Merge branch 'master' into dev

README.md

@@ -545,8 +545,10 @@ Cloudflare 模式下，插件不会再调用 Cloudflare API 创建路由。
 
 - 已刷新到最新 OAuth 链接
 - 认证页已经真正进入登录验证码页面
-- 如遇登录超时报错，不会在这一步点击认证页上的 `重试`；而是直接按既有逻辑把当前状态视为可恢复失败，交给后续链路回到 Step 7 重跑
+- 如遇登录超时报错，会先尝试自动点击认证页上的 `重试` 恢复当前页面，再按既有逻辑重跑整个 Step 7
 - 如遇登录页长时间停滞，会由后台刷新 OAuth 后重跑整个 Step 7
+- 如果重试页内容中出现 `max_check_attempts`，会立刻完全停止流程，并在侧边栏复用现有确认弹窗提示这是 Cloudflare 风控拦截，确认按钮显示为“我知道了”
+- 如果重试页内容中出现 `Operation timed out`，也会立刻完全停止流程，并提示先检查当前代理 / VPN 节点是否稳定，如节点本身无明显延迟问题则更换服务器后继续使用当前邮箱登录
 
 支持：
 
@@ -563,7 +565,9 @@ Step 8 默认要求当前认证页已经处于登录验证码页。
 - 打开邮箱并轮询登录验证码
 - 填写并提交登录验证码
 - 验证码链路失败后按有限次数回退到 Step 7
-- 如果进入登录超时报错/重试页，也会直接报错并回到 Step 7，不会在 Step 8 内部点击 `重试`
+- 如果进入登录超时报错/重试页，会直接报错并回到 Step 7，不会在 Step 8 内部点击 `重试`
+- 如果重试页内容中出现 `max_check_attempts`，会直接完全停止整个流程，并复用现有确认弹窗提醒先等待 15 到 30 分钟或更换浏览器，确认按钮显示为“我知道了”
+- 如果重试页内容中出现 `Operation timed out`，也会直接完全停止整个流程，并提醒先检查当前代理 / VPN 节点是否稳定，必要时更换服务器后再继续使用当前邮箱登录
 
 与 Step 4 类似，但会使用稍微不同的关键词组合去找登录验证码邮件。
 

background.js

@@ -132,6 +132,10 @@ const CLOUDFLARE_TEMP_EMAIL_PROVIDER = 'cloudflare-temp-email';
 const CLOUDFLARE_TEMP_EMAIL_GENERATOR = 'cloudflare-temp-email';
 const HOTMAIL_MAILBOXES = ['INBOX', 'Junk'];
 const STOP_ERROR_MESSAGE = '流程已被用户停止。';
+const CLOUDFLARE_SECURITY_BLOCK_ERROR_PREFIX = 'CF_SECURITY_BLOCKED::';
+const CLOUDFLARE_SECURITY_BLOCK_USER_MESSAGE = '您已触发Cloudflare 安全防护系统，已完全停止流程，请不要短时间内多次进行重新发送验证码，连续刷新、反复点击重试会加重风控；请先关闭页面等待 15-30 分钟，让系统的临时限制自动解除。或者更换浏览器';
+const NETWORK_TIMEOUT_BLOCK_ERROR_PREFIX = 'NETWORK_TIMEOUT_BLOCKED::';
+const NETWORK_TIMEOUT_BLOCK_USER_MESSAGE = '请检查当前网络节点是否稳定，若你使用的代理 / /VPN 节点无延迟过高问题，请换一个服务器继续使用此邮箱继续登陆';
 const HUMAN_STEP_DELAY_MIN = 700;
 const HUMAN_STEP_DELAY_MAX = 2200;
 const STEP6_MAX_ATTEMPTS = 3;
@@ -3836,6 +3840,78 @@ function getErrorMessage(error) {
   return String(typeof error === 'string' ? error : error?.message || '');
 }
 
