zevairouter 1.0.152 → 1.0.154

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -18,6 +18,8 @@
  */
 
 import { randomUUID } from "crypto";
+import fs from "node:fs";
+import path from "node:path";
 import {
   KiroBulkImportManager,
   buildLookupResponse,
@@ -32,6 +34,7 @@ import {
 import { getProxyPools, getProxyPoolById } from "../../../models/index.js";
 import { getSettings } from "../../localDb.js";
 import { getOptimalWorkerCount, getSystemSpecs, isAutoConcurrencyValue } from "../../systemSpecs.js";
+import { redactCredentialText, redactCredentialUrl } from "../../providerConnectionSanitizer.js";
 import { CODEBUDDY_CN_CONFIG } from "../constants/oauth.js";
 import { FiveSimClient, FiveSimTimeoutError } from "./fiveSimClient.js";
 import { runCodeBuddyCnPhoneRegistration } from "./codebuddyCnPhoneAutomation.js";
@@ -89,11 +92,14 @@ const CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS = 5_000;
 const CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS = 12_000;
 const CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS = 6_000;
 const CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN = "CN_API_KEY_OUTCOME_UNKNOWN";
+const CODEBUDDY_CN_API_KEY_RETRY_STOPPED = "CN_API_KEY_AUTOMATIC_RETRY_STOPPED";
 const CODEBUDDY_CN_ACCOUNT_RESTRICTED = "CN_ACCOUNT_RESTRICTED";
 
 // Supported 5sim regions
 const SUPPORTED_REGIONS = new Set(["hongkong", "china", "any"]);
 const DEFAULT_REGION = "hongkong";
+const ACTIVE_CN_JOB_STATUSES = new Set(["queued", "running", "needs_manual"]);
+const ACTIVE_CN_ACCOUNT_STATUSES = new Set(["queued", "running", "needs_manual"]);
 
 // Hard rule: each account buys exactly ONE 5sim number.
 // No prefix cancel/re-order loops — those burned balance when inventory
@@ -111,6 +117,40 @@ function defaultPhoneFormatter(phone) {
   return String(phone || "").trim();
 }
 
+function attachCnManualSession(account, context, page) {
+  account.manualSession = {
+    context,
+    page,
+    opened: false,
+    openedAt: null,
+  };
+  return account.manualSession;
+}
+
+function findLatestPersistedCnJobId(storageDir) {
+  try {
+    const candidates = fs.readdirSync(storageDir)
+      .filter((name) => name.endsWith(".json") && name !== "meta.json")
+      .map((name) => {
+        const filePath = path.join(storageDir, name);
+        try {
+          const snapshot = JSON.parse(fs.readFileSync(filePath, "utf8"));
+          if (!snapshot?.jobId) return null;
+          const createdAt = Date.parse(snapshot.createdAt || "");
+          const sortTime = Number.isFinite(createdAt) ? createdAt : fs.statSync(filePath).mtimeMs;
+          return { jobId: snapshot.jobId, sortTime };
+        } catch {
+          return null;
+        }
+      })
+      .filter(Boolean)
+      .sort((left, right) => right.sortTime - left.sortTime);
+    return candidates[0]?.jobId || null;
+  } catch {
+    return null;
+  }
+}
+
 function isLowMemHost() {
   try {
     const { totalMemGb } = getSystemSpecs();
@@ -133,8 +173,27 @@ function clampCnConcurrency(value) {
   return Math.min(hardMax, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, parsed));
 }
 
-function resolveCnJobConcurrency(value, { manualProxy = false } = {}) {
-  return manualProxy ? 1 : clampCnConcurrency(value);
+function resolveCnJobConcurrency(value, {
+  manualProxy = false,
+  processBoundProxy = false,
+} = {}) {
+  // CloakBrowser applies GeoIP/WebRTC at process scope. Sharing one process
+  // across context proxies leaks the first proxy's fingerprint into later
+  // accounts, so every proxy-bound CN job must recycle sequentially.
+  return manualProxy || processBoundProxy ? 1 : clampCnConcurrency(value);
+}
+
+function requiresIsolatedProxyBrowser(job) {
+  return Boolean(job?.proxyUrls?.length)
+    && ["manual", "all", "single"].includes(job?.proxyPoolMode);
+}
+
+function requireSelectedProxy(proxyPoolMode, proxyUrls) {
+  if (!["all", "single"].includes(proxyPoolMode) || proxyUrls.length > 0) return;
+  const message = proxyPoolMode === "single"
+    ? "Selected proxy is missing or inactive; no automation was started"
+    : "No active proxies are available in the selected pool; no automation was started";
+  throw Object.assign(new Error(message), { error: message, code: "CN_PROXY_SELECTION_EMPTY" });
 }
 
 function parseEgressIp(value) {
@@ -268,6 +327,28 @@ async function withTimeoutCleanup(
   }
 }
 
