zevairouter 1.0.154 → 1.0.155

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -1,2088 +0,0 @@
-/**
- * CodeBuddy CN (Tencent Cloud Code Assistant) Bulk Import Manager.
- *
- * Extends KiroBulkImportManager to provide bulk phone-number auto-registration
- * for CodeBuddy CN accounts via the 5sim.net SMS verification service.
- *
- * Unlike the global CodeBuddy manager (which uses Google/GSuite login), this
- * manager registers accounts using virtual phone numbers:
- *   1. Order a phone number from 5sim (default region: Hong Kong / +852)
- *   2. Drive Playwright to complete phone registration at www.codebuddy.cn
- *   3. After registration, initiate device-code OAuth in the same session
- *   4. Capture the OAuth token and save the provider connection
- *
- * Token-capture sequencing (key difference from global):
- *   The device-code flow is initiated AFTER phone registration completes
- *   (the browser must hold a logged-in session before navigating to the
- *   device authorization URL).
- */
-
-import { randomUUID } from "crypto";
-import fs from "node:fs";
-import path from "node:path";
-import {
-  KiroBulkImportManager,
-  buildLookupResponse,
-  createFreshContext,
-  createLogEntry,
-  clampConcurrency,
-  nowIso,
-  KIRO_BULK_IMPORT_DEFAULT_CONCURRENCY,
-  KIRO_BULK_IMPORT_MAX_CONCURRENCY,
-  KIRO_BULK_IMPORT_MIN_CONCURRENCY,
-} from "./kiroBulkImportManager.js";
-import { getProxyPools, getProxyPoolById } from "../../../models/index.js";
-import { getSettings } from "../../localDb.js";
-import { getOptimalWorkerCount, getSystemSpecs, isAutoConcurrencyValue } from "../../systemSpecs.js";
-import { redactCredentialText, redactCredentialUrl } from "../../providerConnectionSanitizer.js";
-import { CODEBUDDY_CN_CONFIG } from "../constants/oauth.js";
-import { FiveSimClient, FiveSimTimeoutError } from "./fiveSimClient.js";
-import { runCodeBuddyCnPhoneRegistration } from "./codebuddyCnPhoneAutomation.js";
-import {
-  defaultRequestDeviceCode,
-  defaultPollForToken,
-  fetchCodeBuddyLoginAccount,
-} from "./codebuddyBulkImportManager.js";
-import {
-  forceCloseBrowser,
-  getCloakProxyProfile,
-  parseProxyEgressIp,
-  PROXY_EGRESS_ECHO_URLS,
-} from "./bulkImportBrowserEngine.js";
-
-const CODEBUDDY_CN_PROVIDER_ID = "codebuddy-cn";
-const CODEBUDDY_CN_LABEL = "CodeBuddy CN";
-const CODEBUDDY_CN_DOMAIN = "www.codebuddy.cn";
-
-// Default concurrency 1 to keep Chromium responsive on a 2GB VPS.
-const CODEBUDDY_CN_DEFAULT_CONCURRENCY = 1;
-const CODEBUDDY_CN_MAX_CONCURRENCY = 8;
-const CODEBUDDY_CN_MIN_CONCURRENCY = 1;
-// Hosts under this RAM hard-cap concurrency at 1 (typical cheap VPS = 1.9–2GB).
-const CODEBUDDY_CN_LOW_MEM_GB = 3;
-
-// Cap on count per job (bound cost/rate)
-const CODEBUDDY_CN_MAX_COUNT = 200;
-
-// Device-code poll timeout (15 min — same as global)
-const CODEBUDDY_CN_POLL_TIMEOUT_MS = 15 * 60_000;
-
-// SMS OTP timeout — if no SMS code arrives within 90s, ban the number immediately.
-// 90s = 60s target + 30s buffer for automation overhead (navigate, select country,
-// input phone, click send code takes ~15-20s before SMS is actually requested).
-const CODEBUDDY_CN_SMS_TIMEOUT_MS = 90_000;
-
-// Hard wall-clock for phone registration (nav + form + SMS). Console/API work
-// has separate bounded operations below.
-const CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS = Number.parseInt(
-  process.env.ZEVAI_CN_ACCOUNT_TIMEOUT_MS || "",
-  10,
-) || 5 * 60_000;
-
-const CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS = 90_000;
-const CODEBUDDY_CN_CONTEXT_TIMEOUT_MS = 30_000;
-const CODEBUDDY_CN_CONSOLE_NAV_TIMEOUT_MS = 18_000;
-const CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS = 10_000;
-const CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS = 60_000;
-const CODEBUDDY_CN_OIDC_MAX_ATTEMPTS = 6;
-const CODEBUDDY_CN_API_REHANDOFF_ROUNDS = 2;
-const CODEBUDDY_CN_MANUAL_TIMEOUT_MS = 8 * 60_000;
-const CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS = 3 * 60_000;
-const CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS = 5_000;
-const CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS = 12_000;
-const CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS = 6_000;
-const CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN = "CN_API_KEY_OUTCOME_UNKNOWN";
-const CODEBUDDY_CN_API_KEY_RETRY_STOPPED = "CN_API_KEY_AUTOMATIC_RETRY_STOPPED";
-const CODEBUDDY_CN_ACCOUNT_RESTRICTED = "CN_ACCOUNT_RESTRICTED";
-
-// Supported 5sim regions
-const SUPPORTED_REGIONS = new Set(["hongkong", "china", "any"]);
-const DEFAULT_REGION = "hongkong";
-const ACTIVE_CN_JOB_STATUSES = new Set(["queued", "running", "needs_manual"]);
-const ACTIVE_CN_ACCOUNT_STATUSES = new Set(["queued", "running", "needs_manual"]);
-
-// Hard rule: each account buys exactly ONE 5sim number.
-// No prefix cancel/re-order loops — those burned balance when inventory
-// returned non-[52,54,57] prefixes (historically up to 15 buys per account).
-
-/**
- * Default phone formatter: strip the leading "+" for forms that expect
- * the number without the international prefix symbol.
- * The form may want just digits or the local portion; this can be overridden
- * via the `phoneFormatter` constructor option.
- */
-function defaultPhoneFormatter(phone) {
-  // 5sim returns "+852XXXXXXXX" — keep the full E.164 format; the automation
-  // module's parsePhoneNumber() will split it into country code + local number.
-  return String(phone || "").trim();
-}
-
-function attachCnManualSession(account, context, page) {
-  account.manualSession = {
-    context,
-    page,
-    opened: false,
-    openedAt: null,
-  };
-  return account.manualSession;
-}
-
-function findLatestPersistedCnJobId(storageDir) {
-  try {
-    const candidates = fs.readdirSync(storageDir)
-      .filter((name) => name.endsWith(".json") && name !== "meta.json")
-      .map((name) => {
-        const filePath = path.join(storageDir, name);
-        try {
-          const snapshot = JSON.parse(fs.readFileSync(filePath, "utf8"));
-          if (!snapshot?.jobId) return null;
-          const createdAt = Date.parse(snapshot.createdAt || "");
-          const sortTime = Number.isFinite(createdAt) ? createdAt : fs.statSync(filePath).mtimeMs;
-          return { jobId: snapshot.jobId, sortTime };
-        } catch {
-          return null;
-        }
-      })
-      .filter(Boolean)
-      .sort((left, right) => right.sortTime - left.sortTime);
-    return candidates[0]?.jobId || null;
-  } catch {
-    return null;
-  }
-}
-
-function isLowMemHost() {
-  try {
-    const { totalMemGb } = getSystemSpecs();
-    return Number.isFinite(totalMemGb) && totalMemGb > 0 && totalMemGb < CODEBUDDY_CN_LOW_MEM_GB;
-  } catch {
-    return false;
-  }
-}
-
-function clampCnConcurrency(value) {
-  const lowMem = isLowMemHost();
-  const hardMax = lowMem ? 1 : CODEBUDDY_CN_MAX_CONCURRENCY;
-  const def = lowMem ? 1 : CODEBUDDY_CN_DEFAULT_CONCURRENCY;
-  if (isAutoConcurrencyValue(value)) {
-    const optimal = getOptimalWorkerCount();
-    return Math.min(hardMax, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, optimal));
-  }
-  const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed)) return Math.min(hardMax, def);
-  return Math.min(hardMax, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, parsed));
-}
-
-function resolveCnJobConcurrency(value, {
-  manualProxy = false,
-  processBoundProxy = false,
-} = {}) {
-  // CloakBrowser applies GeoIP/WebRTC at process scope. Sharing one process
-  // across context proxies leaks the first proxy's fingerprint into later
-  // accounts, so every proxy-bound CN job must recycle sequentially.
