captchakraken 3.2.0__tar.gz → 3.2.1__tar.gz

{captchakraken-3.2.0 → captchakraken-3.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: captchakraken
-Version: 3.2.0
+Version: 3.2.1
 Summary: Captcha-solving engine and CLI: OpenCV grid detection plus a fine-tuned Qwen3.5-9B vision model, for image grids, click and drag puzzles, sliders, distorted text and animated challenges. Hosted API or self-hosted on vLLM.
 Project-URL: Homepage, https://captchakraken.com
 Project-URL: Documentation, https://github.com/CaptchaKraken/CaptchaKraken#readme

{captchakraken-3.2.0 → captchakraken-3.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "captchakraken"
-version = "3.2.0"
+version = "3.2.1"
 description = "Captcha-solving engine and CLI: OpenCV grid detection plus a fine-tuned Qwen3.5-9B vision model, for image grids, click and drag puzzles, sliders, distorted text and animated challenges. Hosted API or self-hosted on vLLM."
 readme = "README.md"
 requires-python = ">=3.11"

{captchakraken-3.2.0 → captchakraken-3.2.1}/src/captchakraken/__init__.py

@@ -103,4 +103,4 @@ __all__ = [
     "Verdict",
 ]
 
-__version__ = "3.2.0"
+__version__ = "3.2.1"

{captchakraken-3.2.0 → captchakraken-3.2.1}/src/captchakraken/page_solver.py

@@ -25,7 +25,7 @@ from .action_types import CaptchaAction
 from .humanize import Humanizer, resolve as resolve_humanizer
 from .kinds import (ActionKind, FrameRole, HumanizationMode, KeyframeMode, PauseKind, Phase, PromptFamily,
                     RecaptchaBanner, RetryMode, SettleVerdict, Vendor, Verdict)
-from .selectors import (ACCEPTED_SELECTORS, PIECE_SELECTORS, RESPONSE_SELECTORS, SELECTORS, SLIDER_HANDLE_SELECTORS,
+from .selectors import (ACCEPTED_SELECTORS, ENCLAVE_SELECTORS, PIECE_SELECTORS, RESPONSE_SELECTORS, SELECTORS, SLIDER_HANDLE_SELECTORS,
                         SUBMIT_SELECTORS, TEXT_INPUT_SELECTORS, TEXT_INPUT_VENDOR_SELECTORS, VENDORS, WIDGET_PROBES,
                         VendorSelectors, WidgetProbe)
 from .solver import CaptchaSolver, UnsupportedCaptchaError
@@ -366,6 +366,16 @@ def _frame_of(at: Any) -> Optional[Any]:
         return None
 
 
+def _host_scopes(page: Any) -> List[Any]:
+    """Where the host-page selectors are read: the page, then the inside of every VISIBLE vendor enclave. A hidden enclave
+    is skipped because Playwright judges an element visible within its own document, whatever its frame's visibility."""
+    return [page, *(f for f in map(_frame_of, _visible(page, ENCLAVE_SELECTORS)) if f is not None)]
+
+
+def _visible_in(scopes: Sequence[Any], selectors: Sequence[str]) -> List[Any]:
+    return [at for scope in scopes for at in _visible(scope, selectors)]
+
+
 def _input_value(handle: Any) -> str:
     try:
         return str(handle.input_value() or "")
@@ -864,13 +874,15 @@ class PageSolver:
 
     # ── detection ────────────────────────────────────────────────────────
 
-    def _has_value(self, page: Any, selector: str) -> bool:
+    def _has_value(self, scopes: Sequence[Any], selector: str) -> bool:
         """Any element at `selector` carrying a non-blank value; response fields are hidden, so no visibility filter."""
-        try:
-            fields = _handles(page.locator(selector).all())
-        except Exception:
-            return False
-        return any(_input_value(f).strip() for f in fields)
+        def fields(scope: Any) -> List[Any]:
+            try:
+                return _handles(scope.locator(selector).all())
+            except Exception:
+                return []
+
+        return any(_input_value(f).strip() for scope in scopes for f in fields(scope))
 
     def _visible_with_text(self, scope: Any, selector: str) -> bool:
         """A visible match carrying text; an empty banner or prompt is a placeholder, not a signal."""
@@ -895,20 +907,21 @@ class PageSolver:
 
     def detect_captcha(self, page: Any) -> Optional[Widget]:
         """Open challenges first, then unsolved checkboxes, then the inline vendors."""
+        scopes = _host_scopes(page)
         for probe in WIDGET_PROBES:
-            at = next(iter(_visible(page, (probe.selector,))), None)
-            if at is None or self._already_accepted(page, at, probe):
+            at = next(iter(_visible_in(scopes, (probe.selector,))), None)
+            if at is None or self._already_accepted(scopes, at, probe):
                 continue
             element = _handle_of(at)
             return Widget(element, at, probe.vendor, probe.role) if element is not None else None
         return None
 