+function isCloudflareSecurityBlockedError(error) {
+  return getErrorMessage(error).startsWith(CLOUDFLARE_SECURITY_BLOCK_ERROR_PREFIX);
+}
+
+function isNetworkTimeoutBlockedError(error) {
+  return getErrorMessage(error).startsWith(NETWORK_TIMEOUT_BLOCK_ERROR_PREFIX);
+}
+
+function isTerminalSecurityBlockedError(error) {
+  return isCloudflareSecurityBlockedError(error) || isNetworkTimeoutBlockedError(error);
+}
+
+function getCloudflareSecurityBlockedMessage(error) {
+  const message = getErrorMessage(error);
+  if (message.startsWith(CLOUDFLARE_SECURITY_BLOCK_ERROR_PREFIX)) {
+    return message.slice(CLOUDFLARE_SECURITY_BLOCK_ERROR_PREFIX.length).trim() || CLOUDFLARE_SECURITY_BLOCK_USER_MESSAGE;
+  }
+  return CLOUDFLARE_SECURITY_BLOCK_USER_MESSAGE;
+}
+
+function getNetworkTimeoutBlockedMessage(error) {
+  const message = getErrorMessage(error);
+  if (message.startsWith(NETWORK_TIMEOUT_BLOCK_ERROR_PREFIX)) {
+    return message.slice(NETWORK_TIMEOUT_BLOCK_ERROR_PREFIX.length).trim() || NETWORK_TIMEOUT_BLOCK_USER_MESSAGE;
+  }
+  return NETWORK_TIMEOUT_BLOCK_USER_MESSAGE;
+}
+
+function getTerminalSecurityBlockedMessage(error) {
+  if (isNetworkTimeoutBlockedError(error)) {
+    return getNetworkTimeoutBlockedMessage(error);
+  }
+  return getCloudflareSecurityBlockedMessage(error);
+}
+
+function getTerminalSecurityBlockedAlertText(error) {
+  if (isNetworkTimeoutBlockedError(error)) {
+    return '检测到网络节点异常，请暂停当前操作。';
+  }
+  return '检测到 Cloudflare 风控，请暂停当前操作。';
+}
+
+function getTerminalSecurityBlockedTitle(error) {
+  if (isNetworkTimeoutBlockedError(error)) {
+    return '网络节点异常';
+  }
+  return 'Cloudflare 风控拦截';
+}
+
+function broadcastSecurityBlockedAlert(title = '流程已完全停止', message = CLOUDFLARE_SECURITY_BLOCK_USER_MESSAGE, alertText = '检测到 Cloudflare 风控，请暂停当前操作。') {
+  chrome.runtime.sendMessage({
+    type: 'SECURITY_BLOCKED_ALERT',
+    payload: {
+      title,
+      message,
+      alert: {
+        text: alertText,
+        tone: 'danger',
+      },
+    },
+  }).catch(() => { });
+}
+
+async function handleCloudflareSecurityBlocked(error) {
+  const title = getTerminalSecurityBlockedTitle(error);
+  const message = getTerminalSecurityBlockedMessage(error);
+  const alertText = getTerminalSecurityBlockedAlertText(error);
+  await requestStop({ logMessage: message });
+  broadcastSecurityBlockedAlert(title, message, alertText);
+  return message;
+}
+
 function isVerificationMailPollingError(error) {
   if (typeof loggingStatus !== 'undefined' && loggingStatus?.isVerificationMailPollingError) {
     return loggingStatus.isVerificationMailPollingError(error);
@@ -4978,6 +5054,10 @@ async function executeStep(step, options = {}) {
       await appendManualAccountRunRecordIfNeeded(`step${step}_stopped`, state, getErrorMessage(err));
       throw err;
     }
+    if (isTerminalSecurityBlockedError(err)) {
+      await handleCloudflareSecurityBlocked(err);
+      throw new Error(STOP_ERROR_MESSAGE);
+    }
     if (!(deferRetryableTransportError && doesStepUseCompletionSignal(step) && isRetryableContentScriptTransportError(err))) {
       await setStepStatus(step, 'failed');
       await addLog(`步骤 ${step} 失败：${err.message}`, 'error');
@@ -5910,9 +5990,11 @@ const messageRouter = self.MultiPageBackgroundMessageRouter?.createMessageRouter
   getSourceLabel,
   getState,
   getStopRequested: () => stopRequested,
+  handleCloudflareSecurityBlocked,
   handleAutoRunLoopUnhandledError,
   importSettingsBundle,
   invalidateDownstreamAfterStepRestart,
+  isCloudflareSecurityBlockedError: isTerminalSecurityBlockedError,
   isAutoRunLockedState,
   isHotmailProvider,
   isLocalhostOAuthCallbackUrl,
@@ -6446,6 +6528,13 @@ async function ensureStep8VerificationPageReady(options = {}) {
     return pageState;
   }
 