-  return manualProxy || processBoundProxy ? 1 : clampCnConcurrency(value);
-}
-
-function requiresIsolatedProxyBrowser(job) {
-  return Boolean(job?.proxyUrls?.length)
-    && ["manual", "all", "single"].includes(job?.proxyPoolMode);
-}
-
-function requireSelectedProxy(proxyPoolMode, proxyUrls) {
-  if (!["all", "single"].includes(proxyPoolMode) || proxyUrls.length > 0) return;
-  const message = proxyPoolMode === "single"
-    ? "Selected proxy is missing or inactive; no automation was started"
-    : "No active proxies are available in the selected pool; no automation was started";
-  throw Object.assign(new Error(message), { error: message, code: "CN_PROXY_SELECTION_EMPTY" });
-}
-
-function parseEgressIp(value) {
-  return parseProxyEgressIp(value);
-}
-
-async function probeCodeBuddyProxyEgress(
-  context,
-  { timeoutMs = CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS } = {},
-) {
-  let requestContext = null;
-  try {
-    requestContext = context?.request || null;
-  } catch {
-    requestContext = null;
-  }
-  if (!requestContext || typeof requestContext.get !== "function") {
-    return { ok: false, ip: null, ips: [], samples: 0, error: "context request unavailable" };
-  }
-
-  const attemptedUrls = [];
-  let lastError = null;
-  for (const url of PROXY_EGRESS_ECHO_URLS) {
-    attemptedUrls.push(url);
-    let response = null;
-    try {
-      response = await requestContext.get(url, {
-        timeout: timeoutMs,
-        failOnStatusCode: false,
-        headers: {
-          Accept: "text/plain, application/json;q=0.9, */*;q=0.1",
-          "Cache-Control": "no-cache",
-        },
-      });
-      if (response.status() < 200 || response.status() >= 300) {
-        lastError = `HTTP ${response.status()}`;
-        continue;
-      }
-      const ip = parseEgressIp(await response.text().catch(() => ""));
-      if (!ip) {
-        lastError = "exit-IP response was not recognized";
-        continue;
-      }
-      return {
-        ok: true,
-        ip,
-        ips: [ip],
-        samples: 1,
-        attempts: attemptedUrls.length,
-        attemptedUrls,
-        unstable: false,
-        error: null,
-      };
-    } catch (error) {
-      lastError = error?.name === "TimeoutError"
-        ? `timed out after ${timeoutMs}ms`
-        : "request failed";
-    } finally {
-      if (typeof response?.dispose === "function") {
-        await Promise.resolve(response.dispose()).catch(() => null);
-      }
-    }
-  }
-  return {
-    ok: false,
-    ip: null,
-    ips: [],
-    samples: 0,
-    attempts: attemptedUrls.length,
-    attemptedUrls,
-    unstable: false,
-    error: lastError || "all exit-IP services failed",
-  };
-}
-
-function requireStableProxyEgress(probe, expectedIp = null) {
-  if (probe?.unstable) {
-    throw Object.assign(
-      new Error("Manual proxy rotated between exit IPs during preflight; no phone number was purchased"),
-      { code: "CN_PROXY_EGRESS_UNSTABLE" },
-    );
-  }
-  if (!probe?.ok || !probe?.ip) {
-    throw Object.assign(
-      new Error(`Manual proxy exit IP could not be verified (${probe?.error || "no response"}); no phone number was purchased`),
-      { code: "CN_PROXY_EGRESS_UNVERIFIED" },
-    );
-  }
-  if (expectedIp && probe.ip !== expectedIp) {
-    throw Object.assign(
-      new Error("Manual proxy exit IP changed after CloakBrowser GeoIP alignment; no phone number was purchased"),
-      { code: "CN_PROXY_EGRESS_CHANGED" },
-    );
-  }
-  return probe.ip;
-}
-
-async function withTimeoutCleanup(
-  task,
-  {
-    timeoutMs,
-    message,
-    code,
-    onTimeout,
-    onLateResolve,
-  },
-) {
-  const operation = Promise.resolve(task);
-  let timer = null;
-  let timedOut = false;
-  const timeout = new Promise((_, reject) => {
-    timer = setTimeout(() => {
-      timedOut = true;
-      try {
-        if (typeof onTimeout === "function") onTimeout();
-      } catch {
-        // Timeout reporting must not be replaced by cleanup callback failures.
-      }
-      reject(Object.assign(new Error(message), { code }));
-    }, timeoutMs);
-    if (typeof timer.unref === "function") timer.unref();
-  });
-
-  try {
-    return await Promise.race([operation, timeout]);
-  } finally {
-    if (timer) clearTimeout(timer);
-    if (timedOut && typeof onLateResolve === "function") {
-      void operation.then(onLateResolve).catch(() => null);
-    }
-  }
-}
-
-function assertAutomaticApiKeyRetrySafe(result, label = "API key request") {
-  const status = Number(result?.status);
-  if (status === 429) {
-    throw Object.assign(
-      new Error(`${label} was rate limited (HTTP 429); automatic POST retries stopped`),
-      { code: CODEBUDDY_CN_API_KEY_RETRY_STOPPED },
-    );
-  }
-  if (Number.isFinite(status) && status >= 500) {
-    throw Object.assign(
-      new Error(`${label} returned HTTP ${status}; creation outcome may be unknown and automatic POST retries stopped`),
-      { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
-    );
-  }
-  return result;
-}
-
-function isApiKeyPostRetryStopped(error) {
-  return error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN
-    || error?.code === CODEBUDDY_CN_API_KEY_RETRY_STOPPED;
-}
-
-function isLoginHtmlProbe(probe) {
-  const raw = `${probe?.text || ""} ${probe?.data?._raw || ""} ${probe?.url || ""}`;
-  return /<!doctype html|<html|login-pf|\/auth\/realms\//i.test(raw);
-}
-
-function parseConsoleProbeBody(status, text, extras = {}) {
-  const rawText = String(text || "");
-  let data = null;
-  try {
-    data = rawText ? JSON.parse(rawText) : null;
-  } catch {
-    data = { _raw: rawText.slice(0, 240), _notJson: true };
-  }
-  return {
-    status: Number(status) || 0,
-    data,
-    text: rawText.slice(0, 240),
-    ...extras,
-  };
-}
-
-function hasRestrictedConsoleEvidence(probe, cookieNames = []) {
-  const names = cookieNames instanceof Set ? cookieNames : new Set(cookieNames);
-  const raw = `${probe?.text || ""} ${probe?.data?._raw || ""}`;
-  if (/账号访问受限|安全策略限制|访问受限|account restricted|access restricted/i.test(raw)) {
-    return true;
-  }
-  if (!names.has("login_risk_state")) return false;
-  return isLoginHtmlProbe(probe)
-    || probe?.status === 0
-    || probe?.status === 401
-    || probe?.status === 403;
-}
-
-async function probeCodeBuddyConsoleAccounts({
-  context,
-  page,
-  timeoutMs = CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS,
-}) {
-  const headers = {
-    Accept: "application/json, text/plain, */*",
-    "x-requested-with": "XMLHttpRequest",
-    "X-Domain": "www.codebuddy.cn",
-    "X-Product": "SaaS",
-  };
-
-  // The context request shares browser cookies but bypasses page-origin CORS.
-  let requestContext = null;
-  try {
-    requestContext = context?.request || null;
-  } catch {
-    requestContext = null;
-  }
-  if (requestContext && typeof requestContext.get === "function") {
-    try {
-      const response = await requestContext.get(
-        "https://www.codebuddy.cn/console/accounts",
-        { headers, timeout: timeoutMs, failOnStatusCode: false },
-      );
-      const text = await response.text().catch(() => "");
-      return parseConsoleProbeBody(response.status(), text, {
-        source: "context-request",
-        url: response.url(),
-        contentType: response.headers()?.["content-type"] || "",
-      });
-    } catch {
-      // Compatibility fallback for older CloakBrowser request contexts.
-    }
-  }
-
-  const probeTask = page.evaluate(async ({ requestTimeoutMs, requestHeaders }) => {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), requestTimeoutMs);
-    try {
-      const host = window.location.hostname || "www.codebuddy.cn";
-      const base = host === "www.codebuddy.cn"
-        ? `${window.location.origin}`
-        : "https://www.codebuddy.cn";
-      const response = await fetch(`${base}/console/accounts`, {
-        credentials: "include",
-        signal: controller.signal,
-        headers: requestHeaders,
-      });
-      const text = await response.text().catch(() => "");
-      let data = null;
-      try {
-        data = text ? JSON.parse(text) : null;
-      } catch {
-        data = { _raw: String(text || "").slice(0, 240), _notJson: true };
-      }
-      return {
-        status: response.status,
-        data,
-        text: String(text || "").slice(0, 240),
-        source: "page-fetch",
-        url: response.url,
-        contentType: response.headers.get("content-type") || "",
-      };
-    } catch (error) {
-      return {
-        status: 0,
-        timedOut: error?.name === "AbortError",
-        error: error?.message || String(error),
-        source: "page-fetch",
-      };
-    } finally {
-      clearTimeout(timer);
-    }
-  }, { requestTimeoutMs: timeoutMs, requestHeaders: headers });
-
-  return withTimeoutCleanup(probeTask, {
-    timeoutMs,
-    message: `Console account probe timed out after ${timeoutMs / 1000}s`,
-    code: "CN_CONSOLE_PROBE_TIMEOUT",
-  }).catch((error) => ({
-    status: 0,
-    timedOut: error?.code === "CN_CONSOLE_PROBE_TIMEOUT",
-    error: error?.message || String(error),
-    source: "page-fetch",
-  }));
-}
-
-async function closeResourceBounded(resource) {
-  if (!resource || typeof resource.close !== "function") return true;
-  try {
-    await withTimeoutCleanup(Promise.resolve().then(() => resource.close()), {
-      timeoutMs: CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS,
-      message: `Browser resource close timed out after ${CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS / 1000}s`,
-      code: "CN_RESOURCE_CLOSE_TIMEOUT",
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function closeContextOrBrowser(context, job) {
-  if (await closeResourceBounded(context)) return;
-  if (!job?.browser) return;
-  const browser = job.browser;
-  job.browser = null;
-  await forceCloseBrowser(browser).catch(() => null);
-}
-
-async function settleFiveSimOrder(operation) {
-  try {
-    return await withTimeoutCleanup(Promise.resolve().then(operation), {
-      timeoutMs: CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS,
-      message: `5sim order settlement timed out after ${CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS / 1000}s`,
-      code: "CN_FIVESIM_SETTLE_TIMEOUT",
-    });
-  } catch {
-    // Finish/cancel/ban are best-effort and must not hold the browser worker.
-    return false;
-  }
-}
-
-/**
- * Save a CodeBuddy CN provider connection to the database.
- */
-async function defaultSaveCodeBuddyCnConnection({ apiKey, phone, region, fiveSimOrderId, account }) {
-  const { createProviderConnection } = await import("../../../models/index.js");
-
-  const providerSpecificData = {
-    domain: CODEBUDDY_CN_DOMAIN,
-    phoneNumber: phone,
-    fiveSimOrderId,
-    region,
-    automation: "5sim-phone-bulk",
-  };
-
-  const connectionData = {
-    provider: CODEBUDDY_CN_PROVIDER_ID,
-    // Must be "apikey" (no hyphen) — quotaService only treats that as usage-eligible.
-    authType: "apikey",
-    apiKey,
-    accessToken: apiKey,
-    // Prefer name so provider list shows the phone (email alone is often hidden).
-    name: phone || `5sim-${fiveSimOrderId}`,
-    email: phone || `5sim-${fiveSimOrderId}`,
-    providerSpecificData,
-    testStatus: "active",
-  };
-
-  const connection = await createProviderConnection(connectionData);
-  return { connection };
-}
-
-/**
- * CodeBuddy CN Bulk Import Manager.
- *
- * @extends KiroBulkImportManager
- */
-export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
-  constructor({
-    browserLauncher,
-    requestDeviceCodeFn = defaultRequestDeviceCode,
-    pollToken = defaultPollForToken,
-    fetchLoginAccountFn = fetchCodeBuddyLoginAccount,
-    saveConnection = defaultSaveCodeBuddyCnConnection,
-    fiveSimClientFactory = defaultFiveSimClientFactory,
-    phoneAutomation = runCodeBuddyCnPhoneRegistration,
-    phoneFormatter = defaultPhoneFormatter,
-    pollIntervalMs = CODEBUDDY_CN_CONFIG.pollInterval,
-    storageName = "codebuddy-cn-bulk-import",
-  } = {}) {
-    // CloakBrowser-only: proxy on launch + geoip. Headed by default (Turnstile/Tencent).
