fix: harden GoPay and 5sim PR paths

background/phone-verification-flow.js

@@ -275,6 +275,13 @@
       return Math.max(500, Math.min(30000, parsed));
     }
 
+    function assertFiveSimMaxPriceCompatibleWithOperator(operator, maxPriceLimit) {
+      const normalizedOperator = normalizeFiveSimCountryCode(operator, DEFAULT_FIVE_SIM_OPERATOR);
+      if (maxPriceLimit !== null && maxPriceLimit !== undefined && normalizedOperator !== DEFAULT_FIVE_SIM_OPERATOR) {
+        throw new Error('5sim maxPrice only works when operator is "any"; clear the price limit or switch operator to any before buying a number.');
+      }
+    }
+
     function normalizeHeroSmsPriceLimit(value) {
       if (value === undefined || value === null || String(value).trim() === '') {
         return null;
@@ -1381,16 +1388,19 @@
         if (!apiKey) {
           throw new Error('5sim API key is missing. Save it in the side panel before running the phone flow.');
         }
-        const configuredMaxPrice = normalizeHeroSmsPriceLimit(state.fiveSimMaxPrice);
+        const configuredMaxPrice = normalizeHeroSmsPriceLimit(state.fiveSimMaxPrice);
+        const operator = normalizeFiveSimCountryCode(state.fiveSimOperator, DEFAULT_FIVE_SIM_OPERATOR);
+        const maxPriceLimit = configuredMaxPrice !== null
+          ? configuredMaxPrice
+          : normalizeHeroSmsPriceLimit(state.heroSmsMaxPrice);
+        assertFiveSimMaxPriceCompatibleWithOperator(operator, maxPriceLimit);
         return {
           provider,
           apiKey,
           baseUrl: normalizeUrl(state.fiveSimBaseUrl, DEFAULT_FIVE_SIM_BASE_URL).replace(/\/+$/, ''),
-          operator: normalizeFiveSimCountryCode(state.fiveSimOperator, DEFAULT_FIVE_SIM_OPERATOR),
+          operator,
           product: normalizeFiveSimCountryCode(state.fiveSimProduct, DEFAULT_FIVE_SIM_PRODUCT),
-          maxPriceLimit: configuredMaxPrice !== null
-            ? configuredMaxPrice
-            : normalizeHeroSmsPriceLimit(state.heroSmsMaxPrice),
+          maxPriceLimit,
           countryCandidates: resolveFiveSimCountryCandidates(state),
         };
       }

background/steps/gopay-approve.js

@@ -910,13 +910,16 @@
       const target = Number.isInteger(frameId)
         ? await sendGoPayFrameCommand(tabId, frameId, targetMessageType, {})
         : await sendGoPayCommand(tabId, targetMessageType, {});
-      const rect = target?.rect || null;
-      if (!target?.found || !rect || !Number.isFinite(rect.centerX) || !Number.isFinite(rect.centerY)) {
-        return { clicked: false, reason: 'target_not_found', clickTarget: target?.target || '' };
-      }
-      await clickWithDebugger(tabId, rect);
-      return { clicked: true, clickTarget: target.target || '' };
-    }
+      const rect = target?.rect || null;
+      if (!target?.found || !rect || !Number.isFinite(rect.centerX) || !Number.isFinite(rect.centerY)) {
+        return { clicked: false, reason: 'target_not_found', clickTarget: target?.target || '' };
+      }
+      if (Number.isInteger(frameId)) {
+        return { clicked: false, reason: 'debugger_click_skipped_for_frame_target', clickTarget: target.target || '' };
+      }
+      await clickWithDebugger(tabId, rect);
+      return { clicked: true, clickTarget: target.target || '' };
+    }
 
 
     async function clickGoPayContinueWithDebugger(tabId, frameId = null) {