+  if (pageState.maxCheckAttemptsBlocked) {
+    throw new Error(`${CLOUDFLARE_SECURITY_BLOCK_ERROR_PREFIX}${CLOUDFLARE_SECURITY_BLOCK_USER_MESSAGE}`);
+  }
+  if (pageState.operationTimedOutBlocked) {
+    throw new Error(`${NETWORK_TIMEOUT_BLOCK_ERROR_PREFIX}${NETWORK_TIMEOUT_BLOCK_USER_MESSAGE}`);
+  }
+
   if (pageState.state === 'login_timeout_error_page') {
     const urlPart = pageState.url ? ` URL: ${pageState.url}` : '';
     throw new Error(`STEP8_RESTART_STEP7::步骤 8：当前认证页进入登录超时报错页，请回到步骤 7 重新开始。${urlPart}`.trim());
@@ -6594,6 +6683,12 @@ async function waitForStep8Ready(tabId, timeoutMs = STEP8_READY_WAIT_TIMEOUT_MS)
   while (Date.now() - start < timeoutMs) {
     throwIfStopped();
     const pageState = await getStep8PageState(tabId);
+    if (pageState?.maxCheckAttemptsBlocked) {
+      throw new Error(`${CLOUDFLARE_SECURITY_BLOCK_ERROR_PREFIX}${CLOUDFLARE_SECURITY_BLOCK_USER_MESSAGE}`);
+    }
+    if (pageState?.operationTimedOutBlocked) {
+      throw new Error(`${NETWORK_TIMEOUT_BLOCK_ERROR_PREFIX}${NETWORK_TIMEOUT_BLOCK_USER_MESSAGE}`);
+    }
     if (pageState?.addPhonePage) {
       throw new Error('步骤 9：认证页进入了手机号页面，当前不是 OAuth 同意页，无法继续自动授权。');
     }
@@ -6769,6 +6864,12 @@ async function waitForStep8ClickEffect(tabId, baselineUrl, timeoutMs = STEP8_CLI
     }
 
     const pageState = await getStep8PageState(tabId);
+    if (pageState?.maxCheckAttemptsBlocked) {
+      throw new Error(`${CLOUDFLARE_SECURITY_BLOCK_ERROR_PREFIX}${CLOUDFLARE_SECURITY_BLOCK_USER_MESSAGE}`);
+    }
+    if (pageState?.operationTimedOutBlocked) {
+      throw new Error(`${NETWORK_TIMEOUT_BLOCK_ERROR_PREFIX}${NETWORK_TIMEOUT_BLOCK_USER_MESSAGE}`);
+    }
     if (pageState?.addPhonePage) {
       throw new Error('步骤 9：点击“继续”后页面跳到了手机号页面，当前流程无法继续自动授权。');
     }

background/message-router.js

@@ -41,6 +41,7 @@
       handleAutoRunLoopUnhandledError,
       importSettingsBundle,
       invalidateDownstreamAfterStepRestart,
+      isCloudflareSecurityBlockedError,
       isAutoRunLockedState,
       isHotmailProvider,
       isLocalhostOAuthCallbackUrl,
@@ -57,6 +58,7 @@
       patchHotmailAccount,
       registerTab,
       requestStop,
+      handleCloudflareSecurityBlocked,
       resetState,
       resumeAutoRun,
       scheduleAutoRun,
@@ -226,6 +228,13 @@
               await finalizeStep3Completion(message.payload || {});
             }
           } catch (error) {
+            if (typeof isCloudflareSecurityBlockedError === 'function' && isCloudflareSecurityBlockedError(error)) {
+              const userMessage = typeof handleCloudflareSecurityBlocked === 'function'
+                ? await handleCloudflareSecurityBlocked(error)
+                : (error?.message || String(error || ''));
+              notifyStepError(message.step, '流程已被用户停止。');
+              return { ok: true, error: userMessage };
+            }
             const errorMessage = error?.message || String(error || '步骤 3 提交后确认失败');
             await setStepStatus(message.step, 'failed');
             await addLog(`步骤 ${message.step} 失败：${errorMessage}`, 'error');
@@ -246,6 +255,13 @@
         }
 
         case 'STEP_ERROR': {
+          if (typeof isCloudflareSecurityBlockedError === 'function' && isCloudflareSecurityBlockedError(message.error)) {
+            const userMessage = typeof handleCloudflareSecurityBlocked === 'function'
+              ? await handleCloudflareSecurityBlocked(message.error)
+              : (typeof message.error === 'string' ? message.error : String(message.error || ''));
+            notifyStepError(message.step, '流程已被用户停止。');
+            return { ok: true, error: userMessage };
+          }
           if (isStopError(message.error)) {
             await setStepStatus(message.step, 'stopped');
             await addLog(`步骤 ${message.step} 已被用户停止`, 'warn');

content/auth-page-recovery.js

@@ -65,8 +65,10 @@
       const detailMatched = detailPattern instanceof RegExp
         ? detailPattern.test(text)
         : false;
+      const maxCheckAttemptsBlocked = /max_check_attempts/i.test(text);
+      const operationTimedOutBlocked = /operation\s+timed\s+out/i.test(text);
 
-      if (!titleMatched && !detailMatched) {
+      if (!titleMatched && !detailMatched && !maxCheckAttemptsBlocked && !operationTimedOutBlocked) {
         return null;
       }
 
@@ -77,6 +79,8 @@
         retryEnabled: isActionEnabled(retryButton),
         titleMatched,
         detailMatched,
+        maxCheckAttemptsBlocked,
+        operationTimedOutBlocked,
       };
     }
 
