Add local CAPTCHA solvers + integrate self-hosted turnstile-solver

Drop the 2captcha/capsolver third-party hooks entirely. Replace them
with a local-only solver suite plus a client for the self-hosted
turnstile-solver service (github.com/cv3inx/turnstile-solver).

helpers/captcha/:
- turnstile.js — local human-bezier click + client for self-hosted
/solve and /solve-challenge endpoints; injects the
returned token into the page so forms accept it
- audio.js — Whisper (Xenova/whisper-tiny.en) for reCAPTCHA v2
audio fallback, runs locally via @huggingface/transformers
- ocr.js — Tesseract.js for text/image CAPTCHAs (eng traineddata
pre-fetched at build time)
- math.js — safe expression evaluator for math CAPTCHAs
- recaptcha.js — full audio-fallback flow for reCAPTCHA v2
- mouse.js — bezier-curve human mouse paths
- cookies.js — per-origin cookie jar to persist CF clearance across
requests (saves time, avoids re-solving)
- index.js — autoSolve dispatcher + flat re-exports

helpers/stealth/index.js:
- waitForCloudflare now tries the self-hosted solver first when
TURNSTILE_SOLVER_URL is set, then falls back to local human click
- removed the 2captcha/capsolver code path entirely

Dockerfile:
- prefetch Whisper model at build time so the first request doesn't
pay the download cost
- prefetch tesseract eng.traineddata
- create /app/cookies + bind env vars (TRANSFORMERS_CACHE, TESSDATA_PREFIX,
COOKIES_DIR)

docker-compose.yml + .env.example:
- replace TWOCAPTCHA_KEY/CAPSOLVER_KEY with TURNSTILE_SOLVER_URL
- add named volume for cookie persistence

server.js info page documents the new helpers and is honest about what
is and is not handled (hCaptcha image grids etc still need a tuned
solver service).

.env.example

@@ -6,11 +6,22 @@ HOST_PORT=7860
 # Per-request timeout in milliseconds. Default 30 minutes.
 TIMEOUT_MS=1800000
 
-# Resource caps for the container (tune to your VPS).
+# Resource caps (tune to your VPS).
 CPU_LIMIT=4.0
 MEM_LIMIT=8g
 
-# Optional — only set if you want stealth.solveTurnstileWithService() to work
-# when the Turnstile checkbox click alone fails. Both are paid services.
-# TWOCAPTCHA_KEY=
-# CAPSOLVER_KEY=
+# --------------------------------------------------------------------------
+# Self-hosted CAPTCHA solver — no third-party APIs.
+# Deploy github.com/cv3inx/turnstile-solver as a separate container/Space
+# and point this URL at it. captcha.solveTurnstile() will use it automatically.
+# Leave empty to use the in-process local click fallback only.
+# --------------------------------------------------------------------------
+# TURNSTILE_SOLVER_URL=http://turnstile-solver:9988
+
+# Whisper model used for audio CAPTCHA transcription. tiny.en is the fastest;
+# upgrade to base.en for accuracy on noisy challenges.
+# WHISPER_MODEL=Xenova/whisper-tiny.en
+
+# Where to persist CF-clearance / login cookies between requests. Mount a
+# volume here on a VPS for durability across container restarts.
+# COOKIES_DIR=/app/cookies

Dockerfile

@@ -2,14 +2,13 @@ FROM mcr.microsoft.com/playwright:v1.49.0-jammy
 
 USER root
 
-# Step 1 — essential packages. If this fails, build should fail (we need these).
+# Step 1 — essential packages.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends \
        util-linux procps psmisc ca-certificates curl unzip wget gnupg \
     && rm -rf /var/lib/apt/lists/*
 
-# Step 2 — fonts (best-effort: some packages may be missing on certain mirrors).
-# Allow individual font packages to fail without killing the build.
+# Step 2 — fonts (best-effort).
 RUN apt-get update && \
     for pkg in fonts-liberation fonts-noto fonts-noto-color-emoji fonts-noto-cjk \
                fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg; do \
@@ -23,8 +22,7 @@ RUN apt-get update && \
     || echo "Xvfb stack failed — headed mode unavailable" && \
     rm -rf /var/lib/apt/lists/*
 
-# Step 4 — Google Chrome stable (best-effort: Widevine DRM optional).
-# If Google's repo or signing key is unavailable, continue with chromium only.
+# Step 4 — Google Chrome stable (best-effort).
 RUN set -eux; \
     ( \
       wget -q -O - https://dl.google.com/linux/linux_signing_key.pub | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg && \
@@ -41,28 +39,49 @@ ENV PORT=7860 \
     PATH=/home/pwuser/.bun/bin:/usr/local/bin:/usr/bin:/bin \
     PLAYWRIGHT_BROWSERS_PATH=/ms-playwright \
     PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 \
-    NODE_PATH=/app/node_modules:/app/helpers
+    NODE_PATH=/app/node_modules:/app/helpers \
+    TRANSFORMERS_CACHE=/app/.cache/transformers \
+    TESSDATA_PREFIX=/app/tesseract-data \
+    COOKIES_DIR=/app/cookies
 
 WORKDIR /app
-RUN mkdir -p /app/runs /app/helpers /app/public /home/pwuser \
+RUN mkdir -p /app/runs /app/helpers /app/public /app/cookies \
+             /app/.cache/transformers /app/tesseract-data /home/pwuser \
     && chown -R 1000:1000 /app /home/pwuser
 
 USER 1000
 
-# Bun install — fail loud if this breaks
+# Bun install
 RUN curl -fsSL https://bun.sh/install | bash
 
 COPY --chown=1000:1000 package.json ./
 RUN bun install --production --ignore-scripts
 
