Official codex-oauth extension update learnings for phone verification (2026-05-10)

Source inspected: QLHazyCoder/codex-oauth-automation-extension update from local 7dc5cf2 to upstream 6bd00db (origin/master).

Files inspected

background/phone-verification-flow.js
content/phone-auth.js
phone-sms/providers/five-sim.js
tests/phone-auth-country-match.test.js
tests/phone-verification-flow.test.js

Useful changes to copy into Hermes runner/workflow

1. Detect WhatsApp resend channel without clicking

Official content script now extracts resend button text from value, aria-label, title, innerText, and textContent, then classifies the resend channel:

whatsapp if text matches /whats\s*app/i
sms if text matches sms|text message|短信
unknown otherwise

It supports a probeOnly mode that returns channel info without clicking.

Hermes runner rule:

After submitting a phone number and before clicking resend, probe resend button/channel.
If channel is whatsapp and BOSS's policy is SMS-only, cancel the 5sim SMS order and rotate/stop; do not click WhatsApp resend.
Log compact JSONL phase whatsapp_resend_detected_cancel.

2. Classify OpenAI HTTP 500/contact-verification server errors

Official update adds server-error detection for pages such as:

This page isn’t working
currently unable to handle this request
HTTP ERROR 500
500 Internal Server Error

Hermes runner rule:

If resend or phone verification lands on this error page, classify as resend_server_error, cancel current activation, recover by navigating/generating fresh OAuth session back to add-phone before next number.

3. Broader direct-delivery-refused detection

Official update adds a broader delivery-refused classifier for Chinese/English variants such as:

无法向此电话号码发送验证码
无法向...号码...发送验证码/短信
cannot/unable to send/deliver verification code/sms/text to this phone number

Hermes runner should treat these as direct number rejection:

cancel/ban the current order;
rotate to next number;
do not keep polling.

4. United Kingdom prefix mapping

Official HeroSMS prefix mapping includes:

{ prefix: '44', id: 16, label: 'United Kingdom' }

For 5sim/OpenAI country tests in BOSS's runner, map UK as:

5sim country slug: england
OpenAI select ISO: GB
visible text: 英国 (+44)
prefix: 44

5. Stale email-verification guard

Official signup phone flow now checks whether the page has unexpectedly returned to /email-verification before polling/submitting phone SMS. Treat that as stale signup/email-verification state and stop/replace number/account rather than burning SMS orders.

6. Waiting callback while polling 5sim

Official 5sim provider added onWaitingForCode during polling. Hermes runner can mimic this with compact JSONL status events so long waits do not look stuck.

Runner patch applied locally

/tmp/phone_verify_strict_gate_10.py was patched to:

probe resend channel before clicking;
cancel and continue if WhatsApp resend is detected;
classify server-error pages before/after resend;
keep strict country gate before buying and before clicking Continue.

Keep from prior Hermes-specific lessons

Do not submit if selectValue and visible country/dial code mismatch.
Do not submit a non-US number when visible country is 美国 (+1).
If a 5sim order is already bought and country gate fails, cancel immediately.
For BOSS's configured SMS-only policy, do not switch to WhatsApp providers unless explicitly approved.

3.6 KiB Raw Blame History Unescape Escape