grok-keygen/turnstilePatch/content.js

// Turnstile Patch - minimal only
// Full aggressive patches (chrome.runtime delete / permissions / plugins / languages
// / iframe postMessage spam) were observed to break xAI signup with:
//   [permission_denied] HTTP 403
// Keep webdriver hide only. Auto-click remains best-effort and local-only.
// Note: CF challenge iframes are cross-origin — contentDocument click usually fails;
// host-page click + Python CDP shadow path do the real work.

(function () {
    "use strict";
    if (window.__grokStealthApplied) return;
    window.__grokStealthApplied = true;

    // 1. Hide navigator.webdriver (instance + prototype when possible)
    try {
        Object.defineProperty(navigator, "webdriver", {
            get: function () {
                return false;
            },
            configurable: true,
        });
    } catch (e) {}
    try {
        var desc = Object.getOwnPropertyDescriptor(Navigator.prototype, "webdriver");
        if (!desc || desc.configurable) {
            Object.defineProperty(Navigator.prototype, "webdriver", {
                get: function () {
                    return false;
                },
                configurable: true,
            });
        }
    } catch (e) {}

    function firePointer(el) {
        if (!el) return;
        try {
            el.scrollIntoView({ block: "center", inline: "center" });
        } catch (e) {}
        var rect;
        try {
            rect = el.getBoundingClientRect();
        } catch (e) {
            rect = null;
        }
        var x = 12;
        var y = 12;
        if (rect && rect.width > 0) {
            x = rect.left + Math.max(6, Math.min(rect.width - 6, rect.width * 0.35));
            y = rect.top + Math.max(6, Math.min(rect.height - 6, rect.height * 0.5));
        }
        var opts = {
            bubbles: true,
            cancelable: true,
            view: window,
            clientX: x,
            clientY: y,
            button: 0,
        };
        var types = [
            "pointerover",
            "mouseover",
            "mousemove",
            "pointerdown",
            "mousedown",
            "pointerup",
            "mouseup",
            "click",
        ];
        for (var i = 0; i < types.length; i++) {
            var t = types[i];
            try {
                var Ev = t.indexOf("pointer") === 0 ? PointerEvent : MouseEvent;
                el.dispatchEvent(new Ev(t, opts));
            } catch (e) {
                try {
                    el.dispatchEvent(new MouseEvent(t, opts));
                } catch (e2) {}
            }
        }
        try {
            if (typeof el.click === "function") el.click();
        } catch (e) {}
    }

    // 2. Best-effort Turnstile interaction (same-origin iframe + host widget)
    function tryClickTurnstile() {
        try {
            var iframes = document.querySelectorAll(
                'iframe[src*="challenges.cloudflare.com"], iframe[src*="turnstile"]'
            );
            for (var i = 0; i < iframes.length; i++) {
                // Host-side synthetic click (works even when iframe is cross-origin)
                firePointer(iframes[i]);
                try {
                    var body = iframes[i].contentDocument || iframes[i].contentWindow.document;
                    if (!body) continue;
                    var checkbox = body.querySelector(
                        'input[type="checkbox"], .mark, label, [role="checkbox"]'
                    );
                    if (checkbox && !checkbox.checked) {
                        firePointer(checkbox);
                    }
                } catch (e) {
                    // cross-origin: host click above is enough
                }
            }
            var widgets = document.querySelectorAll(
                "div.cf-turnstile, [data-sitekey], input[name='cf-turnstile-response']"
            );
            for (var j = 0; j < widgets.length; j++) {
                firePointer(widgets[j]);
            }
        } catch (e) {}
    }

    function startLoop() {
        var n = 0;
        var t = setInterval(function () {
            n++;
            tryClickTurnstile();
            // ~90s of best-effort clicks (was 40s)
            if (n > 180) clearInterval(t);
        }, 500);
    }

    if (document.readyState === "loading") {
        document.addEventListener("DOMContentLoaded", startLoop);
    } else {
        startLoop();
    }
})();