zevairouter 1.0.61 → 1.0.65

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -31,7 +31,7 @@ import {
 } from "./kiroBulkImportManager.js";
 import { getProxyPools, getProxyPoolById } from "../../../models/index.js";
 import { getSettings } from "../../localDb.js";
-import { getOptimalWorkerCount, isAutoConcurrencyValue } from "../../systemSpecs.js";
+import { getOptimalWorkerCount, getSystemSpecs, isAutoConcurrencyValue } from "../../systemSpecs.js";
 import { CODEBUDDY_CN_CONFIG } from "../constants/oauth.js";
 import { FiveSimClient, FiveSimTimeoutError } from "./fiveSimClient.js";
 import { runCodeBuddyCnPhoneRegistration } from "./codebuddyCnPhoneAutomation.js";
@@ -40,15 +40,18 @@ import {
   defaultPollForToken,
   fetchCodeBuddyLoginAccount,
 } from "./codebuddyBulkImportManager.js";
+import { forceCloseBrowser } from "./bulkImportBrowserEngine.js";
 
 const CODEBUDDY_CN_PROVIDER_ID = "codebuddy-cn";
 const CODEBUDDY_CN_LABEL = "CodeBuddy CN";
 const CODEBUDDY_CN_DOMAIN = "www.codebuddy.cn";
 
-// Override default concurrency to 2 (5sim rating system — keep buys conservative)
-const CODEBUDDY_CN_DEFAULT_CONCURRENCY = 2;
+// Default concurrency 1 — Camoufox alone can pin a 2GB VPS; multi-worker OOM/hang.
+const CODEBUDDY_CN_DEFAULT_CONCURRENCY = 1;
 const CODEBUDDY_CN_MAX_CONCURRENCY = 8;
 const CODEBUDDY_CN_MIN_CONCURRENCY = 1;
+// Hosts under this RAM hard-cap concurrency at 1 (typical cheap VPS = 1.9–2GB).
+const CODEBUDDY_CN_LOW_MEM_GB = 3;
 
 // Cap on count per job (bound cost/rate)
 const CODEBUDDY_CN_MAX_COUNT = 200;
@@ -61,6 +64,13 @@ const CODEBUDDY_CN_POLL_TIMEOUT_MS = 15 * 60_000;
 // input phone, click send code takes ~15-20s before SMS is actually requested).
 const CODEBUDDY_CN_SMS_TIMEOUT_MS = 90_000;
 
+// Hard wall-clock per account (nav + form + SMS + API key). Prevents infinite
+// Camoufox spin when proxy/nav blackholes and Playwright timeouts do not fire.
+const CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS = Number.parseInt(
+  process.env.ZEVAI_CN_ACCOUNT_TIMEOUT_MS || "",
+  10,
+) || 12 * 60_000;
+
 // Supported 5sim regions
 const SUPPORTED_REGIONS = new Set(["hongkong", "china", "any"]);
 const DEFAULT_REGION = "hongkong";
@@ -81,14 +91,26 @@ function defaultPhoneFormatter(phone) {
   return String(phone || "").trim();
 }
 
+function isLowMemHost() {
+  try {
+    const { totalMemGb } = getSystemSpecs();
+    return Number.isFinite(totalMemGb) && totalMemGb > 0 && totalMemGb < CODEBUDDY_CN_LOW_MEM_GB;
+  } catch {
+    return false;
+  }
+}
+
 function clampCnConcurrency(value) {
+  const lowMem = isLowMemHost();
+  const hardMax = lowMem ? 1 : CODEBUDDY_CN_MAX_CONCURRENCY;
+  const def = lowMem ? 1 : CODEBUDDY_CN_DEFAULT_CONCURRENCY;
   if (isAutoConcurrencyValue(value)) {
     const optimal = getOptimalWorkerCount();
-    return Math.min(CODEBUDDY_CN_MAX_CONCURRENCY, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, optimal));
+    return Math.min(hardMax, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, optimal));
   }
   const parsed = Number.parseInt(value, 10);
-  if (!Number.isFinite(parsed)) return CODEBUDDY_CN_DEFAULT_CONCURRENCY;
-  return Math.min(CODEBUDDY_CN_MAX_CONCURRENCY, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, parsed));
+  if (!Number.isFinite(parsed)) return Math.min(hardMax, def);
+  return Math.min(hardMax, Math.max(CODEBUDDY_CN_MIN_CONCURRENCY, parsed));
 }
 