-    // Override: ZEVAI_CN_HEADLESS=0|1
-    const cnBrowserLauncher = browserLauncher || (async (job) => {
-      const {
-        forceCloseBrowser,
-        launchBulkImportBrowser,
-      } = await import("./bulkImportBrowserEngine.js");
-      const proxyUrl = Array.isArray(job?.proxyUrls) && job.proxyUrls.length
-        ? job.proxyUrls[0]
-        : null;
-      const envHeadless = process.env.ZEVAI_CN_HEADLESS;
-      let headless = false;
-      if (envHeadless === "0" || envHeadless === "false") headless = false;
-      if (envHeadless === "1" || envHeadless === "true") headless = true;
-      const launchTask = launchBulkImportBrowser({
-        engine: job?.engine || "cloakbrowser",
-        proxyUrl,
-        headless,
-        windowSize: { width: 1280, height: 900 },
-        requireProxyGeoip: job?.proxyPoolMode === "manual" && Boolean(proxyUrl),
-      });
-      return withTimeoutCleanup(launchTask, {
-        timeoutMs: CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS,
-        message: `CloakBrowser launch timed out after ${CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS / 1000}s`,
-        code: "CN_BROWSER_LAUNCH_TIMEOUT",
-        onLateResolve: (browser) => forceCloseBrowser(browser),
-      });
-    });
-    super({ browserLauncher: cnBrowserLauncher, storageName });
-    if (!this.latestJobId || !this.readPersistedJob(this.latestJobId)) {
-      this.latestJobId = findLatestPersistedCnJobId(this.storageDir);
-      if (this.latestJobId) this.persistLatestJobId(this.latestJobId);
-    }
-    this.requestDeviceCode = requestDeviceCodeFn;
-    this.pollToken = pollToken;
-    this.fetchLoginAccount = fetchLoginAccountFn;
-    this.saveConnection = saveConnection;
-    this.fiveSimClientFactory = fiveSimClientFactory;
-    this.phoneAutomation = phoneAutomation;
-    this.phoneFormatter = phoneFormatter;
-    this.pollIntervalMs = pollIntervalMs;
-  }
-
-  /**
-   * Override startJob to accept count-based input instead of email:password list.
-   *
-   * @param {object} opts
-   * @param {number} opts.count             Number of accounts to register
-   * @param {string|number} opts.concurrency
-   * @param {string} opts.proxyPoolMode     none|all|single
-   * @param {string} [opts.proxyPoolId]
-   * @param {string} [opts.region]          5sim region (hongkong|china|any)
-   */
-  async startJob({ count, concurrency, proxyPoolMode, proxyPoolId, manualProxyUrl, region }) {
-    // Validate count
-    const countNum = Number.parseInt(count, 10);
-    if (!Number.isFinite(countNum) || countNum < 1) {
-      throw Object.assign(new Error("At least one account is required (count >= 1)"), {
-        error: "At least one account is required (count >= 1)",
-      });
-    }
-    if (countNum > CODEBUDDY_CN_MAX_COUNT) {
-      throw Object.assign(new Error(`Count exceeds maximum of ${CODEBUDDY_CN_MAX_COUNT}`), {
-        error: `Count exceeds maximum of ${CODEBUDDY_CN_MAX_COUNT}`,
-      });
-    }
-
-    // Terminalize an interrupted persisted job before checking in-memory work.
-    // CN jobs cannot resume a browser/OTP session safely after process restart.
-    if (this.latestJobId && !this.jobs.has(this.latestJobId)) {
-      this.getJob(this.latestJobId);
-    }
-
-    // Block concurrent jobs — double Start / overlapping runs = multiple 5sim buys.
-    const activeJob = [...this.jobs.values()].find((j) =>
-      j && (j.status === "running" || j.status === "queued" || j.status === "needs_manual") && !j.cancelRequested
-    );
-    if (activeJob) {
-      throw Object.assign(
-        new Error(`Another CodeBuddy CN job is still active (${activeJob.jobId}). Cancel it or wait before starting again.`),
-        { error: `Another CodeBuddy CN job is still active (${activeJob.jobId}). Cancel it or wait before starting again.` },
-      );
-    }
-
-    // Validate region
-    const resolvedRegion = SUPPORTED_REGIONS.has(region) ? region : DEFAULT_REGION;
-
-    // Resolve proxy URLs: manual URL takes precedence over pool selection.
-    let proxyUrls = [];
-    const manualProxy = typeof manualProxyUrl === "string" ? manualProxyUrl.trim() : "";
-    if (manualProxy) {
-      // Basic scheme check — Playwright needs a parseable http(s)/socks URL.
-      if (!/^(https?|socks4|socks5):\/\/.+/i.test(manualProxy)) {
-        throw Object.assign(
-          new Error("manualProxyUrl must be a valid proxy URL (http://, https://, socks4://, or socks5://)"),
-          { error: "manualProxyUrl must be a valid proxy URL (http://, https://, socks4://, or socks5://)" },
-        );
-      }
-      proxyUrls = [manualProxy];
-    } else if (proxyPoolMode === "all") {
-      const pools = await getProxyPools({ isActive: true });
-      proxyUrls = pools.map((p) => p.proxyUrl).filter(Boolean);
-    } else if (proxyPoolMode === "single" && proxyPoolId) {
-      const pool = await getProxyPoolById(proxyPoolId);
-      if (pool?.isActive && pool?.proxyUrl) {
-        proxyUrls = [pool.proxyUrl];
-      }
-    }
-    if (!manualProxy) requireSelectedProxy(proxyPoolMode, proxyUrls);
-
-    const jobId = randomUUID();
-    const createdAt = nowIso();
-    const job = {
-      jobId,
-      status: "running",
-      concurrency: resolveCnJobConcurrency(concurrency, {
-        manualProxy: Boolean(manualProxy),
-        processBoundProxy: proxyUrls.length > 0,
-      }),
-      proxyPoolMode: manualProxy ? "manual" : (proxyPoolMode || "none"),
-      proxyUrls,
-      region: resolvedRegion,
-      createdAt,
-      startedAt: createdAt,
-      finishedAt: null,
-      error: null,
-      cancelRequested: false,
-      browser: null,
-      nextIndex: 0,
-      manualFollowups: new Set(),
-      persistPromise: Promise.resolve(),
-      lastPreview: null,
-      lastPreviewCapturedAt: 0,
-      accounts: Array.from({ length: countNum }, (_, index) => ({
-        line: index + 1,
-        region: resolvedRegion,
-        phone: null,
-        fiveSimOrderId: null,
-        fiveSimActivationId: null,
-        // Unique Chromium fingerprint seed per account (viewport/HW/screen noise).
-        fingerprintSeed: randomUUID(),
-        proxyUrl: null,
-        egressIp: null,
-        proxyTimezone: null,
-        proxyLocale: null,
-        abortController: new AbortController(),
-        status: "queued",
-        error: null,
-        connectionId: null,
-        workerId: null,
-        manualSession: null,
-        runtimeSession: null,
-        currentStep: "queued",
-        updatedAt: createdAt,
-        logs: [createLogEntry("queued", "Queued and waiting for an available worker")],
-      })),
-    };
-
-    this.jobs.set(jobId, job);
-    this.latestJobId = jobId;
-    this.persistLatestJobId(jobId);
-    await this.persistJobSnapshot(job, { forcePreview: false });
-    // Note: we skip persistResumeBlob (encrypted vault) since there are no
-    // static credentials to resume — each account gets a fresh 5sim number.
-    void this.runJob(jobId);
-    return sanitizeCnJob(job);
-  }
-
-  buildPersistedSnapshot(job) {
-    return sanitizeCnJob(job, { preview: job.lastPreview || null });
-  }
-
-  terminalizeInterruptedSnapshot(snapshot) {
-    if (!snapshot || !ACTIVE_CN_JOB_STATUSES.has(snapshot.status)) return snapshot;
-    const message =
-      "CodeBuddy CN job was interrupted by a service restart. Browser and OTP sessions cannot be resumed safely; start a new job.";
-    const accounts = (snapshot.accounts || []).map((account) => {
-      if (!ACTIVE_CN_ACCOUNT_STATUSES.has(account.status)) return account;
-      const log = createLogEntry("failed", message, "error");
-      return {
-        ...account,
-        status: "failed",
-        error: message,
-        currentStep: "failed",
-        updatedAt: log.at,
-        manualSessionAvailable: false,
-        logs: [...(account.logs || []), log].slice(-40),
-      };
-    });
-    const terminal = {
-      ...snapshot,
-      status: "failed",
-      error: snapshot.error || message,
-      finishedAt: snapshot.finishedAt || nowIso(),
-      accounts,
-      summary: buildCnSummary(accounts),
-      preview: null,
-    };
-    this.writePersistedJob(snapshot.jobId, terminal);
-    return terminal;
-  }
-
-  // Base sanitizeJob only keeps email — CN accounts need phone/order fields in API responses.
-  getJob(jobId) {
-    const job = this.jobs.get(jobId);
-    if (job) return sanitizeCnJob(job);
-    const snapshot = this.readPersistedJob(jobId);
-    return snapshot ? this.terminalizeInterruptedSnapshot(snapshot) : null;
-  }
-
-  async getJobWithPreview(jobId) {
-    const job = this.jobs.get(jobId);
-    if (!job) return this.getJob(jobId);
-    await this.persistJobSnapshot(job, { forcePreview: false });
-    return sanitizeCnJob(job, { preview: job.lastPreview || null });
-  }
-
-  /**
-   * Override processAccount — the core phone-registration + device-code-token flow.