-    def _already_accepted(self, page: Any, at: Any, probe: WidgetProbe) -> bool:
+    def _already_accepted(self, scopes: Sequence[Any], at: Any, probe: WidgetProbe) -> bool:
         """A checkbox the vendor has already accepted is not a captcha to solve."""
         s = SELECTORS[probe.vendor]
         if probe.role != FrameRole.CHECKBOX:
             return False
-        return bool(s.response and self._has_value(page, s.response)) or bool(s.checked and self._checked_in(at, s.checked))
+        return bool(s.response and self._has_value(scopes, s.response)) or bool(s.checked and self._checked_in(at, s.checked))
 
     def vendors_on_the_wire(self, page: Any) -> List[Vendor]:
         """Which vendors' code the page loaded. Resource timing, because a request listener would have to have been attached before navigation."""
@@ -921,9 +934,10 @@ class PageSolver:
 
     def _unmatched_vendor_frames(self, page: Any) -> List[Vendor]:
         """Vendors showing a frame no selector names. Only asked once detection has found nothing, and a passive frame
-        (an invisible badge) is not a widget, so what is left is markup the table no longer matches."""
-        return [vendor for vendor, s in VENDORS if s.hosts and len(_visible(page, [f'iframe[src*="{h}"]' for h in s.hosts]))
-                > len(_visible(page, s.passive))]
+        (an invisible badge, an enclave) is not a widget, so what is left is markup the table no longer matches."""
+        scopes = _host_scopes(page)
+        return [vendor for vendor, s in VENDORS if s.hosts and len(_visible_in(scopes, [f'iframe[src*="{h}"]' for h in s.hosts]))
+                > len(_visible_in(scopes, s.passive))]
 
     def _no_widget_message(self, page: Any) -> str:
         base = f"no interactive captcha widget detected within {self.config.detection_timeout_ms}ms"
@@ -954,11 +968,12 @@ class PageSolver:
 
     def _is_blocked(self, page: Any) -> bool:
         """The vendor showing its refusal screen: rate-limited or flagged, with no board to answer."""
+        scopes = _host_scopes(page)
         for probe in WIDGET_PROBES:
             blocked = SELECTORS[probe.vendor].blocked
             if probe.role != FrameRole.CHALLENGE or not blocked:
                 continue
-            at = next(iter(_visible(page, (probe.selector,))), None)
+            at = next(iter(_visible_in(scopes, (probe.selector,))), None)
             frame = _frame_of(at) if at is not None else None
             if frame and any(self._visible_with_text(frame, selector) for selector in blocked):
                 return True
@@ -972,13 +987,14 @@ class PageSolver:
     def is_captcha_solved(self, page: Any) -> bool:
         """The vendor's own done signal: a response token, a painted success state, or a checked box."""
         try:
-            if any(self._has_value(page, s) for s in RESPONSE_SELECTORS) or _visible(page, ACCEPTED_SELECTORS):
+            scopes = _host_scopes(page)
+            if any(self._has_value(scopes, s) for s in RESPONSE_SELECTORS) or _visible_in(scopes, ACCEPTED_SELECTORS):
                 return True
             for probe in WIDGET_PROBES:
                 checked = SELECTORS[probe.vendor].checked
                 if probe.role != FrameRole.CHECKBOX or not checked:
                     continue
-                at = next(iter(_visible(page, (probe.selector,))), None)
+                at = next(iter(_visible_in(scopes, (probe.selector,))), None)
                 if at is not None and self._checked_in(at, checked):
                     return True
         except Exception:
@@ -988,11 +1004,12 @@ class PageSolver:
     def _is_challenge_freshly_rendered(self, page: Any) -> bool:
         """A next round has painted, as opposed to the answered frame animating closed."""
         try:
+            scopes = _host_scopes(page)
             for probe in WIDGET_PROBES:
                 fresh = SELECTORS[probe.vendor].fresh
                 if probe.role != FrameRole.CHALLENGE or not fresh:
                     continue
-                at = next(iter(_visible(page, (probe.selector,))), None)
+                at = next(iter(_visible_in(scopes, (probe.selector,))), None)
                 element = _handle_of(at) if at is not None else None
                 if element is None:
                     continue
@@ -1012,11 +1029,12 @@ class PageSolver:
     def _banner_kind(self, page: Any) -> Optional[RecaptchaBanner]:
         """Which verdict banner the open challenge shows; `dynamic-more` is the dynamic board's normal flow, not an error."""
         try:
+            scopes = _host_scopes(page)
             for probe in WIDGET_PROBES:
                 banners = SELECTORS[probe.vendor].banners
                 if probe.role != FrameRole.CHALLENGE or not banners:
                     continue
-                at = next(iter(_visible(page, (probe.selector,))), None)
+                at = next(iter(_visible_in(scopes, (probe.selector,))), None)
                 frame = _frame_of(at) if at is not None else None
                 if not frame:
                     continue