 /**
@@ -140,17 +162,23 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
     pollIntervalMs = CODEBUDDY_CN_CONFIG.pollInterval,
     storageName = "codebuddy-cn-bulk-import",
   } = {}) {
-    // Camoufox needs proxy on browser launch (not context-only). Headed small
-    // window so operator can watch like other bulk automations (not fullscreen).
+    // Camoufox needs proxy on browser launch (not context-only).
+    // Linux VPS: default headless to cut RAM/CPU (2GB boxes OOM on headed+Xvfb).
+    // Desktop (macOS/Windows): headed so the operator can watch / solve captcha.
+    // Override: ZEVAI_CN_HEADLESS=0|1
     const cnBrowserLauncher = browserLauncher || (async (job) => {
       const { launchBulkImportBrowser } = await import("./bulkImportBrowserEngine.js");
       const proxyUrl = Array.isArray(job?.proxyUrls) && job.proxyUrls.length
         ? job.proxyUrls[0]
         : null;
+      const envHeadless = process.env.ZEVAI_CN_HEADLESS;
+      let headless = process.platform === "linux";
+      if (envHeadless === "0" || envHeadless === "false") headless = false;
+      if (envHeadless === "1" || envHeadless === "true") headless = true;
       return launchBulkImportBrowser({
         engine: job?.engine || "camoufox",
         proxyUrl,
-        headless: false,
+        headless,
         windowSize: { width: 900, height: 700 },
       });
     });
@@ -338,60 +366,94 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       this.setAccountStep(account, "registering", "Running phone registration on CodeBuddy CN");
       await this.persistJobSnapshot(job, { forcePreview: true });
 
-      const automationResult = await this.phoneAutomation({
-        page,
-        resolvePhone: async () => {
-          if (job.cancelRequested) {
-            throw new Error("Job cancelled before ordering phone number");
-          }
-          this.setAccountStep(
-            account,
-            "ordering_number",
-            `Form ready — ordering ${job.region} phone from 5sim (single buy)`,
-          );
-          await this.persistJobSnapshot(job, { forcePreview: true });
+      // Page-level timeouts so a stuck network never outlives the hard wall-clock.
+      try {
+        page.setDefaultTimeout(20_000);
+        page.setDefaultNavigationTimeout(45_000);
+      } catch {
+        // older playwright builds may not expose these
+      }
 