-   */
-  async processAccount(job, account, workerId) {
-    if (job.cancelRequested || !job.browser) {
-      this.finalizeAccount(account, "cancelled", { error: "Job cancelled" });
-      return;
-    }
-
-    let fiveSimClient = null;
-    let fiveSimOrderId = null;
-    let smsReceived = false;
-    let context = null;
-    let verifiedEgressIp = null;
-
-    try {
-      // Step 1: Get 5sim API key from settings
-      this.setAccountStep(account, "reading_settings", "Reading 5sim API key from settings");
-      await this.persistJobSnapshot(job, { forcePreview: true });
-
-      const settings = await getSettings();
-      const fiveSimApiKey = settings.fiveSimApiKey;
-      if (!fiveSimApiKey || !fiveSimApiKey.trim()) {
-        this.finalizeAccount(account, "failed", {
-          error: "5sim API key not configured. Set it in the automation modal or dashboard settings.",
-          step: "failed",
-          message: "5sim API key not configured",
-        });
-        await this.persistJobSnapshot(job, { forcePreview: true });
-        return;
-      }
-
-      // 5sim API must be direct — China residential proxy often cannot reach 5sim.net.
-      // Proxy is only for the Playwright browser session (codebuddy.cn geo).
-      fiveSimClient = this.fiveSimClientFactory({ apiKey: fiveSimApiKey, proxyOptions: null });
-
-      // Step 2: Create browser context FIRST — if proxy/browser fails, we never buy a number.
-      this.setAccountStep(account, "creating_browser", "Creating browser context (before 5sim order)");
-      await this.persistJobSnapshot(job, { forcePreview: true });
-      // CloakBrowser owns the process-wide fingerprint, timezone, locale, and
-      // WebRTC profile. Playwright context overrides would reintroduce CDP tells.
-      const contextTask = createFreshContext(job.browser, account.proxyUrl, {
-        profile: "codebuddy-cn",
-        region: job.region || "hongkong",
-        fingerprintSeed: account.fingerprintSeed,
-        lowMemory: isLowMemHost(),
-        nativeCloakProfile: requiresIsolatedProxyBrowser(job) && Boolean(account.proxyUrl),
-      });
-      const freshContext = await withTimeoutCleanup(contextTask, {
-        timeoutMs: CODEBUDDY_CN_CONTEXT_TIMEOUT_MS,
-        message: `Browser context creation timed out after ${CODEBUDDY_CN_CONTEXT_TIMEOUT_MS / 1000}s`,
-        code: "CN_CONTEXT_TIMEOUT",
-        onLateResolve: (session) => Promise.resolve(session?.context?.close?.()).catch(() => null),
-      });
-      context = freshContext.context;
-      const page = freshContext.page;
-      account.runtimeSession = { context, page };
-
-      if (job.proxyPoolMode === "manual" && account.proxyUrl) {
-        this.setAccountStep(
-          account,
-          "checking_proxy_egress",
-          "Verifying pasted proxy exit IP before opening the registration form",
-        );
-        await this.persistJobSnapshot(job, { forcePreview: false });
-        const launchProfile = getCloakProxyProfile(job.browser);
-        const egressProbe = await probeCodeBuddyProxyEgress(context);
-        verifiedEgressIp = requireStableProxyEgress(egressProbe, launchProfile?.egressIp || null);
-        account.egressIp = verifiedEgressIp;
-        account.proxyTimezone = launchProfile?.timezone || null;
-        account.proxyLocale = launchProfile?.locale || null;
-        this.setAccountStep(
-          account,
-          "proxy_egress_ready",
-          `Manual proxy verified: ${verifiedEgressIp} (${egressProbe.samples} checks, ${account.proxyTimezone || "timezone unknown"}, ${account.proxyLocale || "locale unknown"})`,
-        );
-        await this.persistJobSnapshot(job, { forcePreview: false });
-      }
-
-      if (job.cancelRequested) {
-        throw new Error("Job cancelled before ordering phone number");
-      }
-
-      // Step 3–5: Navigate form FIRST, then buy number, then poll SMS after send-code.
-      // This prevents the two balance-burners:
-      //  1) Order then fail on proxy/nav → wasted number
-      //  2) Start 90s SMS timer before send-code → false sms_timeout after slow nav
-      this.setAccountStep(account, "registering", "Running phone registration on CodeBuddy CN");
-      await this.persistJobSnapshot(job, { forcePreview: true });
-
-      // Page-level timeouts so a stuck network never outlives the hard wall-clock.
-      try {
-        page.setDefaultTimeout(20_000);
-        page.setDefaultNavigationTimeout(45_000);
-      } catch {
-        // older playwright builds may not expose these
-      }
-
-      const hardTimeoutMs = CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS;
-      let hardTimer = null;
-      const hardTimeoutPromise = new Promise((_, reject) => {
-        hardTimer = setTimeout(() => {
-          const timeoutError = Object.assign(
-            new Error(
-              `CodeBuddy CN account hard timeout after ${Math.round(hardTimeoutMs / 1000)}s (browser will be force-closed)`,
-            ),
-            { code: "CN_ACCOUNT_HARD_TIMEOUT" },
-          );
-          if (account.abortController && !account.abortController.signal.aborted) {
-            account.abortController.abort(timeoutError);
-          }
-          reject(timeoutError);
-        }, hardTimeoutMs);
-        if (typeof hardTimer.unref === "function") hardTimer.unref();
-      });
-
-      let automationResult;
-      try {
-        automationResult = await Promise.race([
-          this.phoneAutomation({
-            page,
-            signal: account.abortController?.signal,
-            isCancelled: () => job.cancelRequested === true,
-            resolvePhone: async () => {
-              if (job.cancelRequested) {
-                throw new Error("Job cancelled before ordering phone number");
-              }
-              if (job.proxyPoolMode === "manual" && account.proxyUrl) {
-                this.setAccountStep(
-                  account,
-                  "rechecking_proxy_egress",
-                  "Registration form is ready — confirming the pasted proxy stayed sticky",
-                );
-                await this.persistJobSnapshot(job, { forcePreview: false });
-                const secondProbe = await probeCodeBuddyProxyEgress(context);
-                requireStableProxyEgress(secondProbe, verifiedEgressIp);
-                this.setAccountStep(
-                  account,
-                  "proxy_egress_confirmed",
-                  `Manual proxy remained on ${verifiedEgressIp}; safe to purchase one phone number`,
-                );
-                await this.persistJobSnapshot(job, { forcePreview: false });
-              }
-              this.setAccountStep(
-                account,
-                "ordering_number",
-                `Form ready — ordering ${job.region} phone from 5sim (single buy)`,
-              );
-              await this.persistJobSnapshot(job, { forcePreview: true });
-
-              const numberData = await fiveSimClient.buyNumber({
-                country: job.region,
-                product: "codebuddy",
-                allowProductFallback: false,
-                signal: account.abortController?.signal,
-              });
-              fiveSimOrderId = numberData.id;
-              account.phone = numberData.phone;
-              account.fiveSimOrderId = numberData.id;
-              account.fiveSimActivationId = numberData.id;
-              this.setAccountStep(
-                account,
-                "number_ordered",
-                `Phone number ordered: ${numberData.phone} (1 buy, no re-order)`,
-              );
-              await this.persistJobSnapshot(job, { forcePreview: true });
-              return numberData.phone;
-            },
-            waitForSms: async () => {
-              if (!fiveSimOrderId) {
-                throw new Error("Cannot poll SMS — no 5sim order id");
-              }
-              this.setAccountStep(
-                account,
-                "sms_poll_started",
-                `SMS poll started (full ${CODEBUDDY_CN_SMS_TIMEOUT_MS / 1000}s window after send-code)`,
-              );
-              await this.persistJobSnapshot(job, { forcePreview: false });
-              const code = await fiveSimClient.pollCode(fiveSimOrderId, {
-                timeoutMs: CODEBUDDY_CN_SMS_TIMEOUT_MS,
-                signal: account.abortController?.signal,
-              });
-              smsReceived = true;
-              return code;
-            },
-            onStep: (step, message) => {
-              this.setAccountStep(account, step, message);
-              void this.persistJobSnapshot(job, { forcePreview: false });
-            },
-            phoneFormatter: this.phoneFormatter,
-          }),
-          hardTimeoutPromise,
-        ]);
-      } finally {
-        if (hardTimer) clearTimeout(hardTimer);
-      }
-
-      // Step 6: Try API key capture only if automation reached at least the submit step.
-      // If automation failed early (e.g. page.goto timeout), the session won't be logged in
-      // and API key creation will 401 — so don't waste time. Only try bypass if automation
-      // reported "success" or "needs_manual" (meaning submit happened).
-      if (String(automationResult.status || "").startsWith("failed")) {
-        // Automation failed before submit — no point trying API key
-        const errorMsg = automationResult.error || "Phone registration failed before submit";
-        const failureStatus = automationResult.status || "failed";
-        this.finalizeAccount(account, failureStatus, {
-          error: errorMsg,
-          step: failureStatus,
-          message: errorMsg,
-        });
-        // Only touch 5sim if we actually bought a number (order is deferred until form ready)
-        if (fiveSimClient && fiveSimOrderId) {
-          if (smsReceived) {
-            await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
-          } else {
-            await settleFiveSimOrder(() => fiveSimClient.cancelOrder(fiveSimOrderId));
-          }
-        }
-        account.runtimeSession = null;
-        await closeContextOrBrowser(context, job);
-        await this.persistJobSnapshot(job, { forcePreview: true });
-        return;
-      }
-
-      // Automation reached submit (success or needs_manual) — try API key bypass
-      await this.captureApiKey(job, account, context, page, fiveSimClient, fiveSimOrderId);
-      return;
-    } catch (error) {
-      // SMS timeout (60s, no OTP) → BAN the number (bad number that doesn't receive CodeBuddy SMS)
-      const isSmsTimeout = error instanceof FiveSimTimeoutError;
-      const cancelled = job.cancelRequested || error?.code === "JOB_CANCELLED";
-      const failReason = cancelled
-        ? "Job cancelled"
-        : isSmsTimeout
-          ? `SMS OTP not received within ${CODEBUDDY_CN_SMS_TIMEOUT_MS / 1000}s — number banned`
-          : (error.message || "Unexpected CodeBuddy CN bulk import failure");
-
-      this.finalizeAccount(account, cancelled ? "cancelled" : "failed", {
-        error: failReason,
-        step: cancelled ? "cancelled" : isSmsTimeout ? "sms_timeout" : "failed",
-        message: failReason,
-      });
-      // 5sim hygiene on error
-      if (fiveSimClient && fiveSimOrderId) {
-        if (smsReceived) {
-          await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
-        } else if (isSmsTimeout) {
-          // BAN: number did not receive CodeBuddy SMS within the OTP window.
-          await settleFiveSimOrder(() => fiveSimClient.banOrder(fiveSimOrderId));
-        } else {
-          await settleFiveSimOrder(() => fiveSimClient.cancelOrder(fiveSimOrderId));
-        }
-      }
-      account.runtimeSession = null;
-      await closeContextOrBrowser(context, job);
-      // Hard timeout / blackhole nav: kill the shared browser so the worker unblocks
-      // and Chromium cannot pin 100% CPU on a 2GB VPS until reboot.
