Harden Turnstile solve path for --fast/Xvfb runs

Add cf_sleep, multi-round shadow clicks, richer diagnostics, and longer profile/CF budgets so tokenLen=0 fails less on headless servers.

turnstilePatch/content.js

@@ -3,6 +3,8 @@
 // / iframe postMessage spam) were observed to break xAI signup with:
 //   [permission_denied] HTTP 403
 // Keep webdriver hide only. Auto-click remains best-effort and local-only.
+// Note: CF challenge iframes are cross-origin — contentDocument click usually fails;
+// host-page click + Python CDP shadow path do the real work.
 
 (function () {
     "use strict";
@@ -30,41 +32,101 @@
         }
     } catch (e) {}
 
-    // 2. Best-effort Turnstile checkbox click (same-origin only; no postMessage spam)
+    function firePointer(el) {
+        if (!el) return;
+        try {
+            el.scrollIntoView({ block: "center", inline: "center" });
+        } catch (e) {}
+        var rect;
+        try {
+            rect = el.getBoundingClientRect();
+        } catch (e) {
+            rect = null;
+        }
+        var x = 12;
+        var y = 12;
+        if (rect && rect.width > 0) {
+            x = rect.left + Math.max(6, Math.min(rect.width - 6, rect.width * 0.35));
+            y = rect.top + Math.max(6, Math.min(rect.height - 6, rect.height * 0.5));
+        }
+        var opts = {
+            bubbles: true,
+            cancelable: true,
+            view: window,
+            clientX: x,
+            clientY: y,
+            button: 0,
+        };
+        var types = [
+            "pointerover",
+            "mouseover",
+            "mousemove",
+            "pointerdown",
+            "mousedown",
+            "pointerup",
+            "mouseup",
+            "click",
+        ];
+        for (var i = 0; i < types.length; i++) {
+            var t = types[i];
+            try {
+                var Ev = t.indexOf("pointer") === 0 ? PointerEvent : MouseEvent;
+                el.dispatchEvent(new Ev(t, opts));
+            } catch (e) {
+                try {
+                    el.dispatchEvent(new MouseEvent(t, opts));
+                } catch (e2) {}
+            }
+        }
+        try {
+            if (typeof el.click === "function") el.click();
+        } catch (e) {}
+    }
+
+    // 2. Best-effort Turnstile interaction (same-origin iframe + host widget)
     function tryClickTurnstile() {
         try {
             var iframes = document.querySelectorAll(
                 'iframe[src*="challenges.cloudflare.com"], iframe[src*="turnstile"]'
             );
             for (var i = 0; i < iframes.length; i++) {
+                // Host-side synthetic click (works even when iframe is cross-origin)
+                firePointer(iframes[i]);
                 try {
                     var body = iframes[i].contentDocument || iframes[i].contentWindow.document;
-                    var checkbox = body.querySelector('input[type="checkbox"], .mark');
+                    if (!body) continue;
+                    var checkbox = body.querySelector(
+                        'input[type="checkbox"], .mark, label, [role="checkbox"]'
+                    );
                     if (checkbox && !checkbox.checked) {
-                        checkbox.click();
+                        firePointer(checkbox);
                     }
                 } catch (e) {
-                    // cross-origin: skip
+                    // cross-origin: host click above is enough
                 }
             }
+            var widgets = document.querySelectorAll(
+                "div.cf-turnstile, [data-sitekey], input[name='cf-turnstile-response']"
+            );
+            for (var j = 0; j < widgets.length; j++) {
+                firePointer(widgets[j]);
+            }
         } catch (e) {}
     }
 
-    if (document.readyState === "loading") {
-        document.addEventListener("DOMContentLoaded", function () {
-            var n = 0;
-            var t = setInterval(function () {
-                n++;
-                tryClickTurnstile();
-                if (n > 80) clearInterval(t);
-            }, 500);
-        });
-    } else {
+    function startLoop() {
         var n = 0;
         var t = setInterval(function () {
             n++;
             tryClickTurnstile();
-            if (n > 80) clearInterval(t);
+            // ~90s of best-effort clicks (was 40s)
+            if (n > 180) clearInterval(t);
         }, 500);
     }
+
+    if (document.readyState === "loading") {
+        document.addEventListener("DOMContentLoaded", startLoop);
+    } else {
+        startLoop();
+    }
 })();