-          const numberData = await fiveSimClient.buyNumber({
-            country: job.region,
-            product: "codebuddy",
-            allowProductFallback: false,
-          });
-          fiveSimOrderId = numberData.id;
-          account.phone = numberData.phone;
-          account.fiveSimOrderId = numberData.id;
-          account.fiveSimActivationId = numberData.id;
-          this.setAccountStep(
-            account,
-            "number_ordered",
-            `Phone number ordered: ${numberData.phone} (1 buy, no re-order)`,
-          );
-          await this.persistJobSnapshot(job, { forcePreview: true });
-          return numberData.phone;
-        },
-        waitForSms: async () => {
-          if (!fiveSimOrderId) {
-            throw new Error("Cannot poll SMS — no 5sim order id");
-          }
-          this.setAccountStep(
-            account,
-            "sms_poll_started",
-            `SMS poll started (full ${CODEBUDDY_CN_SMS_TIMEOUT_MS / 1000}s window after send-code)`,
+      const hardTimeoutMs = CODEBUDDY_CN_ACCOUNT_HARD_TIMEOUT_MS;
+      let hardTimer = null;
+      const hardTimeoutPromise = new Promise((_, reject) => {
+        hardTimer = setTimeout(() => {
+          reject(
+            Object.assign(
+              new Error(
+                `CodeBuddy CN account hard timeout after ${Math.round(hardTimeoutMs / 1000)}s (browser will be force-closed)`,
+              ),
+              { code: "CN_ACCOUNT_HARD_TIMEOUT" },
+            ),
           );
-          await this.persistJobSnapshot(job, { forcePreview: false });
-          const code = await fiveSimClient.pollCode(fiveSimOrderId, {
-            timeoutMs: CODEBUDDY_CN_SMS_TIMEOUT_MS,
-            signal: account.abortController?.signal,
-          });
-          smsReceived = true;
-          return code;
-        },
-        onStep: (step, message) => {
-          this.setAccountStep(account, step, message);
-          void this.persistJobSnapshot(job, { forcePreview: false });
-        },
-        phoneFormatter: this.phoneFormatter,
+        }, hardTimeoutMs);
+        if (typeof hardTimer.unref === "function") hardTimer.unref();
       });
 
+      let automationResult;
+      try {
+        automationResult = await Promise.race([
+          this.phoneAutomation({
+            page,
+            signal: account.abortController?.signal,
+            isCancelled: () => job.cancelRequested === true,
+            resolvePhone: async () => {
+              if (job.cancelRequested) {
+                throw new Error("Job cancelled before ordering phone number");
+              }
+              this.setAccountStep(
+                account,
+                "ordering_number",
+                `Form ready — ordering ${job.region} phone from 5sim (single buy)`,
+              );
+              await this.persistJobSnapshot(job, { forcePreview: true });
+
+              const numberData = await fiveSimClient.buyNumber({
+                country: job.region,
+                product: "codebuddy",
+                allowProductFallback: false,
+              });
+              fiveSimOrderId = numberData.id;
+              account.phone = numberData.phone;
+              account.fiveSimOrderId = numberData.id;
+              account.fiveSimActivationId = numberData.id;
+              this.setAccountStep(
+                account,
+                "number_ordered",
+                `Phone number ordered: ${numberData.phone} (1 buy, no re-order)`,
+              );
+              await this.persistJobSnapshot(job, { forcePreview: true });
+              return numberData.phone;
+            },
+            waitForSms: async () => {
+              if (!fiveSimOrderId) {
+                throw new Error("Cannot poll SMS — no 5sim order id");
+              }
+              this.setAccountStep(
+                account,
+                "sms_poll_started",
+                `SMS poll started (full ${CODEBUDDY_CN_SMS_TIMEOUT_MS / 1000}s window after send-code)`,
+              );
+              await this.persistJobSnapshot(job, { forcePreview: false });
+              const code = await fiveSimClient.pollCode(fiveSimOrderId, {
+                timeoutMs: CODEBUDDY_CN_SMS_TIMEOUT_MS,
+                signal: account.abortController?.signal,
+              });
+              smsReceived = true;
+              return code;
+            },
+            onStep: (step, message) => {
+              this.setAccountStep(account, step, message);
+              void this.persistJobSnapshot(job, { forcePreview: false });
+            },
+            phoneFormatter: this.phoneFormatter,
+          }),
+          hardTimeoutPromise,
+        ]);
+      } finally {
+        if (hardTimer) clearTimeout(hardTimer);
+      }
+
       // Step 6: Try API key capture only if automation reached at least the submit step.
       // If automation failed early (e.g. page.goto timeout), the session won't be logged in
       // and API key creation will 401 — so don't waste time. Only try bypass if automation
@@ -446,6 +508,15 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       }
       account.runtimeSession = null;
       if (context) await context.close().catch(() => null);
+      // Hard timeout / blackhole nav: kill the shared browser so the worker unblocks
+      // and Camoufox cannot pin 100% CPU on a 2GB VPS until reboot.
+      if (error?.code === "CN_ACCOUNT_HARD_TIMEOUT" || job.cancelRequested) {
+        if (job.browser) {
+          const b = job.browser;
+          job.browser = null;
+          await forceCloseBrowser(b).catch(() => null);
+        }
+      }
       await this.persistJobSnapshot(job, { forcePreview: true });
     }
   }
@@ -527,7 +598,9 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       let accountsProbe = null;
       let sessionReady = false;
 