@@ -136,6 +140,18 @@
           };
         }
 
+        if (retryState.maxCheckAttemptsBlocked) {
+          throw new Error(
+            'CF_SECURITY_BLOCKED::您已触发Cloudflare 安全防护系统，已完全停止流程，请不要短时间内多次进行重新发送验证码，连续刷新、反复点击重试会加重风控；请先关闭页面等待 15-30 分钟，让系统的临时限制自动解除。或者更换浏览器'
+          );
+        }
+
+        if (retryState.operationTimedOutBlocked) {
+          throw new Error(
+            'NETWORK_TIMEOUT_BLOCKED::请检查当前网络节点是否稳定，若你使用的代理 / /VPN 节点无延迟过高问题，请换一个服务器继续使用此邮箱继续登陆'
+          );
+        }
+
         if (retryState.retryButton && retryState.retryEnabled) {
           clickCount += 1;
           if (typeof log === 'function') {

content/signup-page.js

@@ -936,8 +936,10 @@ function getAuthTimeoutErrorPageState(options = {}) {
   const titleMatched = AUTH_TIMEOUT_ERROR_TITLE_PATTERN.test(text)
     || AUTH_TIMEOUT_ERROR_TITLE_PATTERN.test(document.title || '');
   const detailMatched = AUTH_TIMEOUT_ERROR_DETAIL_PATTERN.test(text);
+  const maxCheckAttemptsBlocked = /max_check_attempts/i.test(text);
+  const operationTimedOutBlocked = /operation\s+timed\s+out/i.test(text);
 
-  if (!titleMatched && !detailMatched) {
+  if (!titleMatched && !detailMatched && !maxCheckAttemptsBlocked && !operationTimedOutBlocked) {
     return null;
   }
 
@@ -948,6 +950,8 @@ function getAuthTimeoutErrorPageState(options = {}) {
     retryEnabled: isActionEnabled(retryButton),
     titleMatched,
     detailMatched,
+    maxCheckAttemptsBlocked,
+    operationTimedOutBlocked,
   };
 }
 
@@ -1000,6 +1004,13 @@ async function recoverCurrentAuthRetryPage(payload = {}) {
       };
     }
 
+    if (retryState.maxCheckAttemptsBlocked) {
+      throw new Error('CF_SECURITY_BLOCKED::您已触发Cloudflare 安全防护系统，已完全停止流程，请不要短时间内多次进行重新发送验证码，连续刷新、反复点击重试会加重风控；请先关闭页面等待 15-30 分钟，让系统的临时限制自动解除。或者更换浏览器');
+    }
+
+    if (retryState.operationTimedOutBlocked) {
+      throw new Error('NETWORK_TIMEOUT_BLOCKED::请检查当前网络节点是否稳定，若你使用的代理 / /VPN 节点无延迟过高问题，请换一个服务器继续使用此邮箱继续登陆');
+    }
     if (retryState.retryButton && retryState.retryEnabled) {
       clickCount += 1;
       log(`${logLabel || `步骤 ${step || '?'}：检测到重试页，正在点击“重试”恢复`}（第 ${clickCount} 次）...`, 'warn');
@@ -1087,6 +1098,8 @@ function inspectLoginAuthState() {
     retryEnabled: Boolean(retryState?.retryEnabled),
     titleMatched: Boolean(retryState?.titleMatched),
     detailMatched: Boolean(retryState?.detailMatched),
+    maxCheckAttemptsBlocked: Boolean(retryState?.maxCheckAttemptsBlocked),
+    operationTimedOutBlocked: Boolean(retryState?.operationTimedOutBlocked),
     verificationTarget,
     passwordInput,
     emailInput,
@@ -1152,6 +1165,8 @@ function serializeLoginAuthState(snapshot) {
     retryEnabled: Boolean(snapshot?.retryEnabled),
     titleMatched: Boolean(snapshot?.titleMatched),
     detailMatched: Boolean(snapshot?.detailMatched),
+    maxCheckAttemptsBlocked: Boolean(snapshot?.maxCheckAttemptsBlocked),
+    operationTimedOutBlocked: Boolean(snapshot?.operationTimedOutBlocked),
     hasVerificationTarget: Boolean(snapshot?.verificationTarget),
     hasPasswordInput: Boolean(snapshot?.passwordInput),
     hasEmailInput: Boolean(snapshot?.emailInput),
@@ -1243,7 +1258,27 @@ function createStep6RecoverableResult(reason, snapshot, options = {}) {
 }
 