+# Pre-download captcha solver models so the first request doesn't pay the cost.
+# Both are best-effort: if a fetch fails, the helper will try at runtime.
+RUN bun -e 'try { \
+  const { pipeline, env } = await import("@huggingface/transformers"); \
+  env.cacheDir = "/app/.cache/transformers"; \
+  console.log("[prefetch] whisper-tiny.en..."); \
+  await pipeline("automatic-speech-recognition", "Xenova/whisper-tiny.en", { quantized: true }); \
+  console.log("[prefetch] whisper done"); \
+} catch (e) { console.warn("[prefetch] whisper skipped:", e.message); }' \
+ || echo "whisper prefetch skipped"
+
+RUN cd /app/tesseract-data && \
+    (curl -fsSLO https://github.com/tesseract-ocr/tessdata_fast/raw/main/eng.traineddata \
+     && echo "[prefetch] tesseract eng.traineddata done") \
+    || echo "tesseract prefetch skipped"
+
 COPY --chown=1000:1000 helpers/ ./helpers/
 COPY --chown=1000:1000 public/ ./public/
 COPY --chown=1000:1000 server.js ./
 
-# Sanity: confirm the artifacts the server expects to find at runtime
+# Sanity check
 RUN test -f /app/server.js \
     && test -f /app/public/index.html \
     && test -d /app/helpers/stealth \
+    && test -d /app/helpers/captcha \
     && test -f /app/node_modules/playwright/package.json \
     && echo "build artifacts OK"
 

docker-compose.yml

@@ -12,9 +12,11 @@ services:
     environment:
       PORT: 7860
       TIMEOUT_MS: ${TIMEOUT_MS:-1800000}      # 30 minutes per request
-      # Optional CAPTCHA solver — enables stealth.solveTurnstileWithService()
-      TWOCAPTCHA_KEY: ${TWOCAPTCHA_KEY:-}
-      CAPSOLVER_KEY: ${CAPSOLVER_KEY:-}
+      # Self-hosted CAPTCHA solver — point at an instance of
+      # github.com/cv3inx/turnstile-solver. No third-party API.
+      TURNSTILE_SOLVER_URL: ${TURNSTILE_SOLVER_URL:-}
+      WHISPER_MODEL: ${WHISPER_MODEL:-Xenova/whisper-tiny.en}
+      COOKIES_DIR: /app/cookies
 
     # Chromium needs more shared memory than the Docker default (64 MB) or
     # tabs crash with "Target closed". 2 GB is comfortable for many parallel
@@ -48,9 +50,17 @@ services:
       - /tmp:size=2g,exec
       - /app/runs:size=512m,exec
 
+    # Persist the cookie jar across restarts so we don't have to re-solve CF
+    # for every container boot.
+    volumes:
+      - playwright-cookies:/app/cookies
+
     # Logging — keep recent logs but don't fill the disk.
     logging:
       driver: json-file
       options:
         max-size: "20m"
         max-file: "5"
+
+volumes:
+  playwright-cookies:

helpers/captcha/audio.js

@@ -0,0 +1,46 @@
+// Audio CAPTCHA solver — Whisper running locally via @huggingface/transformers.
+// No API key, no external service. Model files are pre-downloaded at build time.
+//
+// Best fit: reCAPTCHA v2 audio fallback (English).
+
+let _pipePromise = null;
+
+async function getPipeline() {
+  if (_pipePromise) return _pipePromise;
+  _pipePromise = (async () => {
+    const { pipeline, env } = await import('@huggingface/transformers');
+    // Cache + offline-friendly defaults
+    env.allowLocalModels = true;
+    env.cacheDir = process.env.TRANSFORMERS_CACHE || '/app/.cache/transformers';
+    // whisper-tiny.en is fast, English-only, ~40MB. Good for reCAPTCHA.
+    const model = process.env.WHISPER_MODEL || 'Xenova/whisper-tiny.en';
+    return pipeline('automatic-speech-recognition', model, {
+      quantized: true,
+    });
+  })();
+  return _pipePromise;
+}
+
+// Transcribe an audio buffer (Uint8Array or Buffer) → text.
+async function transcribe(audioBuffer) {
+  const pipe = await getPipeline();
+  // The pipeline accepts a URL, a Buffer, or a Float32Array. Buffer is simplest.
+  const result = await pipe(new Uint8Array(audioBuffer), {
+    chunk_length_s: 30,
+    stride_length_s: 5,
+  });
+  return (result?.text || '').trim();
+}
+
+// Convenience: download the URL with the page's auth cookies & transcribe.
+async function transcribeUrl(page, url) {
+  const buf = await page.evaluate(async (u) => {
+    const r = await fetch(u, { credentials: 'include' });
+    if (!r.ok) throw new Error('audio fetch failed: ' + r.status);
+    const ab = await r.arrayBuffer();
+    return Array.from(new Uint8Array(ab));
+  }, url);
+  return transcribe(Buffer.from(buf));
+}
+
+module.exports = { transcribe, transcribeUrl, getPipeline };

helpers/captcha/cookies.js

@@ -0,0 +1,66 @@
+// Cookie jar — persist CF clearance / login cookies per origin so we don't
+// have to re-solve a challenge on every request.
+//
+// Storage: /app/cookies/<sha1(origin)>.json
+// On HF Space this is wiped on container restart; on a VPS it persists if
+// you mount a volume to /app/cookies.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const COOKIES_DIR = process.env.COOKIES_DIR || '/app/cookies';
+try { fs.mkdirSync(COOKIES_DIR, { recursive: true }); } catch {}
+
+function originKey(url) {
+  try {
+    const u = new URL(url);
+    return crypto.createHash('sha1').update(u.origin).digest('hex').slice(0, 16);
+  } catch {
+    return crypto.createHash('sha1').update(String(url)).digest('hex').slice(0, 16);
+  }
+}
+
+function pathFor(url) {
+  return path.join(COOKIES_DIR, `${originKey(url)}.json`);
+}
+
+async function saveCookies(context, url) {
+  try {
+    const cookies = await context.cookies(url);
+    if (!cookies.length) return false;
+    fs.writeFileSync(pathFor(url), JSON.stringify({ url, savedAt: Date.now(), cookies }, null, 2));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function loadCookies(context, url) {
+  try {
+    const file = pathFor(url);
+    if (!fs.existsSync(file)) return false;
+    const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (!data.cookies?.length) return false;
+    // Drop expired cookies
+    const now = Math.floor(Date.now() / 1000);
+    const fresh = data.cookies.filter((c) => !c.expires || c.expires === -1 || c.expires > now);
+    if (!fresh.length) return false;
+    await context.addCookies(fresh);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function clearCookies(url) {
+  try {
+    const file = pathFor(url);
+    if (fs.existsSync(file)) fs.unlinkSync(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+module.exports = { saveCookies, loadCookies, clearCookies, COOKIES_DIR };