-      for (let attempt = 0; attempt < 18; attempt += 1) {
+      // Cap OIDC nudge loop — 18 × multi-second waits was too long on 2GB VPS.
+      const OIDC_MAX_ATTEMPTS = 8;
+      for (let attempt = 0; attempt < OIDC_MAX_ATTEMPTS; attempt += 1) {
         if (job.cancelRequested) {
           throw new Error("Job cancelled while establishing session");
         }
@@ -538,29 +611,29 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
 
         // Progressive navigation to complete half-finished Keycloak login
         const path = oIDCNudgePaths[Math.min(attempt, oIDCNudgePaths.length - 1)];
-        if (attempt === 0 || attempt === 2 || attempt === 5 || attempt === 8 || attempt === 12) {
+        if (attempt === 0 || attempt === 2 || attempt === 4 || attempt === 6) {
           this.setAccountStep(
             account,
             "waiting_session",
-            `OIDC handoff attempt ${attempt + 1}/18 → ${path} (cookies: ${strong ? "KEYCLOAK" : soft ? "soft-session" : "weak"})`,
+            `OIDC handoff attempt ${attempt + 1}/${OIDC_MAX_ATTEMPTS} → ${path} (cookies: ${strong ? "KEYCLOAK" : soft ? "soft-session" : "weak"})`,
           );
           await this.persistJobSnapshot(job, { forcePreview: false });
-          await page.goto(path, { waitUntil: "domcontentloaded", timeout: 45_000 }).catch(() => null);
-          await page.waitForTimeout(2_500);
+          await page.goto(path, { waitUntil: "domcontentloaded", timeout: 25_000 }).catch(() => null);
+          await page.waitForTimeout(1_500);
 
           // If Keycloak login iframe reappears, user session is not complete —
           // don't treat blank SPA as success; keep probing.
         } else {
-          await page.waitForTimeout(1_500);
+          await page.waitForTimeout(1_000);
         }
 
         // Prefer landing on console for the API probe
-        if (attempt >= 3 && !String(page.url() || "").includes("/console")) {
+        if (attempt >= 2 && !String(page.url() || "").includes("/console")) {
           await page.goto("https://www.codebuddy.cn/console", {
             waitUntil: "domcontentloaded",
-            timeout: 45_000,
+            timeout: 25_000,
           }).catch(() => null);
-          await page.waitForTimeout(1_500);
+          await page.waitForTimeout(1_000);
         }
 
         accountsProbe = await probeConsoleAccounts();
@@ -579,7 +652,7 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         this.setAccountStep(
           account,
           "resolving_enterprise",
-          `Console not ready (HTTP ${accountsProbe?.status || 0}) — retry ${attempt + 1}/18`,
+          `Console not ready (HTTP ${accountsProbe?.status || 0}) — retry ${attempt + 1}/${OIDC_MAX_ATTEMPTS}`,
         );
         await this.persistJobSnapshot(job, { forcePreview: false });
       }
@@ -854,7 +927,8 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
   }
 
   /**
-   * Override cancelJob to abort in-flight 5sim polls and clean up orders.
+   * Override cancelJob to abort in-flight 5sim polls AND force-close the browser.
+   * Previous CN override only aborted controllers — Camoufox kept spinning (VPS hang).
    */
   cancelJob(jobId) {
     const job = this.jobs.get(jobId);
@@ -862,11 +936,24 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
 
     job.cancelRequested = true;
 