{captchakraken-3.2.0 → captchakraken-3.2.1}/src/captchakraken/selectors.py

@@ -18,6 +18,9 @@ class VendorSelectors:
     challenge: Sequence[str] = ()
     # On the host page: the checkbox. Detected while `response` is empty and `checked` is not showing.
     checkbox: Sequence[str] = ()
+    # On the host page: a frame the vendor draws its other frames inside. Every host-page selector also reads the
+    # inside of a visible one.
+    enclave: Sequence[str] = ()
     # On the host page: inline widget shapes, detected last. Iframe selectors go first; a class that lives inside the
     # frame document (.CheckboxCaptcha, .mtcap) only ever matches an inline embed.
     widget: Sequence[str] = ()
@@ -68,17 +71,20 @@ SELECTORS: Mapping[Vendor, VendorSelectors] = {
         blocked=(".rc-doscaptcha-header-text",),
         passive=('iframe[src*="size=invisible"]',),
     ),
-    # Keyed on the `hcaptcha` substring, not the apex host: challenges are served off newassets.hcaptcha.com.
+    # Keyed on the `hcaptcha` substring, not the apex host: challenges are served off newassets.hcaptcha.com. secure-api.js
+    # draws every frame inside a full-viewport enclave, one per render, and only a visible one holds an open challenge.
     Vendor.HCAPTCHA: VendorSelectors(
         hosts=("hcaptcha.com",),
         challenge=('iframe[src*="hcaptcha"][src*="frame=challenge"]',),
-        checkbox=('iframe[src*="hcaptcha"][src*="frame=checkbox"]',),
+        checkbox=('iframe[src*="hcaptcha"][src*="frame=checkbox"]:not([src*="frame=checkbox-invisible"])',),
+        enclave=('iframe[src*="hcaptcha"][src*="frame=enclave"]',),
         response='[name="h-captcha-response"]',
         checked='#checkbox[aria-checked="true"]',
         box=("#checkbox",),
         fresh=".prompt-text",
         images=(".task-image .image", ".task .image", ".challenge-example img", ".image-wrapper img"),
         submit=(".button-submit",),
+        passive=('iframe[src*="hcaptcha"][src*="frame=enclave"]', 'iframe[src*="hcaptcha"][src*="frame=checkbox-invisible"]'),
     ),
     Vendor.TURNSTILE: VendorSelectors(
         hosts=("challenges.cloudflare.com",),
@@ -161,6 +167,7 @@ WIDGET_PROBES: Sequence[WidgetProbe] = tuple(
     for vendor, s in VENDORS
     for selector in getattr(s, key))
 
+ENCLAVE_SELECTORS: Sequence[str] = _of_every_vendor("enclave")
 RESPONSE_SELECTORS: Sequence[str] = tuple(s.response for _, s in VENDORS if s.response)
 ACCEPTED_SELECTORS: Sequence[str] = tuple(s.accepted for _, s in VENDORS if s.accepted)
 

{captchakraken-3.2.0 → captchakraken-3.2.1}/tests/fake_dom.py

@@ -3,6 +3,7 @@ The locator half is the Playwright surface the driver duck-types (`locator/filte
 
 from __future__ import annotations
 
+import re
 from dataclasses import dataclass, field
 from typing import Any, Callable, Dict, List, Optional, Sequence
 
@@ -100,3 +101,15 @@ def fake_scope(nodes: Optional[Sequence[FakeNode]], unparsable: Sequence[str] =
         return [FakeHandle(n) for n in (nodes or ()) if _hit(selector, n.matches)]
 
     return FakeScope(lookup)
+
+
+def iframe_matches(src: str, selectors: Sequence[str]) -> List[str]:
+    """The iframe selectors an element with this `src` answers to, the way a CSS engine would read them."""
+    def wants(sel: str) -> List[str]:
+        return re.findall(r'\[src\*="([^"]+)"\]', sel)
+
+    def hit(sel: str) -> bool:
+        positive, _, negative = sel.partition(":not(")
+        return all(s in src for s in wants(positive)) and not any(s in src for s in wants(negative))
+
+    return [sel for sel in selectors if sel.startswith("iframe[src") and hit(sel)]

