docs: learn official phone verification update

2026-05-10 15:44:19 +08:00
parent ca30d4c5cd
commit 02121412e3
5 changed files with 506 additions and 0 deletions
@@ -0,0 +1,97 @@
+# Official codex-oauth extension update learnings for phone verification (2026-05-10)
+
+Source inspected: `QLHazyCoder/codex-oauth-automation-extension` update from local `7dc5cf2` to upstream `6bd00db` (`origin/master`).
+
+## Files inspected
+
+- `background/phone-verification-flow.js`
+- `content/phone-auth.js`
+- `phone-sms/providers/five-sim.js`
+- `tests/phone-auth-country-match.test.js`
+- `tests/phone-verification-flow.test.js`
+
+## Useful changes to copy into Hermes runner/workflow
+
+### 1. Detect WhatsApp resend channel without clicking
+
+Official content script now extracts resend button text from `value`, `aria-label`, `title`, `innerText`, and `textContent`, then classifies the resend channel:
+
+- `whatsapp` if text matches `/whats\s*app/i`
+- `sms` if text matches `sms|text message|短信`
+- `unknown` otherwise
+
+It supports a `probeOnly` mode that returns channel info without clicking.
+
+Hermes runner rule:
+
+1. After submitting a phone number and before clicking resend, probe resend button/channel.
+2. If channel is `whatsapp` and BOSS's policy is SMS-only, cancel the 5sim SMS order and rotate/stop; do not click WhatsApp resend.
+3. Log compact JSONL phase `whatsapp_resend_detected_cancel`.
+
+### 2. Classify OpenAI HTTP 500/contact-verification server errors
+
+Official update adds server-error detection for pages such as:
+
+- `This page isn’t working`
+- `currently unable to handle this request`
+- `HTTP ERROR 500`
+- `500 Internal Server Error`
+
+Hermes runner rule:
+
+- If resend or phone verification lands on this error page, classify as `resend_server_error`, cancel current activation, recover by navigating/generating fresh OAuth session back to `add-phone` before next number.
+
+### 3. Broader direct-delivery-refused detection
+
+Official update adds a broader delivery-refused classifier for Chinese/English variants such as:
+
+- `无法向此电话号码发送验证码`
+- `无法向...号码...发送验证码/短信`
+- `cannot/unable to send/deliver verification code/sms/text to this phone number`
+
+Hermes runner should treat these as direct number rejection:
+
+- cancel/ban the current order;
+- rotate to next number;
+- do not keep polling.
+
+### 4. United Kingdom prefix mapping
+
+Official HeroSMS prefix mapping includes:
+
+```js
+{ prefix: '44', id: 16, label: 'United Kingdom' }
+```
+
+For 5sim/OpenAI country tests in BOSS's runner, map UK as:
+
+```text
+5sim country slug: england
+OpenAI select ISO: GB
+visible text: 英国 (+44)
+prefix: 44
+```
+
+### 5. Stale email-verification guard
+
+Official signup phone flow now checks whether the page has unexpectedly returned to `/email-verification` before polling/submitting phone SMS. Treat that as stale signup/email-verification state and stop/replace number/account rather than burning SMS orders.
+
+### 6. Waiting callback while polling 5sim
+
+Official 5sim provider added `onWaitingForCode` during polling. Hermes runner can mimic this with compact JSONL status events so long waits do not look stuck.
+
+## Runner patch applied locally
+
+`/tmp/phone_verify_strict_gate_10.py` was patched to:
+
+- probe resend channel before clicking;
+- cancel and continue if WhatsApp resend is detected;
+- classify server-error pages before/after resend;
+- keep strict country gate before buying and before clicking Continue.
+
+## Keep from prior Hermes-specific lessons
+
+- Do not submit if `selectValue` and visible country/dial code mismatch.
+- Do not submit a non-US number when visible country is `美国 (+1)`.
+- If a 5sim order is already bought and country gate fails, cancel immediately.
+- For BOSS's configured SMS-only policy, do not switch to WhatsApp providers unless explicitly approved.
@@ -0,0 +1,89 @@
+# Strict OpenAI phone country/area-code gate (2026-05-10)
+
+## Trigger
+
+Use this note for any OpenAI `auth.openai.com/add-phone` automation that buys and submits 5sim phone numbers.
+
+## Bug that caused this rule
+
+During a 1085 + Indonesia test, the browser page had silently reverted to the United States selector (`美国 (+1)`) while the agent bought an Indonesia `+62` number. The number was submitted as a US local number, and OpenAI moved to `phone-verification` showing it had sent to a `+1 (...)` number. That attempt was invalid and the 5sim order was canceled.
+
+## Mandatory rule
+
+Never rely on the intended country in the script. Before buying, after filling, and immediately before clicking Continue, verify BOTH:
+
+1. Native select value equals the intended ISO country code.
+2. Visible country button text contains the intended country and dialing code.
+
+Examples:
+
+| Country | ISO | Visible text |
+| --- | --- | --- |
+| Argentina | `AR` | `阿根廷 (+54)` |
+| Netherlands | `NL` | `荷兰 (+31)` |
+| Indonesia | `ID` | `印度尼西亚 (+62)` |
+
+If either check fails:
+
+- Do not click Continue.
