P-Adamiec/Free-Games-Claimer-Remaster v1.4

on GitHub

Added

• AliExpress bot-flag guard – new config vars AE_MIN_COINS, AE_FLAG_RETRIES, AE_FLAG_WAIT (default 2, 3, 480s). If check-in offers only 1 coin, bot skips collection and retries instead of wasting the full reward, then notifies you to collect on your phone if it never lifts.
• Anti-bot diagnostics in logs – 🔎 Anti-bot diagnostics line reports actual navigator.webdriver, automation property leaks, AliExpress risk cookies, and challenge detection; 🚧 Blocked app schemes line lists intercepted attempts for troubleshooting.
• Per-store notification toggle (NOTIFY_SKIP_STORES) – silence Discord/Apprise notifications from specific stores while they still run and claim, via a comma-separated denylist of store keys (accepts aliases ae/amazon/gp) — e.g. NOTIFY_SKIP_STORES=aliexpress stops the daily AliExpress summary. Store notifications now route through BaseClaimer.notify() / cfg.store_notify_enabled(), and main.py filters the summary and crash alerts accordingly.

Fixed

• Captchas suddenly appearing on every store – enabling the Page CDP domain (needed so addScriptToEvaluateOnNewDocument isn't silently ignored) made the old hand-rolled desktop stealth JS actually run for the first time, and its HARD-CODED values (Win32 platform, NVIDIA GTX 1650 WebGL, fake plugins) don't match the real headful/VNC container (no NVIDIA GPU, Linux) — that inconsistency is a bot tell and started triggering captchas across Steam, Epic, GOG and Prime at once. BaseClaimer.inject_base_stealth now defaults to False, so those stores use nodriver's clean native fingerprint again (verified live: WebGL reports the real renderer, navigator.webdriver === false).
• Cloudflare / captcha challenges never sent an alert – a human-check (Cloudflare "Just a moment… / Verify you are human", or an hCaptcha/Arkose login challenge) was either only logged or silently treated as "no games"/"not signed in", with no notification. New shared BaseClaimer._human_challenge_present() detects them and _wait_out_challenge() first lets a managed challenge auto-pass, then sends a Discord/Apprise push with the VNC link and waits for you to solve it. epic.py checks for it up front (Cloudflare can gate store.epicgames.com before login — otherwise it just looped "attempt 1/3") and again during login; steam.py checks it on the SteamDB page instead of silently reporting no free games.
• Navigator property spoofs threw mid-injection – missing configurable: true on base stealth properties caused per-store overrides to throw and abort. All navigator spoofs in src/core/claimer.py now use configurable: true so per-store overrides can layer safely.
• navigator.webdriver spoofed as undefined – real Chrome never reports undefined, always false. Now only patches when it's genuinely true, spoofing false instead.
• AliExpress login form not detected in non-English locales – the email/phone field (localized placeholder, plain type=text) and the Kontynuuj/Continue submit button are now found via locale-agnostic selectors and submitted with a trusted click on the real button element plus an Enter keypress, fixing automated login silently stalling.
• AliExpress reported a false "verification required" after a successful login – a successful sign-in redirects to the store homepage (e.g. pl.aliexpress.com/?gatewayAdapt=glo2pol), which has none of the coin-page markers _is_logged_in() looks for, so the bot wrongly fired a VNC "enter your 6-digit code" alert while actually logged in. _is_logged_in() now also recognizes the signed-in store homepage (account/sign-out menu), and _ensure_logged_in() accepts being redirected off the login page onto the aliexpress.com store as success (_left_login_for_store(), mirroring the upstream waitForURL check).
• AliExpress check-in silently reported success on unrendered pages or failed clicks – previously (v1.3), _verify_check_in() defaulted its status to "checked in / active" before checking for buttons. When the check-in widget failed to render or no Collect button was found, the bot silently logged success and sent false notifications (checked in / active), masking missed check-ins and breaking day-streaks. Now, if the widget doesn't render after retries or a collect click cannot be confirmed, aliexpress.py logs an error, saves failure diagnostics (data/ae_checkin_fail.html and screenshot), offers manual collection via VNC, and honestly reports failure (⚠️ NOT collected — widget did not render) if uncollected.
• Chrome app-scheme confirmation dialogs still appeared – xdg-open stub only made launches harmless after clicking the dialog. Added Chrome AutoLaunchProtocolsFromOrigins policy in Dockerfile so schemes (aliexpress://, alipay://, etc.) auto-launch without prompting. Extended DOM-blocking JS to cover all vectors (window.open, injected iframes, pre-existing links).
• Scheduler crashed when SCHEDULER_HOURS >= 24 (#22) – main.py previously passed SCHEDULER_HOURS into a cron expression (CronTrigger(hour=f"*/{cfg.scheduler_hours}")), causing a crash (ValueError: Error validating expression '*/24': the step value is higher than the total range) when set to 24 hours or more. Replaced CronTrigger with APScheduler's IntervalTrigger(hours=cfg.scheduler_hours) so SCHEDULER_HOURS now cleanly supports any positive interval (e.g. 1, 12, 24, 48, 72 hours) without range restrictions.
• Epic 2FA code screen refreshed in a loop so codes couldn't be entered (#21) – epic.py only auto-handled the authenticator (TOTP) method via EG_OTPKEY; for email/SMS codes the automated login loop kept re-navigating and re-typing email/password, wiping the code screen every attempt. It now detects the MFA screen (input[name="code-input-0"] / the /id/login/mfa URL — the same field for email, SMS and authenticator), auto-fills TOTP when EG_OTPKEY is set, and otherwise STOPS re-driving the page and waits on the code screen with a Discord/Apprise "enter your 2FA code" prompt so you can type it via VNC (a Cloudflare/Talon "One more step" check can appear on the same screen and is included in the prompt). New _mfa_prompt_present() / _fill_totp() helpers.
• Amazon Luna / Prime Gaming login clicked the wrong "Sign in with Passkey" button (#13) – login looped ("attempt N/5", "Session lost", "No passkeys for this account") because _ensure_logged_in() clicked the sign-in button via a fuzzy page.find("Sign in") text search, which also matches "Sign in with a passkey"; and the passkey neutralization only disabled the WebAuthn API without removing Amazon's rendered passkey form. prime.py now clicks Luna's exact button[data-a-target="sign-in-button"], and its injected script strips Amazon's signInWithPasskeyButton / signInWithMShopButton forms so only the password form (form[name="signIn"] → #ap_password + #signInSubmit) can be used. If a passkey error still appears (#passkey-error-alert), the bot stops looping and asks you to finish login via VNC with a notification.
• "Failed to connect to browser" after days of running (#19) – every store eventually failed to launch Chrome. Root cause: close_browser() only ran nodriver's stop(), which terminates the parent Chrome but leaves its child processes (zygote/renderer/GPU) alive; and a failed uc.start() raises before returning a handle, so the Chrome it already spawned is orphaned and keeps the profile lock. These pile up over scheduled runs until no new browser can start. src/core/claimer.py now kills the whole Chrome process tree on close (via psutil), retries uc.start() up to 3× while sweeping any orphaned Chrome bound to that store's profile and clearing stale Singleton* lock files between attempts, and raises a clear error if it still can't start. No profile/session data is touched, so store logins in the volume are preserved.
• Docker build hangs on slow/stuck mirrors – added IPv4 forcing and timeouts to apt configuration so stuck downloads retry instead of hanging indefinitely.