captchakraken-3.2.1/tests/fixtures/hcaptcha_enclave/challenge.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<!-- hCaptcha's challenge frame (image_label_binary, 3x3) as a live job-board posting served it inside secure-api.js's
+     enclave on 2026-10-15, reduced to the markup the driver reads: the picture URLs are flat gradients. -->
+<html lang="en"><head><meta charset="utf-8"><title>hCaptcha</title></head>
+<body class="no-selection" style="width: 400px; height: 600px;"><div class="interface-wrapper" style="width: 380px; height: 580px; margin: 10px; position: relative;"><div class="challenge-container" style="width: 380px; height: 500px; position: relative; z-index: 0; margin-bottom: 10px; right: auto;"><div class="challenge" style="width: 380px; height: 500px;"><div class="challenge-view" style="width: 380px; height: 500px;"><div class="challenge-header" style="position: relative; display: block; width: 380px; height: 110px; margin-bottom: 10px;"><div class="challenge-prompt" style="display: table; width: 380px; height: 110px; text-align: left; position: absolute; top: 0px; z-index: 0;"><div class="prompt-padding" style="width: 360px; height: 90px; top: 10px; left: 10px; position: absolute;"><h2 class="prompt-text" id="prompt-question" dir="ltr" style="font-size: 18px; line-height: normal; font-weight: normal; margin: 0px; width: 360px; color: rgb(255, 255, 255); vertical-align: top; display: table-cell; position: absolute; z-index: 5; transition: opacity 0.3s cubic-bezier(0.65, 0, 0.35, 1); direction: ltr; text-align: left;"><span style="color: inherit; font-weight: 500; font-size: inherit; line-height: inherit;">Click on all materials that absorb liquid</span></h2><p class="skip" style="width: 360px; color: rgb(255, 255, 255); font-size: 14px; vertical-align: bottom; display: table-cell; position: absolute; margin: 0px; bottom: 0px; z-index: 5; transition: opacity 0.3s cubic-bezier(0.65, 0, 0.35, 1);"></p></div><div class="prompt-bg" style="opacity: 1; position: absolute; top: 0px; left: 0px; z-index: -1; width: 378px; height: 106px; background-color: rgb(0, 131, 143); border-radius: 4px; border-width: 1px; border-color: rgb(0, 131, 143); border-style: solid;"></div></div></div><div class="task-grid" role="group" aria-labelledby="prompt-question" tabindex="0" style="width: 380px; height: 380px; position: relative; display: inline-block;"><div class="task" tabindex="0" role="button" aria-label="Challenge Image 1" aria-pressed="false" style="width: 120px; height: 120px; cursor: pointer; box-sizing: border-box; outline: none; border-width: medium; border-style: none; border-color: currentcolor; border-image: none; position: absolute; left: 0px; top: 0px;"><div class="task-image" style="transition: none; width: 120px; height: 120px; position: absolute;"><div class="wrapper" style="width: 120px; height: 120px; overflow: hidden; border-radius: 2px; transition: none; position: relative; top: 50%; left: 50%; margin-top: -60px; margin-left: -60px; background-color: rgb(245, 245, 245);"><div class="image" style="position: absolute; top: 50%; left: 50%; z-index: 5; transition: none; background: linear-gradient(135deg, #7b8a8b, #ffffff) 50% 50% / 120px 120px no-repeat; width: 120px; height: 120px; margin-left: -60px; margin-top: -60px;"></div></div></div></div><div class="task" tabindex="0" role="button" aria-label="Challenge Image 2" aria-pressed="false" style="width: 120px; height: 120px; cursor: pointer; box-sizing: border-box; outline: none; border-width: medium; border-style: none; border-color: currentcolor; border-image: none; position: absolute; left: 130px; top: 0px;"><div class="task-image" style="transition: none; width: 120px; height: 120px; position: absolute;"><div class="wrapper" style="width: 120px; height: 120px; overflow: hidden; border-radius: 2px; transition: none; position: relative; top: 50%; left: 50%; margin-top: -60px; margin-left: -60px; background-color: rgb(245, 245, 245);"><div class="image" style="position: absolute; top: 50%; left: 50%; z-index: 5; transition: none; background: linear-gradient(135deg, #c9c3e6, #ffffff) 50% 50% / 120px 120px no-repeat; width: 120px; height: 120px; margin-left: -60px; margin-top: -60px;"></div></div></div></div><div class="task" tabindex="0" role="button" aria-label="Challenge Image 3" aria-pressed="false" style="width: 120px; height: 120px; cursor: pointer; box-sizing: border-box; outline: none; border-width: medium; border-style: none; border-color: currentcolor; border-image: none; position: absolute; left: 260px; top: 0px;"><div class="task-image" style="transition: none; width: 120px; height: 120px; position: absolute;"><div class="wrapper" style="width: 120px; height: 120px; overflow: hidden; border-radius: 2px; transition: none; position: relative; top: 50%; left: 50%; margin-top: -60px; margin-left: -60px; background-color: rgb(245, 245, 245);"><div class="image" style="position: absolute; top: 50%; left: 50%; z-index: 5; transition: none; background: linear-gradient(135deg, #8f9aa0, #ffffff) 50% 50% / 120px 120px no-repeat; width: 120px; height: 120px; margin-left: -60px; margin-top: -60px;"></div></div></div></div><div class="task" tabindex="0" role="button" aria-label="Challenge Image 4" aria-pressed="false" style="width: 120px; height: 120px; cursor: pointer; box-sizing: border-box; outline: none; border-width: medium; border-style: none; border-color: currentcolor; border-image: none; position: absolute; left: 0px; top: 130px;"><div class="task-image" style="transition: none; width: 120px; height: 120px; position: absolute;"><div class="wrapper" style="width: 120px; height: 120px; overflow: hidden; border-radius: 2px; transition: none; position: relative; top: 50%; left: 50%; margin-top: -60px; margin-left: -60px; background-color: rgb(245, 245, 245);"><div class="image" style="position: absolute; top: 50%; left: 50%; z-index: 5; transition: none; background: linear-gradient(135deg, #d8cdb8, #ffffff) 50% 50% / 120px 120px no-repeat; width: 120px; height: 120px; margin-left: -60px; margin-top: -60px;"></div></div></div></div><div class="task" tabindex="0" role="button" aria-label="Challenge Image 5" aria-pressed="false" style="width: 120px; height: 120px; cursor: pointer; box-sizing: border-box; outline: none; border-width: medium; border-style: none; border-color: currentcolor; border-image: none; position: absolute; left: 130px; top: 130px;"><div class="task-image" style="transition: none; width: 120px; height: 120px; position: absolute;"><div class="wrapper" style="width: 120px; height: 120px; overflow: hidden; border-radius: 2px; transition: none; position: relative; top: 50%; left: 50%; margin-top: -60px; margin-left: -60px; background-color: rgb(245, 245, 245);"><div class="image" style="position: absolute; top: 50%; left: 50%; z-index: 5; transition: none; background: linear-gradient(135deg, #2b2b2b, #ffffff) 50% 50% / 120px 120px no-repeat; width: 120px; height: 120px; margin-left: -60px; margin-top: -60px;"></div></div></div></div><div class="task" tabindex="0" role="button" aria-label="Challenge Image 6" aria-pressed="false" style="width: 120px; height: 120px; cursor: pointer; box-sizing: border-box; outline: none; border-width: medium; border-style: none; border-color: currentcolor; border-image: none; position: absolute; left: 260px; top: 130px;"><div class="task-image" style="transition: none; width: 120px; height: 120px; position: absolute;"><div class="wrapper" style="width: 120px; height: 120px; overflow: hidden; border-radius: 2px; transition: none; position: relative; top: 50%; left: 50%; margin-top: -60px; margin-left: -60px; background-color: rgb(245, 245, 245);"><div class="image" style="position: absolute; top: 50%; left: 50%; z-index: 5; transition: none; background: linear-gradient(135deg, #e3dde9, #ffffff) 50% 50% / 120px 120px no-repeat; width: 120px; height: 120px; margin-left: -60px; margin-top: -60px;"></div></div></div></div><div class="task" tabindex="0" role="button" aria-label="Challenge Image 7" aria-pressed="false" style="width: 120px; height: 120px; cursor: pointer; box-sizing: border-box; outline: none; border-width: medium; border-style: none; border-color: currentcolor; border-image: none; position: absolute; left: 0px; top: 260px;"><div class="task-image" style="transition: none; width: 120px; height: 120px; position: absolute;"><div class="wrapper" style="width: 120px; height: 120px; overflow: hidden; border-radius: 2px; transition: none; position: relative; top: 50%; left: 50%; margin-top: -60px; margin-left: -60px; background-color: rgb(245, 245, 245);"><div class="image" style="position: absolute; top: 50%; left: 50%; z-index: 5; transition: none; background: linear-gradient(135deg, #e8e2b0, #ffffff) 50% 50% / 120px 120px no-repeat; width: 120px; height: 120px; margin-left: -60px; margin-top: -60px;"></div></div></div></div><div class="task" tabindex="0" role="button" aria-label="Challenge Image 8" aria-pressed="false" style="width: 120px; height: 120px; cursor: pointer; box-sizing: border-box; outline: none; border-width: medium; border-style: none; border-color: currentcolor; border-image: none; position: absolute; left: 130px; top: 260px;"><div class="task-image" style="transition: none; width: 120px; height: 120px; position: absolute;"><div class="wrapper" style="width: 120px; height: 120px; overflow: hidden; border-radius: 2px; transition: none; position: relative; top: 50%; left: 50%; margin-top: -60px; margin-left: -60px; background-color: rgb(245, 245, 245);"><div class="image" style="position: absolute; top: 50%; left: 50%; z-index: 5; transition: none; background: linear-gradient(135deg, #6f6458, #ffffff) 50% 50% / 120px 120px no-repeat; width: 120px; height: 120px; margin-left: -60px; margin-top: -60px;"></div></div></div></div><div class="task" tabindex="0" role="button" aria-label="Challenge Image 9" aria-pressed="false" style="width: 120px; height: 120px; cursor: pointer; box-sizing: border-box; outline: none; border-width: medium; border-style: none; border-color: currentcolor; border-image: none; position: absolute; left: 260px; top: 260px;"><div class="task-image" style="transition: none; width: 120px; height: 120px; position: absolute;"><div class="wrapper" style="width: 120px; height: 120px; overflow: hidden; border-radius: 2px; transition: none; position: relative; top: 50%; left: 50%; margin-top: -60px; margin-left: -60px; background-color: rgb(245, 245, 245);"><div class="image" style="position: absolute; top: 50%; left: 50%; z-index: 5; transition: none; background: linear-gradient(135deg, #5b4a6e, #ffffff) 50% 50% / 120px 120px no-repeat; width: 120px; height: 120px; margin-left: -60px; margin-top: -60px;"></div></div></div></div></div></div></div></div><div class="interface-challenge" dir="ltr" style="direction: ltr; text-align: left; width: 380px; height: 70px; position: absolute; left: 0px; bottom: 0px;"><div class="button-submit button" tabindex="0" role="button" aria-live="polite" title="Skip Challenge" aria-label="Skip Challenge" aria-disabled="false" style="cursor: pointer; background-color: rgb(85, 85, 85); height: 35px; min-width: 70px; padding: 0px 5px; border-radius: 4px; border: 2px solid rgb(255, 255, 255); position: absolute; bottom: 0px; z-index: 100; right: 0px; left: initial;"><div class="text" style="color: rgb(255, 255, 255); width: 100%; height: 100%; text-align: center; position: relative; pointer-events: none; line-height: 35px; font-size: 14px; font-weight: 600; z-index: 5; display: block;">Skip</div></div></div></div><script>
+  // Stands in for hCaptcha's own script: a tile toggles when pressed, and the submit hands a token to the enclave.
+  document.querySelectorAll('.task').forEach((task) => task.addEventListener('click', () =>
+    task.setAttribute('aria-pressed', String(task.getAttribute('aria-pressed') !== 'true'))));
+  document.querySelector('.button-submit').addEventListener('click', () =>
+    parent.postMessage({ hcaptchaToken: 'P1_' + new URLSearchParams(location.hash.slice(1)).get('id') }, '*'));
+</script>
+</body>
+</html>