-    // Abort in-flight 5sim polls for all running accounts
+    // Abort in-flight 5sim polls + close per-account contexts
     for (const account of job.accounts) {
       if (account.abortController && !account.abortController.signal.aborted) {
         account.abortController.abort();
       }
+      const ctx = account.runtimeSession?.context;
+      if (ctx) {
+        void ctx.close().catch(() => null);
+      }
+      account.runtimeSession = null;
+      account.manualSession = null;
+    }
+
+    // CRITICAL: force-kill Camoufox/Chromium. Graceful close alone hangs when nav is stuck.
+    if (job.browser) {
+      const browser = job.browser;
+      job.browser = null;
+      void forceCloseBrowser(browser).catch(() => null);
     }
 
     if (job.status === "queued") {
@@ -876,7 +963,9 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         if (account.status === "queued") account.status = "cancelled";
       });
     }
-    return job;
+
+    void this.persistJobSnapshot(job, { forcePreview: true });
+    return sanitizeCnJob(job);
   }
 }
 

package/src/lib/oauth/services/codebuddyCnPhoneAutomation.js

@@ -43,9 +43,10 @@ const CODEBUDDY_CN_LOGIN_URL_FALLBACKS = [
   "https://www.codebuddy.cn/register/",
   "https://copilot.tencent.com/login/",
 ];
-const NAV_MAX_ATTEMPTS = 5;
-const NAV_TIMEOUT_MS = 60_000;
-const SPA_TIMEOUT_MS = 60_000;
+// Keep short on VPS so a blackholed proxy cannot pin CPU for many minutes.
+const NAV_MAX_ATTEMPTS = 2;
+const NAV_TIMEOUT_MS = 30_000;
+const SPA_TIMEOUT_MS = 25_000;
 
 // Main page selectors (outside iframe)
 const PHONE_TAB_SELECTORS = [
@@ -139,17 +140,34 @@ export async function runCodeBuddyCnPhoneRegistration({
   onStep,
   phoneFormatter = (p) => p,
   timeouts = {},
+  signal = null,
+  isCancelled = null,
 }) {
-  const nav = timeouts.nav ?? 90_000;
+  const nav = timeouts.nav ?? NAV_TIMEOUT_MS;
   const action = timeouts.action ?? 15_000;
   const codeWait = timeouts.codeWait ?? 900_000;
   const postSubmit = timeouts.postSubmit ?? 10_000;
 
   const reportStep = (step, message) => onStep?.(step, message);
+  const throwIfCancelled = () => {
+    if (signal?.aborted || (typeof isCancelled === "function" && isCancelled())) {
+      const err = new Error("Job cancelled");
+      err.code = "JOB_CANCELLED";
+      throw err;
+    }
+  };
 
   try {
     // Step 1: Navigate — rotating proxy often fails first try; retry until SPA boots
     reportStep("cn_opening_login_page", "Opening CodeBuddy CN login page");
+    throwIfCancelled();
+
+    try {
+      page.setDefaultNavigationTimeout(nav);
+      page.setDefaultTimeout(action);
+    } catch {
+      // ignore
+    }
 
     // ponytail: China residential proxies hang on Google tracker CONNECT; abort them so SPA can boot
     try {
@@ -166,6 +184,7 @@ export async function runCodeBuddyCnPhoneRegistration({
 
     let phoneFrame = null;
     for (let navAttempt = 1; navAttempt <= NAV_MAX_ATTEMPTS; navAttempt++) {
+      throwIfCancelled();
       try {
         const targetUrl = CODEBUDDY_CN_LOGIN_URL_FALLBACKS[(navAttempt - 1) % CODEBUDDY_CN_LOGIN_URL_FALLBACKS.length];
         reportStep("cn_nav_attempt", `Navigation attempt ${navAttempt}/${NAV_MAX_ATTEMPTS} → ${targetUrl}`);
@@ -173,20 +192,23 @@ export async function runCodeBuddyCnPhoneRegistration({
         // Between retries, hard-reload by clearing cookies for codebuddy so CDN/session glitches reset
         if (navAttempt > 1) {
           await page.context().clearCookies().catch(() => {});
-          await page.waitForTimeout(1_500);
+          await page.waitForTimeout(800);
         }
 