-      if (
-        error?.code === "CN_ACCOUNT_HARD_TIMEOUT"
-        || error?.code === "CN_CONTEXT_TIMEOUT"
-        || job.cancelRequested
-      ) {
-        if (job.browser) {
-          const b = job.browser;
-          job.browser = null;
-          await forceCloseBrowser(b).catch(() => null);
-        }
-      }
-      await this.persistJobSnapshot(job, { forcePreview: true });
-    }
-  }
-
-  /**
-   * Complete the device-code OAuth capture after phone registration succeeds.
-   *
-   * Steps 7-12: request device code → navigate to authUrl → poll token → save.
-   */
-  /**
-   * Capture API key after phone registration succeeds.
-   *
-   * The browser is now logged in to codebuddy.cn. Navigate to /profile/keys
-   * and POST to /console/api/client/v1/api-keys to create an API key.
-   * Save the key as a provider connection.
-   */
-  async captureApiKey(job, account, context, page, fiveSimClient, fiveSimOrderId) {
-    const PERSONAL_ENTERPRISE_ID = "personal-edition-user-id";
-    let capturedApiKey = null;
-
-    // Tiny event-driven poller — replaces multi-second blind sleeps.
-    const waitUntil = async (checkFn, { timeout = 12_000, interval = 150 } = {}) => {
-      const deadline = Date.now() + timeout;
-      while (Date.now() < deadline) {
-        try {
-          if (await checkFn()) return true;
-        } catch {
-          /* retry */
-        }
-        await new Promise((r) => setTimeout(r, interval));
-      }
-      return false;
-    };
-
-    try {
-      // Functional session establishment — do NOT hard-require KEYCLOAK_IDENTITY.
-      // Live failures show OTP can succeed with AUTH_SESSION_ID + session + qcloud_uid
-      // while KEYCLOAK_IDENTITY never appears (mid-OIDC). What matters is whether
-      // /console/accounts and api-keys accept the browser cookies.
-      this.setAccountStep(account, "waiting_session", "Establishing CodeBuddy console session (probe APIs, not just cookies)");
-      await this.persistJobSnapshot(job, { forcePreview: true });
-
-      const cookieSnapshot = async () => {
-        const cookies = await context.cookies().catch(() => []);
-        return {
-          cookies,
-          names: new Set(cookies.map((c) => c.name)),
-          list: cookies.map((c) => c.name),
-        };
-      };
-
-      const hasStrongKeycloak = (names) =>
-        names.has("KEYCLOAK_IDENTITY")
-        || names.has("KEYCLOAK_SESSION")
-        || names.has("KEYCLOAK_IDENTITY_LEGACY")
-        || names.has("KEYCLOAK_SESSION_LEGACY");
-
-      const hasSoftSession = (names) =>
-        names.has("AUTH_SESSION_ID")
-        || names.has("session")
-        || names.has("qcloud_uid")
-        || names.has("qcmainCSRFToken")
-        || names.has("x_host_key_access");
-
-      const probeConsoleAccounts = () => probeCodeBuddyConsoleAccounts({ context, page });
-
-      const extractAccountList = (probe) => {
-        const d = probe?.data;
-        if (!d || typeof d !== "object") return [];
-        const candidates = [
-          d?.data?.accounts,
-          d?.accounts,
-          d?.data?.list,
-          d?.list,
-          d?.data?.result,
-          d?.result,
-          d?.data?.items,
-          d?.items,
-          Array.isArray(d?.data) ? d.data : null,
-          Array.isArray(d) ? d : null,
-        ];
-        for (const c of candidates) {
-          if (Array.isArray(c) && c.length > 0) return c;
-        }
-        return [];
-      };
-
-      // A committed response is enough to start session probes. Waiting for the
-      // full SPA DOM is expensive and frequently stalls on small VPS hosts.
-      const waitAfterNav = async (timeoutMs = 2_500) => {
-        let settled = false;
-        let timer = null;
-        try {
-          await Promise.race([
-            page.waitForLoadState("domcontentloaded", { timeout: timeoutMs }).catch(() => null),
-            waitUntil(async () => {
-              if (settled) return true;
-              const snap = await cookieSnapshot();
-              return hasStrongKeycloak(snap.names);
-            }, { timeout: timeoutMs, interval: 200 }),
-            new Promise((resolve) => {
-              timer = setTimeout(resolve, timeoutMs);
-            }),
-          ]);
-        } finally {
-          settled = true;
-          if (timer) clearTimeout(timer);
-        }
-      };
-
-      const navigateConsole = async (path) => {
-        const startedAt = Date.now();
-        try {
-          await page.goto(path, {
-            waitUntil: "commit",
-            timeout: CODEBUDDY_CN_CONSOLE_NAV_TIMEOUT_MS,
-          });
-          const remainingMs = CODEBUDDY_CN_CONSOLE_NAV_TIMEOUT_MS - (Date.now() - startedAt);
-          if (remainingMs > 0) await waitAfterNav(Math.min(2_500, remainingMs));
-          return true;
-        } catch {
-          return false;
-        }
-      };
-
-      // Navigate sequence to finish OIDC handoff when only AUTH_SESSION_ID is present.
-      // Never revisit /login here: it can wipe a valid partial OIDC session.
-      const oIDCNudgePaths = [
-        "https://www.codebuddy.cn/",
-        "https://www.codebuddy.cn/console",
-        "https://www.codebuddy.cn/console/",
-        "https://www.codebuddy.cn/profile",
-        "https://www.codebuddy.cn/profile/keys",
-      ];
-
-      let accountList = [];
-      let accountsProbe = null;
-      let sessionReady = false;
-      let lastPayloadSnippet = "";
-      let lastMeaningfulProbe = null;
-      let restrictedProbeCount = 0;
-
-      // Event-driven OIDC settle: bounded attempts and no blind multi-second sleeps.
-      for (let attempt = 0; attempt < CODEBUDDY_CN_OIDC_MAX_ATTEMPTS; attempt += 1) {
-        if (job.cancelRequested) {
-          throw new Error("Job cancelled while establishing session");
-        }
-
-        const snap = await cookieSnapshot();
-        const strong = hasStrongKeycloak(snap.names);
-        const soft = hasSoftSession(snap.names);
-
-        const path = oIDCNudgePaths[Math.min(attempt, oIDCNudgePaths.length - 1)];
-        // Always nudge on first 3 + even attempts; skip re-nav when soft session already present
-        // and we only need to re-probe accounts.
-        const shouldNav = attempt < 3 || attempt % 2 === 0 || !soft;
-        if (shouldNav) {
-          this.setAccountStep(
-            account,
-            "waiting_session",
-            `OIDC handoff ${attempt + 1}/${CODEBUDDY_CN_OIDC_MAX_ATTEMPTS} → ${path.replace("https://www.codebuddy.cn", "")} (${strong ? "KEYCLOAK" : soft ? "soft-session" : "weak"})`,
-          );
-          await this.persistJobSnapshot(job, { forcePreview: false });
-          await navigateConsole(path);
-        } else {
-          // Soft session present — short yield then re-probe (no blind multi-second sleep).
-          await new Promise((r) => setTimeout(r, 300));
-        }
-
-        // Prefer landing on console for the API probe (absolute host)
-        const onCodebuddy = /^https:\/\/www\.codebuddy\.cn(?:[/:]|$)/i.test(page.url?.() || "");
-        if (!onCodebuddy) {
-          await navigateConsole("https://www.codebuddy.cn/console");
-        }
-
-        accountsProbe = await probeConsoleAccounts();
-        accountList = extractAccountList(accountsProbe);
-        if (
-          accountsProbe?.status > 0
-          || accountsProbe?.text
-          || accountsProbe?.data
-        ) {
-          lastMeaningfulProbe = accountsProbe;
-        }
-        lastPayloadSnippet = JSON.stringify(
-          accountsProbe?.data
-          ?? accountsProbe?.text
-          ?? accountsProbe?.error
-          ?? null,
-        ).slice(0, 180);
-        const loginHtml = isLoginHtmlProbe(accountsProbe);
-        const probeSnap = await cookieSnapshot();
-        const probeStrong = hasStrongKeycloak(probeSnap.names);
-        if (!probeStrong && hasRestrictedConsoleEvidence(accountsProbe, probeSnap.names)) {
-          restrictedProbeCount += 1;
-        } else {
-          restrictedProbeCount = 0;
-        }
-
-        if (restrictedProbeCount >= 2) {
-          throw Object.assign(
-            new Error(
-              `Tencent restricted the post-OTP session (${restrictedProbeCount} console probes returned login/risk evidence; source=${accountsProbe?.source || "unknown"})`,
-            ),
-            { code: CODEBUDDY_CN_ACCOUNT_RESTRICTED },
-          );
-        }
-
-        if (
-          accountsProbe?.status === 200
-          && !loginHtml
-          && Array.isArray(accountList)
-          && accountList.length > 0
-        ) {
-          sessionReady = true;
-          this.setAccountStep(
-            account,
-            "session_ready",
-            `Console session accepted (HTTP 200, ${accountList.length} account(s)${strong ? ", KEYCLOAK ok" : ", soft session"})`,
-          );
-          await this.persistJobSnapshot(job, { forcePreview: true });
-          break;
-        }
-
-        // Soft session + HTTP 200 empty accounts: console often still accepts api-keys.
-        // Don't fail early — break out and try key create with personal enterprise id.