captchakraken-3.2.1/tests/fixtures/hcaptcha_enclave/enclave.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<!-- hCaptcha's secure-api.js enclave frame, recorded on a live job-board posting on 2026-10-15 with its challenge open.
+     The script stands in for hCaptcha's: the challenge's token lands in this frame's response field, not the host page's. -->
+<html lang="en"><head><meta charset="utf-8"><title>hCaptcha</title></head>
+<body class="no-selection" style="overflow-y: auto;">
+<div style="background-color: rgb(255, 255, 255); border: 1px solid rgb(215, 215, 215); box-shadow: rgba(0, 0, 0, 0.1) 0px 0px 4px; border-radius: 4px; left: 440px; top: 150px; z-index: 2147483647; position: absolute; pointer-events: auto; opacity: 1; visibility: visible; display: block;"><div style="position: relative; z-index: 1; width: 400px; height: 600px;"><iframe src="hcaptcha.html#frame=challenge&amp;id=0so2b8l008q&amp;host=careers.example.com&amp;size=invisible&amp;theme=light" frameborder="0" scrolling="no" allow="private-state-token-redemption" title="hCaptcha challenge" style="border: 0px; z-index: 2000000000; position: relative; width: 400px; height: 600px;"></iframe></div><div style="width: 100%; height: 100%; position: fixed; pointer-events: auto; top: 0px; left: 0px; z-index: 0; background-color: rgb(255, 255, 255); opacity: 0.05; cursor: pointer;"></div></div>
+<iframe aria-hidden="true" data-hcaptcha-widget-id="0so2b8l008q" data-hcaptcha-response="" src="hcaptcha.html#frame=checkbox-invisible" style="display: none;"></iframe>
+<textarea id="g-recaptcha-response-0so2b8l008q" name="g-recaptcha-response" style="display: none;"></textarea>
+<textarea id="h-captcha-response-0so2b8l008q" name="h-captcha-response" style="display: none;"></textarea>
+<script>
+  addEventListener('message', (e) => {
+    if (e.data && e.data.hcaptchaToken) document.querySelector('[name="h-captcha-response"]').value = e.data.hcaptchaToken;
+  });
+</script>
+</body>
+</html>

