Brandon LiandClaude Opus 5
2d53639c82
First live run reset one account, then failed on the second: the confirm button never enabled and the step reported it covered by a bare `div`. reCAPTCHA adds a client to ___grecaptcha_cfg.clients per rendered widget and removes none, so the second modal leaves two — and the callback walk fired the first it found, the one belonging to the modal that already closed. The token goes to a widget nobody is listening to, the live modal never hears it was solved, and its button stays dark. Iteration 1 worked only because there was one client to find. Now the newest wins: hook widgets are walked in reverse, clients sorted by descending key, and the count of candidates is reported so `2 widgets on the page, used the newest` says plainly when a page is stacking stale ones. Also from that run: - coveredBy printed `div` and nothing else, which diagnoses nothing. It only ever reported tag and id, and modal backdrops and captcha overlays carry neither. It now names classes too. - A covered target gets 8s to clear before the step fails. Most things over a button are on their way out — a backdrop mid-fade, an overlay closing. This does not weaken the check: still covered at the deadline still fails, and nothing is clicked while anything is on top of it. - The reset list's scroll container is confirmed as a class, so the class-or-id hedge is trimmed. The run reported it as `dashboard_body MuiBox-root mui-0`. Extension to 0.11.1 so the dashboard can confirm the reload took. Runner VERSION deliberately unchanged — the step vocabulary is the same, and a bump would raise the mismatch banner for a change that does not need it. The runner does still need restarting to pick up the covered-retry. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
AutoFirmer Capture (Chromium extension)
Scrapes the firm tab you are looking at and posts its HTML back to the dashboard. There is no on/off switch for that — see Scope below for what limits it instead.
Install (unpacked)
- Start the dashboard (
npm run dev) sohttp://localhost:3000is up. - Open
chrome://extensions, enable Developer mode (top right). - Load unpacked → select this
extension/folder. - Click the extension icon to open the popup and set:
- Dashboard URL — default
http://localhost:3000. Use the VPS IP if the dashboard runs elsewhere. - Poll interval — seconds between status checks (default 3).
- Element selector — optional CSS selector; matching elements get their on-screen position measured alongside the HTML.
- Dashboard URL — default
The badge shows ! (red) if the dashboard is unreachable, and nothing otherwise
— blank is the working state. Open the popup for what the last tick actually did.
Flow
extension --GET /api/autobuyer/status--> { pendingLocate }
extension --POST /api/autobuyer/capture-> html + viewport + element rects
AutoBuyer page --GET /api/autobuyer/capture-> renders the HTML
Nothing in that loop is switchable. Every tick serves any queued clicks and then captures the tab you are on.
Scope
Capture has no switch, so scope is what keeps it honest. Three limits, all enforced by Chrome rather than by this code:
host_permissionsis deliberately narrow — the firm sites plus localhost for the dashboard. The extension is technically incapable of reading any other site, so an accidental capture of your bank or mail tab cannot happen however the logic here is changed.- Only the tab you are on.
pickTab()asks for the active tab of the last-focused window and a host_permissions match. A firm tab sitting in the background is not captured, and neither is anything else. Switch away and capture simply stops until you switch back. - One content script, same hosts.
captcha-hook.jsruns at document_start on the firm sites only. It wrapsturnstile.render/grecaptcha.render/hcaptcha.renderand remembers what the page passed them — the sitekey, and above all the callback a solved token has to be handed to, which a programmatically rendered widget puts nowhere else. It reads nothing else and sends nothing anywhere; the remembered arguments stay in the page's own world until asolveCaptchastep comes to collect them.
To automate a different broker, add its pattern to host_permissions in
manifest.json and reload the extension — that alone scopes capture to it. Avoid
going back to <all_urls>: it would put every tab you visit in reach, and limit
1 is the only thing standing between this and scraping your whole browser. A new
firm needs its host in both lists — host_permissions and the content_scripts
matches — or captchas on that site will have no callback to fire.
Notes
- The extension never captures the dashboard's own pages — otherwise it would just mirror its own output back.
chrome://,about:and Web Store pages cannot be scripted by any extension; they're skipped.- MV3 service workers are torn down when idle. Each poll makes an extension API call, which keeps the worker alive; a 30-second alarm revives it if Chrome kills it anyway. So worst-case cadence is 30s, normal cadence is the poll interval.