Add one-click start scripts for Linux and Windows

- start.sh: Linux/Mac one-click launcher
- start.bat: Windows one-click launcher
- Both scripts auto-detect/install:
  - Python 3.13+
  - uv package manager
  - Chrome/Chromium browser
  - Sync Python dependencies
  - Create .env/config.json from templates if missing
- Default to unlimited accounts (--count 0)
- Pass through CLI args for custom runs

turnstilePatch/content.js

@@ -1,11 +1,15 @@
-// Turnstile Patch - 隐藏自动化标识，加速 Turnstile 验证
-// MV3 MAIN world + document_start：在页面脚本之前修补真实页面上下文
+// Turnstile Patch - minimal only
+// Full aggressive patches (chrome.runtime delete / permissions / plugins / languages
+// / iframe postMessage spam) were observed to break xAI signup with:
+//   [permission_denied] HTTP 403
+// Keep webdriver hide only. Auto-click remains best-effort and local-only.
 
 (function () {
     "use strict";
+    if (window.__grokStealthApplied) return;
+    window.__grokStealthApplied = true;
 
-    // 1. 隐藏 navigator.webdriver 标识
-    // Chrome 自动化模式下 navigator.webdriver = true，Turnstile 会检测此属性
+    // 1. Hide navigator.webdriver (instance + prototype when possible)
     try {
         Object.defineProperty(navigator, "webdriver", {
             get: function () {
@@ -14,103 +18,53 @@
             configurable: true,
         });
     } catch (e) {}
-
-    // 2. 移除 Chrome 自动化相关的 Runtime 属性
     try {
-        if (window.chrome && window.chrome.runtime) {
-            delete window.chrome.runtime.onConnect;
-            delete window.chrome.runtime.onMessage;
+        var desc = Object.getOwnPropertyDescriptor(Navigator.prototype, "webdriver");
+        if (!desc || desc.configurable) {
+            Object.defineProperty(Navigator.prototype, "webdriver", {
+                get: function () {
+                    return false;
+                },
+                configurable: true,
+            });
         }
     } catch (e) {}
 
-    // 3. 覆盖 permissions.query，隐藏 notifications 权限异常
-    try {
-        if (navigator.permissions && navigator.permissions.query) {
-            var origQuery = navigator.permissions.query.bind(navigator.permissions);
-            navigator.permissions.query = function (params) {
-                if (params && params.name === "notifications") {
-                    return Promise.resolve({ state: Notification.permission });
+    // 2. Best-effort Turnstile checkbox click (same-origin only; no postMessage spam)
+    function tryClickTurnstile() {
+        try {
+            var iframes = document.querySelectorAll(
+                'iframe[src*="challenges.cloudflare.com"], iframe[src*="turnstile"]'
+            );
+            for (var i = 0; i < iframes.length; i++) {
+                try {
+                    var body = iframes[i].contentDocument || iframes[i].contentWindow.document;
+                    var checkbox = body.querySelector('input[type="checkbox"], .mark');
+                    if (checkbox && !checkbox.checked) {
+                        checkbox.click();
+                    }
+                } catch (e) {
+                    // cross-origin: skip
                 }
-                return origQuery(params);
-            };
-        }
-    } catch (e) {}
-
-    // 4. 修补 plugin 数量，模拟正常浏览器
-    try {
-        Object.defineProperty(navigator, "plugins", {
-            get: function () {
-                return [1, 2, 3, 4, 5];
-            },
-            configurable: true,
-        });
-    } catch (e) {}
-
-    // 5. 修补 languages 属性
-    try {
-        Object.defineProperty(navigator, "languages", {
-            get: function () {
-                return ["en-US", "en"];
-            },
-            configurable: true,
-        });
-    } catch (e) {}
-
-    // 6. 页面加载完成后，自动监控并点击 Turnstile 复选框
-    if (document.readyState === "loading") {
-        document.addEventListener("DOMContentLoaded", autoClickTurnstile);
-    } else {
-        autoClickTurnstile();
+            }
+        } catch (e) {}
     }
 
-    function autoClickTurnstile() {
-        // 定时检查 Turnstile iframe 是否出现
-        var checkCount = 0;
-        var maxChecks = 100; // 最多检查 100 次（约 50 秒）
-        var timer = setInterval(function () {
-            checkCount++;
-            if (checkCount > maxChecks) {
-                clearInterval(timer);
-                return;
-            }
-            try {
-                // 查找 Turnstile iframe
-                var iframes = document.querySelectorAll(
-                    'iframe[src*="challenges.cloudflare.com"], iframe[src*="turnstile"]'
-                );
-                for (var i = 0; i < iframes.length; i++) {
-                    var iframe = iframes[i];
-                    try {
-                        // 尝试访问 iframe 内部的 checkbox
-                        var body = iframe.contentDocument || iframe.contentWindow.document;
-                        var checkbox = body.querySelector(
-                            'input[type="checkbox"], .mark, #cf-chl-widget-nomu1_resp'
-                        );
-                        if (checkbox && !checkbox.checked) {
-                            checkbox.click();
-                        }
-                    } catch (e) {
-                        // 跨域限制，尝试通过 postMessage 触发
-                        try {
-                            iframe.contentWindow.postMessage(
-                                { type: "turnstile-auto-click" },
-                                "*"
-                            );
-                        } catch (e2) {}
-                    }
-                }
-
-                // 也尝试直接操作 Turnstile API
-                if (
-                    window.turnstile &&
-                    typeof window.turnstile.getResponse === "function"
-                ) {
-                    var resp = window.turnstile.getResponse();
-                    if (resp && resp.length > 0) {
-                        clearInterval(timer); // 已获得 token，停止检查
-                    }
-                }
-            } catch (e) {}
+    if (document.readyState === "loading") {
+        document.addEventListener("DOMContentLoaded", function () {
+            var n = 0;
+            var t = setInterval(function () {
+                n++;
+                tryClickTurnstile();
+                if (n > 80) clearInterval(t);
+            }, 500);
+        });
+    } else {
+        var n = 0;
+        var t = setInterval(function () {
+            n++;
+            tryClickTurnstile();
+            if (n > 80) clearInterval(t);
         }, 500);
     }
 })();

turnstilePatch/manifest.json

@@ -1,12 +1,16 @@
 {
     "manifest_version": 3,
     "name": "Turnstile Patch",
-    "version": "1.1.0",
-    "description": "Patch browser automation detection for Turnstile",
+    "version": "1.2.0",
+    "description": "Minimal webdriver hide for Turnstile (no aggressive API patches)",
     "content_scripts": [
         {
-            "matches": ["<all_urls>"],
-            "js": ["content.js"],
+            "matches": [
+                "<all_urls>"
+            ],
+            "js": [
+                "content.js"
+            ],
             "run_at": "document_start",
             "all_frames": true,
             "world": "MAIN",