captchakraken-3.2.1/tests/fixtures/hcaptcha_enclave/host.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<!-- A job-board apply page after hcaptcha.execute(), as recorded on 2026-10-15: no hCaptcha frame of its own, only
+     secure-api.js's two full-viewport enclaves, one per render. Both are served the recorded open enclave, so only the
+     enclave's own visibility tells them apart. FRAMES_ORIGIN is replaced with a second origin when served, because the
+     vendor's frames are cross-origin. -->
+<html lang="en"><head><meta charset="utf-8"><title>Apply</title></head>
+<body style="margin: 0; font: 16px sans-serif; background: #f5f5f5;">
+<h1 style="margin: 40px 260px;">Apply</h1>
+<form style="margin: 0 260px;"><label>Full name <input name="name"></label></form>
+<iframe sandbox="allow-scripts allow-same-origin" title="Widget containing checkbox for hCaptcha security challenge" frameborder="0" scrolling="no" src="FRAMES_ORIGIN/idle/hcaptcha-enclave.html#frame=enclave&amp;_channel=0a0j3b54q9jb&amp;host=careers.example.com" style="position: fixed; top: 0px; left: 0px; width: 100%; height: 100%; z-index: 2147483647; visibility: hidden;"></iframe>
+<iframe sandbox="allow-scripts allow-same-origin" title="Widget containing checkbox for hCaptcha security challenge" frameborder="0" scrolling="no" src="FRAMES_ORIGIN/live/hcaptcha-enclave.html#frame=enclave&amp;_channel=1vx5ycvkplus&amp;host=careers.example.com" style="position: fixed; top: 0px; left: 0px; width: 100%; height: 100%; z-index: 2147483647; visibility: visible;"></iframe>
+</body>
+</html>

