# Accessibility Automation — Contract Brief ## Context I have multiple disabilities (motor: type with nose; hearing: audio challenges unusable) that effectively lock me out of reCAPTCHA-protected flows. I'm building a Python automation stack to traverse captcha walls on sites I'm a legitimate customer of — this is accommodation, not scraping/fraud. The stack is ~80% working end-to-end. I'm looking for a senior web-automation dev to help harden anti-bot resistance, improve reliability over slow proxies, and tidy the architecture. ## Tech stack - **Python 3.13** + **SeleniumBase** (UC mode / undetected-chromedriver) - **2captcha API v2** (`RecaptchaV2EnterpriseTaskProxyless`) for solving when captcha appears - **Residential HTTP proxy** for IP rotation (sticky 5-min sessions) - **Server-Sent Events (SSE)** command pipeline from a remote Node/Express server to the local daemon - Deployed on Windows 11, Chrome 147 ## Current architecture ``` [Web UI / PWA] --HTTP POST--> [Node server] | | SSE stream v [Python SB daemon on Windows] | | SB(uc=True, incognito=True, proxy=...) v [Chrome — target site flow] | | iframe reCAPTCHA v [2captcha API → token] v [Inject token → submit] ``` ## What's been solved - SSE command dispatch + ack round-trip - UC-safe JS execution via `sb.execute_script` (CDP path — raw `driver.execute_script` breaks under UC mode) - reCAPTCHA v2 Enterprise detection + token injection (handling HTML-entity encoded `&` in iframe src) - Form filling via native JS setters (React-safe) — SB's `update_text` misses React state updates in some modern sites - Serialized flow execution (one concurrent browser at a time) - Error-page early-exit (detect "Oops something went wrong" banner before cascading further in the wizard) - Residential proxy integration + IP-stickiness verification ## What needs help 1. **Anti-bot hardening** — despite UC mode + residential proxy + valid captcha token, the target site sometimes still 400s the submit. Fingerprint tuning (Canvas/WebGL/Audio/Font signals) may help. 2. **Slow-proxy resilience** — residential proxies take 10-25s to inject the reCAPTCHA iframe vs 1-2s direct. Currently polling; may need async load detection. 3. **Abort + cleanup** — aborting mid-flow sometimes leaves orphan Chrome/chromedriver processes. 4. **Observability** — structured logs + per-run traces for failure diagnostics. ## Representative snippets (sanitised) ### SSE reader (Python → Node server) ```python def stream_commands(cfg): import sseclient while True: try: r = requests.get( cfg.url("/api/daemon/stream"), headers={"Authorization": f"Bearer {cfg.token}", "Accept": "text/event-stream"}, stream=True, timeout=(10, None), ) if r.status_code != 200: time.sleep(5); continue for event in sseclient.SSEClient(r).events(): if not event.data: continue try: data = json.loads(event.data) except Exception: continue if data.get("type") == "hello": continue yield data time.sleep(1.5) # clean stream end — wait before reconnect except requests.exceptions.ConnectionError: time.sleep(3) ``` ### SeleniumBase UC launch with residential proxy ```python from seleniumbase import SB with SB( uc=True, incognito=True, headless=False, window_size="1280,900", locale_code="en-US", proxy="USER:PASS@na.proxy.example.com:2334", test=False, ) as sb: sb.open("https://example.com/signup") sb.sleep(4) # fill wizard, solve captcha, submit ``` ### reCAPTCHA v2 Enterprise detect (UC-safe, no `arguments[]`) ```python _DETECT_JS = r""" (function() { var iframes = document.querySelectorAll('iframe'); for (var i = 0; i < iframes.length; i++) { var raw = iframes[i].src || ''; if (raw.indexOf('recaptcha') === -1) continue; var src = raw.replace(/&/g, '&'); var key = null; try { key = new URL(src).searchParams.get('k'); } catch (e) {} if (!key) continue; return { siteKey: key, invisible: /size=invisible/.test(src), enterprise: /\/enterprise\//.test(src), }; } return null; })(); """ def detect(sb): # Must use sb.execute_script (CDP path). driver.execute_script fails # in UC mode because chromedriver's HTTP port is closed. try: return sb.execute_script(_DETECT_JS) except Exception: return None ``` ### 2captcha solve + inject ```python def solve_and_inject(sb, cfg, site_key, page_url, enterprise=True): task_type = ("RecaptchaV2EnterpriseTaskProxyless" if enterprise else "RecaptchaV2TaskProxyless") r = requests.post("https://api.2captcha.com/createTask", json={ "clientKey": cfg.captcha2_key, "task": {"type": task_type, "websiteURL": page_url, "websiteKey": site_key}, }, timeout=20).json() task_id = r["taskId"] time.sleep(6) for _ in range(24): d = requests.post("https://api.2captcha.com/getTaskResult", json={ "clientKey": cfg.captcha2_key, "taskId": task_id, }, timeout=20).json() if d.get("status") == "ready": token = d["solution"]["gRecaptchaResponse"] # Inject — bake token as JSON literal (UC has no `arguments`) js = INJECT_JS_TEMPLATE.replace("__TOKEN__", json.dumps(token)) sb.execute_script(js) return True time.sleep(5) return False ``` ### Form fill — React-safe native setter (UC-safe) ```python _NATIVE_SET_TMPL = r""" (function() { var sel = __SEL__; var value = __VALUE__; var el = document.querySelector(sel); if (!el) return { ok: false }; var proto = el.tagName === 'TEXTAREA' ? HTMLTextAreaElement.prototype : el.tagName === 'SELECT' ? HTMLSelectElement.prototype : HTMLInputElement.prototype; var setter = Object.getOwnPropertyDescriptor(proto, 'value'); setter.set.call(el, String(value)); el.dispatchEvent(new Event('input', { bubbles: true })); el.dispatchEvent(new Event('change', { bubbles: true })); el.dispatchEvent(new Event('blur', { bubbles: true })); return { ok: true }; })(); """ def fill_instant(sb, selector, value): js = (_NATIVE_SET_TMPL .replace("__SEL__", json.dumps(selector)) .replace("__VALUE__", json.dumps("" if value is None else str(value)))) return bool(sb.execute_script(js)) ``` ## Scope redlines - This is assistive automation on sites I'm already a paying customer of - Not scraping, not mass account creation, not ban evasion - No hardware-level identifier modification (policy) - If anti-bot evasion ideas veer into fraud territory we stop and pivot ## What I'd want in a candidate - Senior Python + SeleniumBase/Playwright - Past work against modern anti-bot stacks (Cloudflare, reCAPTCHA v3/Enterprise, Akamai Bot Manager) - Comfort with CDP direct calls for tricky DOM access - Understanding of accessibility considerations — this isn't a typical scraping gig ## Deliverables I'd scope initially (2-4 weeks, pace-appropriate) 1. Audit the fingerprint surface under UC mode; propose 3-5 concrete hardening changes with measurements before/after 2. Async page-load model that replaces the current polling for iframe injection 3. Reliable abort + process cleanup on Windows 4. Structured run-trace logging (JSON, one event per flow stage) for debugging ## Deliverables I would NOT accept - Hardware-ID / SMBIOS / MAC spoofing - Anti-cheat/DRM evasion libraries - Anything that would violate a site's ToS beyond reasonable accessibility accommodation --- **Redacted items** (shared only after NDA/mutual comfort): - Exact target site URLs - Bearer tokens + API keys - 2captcha account credentials - Server host + SSH access