         // commit only — domcontentloaded stalls when any subresource (ads/CDN) hangs via proxy
         await page.goto(targetUrl, {
           waitUntil: "commit",
-          timeout: NAV_TIMEOUT_MS,
+          timeout: nav,
         });
+        throwIfCancelled();
 
         // Give the SPA a short moment to mount React/Vue after document commit
-        await page.waitForTimeout(2_500);
+        await page.waitForTimeout(1_500);
+        throwIfCancelled();
 
         // SPA shell loads first; wait for any login UI marker (not networkidle — long-lived sockets)
         const spaReady = await waitForAnyVisible(page, SPA_READY_SELECTORS, SPA_TIMEOUT_MS);
+        throwIfCancelled();
         if (!spaReady) {
           const bodyText = await page.locator("body").innerText().catch(() => "");
           const htmlLen = await page.evaluate(() => document.documentElement?.outerHTML?.length || 0).catch(() => 0);
@@ -204,23 +226,23 @@ export async function runCodeBuddyCnPhoneRegistration({
 
         // Step 2: Switch to phone-number tab
         reportStep("cn_selecting_phone_tab", "Selecting phone-number tab");
-        const phoneTab = await waitForFirstVisibleLocator(page, PHONE_TAB_SELECTORS, { timeout: 15_000 });
+        const phoneTab = await waitForFirstVisibleLocator(page, PHONE_TAB_SELECTORS, { timeout: 12_000 });
         if (phoneTab) {
           await phoneTab.click().catch(() => {});
           reportStep("cn_phone_tab_selected", "Phone tab selected");
-          await page.waitForTimeout(1_000);
+          await page.waitForTimeout(800);
         } else {
           reportStep("cn_phone_tab_not_found", "Phone tab not found — checking if iframe already present");
         }
 
         // Step 3: Wait for Keycloak phone iframe
         reportStep("cn_waiting_for_iframe", "Waiting for phone iframe to load");
-        await page.locator(PHONE_IFRAME_SELECTOR).waitFor({ state: "attached", timeout: 25_000 }).catch(() => {});
+        await page.locator(PHONE_IFRAME_SELECTOR).waitFor({ state: "attached", timeout: 18_000 }).catch(() => {});
         phoneFrame = await getPhoneFrame(page);
         if (phoneFrame) {
           // Confirm phone input is actually inside the iframe
           const phoneInputReady = await phoneFrame
-            .waitForSelector(IFRAME_PHONE_INPUT, { state: "visible", timeout: 20_000 })
+            .waitForSelector(IFRAME_PHONE_INPUT, { state: "visible", timeout: 15_000 })
             .then(() => true)
             .catch(() => false);
           if (phoneInputReady) {
@@ -233,6 +255,7 @@ export async function runCodeBuddyCnPhoneRegistration({
           reportStep("cn_iframe_missing", `No #phone-iframe (attempt ${navAttempt}/${NAV_MAX_ATTEMPTS})`);
         }
       } catch (navErr) {
+        if (navErr?.code === "JOB_CANCELLED") throw navErr;
         reportStep(
           "cn_nav_retry",
           `Navigation attempt ${navAttempt}/${NAV_MAX_ATTEMPTS} failed: ${String(navErr.message || navErr).slice(0, 120)}`,
@@ -383,13 +406,12 @@ export async function runCodeBuddyCnPhoneRegistration({
     reportStep("cn_code_entered", "Verification code entered");
 