captchakraken-3.2.1/tests/test_a_widget_inside_an_enclave_is_found.py

@@ -0,0 +1,185 @@
+"""hCaptcha's secure-api.js draws no frame on the host page. Every frame it owns sits inside a full-viewport enclave
+iframe, one enclave per render, and only the visible one holds the open challenge.
+
+Measured on a live job-board posting on 2026-10-15: after hcaptcha.execute() the host page held two enclaves and nothing else, so
+detection found no widget, and the tripwire blamed the selector table for a challenge that was on screen and still
+matched every selector inside its frame. The JS test of the same name drives the same cases.
+"""
+
+from __future__ import annotations
+
+import struct
+import sys
+import threading
+from contextlib import contextmanager
+from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from typing import Any, Iterator, List, Optional
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+from fake_dom import FakeHandle, FakeNode, fake_scope, iframe_matches  # noqa: E402
+
+from captchakraken.action_types import ClickAction  # noqa: E402
+from captchakraken.kinds import FrameRole, Vendor  # noqa: E402
+from captchakraken.page_solver import PageSolver, PageSolverConfig  # noqa: E402
+from captchakraken.selectors import ENCLAVE_SELECTORS, VENDORS, WIDGET_PROBES  # noqa: E402
+
+ASSETS = "https://newassets.hcaptcha.com/captcha/v1/06f8dac28bb865a058d94cbd615a79d63217dd86/static"
+ENCLAVE = f"{ASSETS}/hcaptcha-enclave.html#frame=enclave&_channel=1vx5ycvkplus&host=careers.example.com"
+INVISIBLE = f"{ASSETS}/hcaptcha.html#frame=checkbox-invisible"
+
+
+def _challenge_src(widget_id: str) -> str:
+    return f"{ASSETS}/hcaptcha.html#frame=challenge&id={widget_id}&host=careers.example.com&size=invisible"
+
+
+# Every iframe selector the driver reads on a host page, so a fake frame answers to exactly what a CSS engine would.
+HOST_IFRAME_SELECTORS = tuple(dict.fromkeys([
+    *(p.selector for p in WIDGET_PROBES), *ENCLAVE_SELECTORS,
+    *(sel for _, s in VENDORS for sel in (*s.passive, *(f'iframe[src*="{h}"]' for h in s.hosts))),
+]))
+
+
+def _iframe(src: str, **node: Any) -> FakeNode:
+    return FakeNode(matches=iframe_matches(src, HOST_IFRAME_SELECTORS), **node)
+
+
+def _enclave(visible: bool, frame: List[FakeNode]) -> FakeNode:
+    return _iframe(ENCLAVE, visible=visible, frame=frame)
+
+
+def _response(value: str = "") -> FakeNode:
+    return FakeNode(matches=['[name="h-captcha-response"]'], visible=False, value=value)
+
+
+def test_the_open_challenge_is_found_inside_the_visible_enclave_not_the_hidden_one():
+    # The hidden enclave's challenge is not hidden inside its own document, so the enclave's visibility is what decides.
+    idle = _iframe(_challenge_src("0ewuzu8hdfwo"))
+    live = _iframe(_challenge_src("0so2b8l008q"))
+    page = fake_scope([
+        _enclave(False, [idle, _iframe(INVISIBLE, visible=False), _response()]),
+        _enclave(True, [live, _iframe(INVISIBLE, visible=False), _response()]),
+    ])
+    widget = PageSolver().detect_captcha(page)
+    assert widget is not None, "nothing detected through the enclave"
+    assert (widget.vendor, widget.role) == (Vendor.HCAPTCHA, FrameRole.CHALLENGE)
+    assert isinstance(widget.element, FakeHandle) and widget.element.node is live, "detected the hidden enclave's challenge"
+
+
+def test_an_enclave_nobody_has_raised_holds_no_widget():
+    page = fake_scope([_enclave(False, [_iframe(_challenge_src("a"))]), _enclave(False, [_iframe(_challenge_src("b"))])])
+    assert PageSolver().detect_captcha(page) is None
+
+
+def test_the_invisible_checkbox_is_never_a_checkbox_to_click():
+    assert iframe_matches(INVISIBLE, [p.selector for p in WIDGET_PROBES]) == [], "a probe names the invisible checkbox frame"
+    assert PageSolver().detect_captcha(fake_scope([_enclave(True, [_iframe(INVISIBLE)])])) is None
+
+
+def test_a_token_written_inside_the_enclave_is_a_solve():
+    solver = PageSolver()
+    assert solver.is_captcha_solved(fake_scope([_enclave(True, [_iframe(_challenge_src("a")), _response()])])) is False
+    assert solver.is_captcha_solved(fake_scope([_enclave(True, [_iframe(_challenge_src("a")), _response("P1_eyJ0")])]))
+
+
+def test_an_enclave_is_not_a_frame_the_selector_table_missed():
+    solver = PageSolver()
+    quiet = fake_scope([_enclave(True, [_iframe(INVISIBLE, visible=False)]), _enclave(False, [])])
+    assert solver._unmatched_vendor_frames(quiet) == [], "blamed the table for a frame that is never interactive"
+    # A frame inside the enclave that no selector names IS the table going stale, and must still say so.
+    renamed = fake_scope([_enclave(True, [_iframe(f"{ASSETS}/hcaptcha.html#frame=puzzle&id=a")])])
+    assert solver._unmatched_vendor_frames(renamed) == [Vendor.HCAPTCHA]
+
+
+# The same page through a real browser: two origins, two levels of frames, the layout that page served.
+FIXTURES = Path(__file__).resolve().parent / "fixtures" / "hcaptcha_enclave"
+# Where the live enclave puts its challenge: the wrapper's offset plus its 1px border, at the frame's own size.
+CHALLENGE_BOX = {"x": 441, "y": 151, "width": 400, "height": 600}
+
+
+def _tile(n: int) -> List[float]:
+    """Tile `n` of the recorded 3x3, as the model answers: fractions of the challenge frame."""
+    col, row = (n - 1) % 3, (n - 1) // 3
+    x, y = 10 + col * 130, 130 + row * 130
+    return [x / 400, y / 600, (x + 120) / 400, (y + 120) / 600]
+
+
+class _FixtureHandler(SimpleHTTPRequestHandler):
+    NAMES = {"host.html": "host.html", "hcaptcha-enclave.html": "enclave.html", "hcaptcha.html": "challenge.html"}
+
+    def do_GET(self) -> None:  # noqa: N802 - the stdlib's name
+        name = self.NAMES.get(self.path.split("?")[0].rsplit("/", 1)[-1])
+        if name is None:
+            self.send_error(404)
+            return
+        body = (FIXTURES / name).read_text().replace("FRAMES_ORIGIN", f"http://localhost:{self.server.server_port}")
+        self.send_response(200)
+        self.send_header("content-type", "text/html")
+        self.end_headers()
+        self.wfile.write(body.encode())
+
+    def log_message(self, *_: Any) -> None:
+        pass
+
+
+@contextmanager
+def _served_fixtures() -> Iterator[str]:
+    """host.html on one origin; the enclaves and the challenge on another, as hCaptcha serves them."""
+    server = ThreadingHTTPServer(("127.0.0.1", 0), _FixtureHandler)
+    threading.Thread(target=server.serve_forever, daemon=True).start()
+    try:
+        yield f"http://127.0.0.1:{server.server_port}/host.html"
+    finally:
+        server.shutdown()
+        server.server_close()
+
+
+@pytest.fixture
+def recorded_page() -> Iterator[Any]:
+    sync_playwright = pytest.importorskip("playwright.sync_api", reason="playwright not installed").sync_playwright
+    with _served_fixtures() as url, sync_playwright() as p:
+        browser = p.chromium.launch(headless=True, args=["--no-sandbox", "--disable-dev-shm-usage"])
+        try:
+            page = browser.new_page(viewport={"width": 1280, "height": 900})
+            page.goto(url)
+            page.frame_locator('iframe[src*="/live/"]').frame_locator('iframe[src*="frame=challenge"]') \
+                .locator(".button-submit").wait_for()
+            yield page
+        finally:
+            browser.close()
+
+
+def _live_challenge(page: Any) -> Any:
+    return next(f for f in page.frames if "/live/hcaptcha.html#frame=challenge" in f.url)
+
+
+def test_through_real_frames_the_challenge_is_found_where_it_is_on_screen(recorded_page):
+    widget = PageSolver().detect_captcha(recorded_page)
+    assert widget is not None, "nothing detected through the enclave"
+    assert widget.role == FrameRole.CHALLENGE
+    assert widget.element.content_frame() == _live_challenge(recorded_page), "detected the hidden enclave's challenge"
+    # Clicks and crops are placed in page coordinates, so the box must be measured from the top frame.
+    assert widget.element.bounding_box() == CHALLENGE_BOX
+
+
+def test_through_real_frames_a_solve_clicks_the_tiles_it_was_told_to_and_reads_the_token(recorded_page):
+    solver = PageSolver(config=PageSolverConfig(humanization="none", video_solve_enabled=False, max_solve_loops=1,
+                                                detection_timeout_ms=2_000, post_solve_outcome_timeout_ms=2_000))
+    shown: List[Optional[tuple]] = []
+
+    def answer(image_path: str, *_: Any, **__: Any):
+        shown.append(struct.unpack(">II", Path(image_path).read_bytes()[16:24]))
+        return [ClickAction(action="click", target_bounding_boxes=[_tile(2), _tile(6)])], []
+
+    solver._get_solution = answer
+    solver._solver.planner.report_outcome = lambda *_: False
+
+    result = solver.solve(recorded_page)
+    pressed = _live_challenge(recorded_page).locator('.task[aria-pressed="true"]').evaluate_all(
+        "tasks => tasks.map((t) => t.getAttribute('aria-label'))")
+    assert pressed == ["Challenge Image 2", "Challenge Image 6"], "the clicks landed on other tiles"
+    assert shown == [(CHALLENGE_BOX["width"], CHALLENGE_BOX["height"])], "the model was shown something other than the challenge"
+    assert result.is_solved, "the token the enclave received was not read as a solve"

{captchakraken-3.2.0 → captchakraken-3.2.1}/tests/test_a_widget_is_waited_for.py

@@ -116,10 +116,9 @@ class _Scope:
         self.srcs = srcs
 
     def locator(self, selector: str) -> Any:
-        from fake_dom import FakeLocator
+        from fake_dom import FakeLocator, iframe_matches
 
-        needle = selector.split('src*="', 1)[1].split('"', 1)[0] if 'src*="' in selector else None
-        return FakeLocator(lambda: [_Frame(s) for s in self.srcs if needle and needle in s])
+        return FakeLocator(lambda: [_Frame(s) for s in self.srcs if iframe_matches(s, [selector])])
 
 
 def test_an_invisible_badge_is_not_an_unmatched_frame():