Closes the captcha BOT regression that started 2026-05-15 when VK
updated detection rules on the old calls.getAnonymousToken path and
our PoW + WebView solver could no longer recover (proven dead-end
empirically across 11 phases + 3-platform test on iOS extension /
Mac standalone / FreeBSD VPS — all 100% BOT).
This build adds an alternative cred-fetch route used by the VK Calls
iOS app itself, discovered via static + runtime reverse engineering
of the decrypted VKCallsApp binary:
Step 1: POST api.vk.me/method/auth.getAnonymToken (NO client_secret)
Step 2: POST api.vk.me/method/messages.getCallPreview → user_id + secret
Step 3: POST api.vk.me/method/messages.getAnonymCallToken → OK anonymToken
Step 4: POST calls.okcdn.ru/fb.do?method=auth.anonymLogin → session_key
Step 5: POST calls.okcdn.ru/fb.do?method=vchat.joinConversationByLink
→ TURN credentials
The key unlock is client_id=8093730 (VK Connect — a public app that
needs no client_secret). VK currently does not gate messages.getAnonymCallToken
with captcha for VK Connect anonymous tokens.
Implementation (pkg/proxy/creds_vkcalls.go) wires this as the primary
path in GetVKCreds; the existing PoW + WebView solver in captcha_pow.go
remains as an auto-fallback for when VK eventually adds a captcha gate
to the new path too (this is an arms-race pattern — captcha gates on
the legacy path have existed for months and VK periodically updates
detection rules).
Production validation (vpn.wifi.victory.log, 31+ min run):
- Pre-bootstrap probe → TURN creds in 1.76 s
- Pool fills 12/12/12 in 31 min via design-correct cold-start +
maintenance stagger (120-300 s between fills after slot 3) - 30/30 conns established, 0 reconnects
- Zero captcha invocations during the full session
- 20.9 MB TX / 40.5 MB RX of real user traffic
Diagnostic env vars VK_API_HOST and VK_CLIENT_ID_ONLY kept in tree
as reusable infrastructure for the next round of reverse engineering
when VK closes this path.