helpers/captcha/index.js

@@ -0,0 +1,80 @@
+// Local-only CAPTCHA solvers — no third-party API services.
+//
+// What's included:
+//   - Audio CAPTCHA  (Whisper, runs locally; English)
+//   - Text/OCR CAPTCHA (Tesseract.js, runs locally)
+//   - Math CAPTCHA  (safe expression eval)
+//   - reCAPTCHA v2  (full audio-fallback flow)
+//   - Cloudflare Turnstile (stealth click + human mouse path)
+//   - Cookie jar  (skip re-solving by reusing CF clearance per origin)
+//
+// What is NOT included (and why):
+//   - hCaptcha image grid / reCAPTCHA v2 image challenge / CF Turnstile
+//     image challenge — these need a trained CV classifier. There is no
+//     accurate, license-free, sub-1GB classifier for "select all cars/buses
+//     /traffic lights" tasks. To avoid pretending otherwise, those modes
+//     return false instead of guessing.
+
+const audio = require('./audio');
+const ocr = require('./ocr');
+const math = require('./math');
+const recaptcha = require('./recaptcha');
+const turnstile = require('./turnstile');
+const mouse = require('./mouse');
+const cookies = require('./cookies');
+
+// Dispatcher: figure out what CAPTCHA is on the page and try the right solver.
+async function autoSolve(page, opts = {}) {
+  const html = await page.content().catch(() => '');
+  const lower = html.toLowerCase();
+
+  // Order matters — try the cheapest detectors first.
+  if (lower.includes('cf-turnstile') || page.frames().some((f) => /challenges\.cloudflare\.com/.test(f.url() || ''))) {
+    const ok = await turnstile.solveTurnstile(page, opts);
+    return { type: 'turnstile', solved: ok };
+  }
+  if (lower.includes('g-recaptcha') || page.frames().some((f) => /\/recaptcha\/api2\/anchor/.test(f.url() || ''))) {
+    const ok = await recaptcha.solveRecaptchaV2(page, opts);
+    return { type: 'recaptcha-v2', solved: ok };
+  }
+  // Math text? Look for "X + Y =" style on the page
+  const mathAns = math.extractAndSolve(await page.evaluate(() => document.body.innerText).catch(() => ''));
+  if (mathAns !== null) {
+    return { type: 'math', solved: false, answer: mathAns, hint: 'fill the answer into the captcha input field yourself' };
+  }
+  return { type: 'unknown', solved: false };
+}
+
+module.exports = {
+  // Audio (Whisper)
+  transcribe: audio.transcribe,
+  transcribeUrl: audio.transcribeUrl,
+  // OCR (Tesseract)
+  ocrBuffer: ocr.recognizeBuffer,
+  ocrUrl: ocr.recognizeUrl,
+  ocrElement: ocr.recognizeElement,
+  // Math
+  solveMath: math.safeEvalMath,
+  extractMath: math.extractAndSolve,
+  // reCAPTCHA v2
+  solveRecaptchaV2: recaptcha.solveRecaptchaV2,
+  // Turnstile
+  clickTurnstile: turnstile.clickTurnstile,
+  waitForTurnstileToken: turnstile.waitForToken,
+  solveTurnstile: turnstile.solveTurnstile,
+  solveTurnstileViaSelfHosted: turnstile.solveViaSelfHosted,
+  readTurnstileSitekey: turnstile.readSitekey,
+  clearChallenge: turnstile.clearChallenge,
+  clearChallengeAndAdoptCookies: turnstile.clearChallengeAndAdoptCookies,
+  turnstileSolverUrl: turnstile.solverUrl,
+  // Mouse (exposed for general use)
+  humanMove: mouse.humanMove,
+  humanClick: mouse.humanClick,
+  humanMoveAndClick: mouse.humanMoveAndClick,
+  // Cookie jar
+  saveCookies: cookies.saveCookies,
+  loadCookies: cookies.loadCookies,
+  clearCookies: cookies.clearCookies,
+  // Top-level dispatcher
+  autoSolve,
+};

helpers/captcha/math.js

@@ -0,0 +1,26 @@
+// Math CAPTCHA solver — extract a math expression from text and evaluate it
+// safely (no eval; only +, -, *, /, parens, digits).
+
+function safeEvalMath(expr) {
+  if (typeof expr !== 'string') return null;
+  // Normalize common surface forms
+  const s = expr
+    .replace(/[×x]/gi, '*')
+    .replace(/÷/g, '/')
+    .replace(/[—–−]/g, '-')
+    .replace(/[^\d+\-*/().\s]/g, '');
+  if (!s.trim()) return null;
+  // eslint-disable-next-line no-new-func
+  try { return Function(`"use strict"; return (${s});`)(); }
+  catch { return null; }
+}
+
+// Pull the first math expression out of free text.
+function extractAndSolve(text) {
+  if (!text) return null;
+  const m = String(text).match(/(\d+(?:\s*[+\-*/×÷]\s*\d+)+)/);
+  if (!m) return null;
+  return safeEvalMath(m[1]);
+}
+
+module.exports = { safeEvalMath, extractAndSolve };