+function assertAutomaticApiKeyRetrySafe(result, label = "API key request") {
+  const status = Number(result?.status);
+  if (status === 429) {
+    throw Object.assign(
+      new Error(`${label} was rate limited (HTTP 429); automatic POST retries stopped`),
+      { code: CODEBUDDY_CN_API_KEY_RETRY_STOPPED },
+    );
+  }
+  if (Number.isFinite(status) && status >= 500) {
+    throw Object.assign(
+      new Error(`${label} returned HTTP ${status}; creation outcome may be unknown and automatic POST retries stopped`),
+      { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
+    );
+  }
+  return result;
+}
+
+function isApiKeyPostRetryStopped(error) {
+  return error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN
+    || error?.code === CODEBUDDY_CN_API_KEY_RETRY_STOPPED;
+}
+
 function isLoginHtmlProbe(probe) {
   const raw = `${probe?.text || ""} ${probe?.data?._raw || ""} ${probe?.url || ""}`;
   return /<!doctype html|<html|login-pf|\/auth\/realms\//i.test(raw);
@@ -503,6 +584,10 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       });
     });
     super({ browserLauncher: cnBrowserLauncher, storageName });
+    if (!this.latestJobId || !this.readPersistedJob(this.latestJobId)) {
+      this.latestJobId = findLatestPersistedCnJobId(this.storageDir);
+      if (this.latestJobId) this.persistLatestJobId(this.latestJobId);
+    }
     this.requestDeviceCode = requestDeviceCodeFn;
     this.pollToken = pollToken;
     this.fetchLoginAccount = fetchLoginAccountFn;
@@ -537,6 +622,12 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       });
     }
 
+    // Terminalize an interrupted persisted job before checking in-memory work.
+    // CN jobs cannot resume a browser/OTP session safely after process restart.
+    if (this.latestJobId && !this.jobs.has(this.latestJobId)) {
+      this.getJob(this.latestJobId);
+    }
+
     // Block concurrent jobs — double Start / overlapping runs = multiple 5sim buys.
     const activeJob = [...this.jobs.values()].find((j) =>
       j && (j.status === "running" || j.status === "queued" || j.status === "needs_manual") && !j.cancelRequested
@@ -572,13 +663,17 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         proxyUrls = [pool.proxyUrl];
       }
     }
+    if (!manualProxy) requireSelectedProxy(proxyPoolMode, proxyUrls);
 
     const jobId = randomUUID();
     const createdAt = nowIso();
     const job = {
       jobId,
       status: "running",
-      concurrency: resolveCnJobConcurrency(concurrency, { manualProxy: Boolean(manualProxy) }),
+      concurrency: resolveCnJobConcurrency(concurrency, {
+        manualProxy: Boolean(manualProxy),
+        processBoundProxy: proxyUrls.length > 0,
+      }),
       proxyPoolMode: manualProxy ? "manual" : (proxyPoolMode || "none"),
       proxyUrls,
       region: resolvedRegion,
@@ -620,6 +715,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
 
     this.jobs.set(jobId, job);
     this.latestJobId = jobId;
+    this.persistLatestJobId(jobId);
     await this.persistJobSnapshot(job, { forcePreview: false });
     // Note: we skip persistResumeBlob (encrypted vault) since there are no
     // static credentials to resume — each account gets a fresh 5sim number.
@@ -627,15 +723,51 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     return sanitizeCnJob(job);
   }
 