 async function createStep6LoginTimeoutRecoverableResult(reason, snapshot, message) {
-  return createStep6RecoverableResult(reason, normalizeStep6Snapshot(snapshot || inspectLoginAuthState()), {
+  const resolvedSnapshot = normalizeStep6Snapshot(snapshot || inspectLoginAuthState());
+  if (resolvedSnapshot?.state === 'login_timeout_error_page') {
+    try {
+      const recoveryResult = await recoverCurrentAuthRetryPage({
+        flow: 'login',
+        logLabel: '步骤 7：检测到登录超时报错，正在点击“重试”恢复当前页面',
+        step: 7,
+        timeoutMs: 12000,
+      });
+      if (recoveryResult?.recovered) {
+        log('步骤 7：登录超时报错页已点击“重试”，准备重新执行当前步骤。', 'warn');
+      }
+    } catch (error) {
+      if (/(?:CF_SECURITY_BLOCKED|NETWORK_TIMEOUT_BLOCKED)::/i.test(String(error?.message || error || ''))) {
+        throw error;
+      }
+      log(`步骤 7：登录超时报错页自动点击“重试”失败：${error.message}`, 'warn');
+    }
+  }
+
+  return createStep6RecoverableResult(reason, resolvedSnapshot, {
     message,
   });
 }
@@ -1949,6 +1984,8 @@ function getStep8State() {
     retryEnabled: Boolean(retryState?.retryEnabled),
     retryTitleMatched: Boolean(retryState?.titleMatched),
     retryDetailMatched: Boolean(retryState?.detailMatched),
+    maxCheckAttemptsBlocked: Boolean(retryState?.maxCheckAttemptsBlocked),
+    operationTimedOutBlocked: Boolean(retryState?.operationTimedOutBlocked),
     buttonFound: Boolean(continueBtn),
     buttonEnabled: isButtonEnabled(continueBtn),
     buttonText: continueBtn ? getActionText(continueBtn) : '',

sidepanel/sidepanel.js

@@ -3895,6 +3895,17 @@ chrome.runtime.onMessage.addListener((message, _sender, sendResponse) => {
       return true;
     }
 
+    case 'SECURITY_BLOCKED_ALERT': {
+      openConfirmModal({
+        title: message.payload?.title || '流程已完全停止',
+        message: message.payload?.message || '检测到安全风控，当前流程已完全停止。',
+        alert: message.payload?.alert || { text: '检测到 Cloudflare 风控，请暂停当前操作。', tone: 'danger' },
+        confirmLabel: '我知道了',
+        confirmVariant: 'btn-danger',
+      }).catch(() => {});
+      break;
+    }
+
     case 'LOG_ENTRY':
       appendLog(message.payload);
       if (message.payload.level === 'error') {

tests/auth-page-recovery.test.js

@@ -65,7 +65,7 @@ function createRecoveryApi(state) {
 test('auth page recovery detects retry page state', () => {
   const state = {
     clickCount: 0,
-    pageText: 'Something went wrong. Operation timed out.',
+    pageText: 'Something went wrong. Please try again.',
     retryVisible: true,
   };
   const api = createRecoveryApi(state);
@@ -77,13 +77,15 @@ test('auth page recovery detects retry page state', () => {
   assert.equal(Boolean(snapshot), true);
   assert.equal(snapshot.retryEnabled, true);
   assert.equal(snapshot.titleMatched, true);
-  assert.equal(snapshot.detailMatched, true);
+  assert.equal(snapshot.detailMatched, false);
+  assert.equal(snapshot.maxCheckAttemptsBlocked, false);
+  assert.equal(snapshot.operationTimedOutBlocked, false);
 });
 
 test('auth page recovery clicks retry and waits until page recovers', async () => {
   const state = {
     clickCount: 0,
-    pageText: 'Something went wrong. Operation timed out.',
+    pageText: 'Something went wrong. Please try again.',
     retryVisible: true,
   };
   const api = createRecoveryApi(state);
@@ -107,7 +109,7 @@ test('auth page recovery clicks retry and waits until page recovers', async () =
 test('auth page recovery can click retry twice before page recovers', async () => {
   const state = {
     clickCount: 0,
-    pageText: 'Something went wrong. Operation timed out.',
+    pageText: 'Something went wrong. Please try again.',
     retryVisible: true,
     onClick(currentState) {
       if (currentState.clickCount >= 2) {
@@ -135,3 +137,41 @@ test('auth page recovery can click retry twice before page recovers', async () =
   assert.equal(state.clickCount, 2);
   assert.equal(state.retryVisible, false);
 });
+
+test('auth page recovery throws cloudflare security blocked error on max_check_attempts page', async () => {
+  const state = {
+    clickCount: 0,
+    pageText: 'Something went wrong. max_check_attempts reached.',
+    retryVisible: true,
+  };
+  const api = createRecoveryApi(state);
+
+  await assert.rejects(
+    () => api.recoverAuthRetryPage({
+      logLabel: '步骤 7：检测到登录超时报错，正在点击“重试”恢复当前页面',
+      pathPatterns: [/\/log-in(?:[/?#]|$)/i],
+      step: 7,
+      timeoutMs: 1000,
+    }),
+    /CF_SECURITY_BLOCKED::/
+  );
+});
+
+test('auth page recovery throws network timeout block error on operation timed out page', async () => {
+  const state = {
+    clickCount: 0,
+    pageText: 'Something went wrong. Operation timed out.',
+    retryVisible: true,
+  };
+  const api = createRecoveryApi(state);
+
+  await assert.rejects(
+    () => api.recoverAuthRetryPage({
+      logLabel: '步骤 7：检测到登录超时报错，正在点击“重试”恢复当前页面',
+      pathPatterns: [/\/log-in(?:[/?#]|$)/i],
+      step: 7,
+      timeoutMs: 1000,
+    }),
+    /NETWORK_TIMEOUT_BLOCKED::/
+  );
+});

