  return {
+    ok: false,
+    ip: null,
+    ips: [],
+    samples: 0,
+    attempts: attemptedUrls.length,
+    attemptedUrls,
+    unstable: false,
+    error: lastError || "all exit-IP services failed",
+  };
+}
+
+function requireStableProxyEgress(probe, expectedIp = null) {
+  if (probe?.unstable) {
+    throw Object.assign(
+      new Error("Manual proxy rotated between exit IPs during preflight; no phone number was purchased"),
+      { code: "CN_PROXY_EGRESS_UNSTABLE" },
+    );
+  }
+  if (!probe?.ok || !probe?.ip) {
+    throw Object.assign(
+      new Error(`Manual proxy exit IP could not be verified (${probe?.error || "no response"}); no phone number was purchased`),
+      { code: "CN_PROXY_EGRESS_UNVERIFIED" },
+    );
+  }
+  if (expectedIp && probe.ip !== expectedIp) {
+    throw Object.assign(
+      new Error("Manual proxy exit IP changed after CloakBrowser GeoIP alignment; no phone number was purchased"),
+      { code: "CN_PROXY_EGRESS_CHANGED" },
+    );
+  }
+  return probe.ip;
+}
+
 async function withTimeoutCleanup(
   task,
   {
@@ -388,6 +493,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         proxyUrl,
         headless,
         windowSize: { width: 1280, height: 900 },
+        requireProxyGeoip: job?.proxyPoolMode === "manual" && Boolean(proxyUrl),
       });
       return withTimeoutCleanup(launchTask, {
         timeoutMs: CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS,
@@ -472,7 +578,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     const job = {
       jobId,
       status: "running",
-      concurrency: clampCnConcurrency(concurrency),
+      concurrency: resolveCnJobConcurrency(concurrency, { manualProxy: Boolean(manualProxy) }),
       proxyPoolMode: manualProxy ? "manual" : (proxyPoolMode || "none"),
       proxyUrls,
       region: resolvedRegion,
@@ -496,6 +602,9 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         // Unique Chromium fingerprint seed per account (viewport/HW/screen noise).
         fingerprintSeed: randomUUID(),
         proxyUrl: null,
+        egressIp: null,
+        proxyTimezone: null,
+        proxyLocale: null,
         abortController: new AbortController(),
         status: "queued",
         error: null,
@@ -544,6 +653,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     let fiveSimOrderId = null;
     let smsReceived = false;
     let context = null;
+    let verifiedEgressIp = null;
 
     try {
       // Step 1: Get 5sim API key from settings
@@ -569,16 +679,14 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // Step 2: Create browser context FIRST — if proxy/browser fails, we never buy a number.
       this.setAccountStep(account, "creating_browser", "Creating browser context (before 5sim order)");
       await this.persistJobSnapshot(job, { forcePreview: true });
-      // CloakBrowser stack: zh-CN locale + HK/CN timezone so Tencent risk
-      // scoring does not see EN-US browser on residential CN/HK egress (common
-      // cause of 账号访问受限 right after OTP). Per-account fingerprint seed —
-      // sticky residential IP alone still clusters if every session shares HW.
-      if (!account.fingerprintSeed) account.fingerprintSeed = randomUUID();
+      // CloakBrowser owns the process-wide fingerprint, timezone, locale, and
+      // WebRTC profile. Playwright context overrides would reintroduce CDP tells.
       const contextTask = createFreshContext(job.browser, account.proxyUrl, {
         profile: "codebuddy-cn",
         region: job.region || "hongkong",
         fingerprintSeed: account.fingerprintSeed,
         lowMemory: isLowMemHost(),
+        nativeCloakProfile: job.proxyPoolMode === "manual",
       });
       const freshContext = await withTimeoutCleanup(contextTask, {
         timeoutMs: CODEBUDDY_CN_CONTEXT_TIMEOUT_MS,
@@ -590,6 +698,27 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       const page = freshContext.page;
       account.runtimeSession = { context, page };
 
