Repository navigation
Gate Flow CAPTCHA generation after account-safety reports - #68
Closed
raducupreda-art wants to merge 1 commit into
Closed
raducupreda-art wants to merge 1 commit into
raducupreda-art wants to merge 1 commit into
Conversation
Owner
|
wait me for testing |
2 of 3 tasks
Owner
|
Thanks for this — the persistent hold and bounded hijack retries are now on |
iceman9973
pushed a commit
to iceman9973/flowkit_fork
that referenced
this pull request
Oct 27, 2026
…ck retries Issue crisng95#67 reports accounts whose manual Flow UI generation was blocked after FlowKit testing; retrying into the block is a suspected cause. - The generation hold after PUBLIC_ERROR_UNUSUAL_ACTIVITY is written to flow_generation_hold.json and restored on start, so a restart no longer lifts it. FLOW_UNUSUAL_ACTIVITY_COOLDOWN_S defaults to 3600 (was 120). A shorter hold never replaces a longer one or its reason. - [HIJACK] extension_hijack_detected was requeued forever without counting; it now fails once retry_count reaches 3. - Any "unusual_activity" spelling is terminal; a bare code no longer falls into the 10x reCAPTCHA retry loop. - POST /api/flow/clear-hijack clears the file too; /api/flow/status reports the hold's reason. Takes the persistent-hold and bounded-retry ideas of crisng95#68 onto the current batch transport. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #67 reports two Google accounts unable to generate even in the manual Flow UI after FlowKit testing. That timing is concerning, but it does not establish that FlowKit or PR #64 caused the restriction.
Before this change, FlowKit paused for only 30/120 seconds after hijack or unusual-activity signals; the worker could requeue hijack failures without counting a retry, and generic CAPTCHA failures could be retried repeatedly. The extension also auto-injected the hijack bypass and could mint more than once.
This draft makes CAPTCHA-bearing generation opt-in (
FLOW_ENABLE_CAPTCHA_GENERATION=1) and serializes it. It writes a durable in-flight marker before requesting a token, then keeps a persistent safety hold after unusual-activity, hijack, CAPTCHA, or uncertain transport failures. The hold survives restart and cannot be cleared by/api/flow/clear-hijack. The extension no longer auto-loads the hijack bypass or a second reCAPTCHA runtime, uses at most one public mint attempt, and rejects tokens returned by stale tabs without a verified mint-path diagnostic. Read-only media and polling RPCs remain available. README, dashboard, extension, and troubleshooting docs warn testers and distinguish extension-only failures from a manual Flow UI block; no Google recovery time is claimed.Offline validation: 275 Python unit tests (excluding three unrelated Windows/environment-dependent modules), 10 Node extension tests, JS syntax checks, and
git diff --checkpassed. The full Python unit run surfaced existing setup/CLI encoding and Windows symlink failures outside the changed paths. One bounded FlowKit canary was attempted in AdsPower FLOW 1 (one still, one attempt, no references). The patched extension returnedEXTENSION_HIJACK_DETECTEDbefore token minting or a generation RPC; the server persisted anextension_hijack_detectedhold and stopped further requests. Read-only page inspection showed no old FlowKit bypass object (window.__fk_hijackabsent), while the page's public execute wrapper contained theextension_hijack_detectedmarker. No image was generated. This validates the fail-closed path, not generation success; manual Flow UI access on this account was not established by this test.This is a temporary safety mitigation, not a root-cause fix. The opted-in mint path needs separate live verification using a disposable account before any release.