Changed

• AliExpress stealth switched to a real-device fingerprint (browserforge) – replaced the hand-written UA/WebGL/navigator spoofs (incomplete and internally inconsistent — the very thing Alibaba's risk engine detects) with a COMPLETE Android-phone fingerprint sampled from real devices (UA, Sec-CH-UA client-hints, screen, navigator, WebGL, codecs), injected as one coherent unit via CDP and cached per profile (fgc_fingerprint.json) so the bot presents the SAME phone every day. Mirrors the proven upstream stealth stack.
• AliExpress coin balance now read from the API, not the DOM – the coin page shows the balance only as rotating digit animations, so aliexpress.py captures the mtop.aliexpress.coin.execute response (via an in-page fetch/XHR interceptor into window.__fgcCoin, since the CDP network handlers didn't fire) and parses userCoinsNum from it.
• Richer AliExpress check-in notification – after a successful check-in the notification now shows how many coins were collected and the wallet total, e.g. claimed 70 🪙 (665 total) (day-streak and tomorrow's coints are planned)
• Unified VNC "manual action needed" notifications with one-click links – alerts that ask you to act via VNC (login, 2FA/security codes, captcha, Steam Guard, manual coin collection) were worded inconsistently and the link never auto-connected. A single cfg.vnc_url now builds http://<VNC_IP>:<NOVNC_PORT>/?autoconnect=true (opens the noVNC session directly), and a shared BaseClaimer._vnc_notice(title, body) formats every message the same way. All stores (aliexpress, epic, prime, gog, steam) and the base captcha/login helpers use them; the Steam Guard notification now includes the link too.
• Unified + hardened Prime/Luna logged-in detection – the "are we signed in?" check in prime.py was a single fragile selector (user-dropdown-first-name-text), duplicated by a separate Sign in/Try Prime heuristic on game detail pages. A new shared _is_signed_in() now corroborates several account-header signals (amazon-dropdown-header-interactable / amazon-dropdown-header-message) with a sign-in-button negative guard, so a single Amazon attribute rename no longer breaks login into an endless loop; the detail-page session-loss watchdog uses the same method.
• Desktop base stealth is now opt-in – BaseClaimer.inject_base_stealth defaults to False; nodriver's native stealth is used unless a store explicitly opts in. This is what fixes the cross-store captcha regression above (see Fixed). AliExpress keeps it False and injects its own coherent browserforge fingerprint.
• Dockerfile hardening – expanded app-scheme blocklists in Chrome preferences and CDP calls to cover the full AliExpress/Alibaba set.
• Repository & Docker context exclusions (.dockerignore / .gitignore) – updated .dockerignore and .gitignore to exclude AI assistant directories (.gemini/, .claude/, .cursor/), IDE configs, logs, and TEMP_* reference dumps (e.g. TEMP_ORIGINAL_PROJECT/), preventing ~60 MB of local/temporary files from bloating the Docker build context or being accidentally committed.
• Documented previously-undocumented settings – added EMAIL/PASSWORD (global default credentials), VNC_PASSWORD, TIMEOUT, SCREENSHOTS_DIR and NOTIFY_SKIP_STORES to the README config table and .env.example, and aligned the .env.example WIDTH example with the 1280 default.
• Quieter Apprise logging – the app's Apprise notification sent. line is now debug (the apprise library already logs each target at INFO, e.g. Sent ntfy notification to …), so a single successful send no longer looks duplicated.

Removed

• Unused LOGIN_TIMEOUT config – the login_timeout field in src/core/config.py was defined but never read anywhere in the code (distinct from the active VNC_LOGIN_TIMEOUT); removed.