[object Object]

← back to Pattern Vault

spoonflower: add plain-real-Chrome manual-login fallback (sf_login_manual.sh + capture --manual) for when Cloudflare bounces the automated path

ee917f9ad30475802b078cd1fa27fa5c6aae7582 · 2026-07-16 09:33:34 -0700 · Steve Abrams

Files touched

Diff

commit ee917f9ad30475802b078cd1fa27fa5c6aae7582
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:33:34 2026 -0700

    spoonflower: add plain-real-Chrome manual-login fallback (sf_login_manual.sh + capture --manual) for when Cloudflare bounces the automated path
---
 .../daily/scripts/capture_sf_session.js            | 10 +++++
 whimsical-compare/daily/scripts/sf_login_manual.sh | 52 ++++++++++++++++++++++
 2 files changed, 62 insertions(+)

diff --git a/whimsical-compare/daily/scripts/capture_sf_session.js b/whimsical-compare/daily/scripts/capture_sf_session.js
index 9bc21fa..0eaaa1e 100644
--- a/whimsical-compare/daily/scripts/capture_sf_session.js
+++ b/whimsical-compare/daily/scripts/capture_sf_session.js
@@ -34,6 +34,16 @@ const EMAIL = process.env.SPOONFLOWER_EMAIL || envFile.SPOONFLOWER_EMAIL;
 const PASSWORD = process.env.SPOONFLOWER_PASSWORD || envFile.SPOONFLOWER_PASSWORD;
 const STATE = process.env.SF_STATE || path.join(os.homedir(), '.config/pattern-vault/sf-state.json');
 const HEADFUL = process.argv.includes('--headful');
+const MANUAL = process.argv.includes('--manual');
+
+// --manual: escalation fallback when Cloudflare bounces even the Playwright real-Chrome path.
+// Hands off to sf_login_manual.sh, which opens the SHARED profile in plain real Chrome (zero
+// automation flags) so you log in + clear the human-check by hand. No env creds needed.
+if (MANUAL) {
+  const { spawnSync } = require('child_process');
+  const r = spawnSync('bash', [path.join(__dirname, 'sf_login_manual.sh')], { stdio: 'inherit' });
+  process.exit(r.status || 0);
+}
 
 if (!EMAIL || !PASSWORD) { console.error('❌ missing SPOONFLOWER_EMAIL/PASSWORD (env or resize-it/.env)'); process.exit(2); }
 console.log(`🔐 capturing session for ${EMAIL} → ${STATE}`);
diff --git a/whimsical-compare/daily/scripts/sf_login_manual.sh b/whimsical-compare/daily/scripts/sf_login_manual.sh
new file mode 100755
index 0000000..a3f1576
--- /dev/null
+++ b/whimsical-compare/daily/scripts/sf_login_manual.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# ---------------------------------------------------------------------------
+# Spoonflower login FALLBACK — the most-human, least-detectable path.
+#
+# Opens the SHARED persistent profile (the same --user-data-dir upload_sf.js and
+# capture_sf_session.js use) in REAL Google Chrome with ZERO automation flags —
+# no Playwright, no CDP, no --enable-automation. This is the openclaw principle:
+# a genuine human Chrome that Cloudflare waves straight through.
+#
+# You log in + solve any "verify you are human" / Cloudflare check BY HAND, then
+# CLOSE the window. The login (and the valid cf_clearance cookie) persist inside
+# the profile on disk, so upload_sf.js reuses it with no challenge.
+#
+# Rule-safe: nothing is extracted. The session stays inside the browser profile —
+# no cookie/token dump (which the safety classifier blocks, correctly).
+#
+# Use this when the Playwright `channel:'chrome'` capture still lands on /login
+# (Cloudflare still bounced the automated fingerprint). Escalation ladder:
+#   1. node capture_sf_session.js --headful   (Playwright real-Chrome)
+#   2. THIS script                            (plain real-Chrome, no automation)
+#   3. browserbase (proxies + solveCaptchas)  (cloud, clears CF natively)
+# ---------------------------------------------------------------------------
+set -euo pipefail
+
+PROFILE="${SF_PROFILE:-$HOME/.config/pattern-vault/sf-chrome-profile}"
+CHROME="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+
+[ -x "$CHROME" ] || { echo "❌ Google Chrome not found at: $CHROME"; exit 1; }
+mkdir -p "$PROFILE"
+
+cat <<EOF
+🔐 Opening Spoonflower in REAL Chrome (no automation) — profile: $PROFILE
+
+   Account: info@designerwallcoverings.com
+   1) Log in.
+   2) Solve any "verify you are human" / Cloudflare check.
+   3) When you're signed in, CLOSE this Chrome window.
+
+   Waiting until you close it…
+EOF
+
+# Foreground the binary against the DEDICATED profile dir so this blocks until the
+# window is closed. A dedicated data-dir means closing its only window quits this
+# instance (and won't disturb your everyday Chrome).
+"$CHROME" \
+  --user-data-dir="$PROFILE" \
+  --no-first-run \
+  --no-default-browser-check \
+  "https://www.spoonflower.com/login" >/dev/null 2>&1 || true
+
+echo "✅ Chrome closed — profile primed."
+echo "   Verify + upload:  node upload_sf.js <manifest.json> --armed"

← 958c6be spoonflower: drive real Chrome (channel:chrome) w/ persisten  ·  back to Pattern Vault  ·  spoonflower: add rung-3 Browserbase upload path (SF_BROWSERB c528dae →