+- If a 5sim order was already bought, cancel it immediately.
+- Reset the country selector and re-check before retrying.
+- Exclude the invalid attempt from country/provider result statistics.
+
+## Reliable country setting
+
+React Aria click/pointer events are unreliable. Use the hidden/native select directly:
+
+```js
+const sel = document.querySelector('select');
+sel.focus();
+sel.value = 'ID'; // AR, NL, ID, etc.
+sel.dispatchEvent(new Event('input', { bubbles: true }));
+sel.dispatchEvent(new Event('change', { bubbles: true }));
+await new Promise(r => setTimeout(r, 800));
+```
+
+## Gate function
+
+```js
+function visibleCountryText() {
+  return [...document.querySelectorAll('button')]
+    .map(b => b.innerText)
+    .find(t => /\(\+\d+\)/.test(t));
+}
+
+function assertCountryGate(iso, visible) {
+  const selectValue = document.querySelector('select')?.value;
+  const country = visibleCountryText();
+  if (selectValue !== iso || country !== visible) {
+    throw new Error(`country_gate_failed: select=${selectValue} visible=${country}`);
+  }
+}
+```
+
+## Correct runner behavior
+
+1. Restore or open `add-phone`.
+2. Set country via native select.
+3. Run `assertCountryGate()`.
+4. Only then buy a 5sim activation.
+5. Fill the local part of the phone number.
+6. Run `assertCountryGate()` again.
+7. Click Continue.
+8. Read the result:
+   - direct rejection (`无法向此电话号码发送验证码` / `电话号码无效`) -> cancel and rotate;
+   - accepted/waiting -> poll 5sim, click resend once, poll again, then cancel/rotate if still no SMS.
+
+## Replacement limit
+
+For the current configured test, BOSS requested 10 replacements:
+
+```text
+PHONE_VERIFICATION_REPLACEMENT_LIMIT=10
+```
+
+Keep using configured country order first:
+
+```text
+FIVE_SIM_COUNTRY_ORDER=argentina,netherlands,indonesia
+```
@@ -0,0 +1,96 @@
+# OpenAI add-phone UK +44 and interrupted-run cleanup notes (2026-05-10)
+
+## What changed
+
+BOSS requested stopping the active Argentina/Netherlands/Indonesia run and switching phone verification to the UK `+44`.
+
+## Mandatory cleanup when stopping a runner
+
+When a background phone-verification runner is killed/interrupted, immediately inspect the last active 5sim activation from the JSONL log and cancel it if status is still `RECEIVED`.
+
+Observed interrupted order:
+
+```json
+{"activation_id":"1006733450","country":"netherlands","status":"RECEIVED","sms_count":0}
+```
+
+Cleanup result:
+
+```json
+{"activation_id":"1006733450","result":"CANCELED"}
+```
+
+Do not assume a killed runner canceled its current order.
+
+## UK +44 mapping for OpenAI add-phone
+
+5sim country slug used successfully for buying OpenAI activation:
+
+```text
+england
+```
+
+OpenAI selector mapping:
+
+```text
+ISO: GB
+Visible text: 英国 (+44)
+Dial prefix: 44
+```
+
+Config for UK-only run:
+
+```text
+FIVE_SIM_COUNTRY_ORDER=england
+PHONE_VERIFICATION_REPLACEMENT_LIMIT=10
+FIVE_SIM_OPERATOR=any
+FIVE_SIM_PRODUCT=openai
+```
+
+## Strict country gate remains mandatory
+
+Before buying and before clicking Continue, verify both:
+
+```json
+{"country":"英国 (+44)","selectValue":"GB"}
+```
+
+Observed valid gate before the first UK buy:
+
+```json
+{
+  "phase": "country_gate_before_buy",
+  "country": "england",
+  "attempt": 1,
+  "ok": true,
+  "country_text": "英国 (+44)",
+  "selectValue": "GB"
+}
+```
+
+Then 5sim bought a UK number:
+
+```json
+{"phase":"buy","country":"england","activation_id":1006734496,"masked":"+4477***381","status":"RECEIVED"}
+```
+
+## Runner behavior after UK switch
+
+Use a single configurable strict-gate runner, not ad-hoc CDP snippets:
+
+1. Stop old runner.
+2. Cancel in-flight activation from its log.
+3. Set `FIVE_SIM_COUNTRY_ORDER=england`.
+4. Ensure metadata includes `england: {iso:'GB', visible:'英国 (+44)', prefix:'44'}`.
+5. Restore OAuth/add-phone if currently on phone-verification or a Chrome error page.
+6. Set country via native select.
+7. Run strict gate.
+8. Buy only after gate passes.
+9. Fill local phone part.
+10. Run strict gate again.
+11. Click Continue.
+12. Poll; resend once; poll; cancel/rotate if no SMS.
+
+## Pitfall
+
+BOSS watches the visible screen and will catch wrong country/area code. If the visible selector says `美国 (+1)` while a non-US number is being used, stop immediately, cancel any new order, restore add-phone, and verify the correct visible code before buying/submitting again.