     // Step 9: Click submit (#kc-login)
-    // Retry up to 3 times if "account restricted" (账号访问受限) is shown —
-    // refresh + re-enter phone + code each time (SMS code valid for 5 min).
-    // After a clean submit, poll up to SESSION_WAIT_MS for Keycloak cookies —
-    // China residential proxies often leave a blank SPA shell for 5–15s before
-    // the OIDC handoff sets KEYCLOAK_IDENTITY (previous 2s check was too short).
-    const MAX_SUBMIT_RETRIES = 3;
-    const SESSION_WAIT_MS = Math.max(postSubmit, 20_000);
+    // Retry a couple times if "account restricted" (账号访问受限) is shown —
+    // but do not thrash: datacenter/VPS IPs usually stay restricted until a real
+    // residential CN proxy is used. Keep the loop short so Camoufox cannot pin RAM.
+    // After a clean submit, poll for Keycloak cookies (China proxy SPA shell lag).
+    const MAX_SUBMIT_RETRIES = 2;
+    const SESSION_WAIT_MS = Math.max(postSubmit, 12_000);
     let submitSuccess = false;
     for (let retry = 0; retry < MAX_SUBMIT_RETRIES; retry++) {
       reportStep("cn_submitting", `Clicking submit button (attempt ${retry + 1}/${MAX_SUBMIT_RETRIES})`);
@@ -447,13 +469,20 @@ export async function runCodeBuddyCnPhoneRegistration({
       // Check for "account restricted" (账号访问受限)
       const restrictionDetected = await checkAccountRestricted(currentFrame);
       if (restrictionDetected) {
+        if (retry >= MAX_SUBMIT_RETRIES - 1) {
+          return {
+            status: "failed",
+            error:
+              "Account restricted (账号访问受限) after submit. Datacenter/VPS IP is usually blocked — use a residential CN proxy pool (proxyPoolMode=single) and retry.",
+          };
+        }
         reportStep("cn_account_restricted", `Account restricted (attempt ${retry + 1}) — refreshing page and retrying`);
-        await page.reload({ waitUntil: "domcontentloaded", timeout: nav }).catch(() => {});
-        await waitForAnyVisible(page, SPA_READY_SELECTORS, 20_000);
-        const phoneTabRetry = await waitForFirstVisibleLocator(page, PHONE_TAB_SELECTORS, { timeout: action });
+        await page.reload({ waitUntil: "commit", timeout: nav }).catch(() => {});
+        await waitForAnyVisible(page, SPA_READY_SELECTORS, 12_000);
+        const phoneTabRetry = await waitForFirstVisibleLocator(page, PHONE_TAB_SELECTORS, { timeout: 8_000 });
         if (phoneTabRetry) {
           await phoneTabRetry.click().catch(() => {});
-          await page.locator(PHONE_IFRAME_SELECTOR).waitFor({ state: "attached", timeout: 10_000 }).catch(() => {});
+          await page.locator(PHONE_IFRAME_SELECTOR).waitFor({ state: "attached", timeout: 8_000 }).catch(() => {});
         }
         continue; // Retry submit
       }
@@ -622,14 +651,19 @@ function parsePhoneNumber(phone) {
 /**
  * Select the country code in the Keycloak form dropdown.
  * If the current country code already matches, do nothing.
+ *
+ * IMPORTANT: Keycloak country lists are 200+ rows. Never scan options.nth(i) in a
+ * loop — that pinned Camoufox for ~80s on retry after account-restricted. Prefer
+ * :has-text / getByText with a hard wall-clock.
  */
 async function selectCountry(frame, targetCountryCode, actionTimeout, reportStep) {
   if (!targetCountryCode) return; // No specific country to select
 