-        if (
-          soft
-          && accountsProbe?.status === 200
-          && !loginHtml
-          && accountsProbe?.data?._notJson !== true
-          && Array.isArray(accountList)
-          && accountList.length === 0
-          && attempt >= 3
-        ) {
-          this.setAccountStep(
-            account,
-            "session_soft",
-            `Console HTTP 200 but 0 accounts — trying personal API key with soft session (cookies ok)`,
-          );
-          await this.persistJobSnapshot(job, { forcePreview: true });
-          sessionReady = true; // allow create-key path
-          break;
-        }
-
-        this.setAccountStep(
-          account,
-          "resolving_enterprise",
-          `Console not ready (HTTP ${accountsProbe?.status || 0}, accounts=${accountList.length}${loginHtml ? ", login HTML" : ""}, source=${accountsProbe?.source || "unknown"}) — ${attempt + 1}/${CODEBUDDY_CN_OIDC_MAX_ATTEMPTS} body=${lastPayloadSnippet.slice(0, 80)}`,
-        );
-        await this.persistJobSnapshot(job, { forcePreview: false });
-      }
-
-      if (!sessionReady) {
-        const snap = await cookieSnapshot();
-        const diagnosticProbe = lastMeaningfulProbe || accountsProbe;
-        const restricted = hasRestrictedConsoleEvidence(diagnosticProbe, snap.names)
-          || (snap.names.has("login_risk_state") && restrictedProbeCount > 0);
-        throw Object.assign(
-          new Error(
-            restricted
-              ? `Tencent restricted the post-OTP session (HTTP ${diagnosticProbe?.status || 0}; login_risk_state present; source=${diagnosticProbe?.source || "unknown"})`
-              : `Console accounts unavailable after login (HTTP ${diagnosticProbe?.status || 0}; cookies: ${snap.list.slice(0, 18).join(",") || "(none)"}; body=${lastPayloadSnippet.slice(0, 120)}; probeError=${accountsProbe?.error || "none"}) — session not accepted for API key`,
-          ),
-          { code: restricted ? CODEBUDDY_CN_ACCOUNT_RESTRICTED : "CN_CONSOLE_SESSION_UNAVAILABLE" },
-        );
-      }
-
-      let userEnterpriseId = PERSONAL_ENTERPRISE_ID;
-      if (Array.isArray(accountList) && accountList.length > 0) {
-        const preferred = accountList.find((entry) => entry?.lastLogin) || accountList[0];
-        if (preferred?.type && preferred.type !== "personal" && preferred.enterpriseId) {
-          userEnterpriseId = preferred.enterpriseId;
-        } else if (preferred?.enterpriseId && preferred?.type !== "personal") {
-          userEnterpriseId = preferred.enterpriseId;
-        }
-      }
-
-      // Create API key — CN requires user_enterprise_id (400 code 12505 without it).
-      this.setAccountStep(account, "creating_api_key", `Creating API key (enterprise=${userEnterpriseId}, accounts=${accountList.length})`);
-      await this.persistJobSnapshot(job, { forcePreview: true });
-
-      // Keep one name for every safe retry in this capture attempt. A timed-out
-      // POST has an unknown outcome and must never be sent again automatically.
-      const apiKeyName = `zevai-router-${account.workerId || "account"}-${Date.now()}`;
-      const createKeyOnPage = async (enterpriseId) => page.evaluate(async ({
-        enterpriseId: entId,
-        keyName,
-        timeoutMs,
-      }) => {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), timeoutMs);
-        try {
-          const host = window.location.hostname || "www.codebuddy.cn";
-          const base = host === "www.codebuddy.cn"
-            ? window.location.origin
-            : "https://www.codebuddy.cn";
-          const res = await fetch(`${base}/console/api/client/v1/api-keys`, {
-            method: "POST",
-            credentials: "include",
-            signal: controller.signal,
-            headers: {
-              "Content-Type": "application/json",
-              Accept: "application/json, text/plain, */*",
-              "x-requested-with": "XMLHttpRequest",
-              "X-Domain": "www.codebuddy.cn",
-              "X-Product": "SaaS",
-            },
-            body: JSON.stringify({
-              name: keyName,
-              expire_in_days: 365,
-              user_enterprise_id: entId,
-            }),
-          });
-          const text = await res.text().catch(() => "");
-          let data = null;
-          try {
-            data = text ? JSON.parse(text) : null;
-          } catch {
-            data = { _raw: String(text || "").slice(0, 200) };
-          }
-          return { ok: res.ok, status: res.status, data };
-        } catch (error) {
-          // Fetch/network failures after a POST starts are ambiguous: the server
-          // may have created the key even if the browser lost the response.
-          return {
-            ok: false,
-            status: 0,
-            outcomeUnknown: true,
-            timedOut: error?.name === "AbortError",
-            error: error?.message || String(error),
-          };
-        } finally {
-          clearTimeout(timer);
-        }
-      }, {
-        enterpriseId,
-        keyName: apiKeyName,
-        timeoutMs: CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS,
-      });
-
-      const requestApiKey = async (enterpriseId, label) => {
-        const startedAt = Date.now();
-        let heartbeatPromise = null;
-        const heartbeat = setInterval(() => {
-          if (heartbeatPromise) return;
-          const elapsedSeconds = Math.max(5, Math.round((Date.now() - startedAt) / 1000));
-          this.setAccountStep(
-            account,
-            "creating_api_key",
-            `${label} — waiting for CodeBuddy (${elapsedSeconds}s)`,
-          );
-          heartbeatPromise = this.persistJobSnapshot(job, { forcePreview: false })
-            .catch(() => null)
-            .finally(() => {
-              heartbeatPromise = null;
-            });
-        }, 5_000);
-        if (typeof heartbeat.unref === "function") heartbeat.unref();
-
-        let result;
-        try {
-          result = await withTimeoutCleanup(createKeyOnPage(enterpriseId), {
-            timeoutMs: CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS,
-            message: `API key request timed out after ${CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS / 1000}s; creation outcome is unknown`,
-            code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN,
-          });
-        } catch (error) {
-          if (error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN) throw error;
-          throw Object.assign(
-            new Error(`API key request lost its response; creation outcome is unknown: ${error?.message || String(error)}`),
-            { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
-          );
-        } finally {
-          clearInterval(heartbeat);
-          if (heartbeatPromise) await heartbeatPromise.catch(() => null);
-        }
-
-        if (result?.outcomeUnknown) {
-          const reason = result.timedOut
-            ? `timed out after ${CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS / 1000}s`
-            : `lost its response (${result.error || "network error"})`;
-          throw Object.assign(
-            new Error(`API key request ${reason}; creation outcome is unknown`),
-            { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
-          );
-        }
-        return assertAutomaticApiKeyRetrySafe(result, label);
-      };
-
-      // Always open keys page first (SPA hydrates CSRF / host-key there).
-      const keysPageReady = await navigateConsole("https://www.codebuddy.cn/profile/keys");
-      if (!keysPageReady) {
-        throw Object.assign(
-          new Error(`Keys page navigation timed out after ${CODEBUDDY_CN_CONSOLE_NAV_TIMEOUT_MS / 1000}s`),
-          { code: "CN_CONSOLE_NAV_TIMEOUT" },
-        );
-      }
-
-      let apiKeyResult = await requestApiKey(userEnterpriseId, "Creating API key");
-
-      // A confirmed 400 can safely retry with the personal enterprise id. Do
-      // not retry 5xx/network failures because the POST outcome is ambiguous.
-      if (
-        apiKeyResult?.status === 400
-        && userEnterpriseId !== PERSONAL_ENTERPRISE_ID
-      ) {
-        this.setAccountStep(account, "retrying_api_key", "Retrying with personal-edition enterprise id");
-        await this.persistJobSnapshot(job, { forcePreview: false });
-        apiKeyResult = await requestApiKey(PERSONAL_ENTERPRISE_ID, "Retrying personal API key");
-      }
-
-      // Retry loop on 401/403 — openresty edge blocks create-key when Keycloak
-      // cookies are half-synced (common on slow proxies). Nudge OIDC handoff,
-      // wait for strong session, then retry with a strict round cap.
-      const isAuthBlocked = (result) =>
-        result?.ok === false && (result.status === 401 || result.status === 403);
-      for (
-        let round = 1;
-        round <= CODEBUDDY_CN_API_REHANDOFF_ROUNDS && isAuthBlocked(apiKeyResult);
-        round += 1
-      ) {
-        this.setAccountStep(
-          account,
-          "retrying_api_key",
-          `API key 401/403 — OIDC re-handoff round ${round}/${CODEBUDDY_CN_API_REHANDOFF_ROUNDS} (waiting strong session)`,
-        );
-        await this.persistJobSnapshot(job, { forcePreview: true });
-        for (const path of [
-          "https://www.codebuddy.cn/",
-          "https://www.codebuddy.cn/console",
-          "https://www.codebuddy.cn/profile/keys",
-        ]) {
-          await navigateConsole(path);
-        }
-        // Wait for strong Keycloak cookie — openresty accepts api-keys only after full session.
-        await waitUntil(async () => {
-          const snap = await cookieSnapshot();
-          return hasStrongKeycloak(snap.names);
-        }, { timeout: 8_000 * round, interval: 300 }).catch(() => null);
-        apiKeyResult = await requestApiKey(
-          PERSONAL_ENTERPRISE_ID,
-          `Retrying API key after OIDC handoff ${round}/${CODEBUDDY_CN_API_REHANDOFF_ROUNDS}`,
-        );
-      }
-
-      const businessCode = apiKeyResult?.data?.code;
-      const businessOk = businessCode === 0 || businessCode === 200 || typeof businessCode === "undefined";
-      if (!apiKeyResult || !apiKeyResult.ok || !apiKeyResult.data || !businessOk) {
-        // Surface openresty HTML block (_raw) clearly instead of opaque "code=n/a".
-        const rawSnippet = typeof apiKeyResult?.data?._raw === "string"
-          ? apiKeyResult.data._raw.replace(/\s+/g, " ").slice(0, 120)
-          : null;
-        const edgeNote = rawSnippet && /openresty|nginx|Authorization Required/i.test(rawSnippet)
-          ? " [edge proxy blocked — session half-baked]"
-          : "";
-        throw new Error(
-          `API key creation failed (HTTP ${apiKeyResult?.status ?? "no-response"}, code=${businessCode ?? "n/a"})${edgeNote}: ${JSON.stringify(apiKeyResult?.data ?? null).slice(0, 200)}`,
-        );
-      }
-
-      // Extract the API key from the response — CodeBuddy wraps secrets under data.*
-      const payload = apiKeyResult.data?.data || apiKeyResult.data;
-      const apiKey =
-        payload?.apiKey ||
-        payload?.key ||
-        payload?.token ||
-        payload?.secret ||
-        payload?.api_key ||
-        (typeof payload === "string" ? payload : null) ||
-        apiKeyResult.data.apiKey ||
-        apiKeyResult.data.key ||
-        apiKeyResult.data.token ||
-        apiKeyResult.data.secret;
-
-      if (!apiKey || typeof apiKey !== "string") {
-        throw Object.assign(
-          new Error(`API key response did not contain a key field; creation outcome is unknown: ${JSON.stringify(apiKeyResult.data).slice(0, 300)}`),
-          { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
-        );
-      }
-      capturedApiKey = apiKey;
-
-      this.setAccountStep(account, "api_key_created", `API key created successfully`);
-      await this.persistJobSnapshot(job, { forcePreview: true });
-
-      // Step 9: Save connection
-      this.setAccountStep(account, "saving_connection", "Saving CodeBuddy CN connection");
-      await this.persistJobSnapshot(job, { forcePreview: true });
-
-      const { connection } = await this.saveConnection({
-        apiKey,
-        phone: account.phone,
-        region: account.region,
-        fiveSimOrderId,
-        account,
-      });
-
-      // Step 10: Finish 5sim order + finalize
-      await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
-
-      this.finalizeAccount(account, "success", {
-        connectionId: connection.id,
-        step: "connection_saved",
-        message: `CodeBuddy CN connection saved (phone: ${account.phone})`,
-      });
-      account.runtimeSession = null;
-      await closeContextOrBrowser(context, job);
-      await this.persistJobSnapshot(job, { forcePreview: true });
-    } catch (error) {
-      // If API key capture fails after registration, the account is registered
-      // but we don't have a key. Surface as needs_manual so the operator can
-      // create the key manually in the opened browser — number is NOT re-bought.