tests/background-message-router-step2-skip.test.js

@@ -14,6 +14,7 @@ function createRouter(overrides = {}) {
     finalizePayloads: [],
     notifyCompletions: [],
     notifyErrors: [],
+    securityBlocks: [],
   };
 
   const router = api.createMessageRouter({
@@ -56,8 +57,14 @@ function createRouter(overrides = {}) {
     getState: async () => overrides.state || { stepStatuses: { 3: 'pending' } },
     getStopRequested: () => false,
     handleAutoRunLoopUnhandledError: async () => {},
+    handleCloudflareSecurityBlocked: overrides.handleCloudflareSecurityBlocked || (async (error) => {
+      const message = typeof error === 'string' ? error : error?.message || '';
+      events.securityBlocks.push(message);
+      return message.replace(/^(?:CF_SECURITY_BLOCKED|NETWORK_TIMEOUT_BLOCKED)::/, '') || message;
+    }),
     importSettingsBundle: async () => {},
     invalidateDownstreamAfterStepRestart: async () => {},
+    isCloudflareSecurityBlockedError: overrides.isCloudflareSecurityBlockedError || ((error) => /^(?:CF_SECURITY_BLOCKED|NETWORK_TIMEOUT_BLOCKED)::/.test(typeof error === 'string' ? error : error?.message || '')),
     isAutoRunLockedState: () => false,
     isHotmailProvider: () => false,
     isLocalhostOAuthCallbackUrl: () => true,
@@ -195,3 +202,50 @@ test('message router marks step 3 failed when post-submit finalize fails', async
   assert.equal(events.logs.some(({ message }) => /步骤 3 失败：步骤 3 提交后仍停留在密码页。/.test(message)), true);
   assert.deepStrictEqual(response, { ok: true, error: '步骤 3 提交后仍停留在密码页。' });
 });
+
+test('message router stops the flow and surfaces cloudflare security block errors', async () => {
+  const { router, events } = createRouter();
+
+  const response = await router.handleMessage({
+    type: 'STEP_ERROR',
+    step: 7,
+    source: 'signup-page',
+    payload: {},
+    error: 'CF_SECURITY_BLOCKED::您已触发Cloudflare 安全防护系统',
+  }, {});
+
+  assert.deepStrictEqual(events.securityBlocks, ['CF_SECURITY_BLOCKED::您已触发Cloudflare 安全防护系统']);
+  assert.deepStrictEqual(events.notifyErrors, [
+    {
+      step: 7,
+      error: '流程已被用户停止。',
+    },
+  ]);
+  assert.deepStrictEqual(response, {
+    ok: true,
+    error: '您已触发Cloudflare 安全防护系统',
+  });
+});
+test('message router stops the flow and surfaces network timeout block errors', async () => {
+  const { router, events } = createRouter();
+
+  const response = await router.handleMessage({
+    type: 'STEP_ERROR',
+    step: 7,
+    source: 'signup-page',
+    payload: {},
+    error: 'NETWORK_TIMEOUT_BLOCKED::请检查当前网络节点是否稳定',
+  }, {});
+
+  assert.deepStrictEqual(events.securityBlocks, ['NETWORK_TIMEOUT_BLOCKED::请检查当前网络节点是否稳定']);
+  assert.deepStrictEqual(events.notifyErrors, [
+    {
+      step: 7,
+      error: '流程已被用户停止。',
+    },
+  ]);
+  assert.deepStrictEqual(response, {
+    ok: true,
+    error: '请检查当前网络节点是否稳定',
+  });
+});