+  buildPersistedSnapshot(job) {
+    return sanitizeCnJob(job, { preview: job.lastPreview || null });
+  }
+
+  terminalizeInterruptedSnapshot(snapshot) {
+    if (!snapshot || !ACTIVE_CN_JOB_STATUSES.has(snapshot.status)) return snapshot;
+    const message =
+      "CodeBuddy CN job was interrupted by a service restart. Browser and OTP sessions cannot be resumed safely; start a new job.";
+    const accounts = (snapshot.accounts || []).map((account) => {
+      if (!ACTIVE_CN_ACCOUNT_STATUSES.has(account.status)) return account;
+      const log = createLogEntry("failed", message, "error");
+      return {
+        ...account,
+        status: "failed",
+        error: message,
+        currentStep: "failed",
+        updatedAt: log.at,
+        manualSessionAvailable: false,
+        logs: [...(account.logs || []), log].slice(-40),
+      };
+    });
+    const terminal = {
+      ...snapshot,
+      status: "failed",
+      error: snapshot.error || message,
+      finishedAt: snapshot.finishedAt || nowIso(),
+      accounts,
+      summary: buildCnSummary(accounts),
+      preview: null,
+    };
+    this.writePersistedJob(snapshot.jobId, terminal);
+    return terminal;
+  }
+
   // Base sanitizeJob only keeps email — CN accounts need phone/order fields in API responses.
   getJob(jobId) {
     const job = this.jobs.get(jobId);
-    return job ? sanitizeCnJob(job) : null;
+    if (job) return sanitizeCnJob(job);
+    const snapshot = this.readPersistedJob(jobId);
+    return snapshot ? this.terminalizeInterruptedSnapshot(snapshot) : null;
   }
 
   async getJobWithPreview(jobId) {
     const job = this.jobs.get(jobId);
-    if (!job) return null;
+    if (!job) return this.getJob(jobId);
     await this.persistJobSnapshot(job, { forcePreview: false });
     return sanitizeCnJob(job, { preview: job.lastPreview || null });
   }
@@ -686,7 +818,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         region: job.region || "hongkong",
         fingerprintSeed: account.fingerprintSeed,
         lowMemory: isLowMemHost(),
-        nativeCloakProfile: job.proxyPoolMode === "manual",
+        nativeCloakProfile: requiresIsolatedProxyBrowser(job) && Boolean(account.proxyUrl),
       });
       const freshContext = await withTimeoutCleanup(contextTask, {
         timeoutMs: CODEBUDDY_CN_CONTEXT_TIMEOUT_MS,
@@ -742,14 +874,16 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       let hardTimer = null;
       const hardTimeoutPromise = new Promise((_, reject) => {
         hardTimer = setTimeout(() => {
-          reject(
-            Object.assign(
-              new Error(
-                `CodeBuddy CN account hard timeout after ${Math.round(hardTimeoutMs / 1000)}s (browser will be force-closed)`,
-              ),
-              { code: "CN_ACCOUNT_HARD_TIMEOUT" },
+          const timeoutError = Object.assign(
+            new Error(
+              `CodeBuddy CN account hard timeout after ${Math.round(hardTimeoutMs / 1000)}s (browser will be force-closed)`,
             ),
+            { code: "CN_ACCOUNT_HARD_TIMEOUT" },
           );
+          if (account.abortController && !account.abortController.signal.aborted) {
+            account.abortController.abort(timeoutError);
+          }
+          reject(timeoutError);
         }, hardTimeoutMs);
         if (typeof hardTimer.unref === "function") hardTimer.unref();
       });
@@ -792,6 +926,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
                 country: job.region,
                 product: "codebuddy",
                 allowProductFallback: false,
+                signal: account.abortController?.signal,
               });
               fiveSimOrderId = numberData.id;
               account.phone = numberData.phone;
@@ -867,13 +1002,16 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     } catch (error) {
       // SMS timeout (60s, no OTP) → BAN the number (bad number that doesn't receive CodeBuddy SMS)
       const isSmsTimeout = error instanceof FiveSimTimeoutError;
-      const failReason = isSmsTimeout
-        ? `SMS OTP not received within ${CODEBUDDY_CN_SMS_TIMEOUT_MS / 1000}s — number banned`
-        : (error.message || "Unexpected CodeBuddy CN bulk import failure");
-
-      this.finalizeAccount(account, "failed", {
+      const cancelled = job.cancelRequested || error?.code === "JOB_CANCELLED";
+      const failReason = cancelled
+        ? "Job cancelled"
+        : isSmsTimeout
+          ? `SMS OTP not received within ${CODEBUDDY_CN_SMS_TIMEOUT_MS / 1000}s — number banned`
+          : (error.message || "Unexpected CodeBuddy CN bulk import failure");
+
+      this.finalizeAccount(account, cancelled ? "cancelled" : "failed", {
         error: failReason,
-        step: isSmsTimeout ? "sms_timeout" : "failed",
+        step: cancelled ? "cancelled" : isSmsTimeout ? "sms_timeout" : "failed",
         message: failReason,
       });
       // 5sim hygiene on error
@@ -920,6 +1058,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
    */
   async captureApiKey(job, account, context, page, fiveSimClient, fiveSimOrderId) {
     const PERSONAL_ENTERPRISE_ID = "personal-edition-user-id";
+    let capturedApiKey = null;
 