+      if (job.proxyPoolMode === "manual" && account.proxyUrl) {
+        this.setAccountStep(
+          account,
+          "checking_proxy_egress",
+          "Verifying pasted proxy exit IP before opening the registration form",
+        );
+        await this.persistJobSnapshot(job, { forcePreview: false });
+        const launchProfile = getCloakProxyProfile(job.browser);
+        const egressProbe = await probeCodeBuddyProxyEgress(context);
+        verifiedEgressIp = requireStableProxyEgress(egressProbe, launchProfile?.egressIp || null);
+        account.egressIp = verifiedEgressIp;
+        account.proxyTimezone = launchProfile?.timezone || null;
+        account.proxyLocale = launchProfile?.locale || null;
+        this.setAccountStep(
+          account,
+          "proxy_egress_ready",
+          `Manual proxy verified: ${verifiedEgressIp} (${egressProbe.samples} checks, ${account.proxyTimezone || "timezone unknown"}, ${account.proxyLocale || "locale unknown"})`,
+        );
+        await this.persistJobSnapshot(job, { forcePreview: false });
+      }
+
       if (job.cancelRequested) {
         throw new Error("Job cancelled before ordering phone number");
       }
@@ -636,6 +765,22 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
               if (job.cancelRequested) {
                 throw new Error("Job cancelled before ordering phone number");
               }
+              if (job.proxyPoolMode === "manual" && account.proxyUrl) {
+                this.setAccountStep(
+                  account,
+                  "rechecking_proxy_egress",
+                  "Registration form is ready — confirming the pasted proxy stayed sticky",
+                );
+                await this.persistJobSnapshot(job, { forcePreview: false });
+                const secondProbe = await probeCodeBuddyProxyEgress(context);
+                requireStableProxyEgress(secondProbe, verifiedEgressIp);
+                this.setAccountStep(
+                  account,
+                  "proxy_egress_confirmed",
+                  `Manual proxy remained on ${verifiedEgressIp}; safe to purchase one phone number`,
+                );
+                await this.persistJobSnapshot(job, { forcePreview: false });
+              }
               this.setAccountStep(
                 account,
                 "ordering_number",
@@ -1483,6 +1628,62 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     job.manualFollowups.add(followupPromise);
   }
 
+  /**
+   * A pasted proxy is intentionally single-worker. Recycle the whole CloakBrowser
+   * process between accounts so its binary fingerprint and GeoIP profile cannot
+   * leak from one registration into the next.
+   */
+  async runWorker(job, workerId) {
+    if (job.proxyPoolMode !== "manual") {
+      return super.runWorker(job, workerId);
+    }
+
+    while (!job.cancelRequested) {
+      const account = this.dequeueAccount(job, workerId);
+      if (!account) return;
+
+      if (!job.browser) {
+        try {
+          job.browser = await this.browserLauncher({
+            ...job,
+            proxyUrls: account.proxyUrl ? [account.proxyUrl] : job.proxyUrls,
+          });
+        } catch (error) {
+          this.finalizeAccount(account, "failed", {
+            error: error?.message || "Manual proxy browser launch failed",
+            step: "failed",
+            message: error?.message || "Manual proxy browser launch failed",
+          });
+          await this.persistJobSnapshot(job, { forcePreview: true });
+          continue;
+        }
+      }
+
+      try {
+        await this.processAccount(job, account, workerId);
+      } catch (error) {
+        if (account.status === "running") {
+          this.finalizeAccount(account, "failed", {
+            error: error?.message || "Unexpected manual proxy worker failure",
+            step: "failed",
+            message: error?.message || "Unexpected manual proxy worker failure",
+          });
+          await this.persistJobSnapshot(job, { forcePreview: true });
+        }
+      } finally {
+        if (job.manualFollowups.size > 0) {
+          await Promise.allSettled([...job.manualFollowups]);
+        }
+
+        if (job.browser) {
+          const browser = job.browser;
+          job.browser = null;
+          await forceCloseBrowser(browser).catch(() => null);
+        }
+      }
+    }
+  }
+
   /**
    * Override cancelJob to abort in-flight 5sim polls AND force-close the browser.
    * Previous CN override only aborted controllers — Chromium kept spinning (VPS hang).
@@ -1589,6 +1790,9 @@ function sanitizeCnJob(job, extras = {}) {
       phone: account.phone,
       fiveSimOrderId: account.fiveSimOrderId,
       proxyUrl: account.proxyUrl ? maskProxyUrl(account.proxyUrl) : null,
+      egressIp: account.egressIp || null,
+      proxyTimezone: account.proxyTimezone || null,
+      proxyLocale: account.proxyLocale || null,
       status: account.status,
       error: account.error,
       connectionId: account.connectionId,
@@ -1643,14 +1847,18 @@ export {
 
