Brings the captcha-solver improvements from main into feat/doh while keeping
the flat client/ layout (no internal/* refactor pulled in).
- Persistent SavedProfile (UA + Sec-CH-UA + device JSON + browser_fp) captured
during manual solve and replayed by auto/slider so VK sees a consistent
fingerprint across runs. Stored under $VK_PROFILE_PATH | UserCacheDir |
TempDir | CWD.
- callCaptchaNotRobot: per-session adFp, sha256 debug_info, jittered
connectionRtt/connectionDownlink, cursor "[]" on first check, headers
switched to Origin api.vk.ru / Referer not_robot_captcha.
- Slider session: per-session adFp + debugInfo, savedProfile injection,
ApplyBrowserProfileFhttp + same captcha headers on every request,
getContent fallback with/without captcha_settings, second componentDone
before getContent (matches real widget lifecycle).
- Manual proxy: strip WebView identity headers (X-Requested-With and friends),
server-side rewrite of src/href/action attributes (skipping <script>/<style>
spans), inject helper script at <head> opening, sendBeacon + form fallback
for token delivery on mobile WebView, /generic_proxy SSRF allowlist +
scheme check + security-header strip + server-side success_token extract,
loggingTransport that captures the real browser fingerprint and persists
it as SavedProfile, best-effort 3s Shutdown, Windows rundll32 launcher,
PII redaction in logs.
- solvePoW returns an error instead of an empty string.
- Manual captcha timeout bumped 60s -> 3m on context.Background so a human
has time to solve regardless of the auth-level deadline; non-empty
token/key from the manual goroutine is treated as success even if the
server cleanup returned an error.
samosvalishe
41593ad56f