-      const restricted = error?.code === CODEBUDDY_CN_ACCOUNT_RESTRICTED;
-      const outcomeUnknown = error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN;
-      const retryStopped = error?.code === CODEBUDDY_CN_API_KEY_RETRY_STOPPED;
-      const automaticPostStopped = outcomeUnknown || retryStopped;
-      if (restricted) {
-        this.finalizeAccount(account, "failed_restricted", {
-          error: `${error.message}. Use a different residential CN/HK proxy with concurrency 1.`,
-          step: "failed_restricted",
-          message: "Tencent restricted the post-OTP session; API-key capture was not attempted",
-        });
-        await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
-        account.runtimeSession = null;
-        await closeContextOrBrowser(context, job);
-        await this.persistJobSnapshot(job, { forcePreview: true });
-        return;
-      }
-      const failureMessage = outcomeUnknown
-        ? `${error.message}. Check the CodeBuddy keys page before creating another key.`
-        : error.message;
-      if (!automaticPostStopped) {
-        attachCnManualSession(account, context, page);
-      }
-      this.finalizeAccount(account, "needs_manual", {
-        error: `Registration succeeded but API key capture failed: ${failureMessage}`,
-        step: outcomeUnknown
-          ? "api_key_outcome_unknown"
-          : retryStopped
-            ? "api_key_retry_stopped"
-            : "awaiting_manual",
-        message: outcomeUnknown
-          ? `Registration done; API key request outcome is unknown. Check existing keys before retrying.`
-          : retryStopped
-            ? "Registration done; API key request was rate limited. Automatic POST retries stopped."
-          : capturedApiKey
-            ? `API key captured; retrying local connection save without creating another key: ${error.message}`
-            : `Registration done, API key capture failed: ${error.message}`,
-      });
-      // The 5sim order was successful (SMS received) — finish it (no re-order)
-      await settleFiveSimOrder(() => fiveSimClient.finishOrder(fiveSimOrderId));
-      await this.persistJobSnapshot(job, { forcePreview: true });
-
-      if (automaticPostStopped) {
-        // Closing the page aborts any late browser work. Automatic/manual POST
-        // retries are disabled because the key may exist or the API is throttling.
-        account.runtimeSession = null;
-        await closeContextOrBrowser(context, job);
-        return;
-      }
-
-      // Expose the live page through the inherited manual-session endpoint while
-      // the bounded follow-up waits for the operator to finish captcha/login.
-      await this.runCnManualFollowup(
-        job,
-        account,
-        account.workerId,
-        context,
-        page,
-        fiveSimClient,
-        fiveSimOrderId,
-        capturedApiKey,
-      );
-    }
-  }
-
-  /**
-   * Manual followup — operator completes registration/captcha/API-key creation in a
-   * headed browser. We wait for the operator to finish, then try to capture the API key.
-   */
-  async runCnManualFollowup(
-    job,
-    account,
-    workerId,
-    context,
-    page,
-    fiveSimClient,
-    fiveSimOrderId,
-    existingApiKey = null,
-  ) {
-    const followupPromise = (async () => {
-      const closeManualResources = async () => {
-        const ms = account.manualSession;
-        const ctx = ms?.context || context;
-        const headed = ms?.headedBrowser || null;
-        await closeContextOrBrowser(ctx, job);
-        if (headed) await forceCloseBrowser(headed).catch(() => null);
-      };
-
-      try {
-        this.setAccountStep(account, "manual_waiting", "Waiting for operator to complete in headed browser");
-        await this.persistJobSnapshot(job, { forcePreview: true });
-
-        // Wait up to 3 minutes on low-memory hosts, otherwise 8 minutes.
-        const manualTimeoutMs = isLowMemHost()
-          ? CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS
-          : CODEBUDDY_CN_MANUAL_TIMEOUT_MS;
-        const deadline = Date.now() + manualTimeoutMs;
-        let apiKey = typeof existingApiKey === "string" && existingApiKey
-          ? existingApiKey
-          : null;
-        const manualApiKeyName = `zevai-router-manual-${account.workerId || "account"}-${Date.now()}`;
-
-        while (!apiKey && Date.now() < deadline && !job.cancelRequested) {
-          await new Promise((r) => setTimeout(r, 10_000)); // Check every 10s
-
-          // Check if the operator has navigated to the keys page and we can create a key
-          try {
-            const currentUrl = page.url();
-            if (!currentUrl.includes("codebuddy.cn")) continue;
-
-            // Try to create an API key via the console API (include enterprise id)
-            const result = await withTimeoutCleanup(page.evaluate(async ({ keyName, timeoutMs }) => {
-              const controller = new AbortController();
-              const timer = setTimeout(() => controller.abort(), timeoutMs);
-              try {
-                const host = window.location.hostname || "www.codebuddy.cn";
-                const base = host === "www.codebuddy.cn"
-                  ? window.location.origin
-                  : "https://www.codebuddy.cn";
-                const res = await fetch(`${base}/console/api/client/v1/api-keys`, {
-                  method: "POST",
-                  headers: {
-                    "Content-Type": "application/json",
-                    Accept: "application/json, text/plain, */*",
-                    "x-requested-with": "XMLHttpRequest",
-                    "X-Domain": "www.codebuddy.cn",
-                    "X-Product": "SaaS",
-                  },
-                  credentials: "include",
-                  signal: controller.signal,
-                  body: JSON.stringify({
-                    name: keyName,
-                    expire_in_days: 365,
-                    user_enterprise_id: "personal-edition-user-id",
-                  }),
-                });
-                const data = await res.json().catch(() => null);
-                return { ok: res.ok, status: res.status, data };
-              } catch (error) {
-                return {
-                  ok: false,
-                  status: 0,
-                  outcomeUnknown: true,
-                  error: error?.message || String(error),
-                };
-              } finally {
-                clearTimeout(timer);
-              }
-            }, {
-              keyName: manualApiKeyName,
-              timeoutMs: CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS,
-            }), {
-              timeoutMs: CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS,
-              message: "Manual API key request timed out; creation outcome is unknown",
-              code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN,
-            });
-
-            if (result?.outcomeUnknown) {
-              throw Object.assign(
-                new Error(`Manual API key request lost its response; creation outcome is unknown: ${result.error || "network error"}`),
-                { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
-              );
-            }
-
-            assertAutomaticApiKeyRetrySafe(result, "Manual API key request");
-
-            if (result?.ok) {
-              const payload = result.data?.data || result.data;
-              apiKey =
-                payload?.apiKey ||
-                payload?.key ||
-                payload?.token ||
-                payload?.secret ||
-                payload?.api_key ||
-                (typeof payload === "string" ? payload : null);
-              if (apiKey && typeof apiKey === "string") break;
-              throw Object.assign(
-                new Error("Manual API key response was successful but did not contain the key; creation outcome is unknown"),
-                { code: CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN },
-              );
-            }
-          } catch (error) {
-            if (isApiKeyPostRetryStopped(error)) throw error;
-            // Operator might still be completing — keep waiting
-          }
-        }
-
-        if (job.cancelRequested) {
-          this.finalizeAccount(account, "cancelled", {
-            error: "Job cancelled",
-            step: "cancelled",
-            message: "Job cancelled while waiting for manual completion",
-          });
-          await this.persistJobSnapshot(job, { forcePreview: true });
-          return;
-        }
-
-        if (!apiKey) {
-          throw new Error("Manual assist timed out — could not capture API key");
-        }
-
-        // Save connection
-        this.setAccountStep(account, "saving_connection", "Saving CodeBuddy CN connection (manual)");
-        await this.persistJobSnapshot(job, { forcePreview: true });
-
-        const { connection } = await this.saveConnection({
-          apiKey,
-          phone: account.phone,
-          region: account.region,
-          fiveSimOrderId,
-          account,
-        });
-
-        this.finalizeAccount(account, "success", {
-          connectionId: connection.id,
-          step: "connection_saved",
-          message: `CodeBuddy CN connection saved via manual assist (phone: ${account.phone || "N/A"})`,
-        });
-        await this.persistJobSnapshot(job, { forcePreview: true });
-      } catch (error) {
-        if (job.cancelRequested) {
-          this.finalizeAccount(account, "cancelled", {
-            error: "Job cancelled",
-            step: "cancelled",
-            message: "Job cancelled while waiting for manual completion",
-          });
-        } else if (isApiKeyPostRetryStopped(error)) {
-          this.finalizeAccount(account, "needs_manual", {
-            error: `${error.message}. Check existing CodeBuddy keys before retrying manually.`,
-            step: error?.code === CODEBUDDY_CN_API_KEY_OUTCOME_UNKNOWN
-              ? "api_key_outcome_unknown"
-              : "api_key_retry_stopped",
-            message: "Manual API key POST retries stopped",
-          });
-        } else {
-          this.finalizeAccount(account, "failed", {
-            error: error.message || "Manual assist flow failed",
-            step: "failed",
-            message: error.message || "Manual assist flow failed",
-          });
-        }
-        await this.persistJobSnapshot(job, { forcePreview: true });
-      } finally {
-        await closeManualResources();
-        account.manualSession = null;
-        account.runtimeSession = null;
-        job.manualFollowups.delete(followupPromise);
-        await this.persistJobSnapshot(job, { forcePreview: true });
-      }
-    })();
-
-    job.manualFollowups.add(followupPromise);
-  }
-
-  /**
-   * Proxy-bound CN jobs are intentionally single-worker. Recycle the whole
-   * CloakBrowser process between accounts so the binary GeoIP/WebRTC profile
-   * always belongs to the same proxy as the account context.