 export const __test__ = {
   clampCnConcurrency,
+  resolveCnJobConcurrency,
   sanitizeCnJob,
   defaultPhoneFormatter,
   defaultSaveCodeBuddyCnConnection,
   buildCnSummary,
   hasRestrictedConsoleEvidence,
   isLoginHtmlProbe,
+  parseEgressIp,
   parseConsoleProbeBody,
+  probeCodeBuddyProxyEgress,
   probeCodeBuddyConsoleAccounts,
+  requireStableProxyEgress,
   withTimeoutCleanup,
   AUTOMATION_LIMITS: {
     registrationHardTimeoutMs: CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS,
@@ -1665,5 +1873,6 @@ export const __test__ = {
     lowMemoryManualTimeoutMs: CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS,
     resourceCloseTimeoutMs: CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS,
     fiveSimSettleTimeoutMs: CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS,
+    egressProbeTimeoutMs: CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS,
   },
 };

package/src/lib/oauth/services/kiroBulkImportManager.js

@@ -384,10 +384,13 @@ export { parsePlaywrightProxy };
  * @param {"hongkong"|"china"|string} [opts.region]  Used by codebuddy-cn profile
  * @param {string|number} [opts.fingerprintSeed]  Per-account seed for viewport/HW fingerprint
  * @param {boolean} [opts.randomizeFingerprint]   Force fingerprint even outside codebuddy-cn
+ * @param {boolean} [opts.nativeCloakProfile]     Keep CloakBrowser's binary profile untouched
  */
 export async function createFreshContext(browser, proxy, opts = {}) {
   let effectiveProxy = proxy;
   let socksBridge = null;
+  const useNativeCloakProfile =
+    opts.profile === "codebuddy-cn" && opts.nativeCloakProfile === true;
 
   // Chromium cannot authenticate SOCKS5 — bridge to local HTTP proxy first
   if (proxy) {
@@ -406,9 +409,8 @@ export async function createFreshContext(browser, proxy, opts = {}) {
   // Per-account fingerprint (viewport + navigator.* + screen) via init script.
   // Sticky residential IP alone still clusters if every session shares the same HW profile.
   const wantFingerprint =
-    opts.profile === "codebuddy-cn" ||
-    opts.randomizeFingerprint === true ||
-    opts.fingerprintSeed != null;
+    !useNativeCloakProfile
+    && (opts.randomizeFingerprint === true || opts.fingerprintSeed != null);
   let fingerprint = null;
   if (wantFingerprint) {
     try {
@@ -434,22 +436,20 @@ export async function createFreshContext(browser, proxy, opts = {}) {
       fingerprint = null;
     }
   }
-  if (!contextOptions.viewport) {
+  if (!contextOptions.viewport && !useNativeCloakProfile) {
     contextOptions.viewport = { width: 1280, height: 900 };
   }
   // Ignore HTTPS errors common through residential proxies / MITM chains
   contextOptions.ignoreHTTPSErrors = true;
 
-  // Regional profile — CodeBuddy CN / Tencent risk engine scores EN-US + CN IP heavily.
-  if (opts.profile === "codebuddy-cn") {
+  if (opts.profile === "codebuddy-cn" && !useNativeCloakProfile) {
     const isChinaMainland = String(opts.region || "").toLowerCase() === "china";
     contextOptions.locale = "zh-CN";
     contextOptions.languages = ["zh-CN", "zh", "en-US", "en"];
     contextOptions.timezoneId = isChinaMainland ? "Asia/Shanghai" : "Asia/Hong_Kong";
-    // Approximate city coords matching default 5sim regions (HK vs mainland)
     contextOptions.geolocation = isChinaMainland
-      ? { longitude: 121.4737, latitude: 31.2304 } // Shanghai
-      : { longitude: 114.1694, latitude: 22.3193 }; // Hong Kong
+      ? { longitude: 121.4737, latitude: 31.2304 }
+      : { longitude: 114.1694, latitude: 22.3193 };
     contextOptions.permissions = ["geolocation"];
     contextOptions.extraHTTPHeaders = {
       ...(contextOptions.extraHTTPHeaders || {}),
@@ -457,6 +457,9 @@ export async function createFreshContext(browser, proxy, opts = {}) {
     };
   }
 
+  // A pasted proxy inherits CloakBrowser's binary-level locale/timezone/WebRTC
+  // profile. Phone country and residential proxy country may legitimately differ.
+
   // Allow callers to override any field
   if (opts.locale) contextOptions.locale = opts.locale;
   if (opts.timezoneId) contextOptions.timezoneId = opts.timezoneId;