tests/background-security-block-alert.test.js

@@ -0,0 +1,74 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+
+const source = fs.readFileSync('background.js', 'utf8');
+
+function extractFunction(name) {
+  const markers = [`async function ${name}(`, `function ${name}(`];
+  const start = markers
+    .map((marker) => source.indexOf(marker))
+    .find((index) => index >= 0);
+  if (start < 0) {
+    throw new Error(`missing function ${name}`);
+  }
+
+  let parenDepth = 0;
+  let signatureEnded = false;
+  let braceStart = -1;
+  for (let i = start; i < source.length; i += 1) {
+    const ch = source[i];
+    if (ch === '(') {
+      parenDepth += 1;
+    } else if (ch === ')') {
+      parenDepth -= 1;
+      if (parenDepth === 0) {
+        signatureEnded = true;
+      }
+    } else if (ch === '{' && signatureEnded) {
+      braceStart = i;
+      break;
+    }
+  }
+
+  if (braceStart < 0) {
+    throw new Error(`missing body for function ${name}`);
+  }
+
+  let depth = 0;
+  let end = braceStart;
+  for (; end < source.length; end += 1) {
+    const ch = source[end];
+    if (ch === '{') depth += 1;
+    if (ch === '}') {
+      depth -= 1;
+      if (depth === 0) {
+        end += 1;
+        break;
+      }
+    }
+  }
+
+  return source.slice(start, end);
+}
+
+test('security blocked alert title distinguishes cloudflare and network timeout', () => {
+  const api = new Function(`
+const CLOUDFLARE_SECURITY_BLOCK_ERROR_PREFIX = 'CF_SECURITY_BLOCKED::';
+const NETWORK_TIMEOUT_BLOCK_ERROR_PREFIX = 'NETWORK_TIMEOUT_BLOCKED::';
+${extractFunction('getErrorMessage')}
+${extractFunction('isCloudflareSecurityBlockedError')}
+${extractFunction('isNetworkTimeoutBlockedError')}
+${extractFunction('getTerminalSecurityBlockedTitle')}
+return { getTerminalSecurityBlockedTitle };
+`)();
+
+  assert.equal(
+    api.getTerminalSecurityBlockedTitle(new Error('CF_SECURITY_BLOCKED::blocked')),
+    'Cloudflare 风控拦截'
+  );
+  assert.equal(
+    api.getTerminalSecurityBlockedTitle(new Error('NETWORK_TIMEOUT_BLOCKED::timeout')),
+    '网络节点异常'
+  );
+});

tests/step6-timeout-recovery.test.js

@@ -51,7 +51,7 @@ function extractFunction(name) {
   return source.slice(start, end);
 }
 
-test('step 7 timeout recoverable result no longer clicks retry before asking background to rerun', async () => {
+test('step 7 timeout recoverable result clicks retry before asking background to rerun', async () => {
   const api = new Function(`
 const logs = [];
 let recoverCalls = 0;
@@ -97,7 +97,7 @@ return {
   const result = await api.run();
   const snapshot = api.snapshot();
 
-  assert.equal(snapshot.recoverCalls, 0);
+  assert.equal(snapshot.recoverCalls, 1);
   assert.equal(result.step6Outcome, 'recoverable');
   assert.equal(result.reason, 'login_timeout_error_page');
   assert.equal(result.state, 'login_timeout_error_page');

tests/step8-restart-step7-error.test.js

@@ -58,7 +58,7 @@ function extractFunction(source, name) {
 test('ensureStep8VerificationPageReady throws explicit restart-step7 error on login timeout page', async () => {
   const api = new Function(`
 function getLoginAuthStateLabel(state) {
-  return state === 'login_timeout_error_page' ? '登录超时报错页' : '未知页面';
+  return state === 'login_timeout_error_page' ? 'login timeout page' : 'unknown page';
 }
 