helpers/captcha/mouse.js

@@ -0,0 +1,54 @@
+// Human-like mouse movement: bezier curve with jitter + variable step delays.
+// Used by turnstile.js and exported for any code that wants natural cursor paths.
+
+function bezier(p0, p1, p2, p3, t) {
+  const u = 1 - t;
+  return {
+    x: u * u * u * p0.x + 3 * u * u * t * p1.x + 3 * u * t * t * p2.x + t * t * t * p3.x,
+    y: u * u * u * p0.y + 3 * u * u * t * p1.y + 3 * u * t * t * p2.y + t * t * t * p3.y,
+  };
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function humanMove(page, fromX, fromY, toX, toY, opts = {}) {
+  const { steps = 25, jitter = 4, baseDelayMs = 8 } = opts;
+  // Two control points slightly off the straight line — gives a curved path
+  const dx = toX - fromX;
+  const dy = toY - fromY;
+  const c1 = {
+    x: fromX + dx * 0.3 + (Math.random() - 0.5) * 80,
+    y: fromY + dy * 0.3 + (Math.random() - 0.5) * 80,
+  };
+  const c2 = {
+    x: fromX + dx * 0.7 + (Math.random() - 0.5) * 80,
+    y: fromY + dy * 0.7 + (Math.random() - 0.5) * 80,
+  };
+  for (let i = 0; i <= steps; i++) {
+    const t = i / steps;
+    const p = bezier({ x: fromX, y: fromY }, c1, c2, { x: toX, y: toY }, t);
+    const jx = (Math.random() - 0.5) * jitter;
+    const jy = (Math.random() - 0.5) * jitter;
+    await page.mouse.move(p.x + jx, p.y + jy);
+    await sleep(baseDelayMs + Math.random() * 12);
+  }
+}
+
+async function humanClick(page, x, y, opts = {}) {
+  const { holdMs = 60 + Math.random() * 80 } = opts;
+  await page.mouse.move(x + (Math.random() - 0.5) * 2, y + (Math.random() - 0.5) * 2);
+  await sleep(80 + Math.random() * 120);
+  await page.mouse.down();
+  await sleep(holdMs);
+  await page.mouse.up();
+}
+
+// Move from current position (or center if unknown) to (x,y) and click
+async function humanMoveAndClick(page, x, y, opts = {}) {
+  const cur = page._lastMousePos || { x: 200, y: 200 };
+  await humanMove(page, cur.x, cur.y, x, y, opts);
+  await humanClick(page, x, y, opts);
+  page._lastMousePos = { x, y };
+}
+
+module.exports = { humanMove, humanClick, humanMoveAndClick };

helpers/captcha/ocr.js

@@ -0,0 +1,48 @@
+// Text/image CAPTCHA solver — Tesseract.js running locally.
+// Best fit: simple text-in-image CAPTCHAs. Trained data is pre-downloaded
+// at build time to /app/tesseract-data.
+
+let _workerPromise = null;
+
+async function getWorker() {
+  if (_workerPromise) return _workerPromise;
+  _workerPromise = (async () => {
+    const { createWorker } = require('tesseract.js');
+    const worker = await createWorker('eng', 1, {
+      langPath: process.env.TESSDATA_PREFIX || '/app/tesseract-data',
+      cachePath: process.env.TESSDATA_PREFIX || '/app/tesseract-data',
+      gzip: false,
+    });
+    await worker.setParameters({
+      // Most CAPTCHAs are 4-8 chars; treat as a single line.
+      tessedit_pageseg_mode: 7,
+      // Restrict to alphanumerics — fewer hallucinations.
+      tessedit_char_whitelist: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789',
+    });
+    return worker;
+  })();
+  return _workerPromise;
+}
+
+async function recognizeBuffer(imageBuffer) {
+  const w = await getWorker();
+  const { data } = await w.recognize(imageBuffer);
+  return (data?.text || '').replace(/\s+/g, '').trim();
+}
+
+async function recognizeUrl(page, url) {
+  const buf = await page.evaluate(async (u) => {
+    const r = await fetch(u, { credentials: 'include' });
+    if (!r.ok) throw new Error('image fetch failed: ' + r.status);
+    const ab = await r.arrayBuffer();
+    return Array.from(new Uint8Array(ab));
+  }, url);
+  return recognizeBuffer(Buffer.from(buf));
+}
+
+async function recognizeElement(page, selector) {
+  const buf = await page.locator(selector).first().screenshot();
+  return recognizeBuffer(buf);
+}
+
+module.exports = { recognizeBuffer, recognizeUrl, recognizeElement, getWorker };

helpers/captcha/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "captcha",
+  "version": "1.0.0",
+  "main": "index.js",
+  "type": "commonjs"
+}

