fix(captcha): consume response token state

[esokullu]

Summary

• retain the exact CAPTCHA candidate and response-field identity when a gate arms
• consume the matched candidate's boolean responseTokenPresent state after a solve
• clear only when that exact widget has a token and no active challenge frame remains
• keep a non-blocking, persisted recheck marker so stale dialog copy does not immediately re-arm the solved widget
• re-arm before mutation if the token disappears or an active challenge frame returns
• keep Chrome and Firefox behavior aligned

Motivation

#505 identified that the gate inferred solve state from dialog wording and disappearance even after #512 made the widget response-token state available. #2615 added language-neutral active-frame signals, but the gate still did not consume the token boolean.

This change connects those two primitives without treating a widget token as proof that the site's server accepted it.

Safety and behavior

The token is reduced to a boolean by the existing detector; no raw token is retained or serialized. Token-backed clearance requires the original frame, frame path, type, site key, and exact response-field id or index to match. A sibling widget's token cannot clear the gate.

A visible active challenge frame always wins over token presence. After clearance, every mutation still runs the read-only preflight. If the server rejects the token and re-renders the challenge, the gate is restored before the mutation dispatches.

Testing

• node test/run.js — 1,396 passed; 1 inherited failure because package.json is 26.0.3 while the newest CHANGELOG.md entry is 26.0.0
• npm run test:security — 60/60 passed
• npm run test:fixtures — 125/125 passed
• npm run test:ci — passed
• node --check for both agent builds and test/run.js — passed
• git diff --check — passed

Regression coverage includes exact multi-widget correlation, hCaptcha's compatibility response field, visible-frame fail-closed behavior, token clearance, worker restart persistence, stale dialog text, and challenge re-arming.

Scope

This PR does not remove the legacy verification retry/read ladder, consolidate English regexes, or add full-page Cloudflare interstitial detection. Those remain separate unchecked items in #505.

Advances #505.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
webbrain	Ready	Preview	Aug 2, 2026 6:17am

[Copilot]

Pull request overview

Consumes correlated CAPTCHA response-token state while preserving fail-closed challenge handling across Chrome and Firefox.

Changes:

• Persists exact widget identity and token-cleared recheck markers.
• Clears gates only when the correlated token exists without an active frame.
• Adds multi-widget, restart, hCaptcha, and rejection regression coverage.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/chrome/src/agent/agent.js	Adds token-driven gate transitions for Chrome.
src/firefox/src/agent/agent.js	Mirrors token-driven transitions for Firefox.
test/run.js	Adds token correlation and persistence tests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.