 async function getLoginAuthStateFromContent() {
@@ -79,7 +79,75 @@ return {
 
   await assert.rejects(
     () => api.run(),
-    /STEP8_RESTART_STEP7::步骤 8：当前认证页进入登录超时报错页/
+    /STEP8_RESTART_STEP7::/
+  );
+});
+
+test('ensureStep8VerificationPageReady throws cloudflare security block error on max_check_attempts page', async () => {
+  const api = new Function(`
+const CLOUDFLARE_SECURITY_BLOCK_ERROR_PREFIX = 'CF_SECURITY_BLOCKED::';
+const CLOUDFLARE_SECURITY_BLOCK_USER_MESSAGE = 'cloudflare blocked';
+const NETWORK_TIMEOUT_BLOCK_ERROR_PREFIX = 'NETWORK_TIMEOUT_BLOCKED::';
+const NETWORK_TIMEOUT_BLOCK_USER_MESSAGE = 'network timeout blocked';
+
+function getLoginAuthStateLabel(state) {
+  return state === 'login_timeout_error_page' ? 'login timeout page' : 'unknown page';
+}
+
+async function getLoginAuthStateFromContent() {
+  return {
+    state: 'login_timeout_error_page',
+    url: 'https://auth.openai.com/log-in',
+    maxCheckAttemptsBlocked: true,
+  };
+}
+
+${extractFunction(backgroundSource, 'ensureStep8VerificationPageReady')}
+
+return {
+  run() {
+    return ensureStep8VerificationPageReady({});
+  },
+};
+`)();
+
+  await assert.rejects(
+    () => api.run(),
+    /CF_SECURITY_BLOCKED::/
+  );
+});
+
+test('ensureStep8VerificationPageReady throws network timeout block error on operation timed out page', async () => {
+  const api = new Function(`
+const CLOUDFLARE_SECURITY_BLOCK_ERROR_PREFIX = 'CF_SECURITY_BLOCKED::';
+const CLOUDFLARE_SECURITY_BLOCK_USER_MESSAGE = 'cloudflare blocked';
+const NETWORK_TIMEOUT_BLOCK_ERROR_PREFIX = 'NETWORK_TIMEOUT_BLOCKED::';
+const NETWORK_TIMEOUT_BLOCK_USER_MESSAGE = 'network timeout blocked';
+
+function getLoginAuthStateLabel(state) {
+  return state === 'login_timeout_error_page' ? 'login timeout page' : 'unknown page';
+}
+
+async function getLoginAuthStateFromContent() {
+  return {
+    state: 'login_timeout_error_page',
+    url: 'https://auth.openai.com/log-in',
+    operationTimedOutBlocked: true,
+  };
+}
+
+${extractFunction(backgroundSource, 'ensureStep8VerificationPageReady')}
+
+return {
+  run() {
+    return ensureStep8VerificationPageReady({});
+  },
+};
+`)();
+
+  await assert.rejects(
+    () => api.run(),
+    /NETWORK_TIMEOUT_BLOCKED::/
   );
 });
 
@@ -106,7 +174,7 @@ test('step 8 reruns step 7 when auth page enters login timeout retry state', asy
     ensureStep8VerificationPageReady: async () => {
       calls.ensureReady += 1;
       if (calls.ensureReady === 1) {
-        throw new Error('STEP8_RESTART_STEP7::步骤 8：当前认证页进入登录超时报错页，请回到步骤 7 重新开始。 URL: https://auth.openai.com/log-in');
+        throw new Error('STEP8_RESTART_STEP7::step 8 timeout retry page');
       }
       return { state: 'verification_page' };
     },
@@ -117,7 +185,7 @@ test('step 8 reruns step 7 when auth page enters login timeout retry state', asy
     getOAuthFlowStepTimeoutMs: async (defaultTimeoutMs) => Math.min(defaultTimeoutMs, 8000),
     getMailConfig: () => ({
       provider: 'qq',
-      label: 'QQ 邮箱',
+      label: 'QQ mail',
       source: 'mail-qq',
       url: 'https://mail.qq.com',
       navigateOnReuse: false,
@@ -152,6 +220,6 @@ test('step 8 reruns step 7 when auth page enters login timeout retry state', asy
   assert.equal(calls.executeStep7, 1);
   assert.equal(calls.ensureReady, 2);
   assert.equal(calls.resolveCalls, 1);
-  assert.equal(calls.logs.some(({ message }) => /准备从步骤 7 重新开始/.test(message)), true);
+  assert.equal(calls.logs.some(({ message }) => /重新开始|重新发起/.test(message)), true);
   assert.deepStrictEqual(calls.sleeps, [3000]);
 });

项目完整链路说明.md

@@ -514,6 +514,8 @@
 
 - 新增共享恢复层：`content/auth-page-recovery.js`。
 - Step 4 在等待注册验证码页时，如果命中认证页 `Try again / 重试` 页，会先自动点击 `重试` 恢复，再继续回到密码页重提和验证码页确认流程。
-- Step 7 在识别到登录超时报错页时，不会在当前步骤内部点击 `重试`，而是直接返回可恢复失败，交给后续链路回到 Step 7 重跑。
+- Step 7 在识别到登录超时报错页时，会先尝试自动点击 `重试` 恢复当前页面；若仍未恢复，则按原有可恢复失败逻辑重跑 Step 7。
 - Step 8 如果发现认证页已经进入登录超时报错/重试页，会直接报错并回到 Step 7 重新开始，而不是在 Step 8 内部点击 `重试`。
+- 任意认证页重试页如果正文中出现 `max_check_attempts`，会被视为 Cloudflare 风控触发：后台立刻完全停止流程，侧边栏会复用现有确认弹窗提示等待 15~30 分钟后再试，避免继续刷新或反复重试加重风控，确认按钮显示为“我知道了”。
+- 任意认证页重试页如果正文中出现 `Operation timed out`，会被视为网络节点异常：后台同样会立刻完全停止流程，并提示先检查当前代理 / VPN 节点是否稳定；若节点本身无明显高延迟问题，则更换服务器后继续使用当前邮箱登录。
 - Step 9 在点击 OAuth 同意页 `继续` 后，会额外检查是否进入认证页重试页；若命中则先自动点击 `重试` 恢复，再重新执行当前轮的 `继续` 点击。