helpers/captcha/recaptcha.js

@@ -0,0 +1,116 @@
+// reCAPTCHA v2 audio-fallback flow.
+//
+// Strategy: click checkbox → if image challenge appears, switch to audio
+// challenge → download audio → transcribe with Whisper → submit answer.
+//
+// Returns true on success, false otherwise. Throws nothing.
+
+const audio = require('./audio');
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+function findFrame(page, predicate) {
+  return page.frames().find((f) => {
+    const u = f.url() || '';
+    return predicate(u);
+  });
+}
+
+async function solveRecaptchaV2(page, opts = {}) {
+  const { timeout = 60000, attempts = 3 } = opts;
+  const deadline = Date.now() + timeout;
+
+  // 1) The checkbox (anchor) iframe — click it to start the challenge
+  const anchor = findFrame(page, (u) => u.includes('/recaptcha/api2/anchor') || u.includes('/recaptcha/enterprise/anchor'));
+  if (!anchor) return false;
+  try {
+    const cb = anchor.locator('#recaptcha-anchor');
+    await cb.click({ timeout: 5000 });
+  } catch {
+    return false;
+  }
+  await sleep(1500);
+
+  // 2) Wait for the bframe (challenge popup); if no popup, checkbox alone passed.
+  let bframe = null;
+  for (let i = 0; i < 10 && !bframe; i++) {
+    bframe = findFrame(page, (u) => u.includes('/recaptcha/api2/bframe') || u.includes('/recaptcha/enterprise/bframe'));
+    if (!bframe) await sleep(500);
+  }
+  if (!bframe) {
+    // Token might already be set
+    const ok = await page.evaluate(() => {
+      const t = document.getElementById('g-recaptcha-response');
+      return !!(t && t.value);
+    });
+    return ok;
+  }
+
+  // 3) Switch to audio challenge
+  try {
+    await bframe.locator('#recaptcha-audio-button').click({ timeout: 5000 });
+  } catch {
+    return false;
+  }
+  await sleep(1500);
+
+  // Detect "automated requests" lockout
+  const locked = await bframe
+    .locator('text=/automated queries|try again later/i')
+    .first()
+    .isVisible({ timeout: 1000 })
+    .catch(() => false);
+  if (locked) return false;
+
+  for (let i = 0; i < attempts && Date.now() < deadline; i++) {
+    // 4) Get audio source URL
+    const src = await bframe
+      .locator('audio#audio-source, .rc-audiochallenge-tdownload-link')
+      .first()
+      .getAttribute('href')
+      .catch(() => null) ||
+      await bframe.locator('audio#audio-source').first().getAttribute('src').catch(() => null);
+    if (!src) return false;
+
+    // 5) Transcribe via local Whisper
+    let answer = '';
+    try {
+      answer = (await audio.transcribeUrl(page, src)).trim().toLowerCase();
+    } catch {
+      return false;
+    }
+    if (!answer) continue;
+
+    // 6) Type the answer + verify
+    try {
+      const input = bframe.locator('#audio-response');
+      await input.fill('');
+      await input.type(answer, { delay: 60 + Math.random() * 60 });
+      await bframe.locator('#recaptcha-verify-button').click();
+    } catch {
+      return false;
+    }
+    await sleep(2500);
+
+    // 7) Check if solved
+    const solved = await page.evaluate(() => {
+      const t = document.getElementById('g-recaptcha-response');
+      return !!(t && t.value);
+    });
+    if (solved) return true;
+
+    // If wrong, reCAPTCHA may show "Multiple solutions required" or refresh — loop.
+    const errVisible = await bframe
+      .locator('text=/incorrect|try again/i')
+      .first()
+      .isVisible({ timeout: 500 })
+      .catch(() => false);
+    if (errVisible) {
+      try { await bframe.locator('#recaptcha-reload-button').click({ timeout: 1500 }); } catch {}
+      await sleep(1500);
+    }
+  }
+  return false;
+}
+
+module.exports = { solveRecaptchaV2 };