     // Tiny event-driven poller — replaces multi-second blind sleeps.
     const waitUntil = async (checkFn, { timeout = 12_000, interval = 150 } = {}) => {
@@ -1288,7 +1427,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
             { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
           );
         }
-        return result;
+        return assertAutomaticApiKeyRetrySafe(result, label);
       };
 
       // Always open keys page first (SPA hydrates CSRF / host-key there).
@@ -1382,6 +1521,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
           { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
         );
       }
+      capturedApiKey = apiKey;
 
       this.setAccountStep(account, "api_key_created", `API key created successfully`);
       await this.persistJobSnapshot(job, { forcePreview: true });
@@ -1415,6 +1555,8 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       // create the key manually in the opened browser — number is NOT re-bought.
       const restricted = error?.code === CODEBUDDY_CN_ACCOUNT_RESTRICTED;
       const outcomeUnknown = error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN;
+      const retryStopped = error?.code === CODEBUDDY_CN_API_KEY_RETRY_STOPPED;
+      const automaticPostStopped = outcomeUnknown || retryStopped;
       if (restricted) {
         this.finalizeAccount(account, "failed_restricted", {
           error: `${error.message}. Use a different residential CN/HK proxy with concurrency 1.`,
@@ -1430,27 +1572,48 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       const failureMessage = outcomeUnknown
         ? `${error.message}. Check the CodeBuddy keys page before creating another key.`
         : error.message;
+      if (!automaticPostStopped) {
+        attachCnManualSession(account, context, page);
+      }
       this.finalizeAccount(account, "needs_manual", {
         error: `Registration succeeded but API key capture failed: ${failureMessage}`,
-        step: outcomeUnknown ? "api_key_outcome_unknown" : "awaiting_manual",
+        step: outcomeUnknown
+          ? "api_key_outcome_unknown"
+          : retryStopped
+            ? "api_key_retry_stopped"
+            : "awaiting_manual",
         message: outcomeUnknown
           ? `Registration done; API key request outcome is unknown. Check existing keys before retrying.`
-          : `Registration done, API key capture failed: ${error.message}`,
+          : retryStopped
+            ? "Registration done; API key request was rate limited. Automatic POST retries stopped."
+          : capturedApiKey
+            ? `API key captured; retrying local connection save without creating another key: ${error.message}`
+            : `Registration done, API key capture failed: ${error.message}`,
       });
       // The 5sim order was successful (SMS received) — finish it (no re-order)
       await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
       await this.persistJobSnapshot(job, { forcePreview: true });
 
-      if (outcomeUnknown) {
+      if (automaticPostStopped) {
         // Closing the page aborts any late browser work. Automatic/manual POST
-        // retries are intentionally disabled because the key may already exist.
+        // retries are disabled because the key may exist or the API is throttling.
         account.runtimeSession = null;
         await closeContextOrBrowser(context, job);
         return;
       }
 
-      // Start manual followup for API key capture (reuse same browser session)
-      await this.runCnManualFollowup(job, account, account.workerId, context, page, fiveSimClient, fiveSimOrderId);
+      // Expose the live page through the inherited manual-session endpoint while
+      // the bounded follow-up waits for the operator to finish captcha/login.
+      await this.runCnManualFollowup(
+        job,
+        account,
+        account.workerId,
+        context,
+        page,
+        fiveSimClient,
+        fiveSimOrderId,
+        capturedApiKey,
+      );
     }
   }
 