-  try {
+  const budgetMs = Math.min(Number(actionTimeout) || 15_000, 10_000);
+  const run = async () => {
     // Check current country code
     const currentCodeEl = frame.locator(iframeSelector(IFRAME_COUNTRY_CODE_TEXT)).first();
-    const currentCode = await currentCodeEl.textContent({ timeout: 5_000 }).catch(() => "");
+    const currentCode = await currentCodeEl.textContent({ timeout: 3_000 }).catch(() => "");
     const trimmedCode = String(currentCode).trim();
 
     if (trimmedCode === targetCountryCode) {
@@ -640,35 +674,55 @@ async function selectCountry(frame, targetCountryCode, actionTimeout, reportStep
     // Click the country selector to open dropdown
     reportStep?.("cn_opening_country_dropdown", `Opening country dropdown (current: ${trimmedCode}, target: ${targetCountryCode})`);
     const selector = frame.locator(iframeSelector(IFRAME_COUNTRY_SELECTOR)).first();
-    await selector.waitFor({ state: "visible", timeout: actionTimeout });
-    await selector.click().catch(() => {});
+    await selector.waitFor({ state: "visible", timeout: Math.min(budgetMs, 5_000) });
+    await selector.click({ timeout: 3_000 }).catch(() => {});
     // Wait for dropdown options to appear
     await frame.locator(iframeSelector(IFRAME_COUNTRY_OPTIONS)).first()
-      .waitFor({ state: "visible", timeout: 5_000 }).catch(() => {});
-
-    // Find the option matching the target country code
-    const options = frame.locator(iframeSelector(IFRAME_COUNTRY_OPTIONS));
-    const count = await options.count();
-
-    for (let i = 0; i < count; i++) {
-      const option = options.nth(i);
-      const optionText = await option.textContent().catch(() => "");
-      if (String(optionText).includes(targetCountryCode)) {
-        await option.click().catch(() => {});
-        // Confirm selection applied
+      .waitFor({ state: "visible", timeout: 3_000 }).catch(() => {});
+
+    // Direct label matches first (HK is the default 5sim region for CN bulk)
+    const preferredLabels = {
+      "+852": ["中国香港", "香港", "Hong Kong", "+852"],
+      "+86": ["中国大陆", "中国", "China", "+86"],
+      "+853": ["中国澳门", "澳门", "Macau", "+853"],
+      "+886": ["中国台湾", "台湾", "Taiwan", "+886"],
+    };
+    const labels = preferredLabels[targetCountryCode] || [targetCountryCode];
+
+    for (const label of labels) {
+      // Prefer scoped option rows; fall back to any text match inside the frame
+      const candidates = [
+        frame.locator(`${iframeSelector(IFRAME_COUNTRY_OPTIONS)}:has-text("${label}")`).first(),
+        frame.getByText(label, { exact: false }).first(),
+      ];
+      for (const option of candidates) {
+        const visible = await option.isVisible({ timeout: 1_500 }).catch(() => false);
+        if (!visible) continue;
+        const optionText = await option.textContent({ timeout: 1_500 }).catch(() => label);
+        await option.click({ timeout: 2_000 }).catch(() => {});
         await frame.locator(iframeSelector(IFRAME_COUNTRY_CODE_TEXT))
           .filter({ hasText: targetCountryCode })
           .first()
-          .waitFor({ state: "visible", timeout: 3_000 })
+          .waitFor({ state: "visible", timeout: 2_000 })
           .catch(() => {});
-        reportStep?.("cn_country_selected", `Country selected: ${String(optionText).trim()}`);
+        reportStep?.("cn_country_selected", `Country selected: ${String(optionText || label).trim()}`);
         return;
       }
     }
 
     // If no matching option found, close dropdown by clicking elsewhere
     reportStep?.("cn_country_not_found", `Country code ${targetCountryCode} not found in dropdown; using default`);
-    await frame.locator("body").click().catch(() => {});
+    await frame.locator("body").click({ timeout: 1_000 }).catch(() => {});
+  };
+
+  try {
+    await Promise.race([
+      run(),
+      new Promise((_, reject) => {
+        const t = setTimeout(() => reject(new Error(`selectCountry timed out after ${budgetMs}ms`)), budgetMs);
+        if (typeof t.unref === "function") t.unref();
+      }),
+    ]);
   } catch (err) {
     reportStep?.("cn_country_select_error", `Country selection error: ${err.message}`);
     // Non-fatal — continue with default country