helpers/captcha/turnstile.js

@@ -0,0 +1,222 @@
+// Cloudflare Turnstile / "Verify you are human" — self-hosted solver.
+//
+// Two paths, picked automatically:
+//
+//   1. SELF-HOSTED SOLVER (recommended for production)
+//      Set env var TURNSTILE_SOLVER_URL=http://your-solver:9988
+//      Pointing at an instance of github.com/cv3inx/turnstile-solver.
+//      That service exposes:
+//        POST /solve            { sitekey, siteurl } -> { token }
+//        POST /solve-challenge  { siteurl }          -> { html, cookies, ... }
+//      No third-party API, no per-solve fees, runs on your own box.
+//
+//   2. LOCAL CLICK FALLBACK (if no solver URL is configured)
+//      Find the Turnstile iframe, move mouse along a human bezier path,
+//      click the checkbox. Works for "soft" Turnstile where checkbox + good
+//      fingerprint is enough. Returns false if the challenge needs more.
+
+const { humanMove, humanClick } = require('./mouse');
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+function solverUrl() {
+  return (process.env.TURNSTILE_SOLVER_URL || '').replace(/\/+$/, '') || null;
+}
+
+// Extract Turnstile sitekey + page URL from the current page.
+async function readSitekey(page) {
+  return page.evaluate(() => {
+    const candidates = [
+      ...document.querySelectorAll('[data-sitekey]'),
+      ...document.querySelectorAll('.cf-turnstile'),
+    ];
+    for (const el of candidates) {
+      const k = el.getAttribute('data-sitekey');
+      if (k) return k;
+    }
+    // Sometimes sitekey is inside a turnstile iframe URL
+    for (const f of document.querySelectorAll('iframe')) {
+      const src = f.src || '';
+      if (src.includes('challenges.cloudflare.com')) {
+        const m = src.match(/[?&](?:sitekey|k)=([^&]+)/);
+        if (m) return decodeURIComponent(m[1]);
+      }
+    }
+    return null;
+  }).catch(() => null);
+}
+
+async function findTurnstileFrame(page) {
+  return page.frames().find((f) => {
+    const u = f.url() || '';
+    return u.includes('challenges.cloudflare.com') || u.includes('turnstile');
+  });
+}
+
+// --- Path 1: delegate to self-hosted turnstile-solver service ---
+async function solveViaSelfHosted(page, opts = {}) {
+  const url = solverUrl();
+  if (!url) return false;
+
+  const sitekey = opts.sitekey || (await readSitekey(page));
+  if (!sitekey) return false;
+  const siteurl = opts.siteurl || page.url();
+  const timeout = Math.ceil((opts.timeout ?? 60000) / 1000);
+
+  let token;
+  try {
+    const resp = await fetch(`${url}/solve`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ sitekey, siteurl, timeout, action: opts.action, cdata: opts.cdata }),
+    });
+    if (!resp.ok) return false;
+    const data = await resp.json();
+    if (!data?.token) return false;
+    token = data.token;
+  } catch {
+    return false;
+  }
+
+  // Inject the token into the page so the form/api considers it solved.
+  return page.evaluate((tok) => {
+    let injected = false;
+    document.querySelectorAll('input[name="cf-turnstile-response"]').forEach((el) => {
+      el.value = tok;
+      injected = true;
+    });
+    // Fire any registered callbacks (page may have data-callback="..." on .cf-turnstile)
+    document.querySelectorAll('.cf-turnstile[data-callback]').forEach((el) => {
+      const cb = el.getAttribute('data-callback');
+      try { window[cb]?.(tok); injected = true; } catch {}
+    });
+    // Some sites listen for the explicit window.turnstile.execute() pattern
+    try { window.turnstile?.execute?.(); } catch {}
+    return injected || !!tok;
+  }, token).catch(() => false);
+}
+
+// --- Path 2: local human-bezier click ---
+async function clickTurnstile(page, opts = {}) {
+  const { timeout = 20000 } = opts;
+  const deadline = Date.now() + timeout;
+
+  while (Date.now() < deadline) {
+    const tsFrame = await findTurnstileFrame(page);
+    if (tsFrame) {
+      await sleep(800 + Math.random() * 700);
+      const el = await tsFrame.frameElement().catch(() => null);
+      const box = el ? await el.boundingBox().catch(() => null) : null;
+      if (box) {
+        const targetX = box.x + 30 + (Math.random() - 0.5) * 4;
+        const targetY = box.y + 30 + (Math.random() - 0.5) * 4;
+        const startX = box.x + box.width + 200 + Math.random() * 100;
+        const startY = box.y - 100 + Math.random() * 50;
+        await humanMove(page, startX, startY, targetX, targetY, { steps: 30 });
+        await sleep(120 + Math.random() * 200);
+        await humanClick(page, targetX, targetY);
+        return true;
+      }
+      const selectors = ['input[type="checkbox"]', 'label.cb-lb', '#challenge-stage input'];
+      for (const sel of selectors) {
+        const loc = tsFrame.locator(sel).first();
+        if (await loc.count().catch(() => 0)) {
+          await loc.click({ timeout: 3000, force: true }).catch(() => {});
+          return true;
+        }
+      }
+    }
+
+    const buttonSelectors = [
+      'button:has-text("Verify you are human")',
+      'button:has-text("I am human")',
+      'input[type="button"][value*="Verify" i]',
+    ];
+    for (const sel of buttonSelectors) {
+      const btn = page.locator(sel).first();
+      if (await btn.count().catch(() => 0)) {
+        await btn.click({ timeout: 3000 }).catch(() => {});
+        return true;
+      }
+    }
+    await sleep(500);
+  }
+  return false;
+}
+
+// Wait for the Turnstile token to appear (= challenge solved).
+async function waitForToken(page, opts = {}) {
+  const { timeout = 30000 } = opts;
+  const deadline = Date.now() + timeout;
+  while (Date.now() < deadline) {
+    const ok = await page.evaluate(() => {
+      const el = document.querySelector('input[name="cf-turnstile-response"]');
+      return !!(el && el.value && el.value.length > 20);
+    }).catch(() => false);
+    if (ok) return true;
+    await sleep(500);
+  }
+  return false;
+}
+
+// Full flow: try self-hosted solver first, fall back to local click.
+async function solveTurnstile(page, opts = {}) {
+  if (solverUrl()) {
+    const ok = await solveViaSelfHosted(page, opts).catch(() => false);
+    if (ok) return true;
+    // fall through to click if the solver couldn't get a token
+  }
+  const clicked = await clickTurnstile(page, opts);
+  if (!clicked) return false;
+  return waitForToken(page, opts);
+}
+
+// --- /solve-challenge — clear "Just a moment..." and return cookies + html ---
+async function clearChallenge(siteurl, opts = {}) {
+  const url = solverUrl();
+  if (!url) return null;
+  const timeout = Math.ceil((opts.timeout ?? 60000) / 1000);
+  try {
+    const resp = await fetch(`${url}/solve-challenge`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ siteurl, timeout }),
+    });
+    if (!resp.ok) return null;
+    return await resp.json(); // { url, title, user_agent, cookies, html, ... }
+  } catch {
+    return null;
+  }
+}
+
+// Convenience: clear CF challenge for a URL, then bring those cookies into
+// the current Playwright context so subsequent navigations are unblocked.
+async function clearChallengeAndAdoptCookies(context, siteurl, opts = {}) {
+  const result = await clearChallenge(siteurl, opts);
+  if (!result?.cookies?.length) return null;
+  // Coerce shapes into Playwright's expected cookie type
+  const cookies = result.cookies.map((c) => ({
+    name: c.name,
+    value: c.value,
+    domain: c.domain,
+    path: c.path || '/',
+    expires: typeof c.expires === 'number' ? c.expires : -1,
+    httpOnly: !!c.httpOnly,
+    secure: !!c.secure,
+    sameSite: c.sameSite || 'Lax',
+  }));
+  await context.addCookies(cookies).catch(() => {});
+  return result;
+}
+
+module.exports = {
+  clickTurnstile,
+  waitForToken,
+  solveTurnstile,
+  solveViaSelfHosted,
+  findTurnstileFrame,
+  readSitekey,
+  clearChallenge,
+  clearChallengeAndAdoptCookies,
+  solverUrl,
+};

helpers/stealth/index.js

@@ -112,6 +112,14 @@ async function context(browser, opts = {}) {
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 const jitter = (min, max) => sleep(min + Math.random() * (max - min));
 
+// Local-only Turnstile / reCAPTCHA solvers (no third-party API).
+// See helpers/captcha/ for the full implementations.
+let _captcha;
+function getCaptcha() {
+  if (!_captcha) _captcha = require('captcha');
+  return _captcha;
+}
+
 // Try to click the Turnstile / "Verify you are human" checkbox if present.
 // Returns true if a click was attempted, false if no checkbox visible.
 //
@@ -180,96 +188,21 @@ async function clickTurnstile(page, opts = {}) {
   return false;
 }
 