@@ -1458,7 +1621,16 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
    * Manual followup — operator completes registration/captcha/API-key creation in a
    * headed browser. We wait for the operator to finish, then try to capture the API key.
    */
-  async runCnManualFollowup(job, account, workerId, context, page, fiveSimClient, fiveSimOrderId) {
+  async runCnManualFollowup(
+    job,
+    account,
+    workerId,
+    context,
+    page,
+    fiveSimClient,
+    fiveSimOrderId,
+    existingApiKey = null,
+  ) {
     const followupPromise = (async () => {
       const closeManualResources = async () => {
         const ms = account.manualSession;
@@ -1477,10 +1649,12 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
           ? CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS
           : CODEBUDDY_CN_MANUAL_TIMEOUT_MS;
         const deadline = Date.now() + manualTimeoutMs;
-        let apiKey = null;
+        let apiKey = typeof existingApiKey === "string" && existingApiKey
+          ? existingApiKey
+          : null;
         const manualApiKeyName = `zevai-router-manual-${account.workerId || "account"}-${Date.now()}`;
 
-        while (Date.now() < deadline && !job.cancelRequested) {
+        while (!apiKey && Date.now() < deadline && !job.cancelRequested) {
           await new Promise((r) => setTimeout(r, 10_000)); // Check every 10s
 
           // Check if the operator has navigated to the keys page and we can create a key
@@ -1542,6 +1716,8 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
               );
             }
 
+            assertAutomaticApiKeyRetrySafe(result, "Manual API key request");
+
             if (result?.ok) {
               const payload = result.data?.data || result.data;
               apiKey =
@@ -1558,7 +1734,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
               );
             }
           } catch (error) {
-            if (error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN) throw error;
+            if (isApiKeyPostRetryStopped(error)) throw error;
             // Operator might still be completing — keep waiting
           }
         }
@@ -1602,11 +1778,13 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
             step: "cancelled",
             message: "Job cancelled while waiting for manual completion",
           });
-        } else if (error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN) {
+        } else if (isApiKeyPostRetryStopped(error)) {
           this.finalizeAccount(account, "needs_manual", {
-            error: `${error.message}. Check existing CodeBuddy keys before retrying.`,
-            step: "api_key_outcome_unknown",
-            message: "Manual API key request outcome is unknown; automatic retries stopped",
+            error: `${error.message}. Check existing CodeBuddy keys before retrying manually.`,
+            step: error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN
+              ? "api_key_outcome_unknown"
+              : "api_key_retry_stopped",
+            message: "Manual API key POST retries stopped",
           });
         } else {
           this.finalizeAccount(account, "failed", {
@@ -1629,12 +1807,12 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
   }
 
   /**
-   * A pasted proxy is intentionally single-worker. Recycle the whole CloakBrowser
-   * process between accounts so its binary fingerprint and GeoIP profile cannot
-   * leak from one registration into the next.
+   * Proxy-bound CN jobs are intentionally single-worker. Recycle the whole
+   * CloakBrowser process between accounts so the binary GeoIP/WebRTC profile
+   * always belongs to the same proxy as the account context.
    */
   async runWorker(job, workerId) {
-    if (job.proxyPoolMode !== "manual") {
+    if (!requiresIsolatedProxyBrowser(job)) {
       return super.runWorker(job, workerId);
     }
 
@@ -1684,6 +1862,10 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     }
   }
 
+  shouldPrelaunchBrowser(job) {
+    return !requiresIsolatedProxyBrowser(job);
+  }
+
   /**
    * Override cancelJob to abort in-flight 5sim polls AND force-close the browser.
    * Previous CN override only aborted controllers — Chromium kept spinning (VPS hang).
@@ -1694,17 +1876,36 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
 
     job.cancelRequested = true;
 
