From 4dfe5be68033b4c12efdb4622e6b40a3d75bd999 Mon Sep 17 00:00:00 2001
From: germondai <germondai@gmail.com>
Date: Wed, 8 Jul 2026 19:40:38 +0200
Subject: [PATCH] fix(tiers): escalate JS-shell challenge pages from Tier 1 to
 browser

---
 packages/tiers/src/tier1.ts | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/packages/tiers/src/tier1.ts b/packages/tiers/src/tier1.ts
index 30e45cd..2a499f7 100644
--- a/packages/tiers/src/tier1.ts
+++ b/packages/tiers/src/tier1.ts
@@ -1,6 +1,6 @@
 import { FINGERPRINT } from "@trawl/browser"
 import type { TierResult } from "@trawl/types"
-import { isBlocked, isCloudflarePage } from "./detect"
+import { hasHcaptcha, hasRecaptcha, hasTurnstile, isBlocked, isCloudflarePage } from "./detect"
 import { normalizeHtml } from "./html"
 
 export interface Tier1Result extends TierResult {
@@ -42,6 +42,21 @@ export async function runTier1(
       return { tier: 1, status: "needs-js", durationMs: Date.now() - start, reason: "cloudflare-challenge" }
     }
 
+    // JS-only challenges: the page's static HTML is just a shell that loads the
+    // captcha widget via <script src="...api.js">. Plain fetch sees the shell and
+    // would otherwise report success — but the real content (including the widget)
+    // only renders after JS executes. Escalate so Tier 3 runs the page in a browser,
+    // executes JS, and the solver can engage the actual widget.
+    if (hasHcaptcha(html)) {
+      return { tier: 1, status: "needs-js", durationMs: Date.now() - start, reason: "hcaptcha-shell" }
+    }
+    if (hasRecaptcha(html)) {
+      return { tier: 1, status: "needs-js", durationMs: Date.now() - start, reason: "recaptcha-shell" }
+    }
+    if (hasTurnstile(html)) {
+      return { tier: 1, status: "needs-js", durationMs: Date.now() - start, reason: "turnstile-shell" }
+    }
+
     if (isBlocked(res.status, html)) {
       return { tier: 1, status: "blocked", durationMs: Date.now() - start, reason: `http-${res.status}` }
     }