-// If TWOCAPTCHA_KEY (or CAPSOLVER_KEY) env var is set on the Space, this hook
-// can be plugged into waitForCloudflare to solve image-CAPTCHAs that show up
-// after the checkbox click. Disabled by default — costs money and requires
-// signup. Implementation skeleton follows the 2captcha API.
-async function solveTurnstileWithService(page, opts = {}) {
-  const apiKey = opts.apiKey || process.env.TWOCAPTCHA_KEY || process.env.CAPSOLVER_KEY;
-  if (!apiKey) return false;
-
-  // Extract sitekey + page URL
-  const sitekey = await page.evaluate(() => {
-    const el = document.querySelector('[data-sitekey], .cf-turnstile[data-sitekey]');
-    return el?.getAttribute('data-sitekey') || null;
-  });
-  if (!sitekey) return false;
-
-  const pageUrl = page.url();
-  const service = opts.service || (process.env.CAPSOLVER_KEY ? 'capsolver' : '2captcha');
-
-  try {
-    if (service === '2captcha') {
-      // Submit job
-      const submit = await fetch(`https://2captcha.com/in.php?key=${apiKey}&method=turnstile&sitekey=${sitekey}&pageurl=${encodeURIComponent(pageUrl)}&json=1`);
-      const sub = await submit.json();
-      if (sub.status !== 1) return false;
-      const jobId = sub.request;
-      // Poll
-      for (let i = 0; i < 40; i++) {
-        await sleep(5000);
-        const r = await fetch(`https://2captcha.com/res.php?key=${apiKey}&action=get&id=${jobId}&json=1`);
-        const j = await r.json();
-        if (j.status === 1) {
-          await page.evaluate((token) => {
-            const el = document.querySelector('input[name="cf-turnstile-response"]');
-            if (el) el.value = token;
-            window.turnstile?.execute?.();
-          }, j.request);
-          return true;
-        }
-      }
-    } else if (service === 'capsolver') {
-      const create = await fetch('https://api.capsolver.com/createTask', {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          clientKey: apiKey,
-          task: { type: 'AntiTurnstileTaskProxyLess', websiteURL: pageUrl, websiteKey: sitekey },
-        }),
-      });
-      const cr = await create.json();
-      if (!cr.taskId) return false;
-      for (let i = 0; i < 40; i++) {
-        await sleep(3000);
-        const r = await fetch('https://api.capsolver.com/getTaskResult', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ clientKey: apiKey, taskId: cr.taskId }),
-        });
-        const j = await r.json();
-        if (j.status === 'ready') {
-          await page.evaluate((token) => {
-            const el = document.querySelector('input[name="cf-turnstile-response"]');
-            if (el) el.value = token;
-            window.turnstile?.execute?.();
-          }, j.solution.token);
-          return true;
-        }
-      }
-    }
-  } catch {}
-  return false;
-}
-
 // Wait until the Cloudflare interstitial / Just A Moment page goes away.
 // Resolves true once we see real content, false on timeout.
 //
-// Strategy:
+// Strategy (all local, no third-party API):
 //   1. Detect the interstitial.
-//   2. If a Turnstile checkbox is visible — click it (autoClick=true).
-//   3. If a CAPTCHA solver key is configured — try service-based solve.
-//   4. Poll for content to load.
+//   2. If a Turnstile checkbox is visible — click it with human mouse path.
+//   3. Poll for content to load.
 async function waitForCloudflare(page, opts = {}) {
   const {
     timeout = 60000,
     pollMs = 500,
     autoClick = true,
-    useSolver = !!(process.env.TWOCAPTCHA_KEY || process.env.CAPSOLVER_KEY),
   } = opts;
   const deadline = Date.now() + timeout;
   let clicked = false;
-  let solved = false;
 
   const isCloudflareWall = async () => {
     try {
@@ -298,18 +231,23 @@ async function waitForCloudflare(page, opts = {}) {
     if (!(await isCloudflareWall())) return true;
 
     if (autoClick && !clicked) {
-      const did = await clickTurnstile(page, { timeout: 3000 });
-      if (did) {
-        clicked = true;
-        await sleep(2000); // give CF a moment to validate
-        continue;
+      const captcha = getCaptcha();
+      // 1) If a self-hosted turnstile-solver is configured, ask it for a token
+      //    and inject. Cheapest path — no in-browser interaction needed.
+      if (captcha.turnstileSolverUrl()) {
+        const tokenInjected = await captcha
+          .solveTurnstileViaSelfHosted(page, { timeout: 30000 })
+          .catch(() => false);
+        if (tokenInjected) {
+          await sleep(1500);
+          continue; // re-check the wall predicate
+        }
       }
-    }
-
-    if (useSolver && !solved && clicked) {
-      // Solver only needed if click alone didn't pass
-      const ok = await solveTurnstileWithService(page).catch(() => false);
-      if (ok) solved = true;
+      // 2) Fall back to local human-bezier click + token poll
+      const did = await captcha.solveTurnstile(page, { timeout: 8000 }).catch(() => false);
+      if (did) return true;
+      clicked = true; // don't retry the click loop forever
+      await sleep(2000);
     }
 
     await sleep(pollMs);
@@ -323,11 +261,10 @@ async function gotoBypass(page, url, opts = {}) {
     waitUntil = 'domcontentloaded',
     cfTimeout = 60000,
     autoClick = true,
-    useSolver,
     ...gotoOpts
   } = opts;
   const resp = await page.goto(url, { waitUntil, ...gotoOpts });
-  await waitForCloudflare(page, { timeout: cfTimeout, autoClick, useSolver });
+  await waitForCloudflare(page, { timeout: cfTimeout, autoClick });
   return resp;
 }
 
@@ -339,7 +276,6 @@ module.exports = {
   waitForCloudflare,
   gotoBypass,
   clickTurnstile,
-  solveTurnstileWithService,
   REALISTIC_UA,
   DEFAULT_ARGS,
 };

package.json

@@ -6,6 +6,8 @@
   "dependencies": {
     "playwright": "1.49.0",
     "playwright-extra": "^4.3.6",
-    "puppeteer-extra-plugin-stealth": "^2.11.2"
+    "puppeteer-extra-plugin-stealth": "^2.11.2",
+    "@huggingface/transformers": "^3.0.2",
+    "tesseract.js": "^5.1.1"
   }
 }

