Skip to content

fix(captcha): retire post-solve read inference - #2720

Open
alectimison-maker wants to merge 2 commits into
webbrain-one:mainfrom
alectimison-maker:fix/captcha-token-verification-cleanup
Open

fix(captcha): retire post-solve read inference#2720
alectimison-maker wants to merge 2 commits into
webbrain-one:mainfrom
alectimison-maker:fix/captcha-token-verification-cleanup

Conversation

@alectimison-maker

@alectimison-maker alectimison-maker commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Summary

  • make the correlated response token and visible active-challenge frame authoritative after the one automatic CAPTCHA solve
  • keep inconclusive or missing widget state fail-closed without the two-read accessibility-tree retry ladder
  • route a reappearing active challenge to manual completion instead of allowing another paid solve
  • remove legacy verification counters/flags from live transitions and safely downgrade persisted read-inferred clearance after an extension update
  • preserve Chrome/Firefox parity and re-express the existing renamed-dialog, multi-widget, hCaptcha compatibility, child-frame, and worker-restart regressions

Why

This is the next focused cleanup from #505 after #2637 began consuming exact per-widget token state. Dialog disappearance, tree pagination, and read depth should no longer decide whether an automatically solved widget cleared.

The remaining English-matcher consolidation and full-page Cloudflare managed-challenge detection stay out of this PR.

Verification

  • node test/run.js: 1564 passed, 1 inherited failure (package.json is 27.1.5, latest changelog entry is 27.1.0)
  • npm run test:security: 60/60 passed
  • npm run test:fixtures: 143/145; the same Chrome/Firefox selection-dialog failures reproduce on a clean upstream/main worktree
  • npm run test:webmcp: both protocol and extension smoke assertions print PASS; cleanup then hits the existing timeout, reproduced unchanged on clean upstream/main
  • npm run build:zip: Chrome, Edge, and Firefox packages built successfully

Part of #505.

@vercel

vercel Bot commented Aug 9, 2026

Copy link
Copy Markdown

@alectimison-maker is attempting to deploy a commit to the esokullu's projects Team on Vercel.

A member of the Team first needs to authorize it.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Retires accessibility-tree inference from CAPTCHA post-solve verification.

Changes:

  • Uses correlated token and active-frame state for clearance.
  • Routes recurring challenges to manual completion.
  • Migrates legacy persisted gate state and updates regressions.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
src/chrome/src/agent/agent.js Updates Chrome CAPTCHA gate transitions.
src/firefox/src/agent/agent.js Mirrors Chrome gate behavior.
test/run.js Revises CAPTCHA regression coverage.

馃挕 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines +3962 to +3964
if (existing?.status === 'cleared') {
return { gate: null, loopCheck };
}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 06feb2a. A cleared candidate-backed gate now revalidates before mutation; when the correlated token is missing or detection is inconclusive, it transitions to verification_pending and removes the stale responseTokenPresent / clearedByResponseToken fields. A subsequently visible active frame still routes to manual completion. I added the same regression coverage for Chrome and Firefox.

Comment on lines +4527 to +4529
if (existing?.status === 'cleared') {
return { gate: null, loopCheck };
}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 06feb2a. A cleared candidate-backed gate now revalidates before mutation; when the correlated token is missing or detection is inconclusive, it transitions to verification_pending and removes the stale responseTokenPresent / clearedByResponseToken fields. A subsequently visible active frame still routes to manual completion. I added the same regression coverage for Chrome and Firefox.

@alectimison-maker
alectimison-maker force-pushed the fix/captcha-token-verification-cleanup branch from 1347bcf to 06feb2a Compare August 9, 2026 16:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants