captchaforge 0.2.35

[DO NOT USE — UNDER ACTIVE DEVELOPMENT, NOT PRODUCTION-READY] Captcha solver scaffolding for chromiumoxide-driven browsers. The architecture is in place (vendor solvers, retry-loop iframe walking, VLM provider abstraction, real-WAF bench harness) but the live-vendor success rate is still 0% — Cloudflare Turnstile / hCaptcha / reCAPTCHA detect us at a TLS / CDP fingerprint layer that no flag-based stealth has cleared. Watch the repo; do not depend on this for any real workload.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

# pcap2fixture

Converts a captured HTTP exchange (PCAP / HAR / curl trace) into a
deterministic captchaforge bench fixture or
[`AdversarialCapture`][adv].

The capture path is opportunistic — drop a `.har` / `.pcap` / curl-
trace `.txt` into `tools/pcap2fixture/incoming/` and the script
emits the appropriate fixture stub. Operators then commit the
fixture and add a regression test.

[adv]: ../../src/adversarial_replay.rs

## Workflow

1. Capture the real challenge exchange:
   ```bash
   # HAR (recommended — DevTools "Save all as HAR with content"):
   firefox-devtools → Network → ⋮ → Save All As HAR

   # OR curl trace:
   curl -v --trace-ascii captured.txt https://protected-site.example/

   # OR tcpdump PCAP (for non-TLS or after key-decryption):
   tcpdump -w captured.pcap -i any port 443
   ```
2. Drop the file in `tools/pcap2fixture/incoming/`.
3. Run:
   ```bash
   python3 tools/pcap2fixture/convert.py
   ```
4. The script writes:
   - **For bench**: a new `bench/src/fixtures.rs` HTML constant
     under `// 41. <vendor> (captured)` plus the matching
     `bench/src/server.rs` route registration.
   - **For adversarial-corpus**: an `adversarial_replay::AdversarialCapture`
     JSON file under `adversarial-corpus/<vendor>/`.
5. `git add` + commit. CI now replays the capture forever.

## What `convert.py` knows about

- HAR v1.2 — extracts the response body + status + headers from
  the first request matching a CF / hCaptcha / reCAPTCHA URL
  signature.
- curl `--trace-ascii` — parses the response section delimited
  by `<= Recv data` / `<= Recv header`.
- PCAP — placeholder; requires `scapy` + `tls-decrypt-secrets`.
  Use HAR if TLS keys aren't exportable.

## Status

`convert.py` is a stub today. Real implementation lands when the
first user-reported capture comes in. The PROTOCOL (incoming/ +
out shape) is locked so the script can be filled in incrementally
without disrupting fixture / corpus consumers.