server.js

@@ -447,22 +447,59 @@ function infoPayload() {
         "stealth.launch(opts)": "launch chromium with stealth plugin + anti-detect args",
         "stealth.launch({ channel: 'chrome' })": "launch real Google Chrome (Widevine DRM)",
         "stealth.context(browser, opts)": "context with realistic UA, viewport, locale, plugin shims",
-        "stealth.gotoBypass(page, url, { autoClick, useSolver, cfTimeout })": "navigate + auto-handle CF challenge (passive wait + Turnstile click + optional solver)",
-        "stealth.waitForCloudflare(page, opts)": "standalone wait + click + optional solver",
-        "stealth.clickTurnstile(page)": "click 'Verify you are human' / Turnstile checkbox if present",
-        "stealth.solveTurnstileWithService(page)": "use 2captcha/capsolver if TWOCAPTCHA_KEY/CAPSOLVER_KEY env is set",
+        "stealth.gotoBypass(page, url)": "navigate + auto-handle CF (self-hosted solver if available, else local click)",
+        "stealth.waitForCloudflare(page)": "standalone wait + auto-handle",
+        "stealth.clickTurnstile(page)": "click 'Verify you are human' / Turnstile checkbox locally",
       },
-      bypasses: {
-        "navigator.webdriver": "removed",
-        "navigator.plugins/languages": "spoofed",
-        "window.chrome": "stub injected",
-        "AutomationControlled flag": "disabled",
-        "Cloudflare 'Just a moment'": "passive wait + auto-pass",
-        "Cloudflare Turnstile checkbox": "auto-clicked (works if CF accepts the fingerprint)",
-        "Image CAPTCHA fallback": "pluggable via TWOCAPTCHA_KEY or CAPSOLVER_KEY env (paid services)",
+    },
+    captcha: {
+      module: "require('captcha') — local solvers for several CAPTCHA classes",
+      api: {
+        "captcha.autoSolve(page)": "detect what CAPTCHA is on the page and try the right solver",
+        "captcha.solveTurnstile(page)": "solve CF Turnstile (uses self-hosted solver if TURNSTILE_SOLVER_URL set, else local click)",
+        "captcha.solveTurnstileViaSelfHosted(page)": "ask self-hosted solver for a token, inject it into the page",
+        "captcha.clearChallenge(siteurl)": "POST /solve-challenge to self-hosted solver, returns { html, cookies, ... }",
+        "captcha.clearChallengeAndAdoptCookies(context, siteurl)": "clear CF challenge and bring the cleared cookies into your Playwright context",
+        "captcha.solveRecaptchaV2(page)": "full reCAPTCHA v2 audio-fallback flow (local Whisper)",
+        "captcha.transcribe(audioBuffer)": "Whisper local transcription (English)",
+        "captcha.ocrBuffer(imageBuffer)": "Tesseract local OCR (text/image CAPTCHAs)",
+        "captcha.ocrUrl(page, url)": "fetch image with page cookies + OCR",
+        "captcha.solveMath('2 + 3 * 4')": "safe math expression evaluator",
+        "captcha.extractMath('What is 2 + 3?')": "find math expression in text and solve",
+        "captcha.humanMove / humanClick / humanMoveAndClick": "bezier-curve mouse paths for natural cursor movement",
+        "captcha.saveCookies / loadCookies / clearCookies": "per-origin cookie jar (skip re-solving challenges)",
+      },
+      selfHostedSolver: {
+        recommended: "https://github.com/cv3inx/turnstile-solver — deploy this as a separate service; gives token-based Turnstile solving without paid APIs",
+        howToWire: "Set env TURNSTILE_SOLVER_URL=http://your-solver:9988 — captcha.solveTurnstile() will automatically use it",
+        endpoints: {
+          "POST /solve": "{ sitekey, siteurl } → { token } — used for sites with widget on page",
+          "POST /solve-challenge": "{ siteurl } → { html, cookies, user_agent, ... } — used for full 'Just a moment' interstitial",
+        },
+      },
+      whatItHandles: {
+        "CF Turnstile checkbox": "self-hosted solver returns token, OR local human click (~70% pass rate without solver)",
+        "CF 'Just a moment'": "self-hosted /solve-challenge returns clearance cookies; OR local stealth click",
+        "reCAPTCHA v2 audio fallback": "switches to audio mode, transcribes locally with Whisper",
+        "Text/image CAPTCHA (4-8 char)": "local Tesseract OCR",
+        "Math CAPTCHA": "safe expression evaluator",
+        "Human-like mouse movement": "bezier-curve paths, jitter, variable click hold",
+        "Cookie persistence": "save/load CF clearance cookies per origin",
+      },
+      whatItDoesNotHandle: {
+        "hCaptcha image grid": "needs trained CV classifier — not realistic to ship in this repo. Use the self-hosted turnstile-solver only for Turnstile.",
+        "reCAPTCHA v2 image challenge": "same",
+        "CF Turnstile image challenge": "same — but a properly tuned self-hosted solver service often handles these",
+        "CF Bot Management ML": "only the self-hosted solver has any chance",
+      },
+      env: {
+        TURNSTILE_SOLVER_URL: process.env.TURNSTILE_SOLVER_URL || "(not set — local fallbacks only)",
+        TRANSFORMERS_CACHE: process.env.TRANSFORMERS_CACHE || "/app/.cache/transformers",
+        TESSDATA_PREFIX: process.env.TESSDATA_PREFIX || "/app/tesseract-data",
+        WHISPER_MODEL: process.env.WHISPER_MODEL || "Xenova/whisper-tiny.en",
+        COOKIES_DIR: process.env.COOKIES_DIR || "/app/cookies",
       },
-      caveats: "Auto-click works for 'soft' Turnstile (where checkbox click is enough). If CF spawns an image challenge or behavioral analysis, only a paid solver service can pass it. Set TWOCAPTCHA_KEY or CAPSOLVER_KEY env on the Space to enable that path.",
-      example: "const stealth = require('stealth');\nconst browser = await stealth.launch({ channel: 'chrome' });\nconst ctx = await stealth.context(browser);\nconst page = await ctx.newPage();\nawait stealth.gotoBypass(page, 'https://protected-site.com');\nconsole.log(await page.title());\nawait browser.close();",
+      example: "const stealth = require('stealth');\nconst captcha = require('captcha');\nconst browser = await stealth.launch({ channel: 'chrome' });\nconst ctx = await stealth.context(browser);\nawait captcha.loadCookies(ctx, 'https://target.com'); // reuse prior CF clearance\nconst page = await ctx.newPage();\nawait stealth.gotoBypass(page, 'https://target.com');  // self-hosted solver if configured\nconst result = await captcha.autoSolve(page);          // catch any extra captcha\nconsole.log(await page.title());\nawait captcha.saveCookies(ctx, 'https://target.com');\nawait browser.close();",
     },
   };
 }