-   */
-  async runWorker(job, workerId) {
-    if (!requiresIsolatedProxyBrowser(job)) {
-      return super.runWorker(job, workerId);
-    }
-
-    while (!job.cancelRequested) {
-      const account = this.dequeueAccount(job, workerId);
-      if (!account) return;
-
-      if (!job.browser) {
-        try {
-          job.browser = await this.browserLauncher({
-            ...job,
-            proxyUrls: account.proxyUrl ? [account.proxyUrl] : job.proxyUrls,
-          });
-        } catch (error) {
-          this.finalizeAccount(account, "failed", {
-            error: error?.message || "Manual proxy browser launch failed",
-            step: "failed",
-            message: error?.message || "Manual proxy browser launch failed",
-          });
-          await this.persistJobSnapshot(job, { forcePreview: true });
-          continue;
-        }
-      }
-
-      try {
-        await this.processAccount(job, account, workerId);
-      } catch (error) {
-        if (account.status === "running") {
-          this.finalizeAccount(account, "failed", {
-            error: error?.message || "Unexpected manual proxy worker failure",
-            step: "failed",
-            message: error?.message || "Unexpected manual proxy worker failure",
-          });
-          await this.persistJobSnapshot(job, { forcePreview: true });
-        }
-      } finally {
-        if (job.manualFollowups.size > 0) {
-          await Promise.allSettled([...job.manualFollowups]);
-        }
-
-        if (job.browser) {
-          const browser = job.browser;
-          job.browser = null;
-          await forceCloseBrowser(browser).catch(() => null);
-        }
-      }
-    }
-  }
-
-  shouldPrelaunchBrowser(job) {
-    return !requiresIsolatedProxyBrowser(job);
-  }
-
-  /**
-   * Override cancelJob to abort in-flight 5sim polls AND force-close the browser.
-   * Previous CN override only aborted controllers — Chromium kept spinning (VPS hang).
-   */
-  cancelJob(jobId) {
-    const job = this.jobs.get(jobId);
-    if (!job) return null;
-
-    job.cancelRequested = true;
-
-    // Abort in-flight 5sim polls and capture every live resource before the
-    // session fields are cleared. Manual assist may have relaunched a separate
-    // headed browser that is not the job browser.
-    for (const account of job.accounts) {
-      if (account.abortController && !account.abortController.signal.aborted) {
-        account.abortController.abort();
-      }
-      const manualSession = account.manualSession;
-      const runtimeSession = account.runtimeSession;
-      const contexts = new Set([
-        manualSession?.context,
-        runtimeSession?.context,
-      ].filter(Boolean));
-      const ownedBrowsers = new Set([
-        manualSession?.headedBrowser,
-        manualSession?.ownedBrowser,
-      ].filter(Boolean));
-      void Promise.allSettled([
-        ...[...contexts].map((context) => closeResourceBounded(context)),
-        ...[...ownedBrowsers].map((browser) => forceCloseBrowser(browser)),
-      ]);
-      account.runtimeSession = null;
-      account.manualSession = null;
-      if (ACTIVE_CN_ACCOUNT_STATUSES.has(account.status)) {
-        this.finalizeAccount(account, "cancelled", {
-          error: "Job cancelled",
-          step: "cancelled",
-          message: "Job cancelled by user",
-        });
-      }
-    }
-
-    // CRITICAL: force-kill Chromium. Graceful close alone hangs when nav is stuck.
-    if (job.browser) {
-      const browser = job.browser;
-      job.browser = null;
-      void forceCloseBrowser(browser).catch(() => null);
-    }
-
-    if (ACTIVE_CN_JOB_STATUSES.has(job.status)) {
-      job.status = "cancelled";
-      job.finishedAt = job.finishedAt || nowIso();
-    }
-
-    void this.persistJobSnapshot(job, { forcePreview: true });
-    return sanitizeCnJob(job);
-  }
-}
-
-// ─── Helpers ──────────────────────────────────────────────────────────────
-
-function defaultFiveSimClientFactory({ apiKey, proxyOptions }) {
-  return new FiveSimClient({ apiKey, proxyOptions });
-}
-
-/**
- * Sanitize a job for API response (strip non-serializable fields like
- * AbortController, runtimeSession, etc.).
- */
-function buildCnSummary(accounts = []) {
-  const summary = {
-    total: accounts.length,
-    queued: 0,
-    running: 0,
-    completed: 0,
-    success: 0,
-    failed: 0,
-    needs_manual: 0,
-    cancelled: 0,
-  };
-  for (const account of accounts) {
-    const status = account.status || "queued";
-    if (status === "success") {
-      summary.success += 1;
-      summary.completed += 1;
-    } else if (status.startsWith("failed")) {
-      summary.failed += 1;
-      summary.completed += 1;
-    } else if (status === "needs_manual") {
-      summary.needs_manual += 1;
-    } else if (status === "cancelled") {
-      summary.cancelled += 1;
-      summary.completed += 1;
-    } else if (status === "running") {
-      summary.running += 1;
-    } else {
-      summary.queued += 1;
-    }
-  }
-  return summary;
-}
-
-function sanitizeCnJob(job, extras = {}) {
-  if (!job) return null;
-  return {
-    jobId: job.jobId,
-    status: job.status,
-    summary: buildCnSummary(job.accounts),
-    concurrency: job.concurrency,
-    proxyPoolMode: job.proxyPoolMode,
-    region: job.region,
-    createdAt: job.createdAt,
-    startedAt: job.startedAt,
-    finishedAt: job.finishedAt,
-    error: redactCredentialText(job.error),
-    cancelRequested: job.cancelRequested,
-    accounts: (job.accounts || []).map((account) => ({
-      line: account.line,
-      region: account.region,
-      phone: account.phone,
-      fiveSimOrderId: account.fiveSimOrderId,
-      proxyUrl: account.proxyUrl ? maskProxyUrl(account.proxyUrl) : null,
-      egressIp: account.egressIp || null,
-      proxyTimezone: account.proxyTimezone || null,
-      proxyLocale: account.proxyLocale || null,
-      status: account.status,
-      error: redactCredentialText(account.error),
-      connectionId: account.connectionId,
-      workerId: account.workerId,
-      manualSessionAvailable: !!account.manualSession,
-      currentStep: account.currentStep,
-      updatedAt: account.updatedAt,
-      logs: (account.logs || []).map((entry) => ({
-        ...entry,
-        message: redactCredentialText(entry.message),
-      })),
-    })),
-    preview: extras.preview !== undefined ? extras.preview : (job.lastPreview || null),
-    ...extras,
-  };
-}
-
-function maskProxyUrl(url) {
-  if (!url) return null;
-  const raw = String(url);
-  const maskMalformed = () => raw.length > 20
-    ? `${raw.slice(0, 10)}***${raw.slice(-10)}`
-    : "***";
-  try {
-    const parsed = new URL(raw);
-    if (!/^(https?|socks4|socks5):$/.test(parsed.protocol)) {
-      return maskMalformed();
-    }
-    return redactCredentialUrl(raw);
-  } catch {
-    return maskMalformed();
-  }
-}
-
-// ─── Singleton ────────────────────────────────────────────────────────────
-
-function getSingletonStore() {
-  if (!globalThis.__codeBuddyCnBulkImportSingleton) {
-    globalThis.__codeBuddyCnBulkImportSingleton = {
-      manager: new CodeBuddyCnBulkImportManager(),
-    };
-  }
-  return globalThis.__codeBuddyCnBulkImportSingleton;
-}
-
-export function getCodeBuddyCnBulkImportManager() {
-  return getSingletonStore().manager;
-}
-
-export {
-  buildLookupResponse,
-  CODEBUDDY_CN_DEFAULT_CONCURRENCY,
-  CODEBUDDY_CN_MAX_CONCURRENCY,
-  CODEBUDDY_CN_MIN_CONCURRENCY,
-  CODEBUDDY_CN_MAX_COUNT,
-  SUPPORTED_REGIONS,
-  DEFAULT_REGION,
-};
-
-export const __test__ = {
-  clampCnConcurrency,
-  resolveCnJobConcurrency,
-  requiresIsolatedProxyBrowser,
-  requireSelectedProxy,
-  assertAutomaticApiKeyRetrySafe,
-  sanitizeCnJob,
-  defaultPhoneFormatter,
-  defaultSaveCodeBuddyCnConnection,
-  buildCnSummary,
-  hasRestrictedConsoleEvidence,
-  isLoginHtmlProbe,
-  parseEgressIp,
-  parseConsoleProbeBody,
-  probeCodeBuddyProxyEgress,
-  probeCodeBuddyConsoleAccounts,
-  requireStableProxyEgress,
-  withTimeoutCleanup,
-  attachCnManualSession,
-  findLatestPersistedCnJobId,
-  AUTOMATION_LIMITS: {
-    registrationHardTimeoutMs: CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS,
-    browserLaunchTimeoutMs: CODEBUDDY_CN_BROWSER_LAUNCH_TIMEOUT_MS,
-    contextTimeoutMs: CODEBUDDY_CN_CONTEXT_TIMEOUT_MS,
-    consoleNavTimeoutMs: CODEBUDDY_CN_CONSOLE_NAV_TIMEOUT_MS,
-    consoleProbeTimeoutMs: CODEBUDDY_CN_CONSOLE_PROBE_TIMEOUT_MS,
-    apiKeyRequestTimeoutMs: CODEBUDDY_CN_API_KEY_REQUEST_TIMEOUT_MS,
-    oidcMaxAttempts: CODEBUDDY_CN_OIDC_MAX_ATTEMPTS,
-    apiRehandoffRounds: CODEBUDDY_CN_API_REHANDOFF_ROUNDS,
-    manualTimeoutMs: CODEBUDDY_CN_MANUAL_TIMEOUT_MS,
-    lowMemoryManualTimeoutMs: CODEBUDDY_CN_LOW_MEM_MANUAL_TIMEOUT_MS,
-    resourceCloseTimeoutMs: CODEBUDDY_CN_RESOURCE_CLOSE_TIMEOUT_MS,
-    fiveSimSettleTimeoutMs: CODEBUDDY_CN_FIVESIM_SETTLE_TIMEOUT_MS,
-    egressProbeTimeoutMs: CODEBUDDY_CN_EGRESS_PROBE_TIMEOUT_MS,
-  },
-};