-    // Abort in-flight 5sim polls + close per-account contexts
+    // Abort in-flight 5sim polls and capture every live resource before the
+    // session fields are cleared. Manual assist may have relaunched a separate
+    // headed browser that is not the job browser.
     for (const account of job.accounts) {
       if (account.abortController && !account.abortController.signal.aborted) {
         account.abortController.abort();
       }
-      const ctx = account.runtimeSession?.context;
-      if (ctx) {
-        void ctx.close().catch(() => null);
-      }
+      const manualSession = account.manualSession;
+      const runtimeSession = account.runtimeSession;
+      const contexts = new Set([
+        manualSession?.context,
+        runtimeSession?.context,
+      ].filter(Boolean));
+      const ownedBrowsers = new Set([
+        manualSession?.headedBrowser,
+        manualSession?.ownedBrowser,
+      ].filter(Boolean));
+      void Promise.allSettled([
+        ...[...contexts].map((context) => closeResourceBounded(context)),
+        ...[...ownedBrowsers].map((browser) => forceCloseBrowser(browser)),
+      ]);
       account.runtimeSession = null;
       account.manualSession = null;
+      if (ACTIVE_CN_ACCOUNT_STATUSES.has(account.status)) {
+        this.finalizeAccount(account, "cancelled", {
+          error: "Job cancelled",
+          step: "cancelled",
+          message: "Job cancelled by user",
+        });
+      }
     }
 
     // CRITICAL: force-kill Chromium. Graceful close alone hangs when nav is stuck.
@@ -1714,12 +1915,9 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       void forceCloseBrowser(browser).catch(() => null);
     }
 
-    if (job.status === "queued") {
+    if (ACTIVE_CN_JOB_STATUSES.has(job.status)) {
       job.status = "cancelled";
-      job.finishedAt = nowIso();
-      job.accounts.forEach((account) => {
-        if (account.status === "queued") account.status = "cancelled";
-      });
+      job.finishedAt = job.finishedAt || nowIso();
     }
 
     void this.persistJobSnapshot(job, { forcePreview: true });
@@ -1782,7 +1980,7 @@ function sanitizeCnJob(job, extras = {}) {
     createdAt: job.createdAt,
     startedAt: job.startedAt,
     finishedAt: job.finishedAt,
-    error: job.error,
+    error: redactCredentialText(job.error),
     cancelRequested: job.cancelRequested,
     accounts: (job.accounts || []).map((account) => ({
       line: account.line,
@@ -1794,13 +1992,16 @@ function sanitizeCnJob(job, extras = {}) {
       proxyTimezone: account.proxyTimezone || null,
       proxyLocale: account.proxyLocale || null,
       status: account.status,
-      error: account.error,
+      error: redactCredentialText(account.error),
       connectionId: account.connectionId,
       workerId: account.workerId,
       manualSessionAvailable: !!account.manualSession,
       currentStep: account.currentStep,
       updatedAt: account.updatedAt,
-      logs: account.logs || [],
+      logs: (account.logs || []).map((entry) => ({
+        ...entry,
+        message: redactCredentialText(entry.message),
+      })),
     })),
     preview: extras.preview !== undefined ? extras.preview : (job.lastPreview || null),
     ...extras,
@@ -1809,14 +2010,18 @@ function sanitizeCnJob(job, extras = {}) {
 
 function maskProxyUrl(url) {
   if (!url) return null;
+  const raw = String(url);
+  const maskMalformed = () => raw.length > 20
+    ? `${raw.slice(0, 10)}***${raw.slice(-10)}`
+    : "***";
   try {
-    const parsed = new URL(url);
-    if (parsed.password) {
-      parsed.password = "***";
+    const parsed = new URL(raw);
+    if (!/^(https?|socks4|socks5):$/.test(parsed.protocol)) {
+      return maskMalformed();
     }
-    return parsed.toString();
+    return redactCredentialUrl(raw);
   } catch {
-    return url;
+    return maskMalformed();
   }
 }
 
@@ -1848,6 +2053,9 @@ export {
 export const __test__ = {
   clampCnConcurrency,
   resolveCnJobConcurrency,
+  requiresIsolatedProxyBrowser,
+  requireSelectedProxy,
+  assertAutomaticApiKeyRetrySafe,
   sanitizeCnJob,
   defaultPhoneFormatter,
   defaultSaveCodeBuddyCnConnection,
@@ -1860,6 +2068,8 @@ export const __test__ = {
   probeCodeBuddyConsoleAccounts,
   requireStableProxyEgress,
   withTimeoutCleanup,
+  attachCnManualSession,
+  findLatestPersistedCnJobId,
   AUTOMATION_LIMITS: {
     registrationHardTimeoutMs: CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS,
     browserLaunchTimeoutMs: CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS,