Skip to content

[feat] Support Proof-of-Work (PoW) challenges (Altcha, Friendly Captcha, and Wasm interstitials) #121

Description

@nklowns

Problem

Modern privacy-focused websites, public services, and search engines are increasingly moving away from traditional third-party image CAPTCHAs (reCAPTCHA, hCaptcha) toward Proof-of-Work (PoW) and WebAssembly-based challenges (such as Altcha, Friendly Captcha, mCaptcha, and Wasm-driven interstitials like Brave Search).

Currently, TRAWL has robust solvers for Cloudflare Turnstile, reCAPTCHA v2, hCaptcha, and GeeTest slide in packages/tiers/src/solvers/, but has no dedicated handler for PoW-based widgets or WebAssembly computation interstitials:

  1. When a scraped form contains an Altcha or Friendly Captcha widget, solvePageCaptchas() does not identify or trigger the widget, preventing form submission.
  2. When a site presents an interstitial Proof-of-Work challenge, short navigation timeouts can abort before the background WebAssembly / Web Worker finishes computing the solution nonce.

Proposed solution

Add native Proof-of-Work challenge support into TRAWL's architecture:

  1. In-Page Widget Solvers (packages/tiers/src/solvers/):

    • Add altcha.ts to detect <altcha-widget> / .altcha elements and wait for the SHA-256 verification token.
    • Add friendlyCaptcha.ts to detect .frc-captcha widgets, trigger execution if interactive, and capture the solution token.
    • Register both in solvePageCaptchas() alongside existing Turnstile and reCAPTCHA solvers.
  2. PoW / Wasm Interstitial Waiter (packages/tiers/src/utils/powWait.ts):

    • Add challenge detection for computational Wasm/PoW challenge gates in detect.ts.
    • Route through challengeRouter.ts with a dedicated waiter that monitors computation clearance cookies and redirects without premature timeouts.

Alternatives considered

  • Relying solely on third-party solving APIs: Violates TRAWL's core philosophy of 100% local, free, zero-external-dependency solving.
  • Handling PoW as generic timeouts: Causes non-deterministic failures when target sites adjust puzzle difficulty parameters.

Tier impact

  • Fit inside an existing tier?
  • Require a new tier or solver?
  • Apply cross-cutting (caching, observability, config)?

Adds in-page solvers under packages/tiers/src/solvers/ and an interstitial waiter under packages/tiers/src/utils/ for Tier 3 browser execution.

Willingness to contribute

  • I'd like to implement this myself and open a PR

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions