fix(codex): utls scraper + GitHub Actions token push

.github/workflows/codex-push.yml

@@ -0,0 +1,44 @@
+name: Codex token push
+
+on:
+  schedule:
+    - cron: '*/5 * * * *'
+  workflow_dispatch:
+
+jobs:
+  push-token:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: harnesses/aggregator-head-lag/go.mod
+          cache-dependency-path: harnesses/aggregator-head-lag/go.sum
+
+      - name: Build scraper
+        working-directory: harnesses/aggregator-head-lag
+        run: go build -o /tmp/codex-scraper ./cmd/test-utls/
+
+      - name: Scrape and push token
+        run: |
+          set -euo pipefail
+          output=$(MODE=default /tmp/codex-scraper 2>&1)
+          echo "$output" | head -5
+          token=$(echo "$output" | grep '^CODEX_TOKEN=' | cut -d= -f2-)
+          if [ -z "$token" ] || [ ${#token} -lt 100 ]; then
+            echo "ERROR: no token in output"
+            echo "$output"
+            exit 1
+          fi
+          echo "Got token (len=${#token}), pushing to sidecar..."
+          http_code=$(curl -s -o /tmp/push_resp -w "%{http_code}" -X POST \
+            -H "Content-Type: text/plain" \
+            --data-raw "$token" \
+            "http://57.130.19.92:8080/push")
+          if [ "$http_code" = "204" ]; then
+            echo "Push OK"
+          else
+            echo "Push failed (HTTP $http_code): $(cat /tmp/push_resp)"
+            exit 1
+          fi

harnesses/aggregator-head-lag/cmd/script/codex_scraper.go

@@ -103,9 +103,30 @@ func scrapeCodexToken() (string, error) {
 	return "", fmt.Errorf("codex_token cookie not found after page load")
 }
 
+// chromeAvailable returns true if a Chrome/Chromium binary is found on this host.
+func chromeAvailable() bool {
+	for _, p := range []string{
+		os.Getenv("CHROME_PATH"),
+		"/usr/bin/chromium", "/usr/bin/chromium-browser", "/usr/bin/google-chrome",
+		"/usr/bin/google-chrome-stable",
+	} {
+		if p != "" {
+			if _, err := os.Stat(p); err == nil {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // startInProcessScraper launches a background goroutine that refreshes the JWE every 5 min.
-// Call once from main. Safe to call even if Chrome is not installed (logs error, no crash).
+// Call once from main. No-ops silently if Chrome is not installed.
 func startInProcessScraper(stopChan <-chan struct{}) {
+	if !chromeAvailable() {
+		fmt.Println("[CODEX-SCRAPER] Chrome not found — in-process scraper disabled (sidecar will be used)")
+		return
+	}
+
 	go func() {
 		// Initial delay: let the container fully start before launching Chrome.
 		select {

harnesses/aggregator-head-lag/cmd/script/defined_auth.go

@@ -141,12 +141,20 @@ func GetDefinedJWTToken(sessionCookie string) (string, error) {
 		fmt.Printf("[DEFINED-AUTH] Got token from in-process scraper (age=%v, len=%d)\n", time.Since(mintedAt).Round(time.Second), len(tok))
 		return tok, nil
 	}
-	// Direct mint: JWE minted from this container's IP = same IP used for WS = no 4403.
+	// utls Chrome fingerprint scraper: visits defined.fi, gets CSRF, POSTs to /api/codex/token.
+	// Works if this container's IP is not in Vercel's datacenter blocklist.
+	if tok, err := tryUtlsCodexToken(); err == nil && tok != "" {
+		fmt.Printf("[DEFINED-AUTH] Got token via utls scraper (len=%d)\n", len(tok))
+		return tok, nil
+	} else {
+		fmt.Printf("[DEFINED-AUTH] utls scraper failed: %v\n", err)
+	}
+	// Direct mint (standard Go TLS, usually blocked by Vercel bot check).
 	if tok, err := tryDirectCodexToken(sessionCookie); err == nil && tok != "" {
 		fmt.Printf("[DEFINED-AUTH] Got token via direct /api/codex/token (len=%d)\n", len(tok))
 		return tok, nil
 	}
-	// Sidecar fallback (Paris box chromedp, auto-refreshes every 25 min — may be stale)
+	// Sidecar fallback (Paris box, Mac-push keeps it fresh every 5 min)
 	if svcURL := os.Getenv("DEFINED_TOKEN_SERVICE_URL"); svcURL != "" {
 		if tok, err := tryTokenService(svcURL); err == nil && tok != "" {
 			fmt.Printf("[DEFINED-AUTH] Got token from sidecar (len=%d)\n", len(tok))
@@ -199,49 +207,39 @@ func GetDefinedJWTToken(sessionCookie string) (string, error) {
 	return token, nil
 }
 
-// generateDefinedJWTToken generates a new JWT token from Defined.fi session cookie
-func generateDefinedJWTToken(sessionCookie string) (string, error) {
-	fmt.Println("[DEFINED-AUTH] Generating new JWT token from Defined.fi (local)...")
-	fmt.Println("[DEFINED-AUTH] Creating new HTTP client with fresh TCP connection (no keepalive)")
-
-	// Create a new HTTP client with fresh connection for each request.
-	// CRITICAL: route through HTTP_PROXY/HTTPS_PROXY (webshare rotating proxy)
-	// so each JWT mint hits a fresh IP. Direct from the container IP gets us
-	// stuck on Vercel's bot ban (429 loop) when the container restarts often.
-	transport := &http.Transport{
-		DisableKeepAlives:   true,
-		MaxIdleConnsPerHost: 0,
-		Proxy:               http.ProxyFromEnvironment,
-	}
-	client := &http.Client{
-		Timeout:   10 * time.Second,
-		Transport: transport,
-	}
+// generateDefinedJWTToken generates a new JWT token via un.defined.fi (old UI, still alive).
+// No session cookie or CSRF needed. Falls back to www.defined.fi/api proxy path.
+func generateDefinedJWTToken(_ string) (string, error) {
+	fmt.Println("[DEFINED-AUTH] Generating token via un.defined.fi legacy API...")
 
 	reqBody := map[string]interface{}{
 		"operationName": "CreateApiToken",
 		"query":         "mutation CreateApiToken { createApiTokens(input: { count: 1 }) { token } }",
 		"variables":     map[string]interface{}{},
 	}
-
 	bodyBytes, _ := json.Marshal(reqBody)
-	req, _ := http.NewRequest("POST", "https://www.defined.fi/api", bytes.NewBuffer(bodyBytes))
 
+	transport := &http.Transport{
+		DisableKeepAlives: true,
+		Proxy:             http.ProxyFromEnvironment,
+	}
+	client := &http.Client{Timeout: 10 * time.Second, Transport: transport}
+
+	req, _ := http.NewRequest("POST", "https://un.defined.fi/api", bytes.NewBuffer(bodyBytes))
 	req.Header.Set("Accept", "application/json")
-	req.Header.Set("Accept-Language", "en-US,en;q=0.9")
 	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Origin", "https://www.defined.fi")
-	req.Header.Set("Referer", "https://www.defined.fi/")
 	req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36")
+	req.Header.Set("Accept-Language", "en-US,en;q=0.9")
+	req.Header.Set("Origin", "https://un.defined.fi")
+	req.Header.Set("Referer", "https://un.defined.fi/")
 	req.Header.Set("sec-ch-ua", `"Not_A Brand";v="8", "Chromium";v="131", "Google Chrome";v="131"`)
 	req.Header.Set("sec-ch-ua-mobile", "?0")
 	req.Header.Set("sec-ch-ua-platform", `"macOS"`)
 	req.Header.Set("sec-fetch-dest", "empty")
 	req.Header.Set("sec-fetch-mode", "cors")
 	req.Header.Set("sec-fetch-site", "same-origin")
-	req.AddCookie(&http.Cookie{Name: "defined-attestation-token", Value: sessionCookie})
 
-	fmt.Println("[DEFINED-AUTH] Sending POST request to https://www.defined.fi/api...")
+	fmt.Println("[DEFINED-AUTH] POST https://un.defined.fi/api ...")
 	resp, err := client.Do(req)
 	if err != nil {
 		fmt.Printf("[DEFINED-AUTH] ❌ Request failed: %v\n", err)
@@ -253,18 +251,16 @@ func generateDefinedJWTToken(sessionCookie string) (string, error) {
 	fmt.Printf("[DEFINED-AUTH] Response status: %d\n", resp.StatusCode)
 
 	if resp.StatusCode == 429 {
-		// Parse retry-after header if available
 		retryAfter := resp.Header.Get("Retry-After")
 		fmt.Printf("[DEFINED-AUTH] ⚠ Rate limited! Retry-After: %s\n", retryAfter)
-		if retryAfter != "" {
-			return "", fmt.Errorf("rate limited (429), retry after: %s", retryAfter)
-		}
-		return "", fmt.Errorf("rate limited (429), too many token requests - will retry later")
+		return "", fmt.Errorf("rate limited (429)")
 	}
 
 	if resp.StatusCode != 200 {
-		fmt.Printf("[DEFINED-AUTH] ❌ Unexpected status %d: %s\n", resp.StatusCode, string(respBody[:min(len(respBody), 100)]))
-		return "", fmt.Errorf("unexpected status %d: %s", resp.StatusCode, string(respBody[:min(len(respBody), 100)]))
+		n := len(respBody)
+		if n > 100 { n = 100 }
+		fmt.Printf("[DEFINED-AUTH] ❌ Unexpected status %d: %s\n", resp.StatusCode, string(respBody[:n]))
+		return "", fmt.Errorf("unexpected status %d: %s", resp.StatusCode, string(respBody[:n]))
 	}
 
 	var tokenResp DefinedTokenResponse
@@ -278,7 +274,7 @@ func generateDefinedJWTToken(sessionCookie string) (string, error) {
 		return "", fmt.Errorf("no token returned")
 	}
 
-	fmt.Printf("[DEFINED-AUTH] ✅ JWT token generated successfully (length: %d)\n", len(tokenResp.Data.CreateApiTokens[0].Token))
+	fmt.Printf("[DEFINED-AUTH] ✅ Token generated via un.defined.fi (length: %d)\n", len(tokenResp.Data.CreateApiTokens[0].Token))
 	return tokenResp.Data.CreateApiTokens[0].Token, nil
 }