Initial commit: read social posts back without the app

antisocial is the other half of a StopTheMadness redirect rule. Links to X,
Threads, Instagram, TikTok and Bluesky get rewritten to /<prefix>/<original
path>, and this resolves the post and shows the media and the words, with a
badge saying where it came from and a button to copy the original URL.

Every request drives a real headless Chromium, logged out, from a residential
IP. One code path, and it survives markup changes better than parsing from the
outside would. Extraction is layered, most structured first: the platform's own
API response caught in flight, then an inline payload, then the rendered DOM,
then Open Graph tags.

Media is never linked straight at a CDN. Instagram and TikTok reject requests
without a matching Referer and cookies, and proxying keeps the viewer's browser
from talking to the platform at all. Range is forwarded so the native video
scrubber can seek. HLS is the exception, since proxying it would mean rewriting
playlists.

TikTok sometimes answers with a slider puzzle. Rather than reporting that as a
failure, the page is parked and the viewer is handed the puzzle: screenshots
stream out, pointer events are replayed back. Solving it leaves the cookie in
the shared browser context, so the retry is an ordinary request.

A failed resolve is never a blank error page. The card carries the platform, the
original URL and the copy button, so a broken adapter still leaves the link one
tap away.

Verified end to end against real shared links on all five platforms, in the
container, including multi-image carousels, reels, TikTok short links and photo
posts. 49 tests run the adapters against captured payloads with no network.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01BGkRmLfiWuJHx6tQ12EELY

src/challenge/registry.ts

@@ -0,0 +1,101 @@
+import { randomBytes } from 'node:crypto';
+import type { Page } from 'playwright';
+import type { PlatformId } from '../types.ts';
+
+/**
+ * Pages parked mid-challenge, waiting for a person to finish them.
+ *
+ * A parked page is outside the pool's normal lifecycle: it holds no
+ * concurrency permit, so parking one never blocks anything else, but it does
+ * hold a browser tab, hence the cap and the expiry.
+ */
+export type Challenge = {
+  id: string;
+  page: Page;
+  platform: PlatformId;
+  platformLabel: string;
+  originalUrl: string;
+  /** Where to send the viewer once the puzzle is done. */
+  returnTo: string;
+  expiresAt: number;
+};
+
+/** The selectors a challenge tends to live in, biggest hint first. */
+export const CHALLENGE_SELECTORS = '[id*="captcha"], [class*="captcha_verify"], [class*="captcha-verify"]';
+
+const MAX_PARKED = 3;
+const TTL_MS = 5 * 60 * 1000;
+
+const parked = new Map<string, Challenge>();
+
+async function close(challenge: Challenge): Promise<void> {
+  parked.delete(challenge.id);
+  await challenge.page.close().catch(() => undefined);
+}
+
+function sweep(): void {
+  const now = Date.now();
+  for (const challenge of [...parked.values()]) {
+    if (challenge.expiresAt <= now) void close(challenge);
+  }
+}
+
+export async function park(options: {
+  page: Page;
+  platform: PlatformId;
+  platformLabel: string;
+  originalUrl: string;
+}): Promise<string> {
+  sweep();
+
+  // Never sit on more than a few tabs. The oldest is the least likely to
+  // still have someone looking at it.
+  while (parked.size >= MAX_PARKED) {
+    const oldest = [...parked.values()].sort((a, b) => a.expiresAt - b.expiresAt)[0];
+    if (!oldest) break;
+    await close(oldest);
+  }
+
+  const id = randomBytes(9).toString('base64url');
+  parked.set(id, { ...options, id, returnTo: '/', expiresAt: Date.now() + TTL_MS });
+  return id;
+}
+
+export function get(id: string): Challenge | undefined {
+  sweep();
+  const challenge = parked.get(id);
+  if (!challenge) return undefined;
+  // Someone is still working on it.
+  challenge.expiresAt = Date.now() + TTL_MS;
+  return challenge;
+}
+
+export function setReturnTo(id: string, returnTo: string): void {
+  const challenge = parked.get(id);
+  if (challenge) challenge.returnTo = returnTo;
+}
+
+export async function release(id: string): Promise<string | undefined> {
+  const challenge = parked.get(id);
+  if (!challenge) return undefined;
+  const { returnTo } = challenge;
+  await close(challenge);
+  return returnTo;
+}
+
+export function parkedCount(): number {
+  sweep();
+  return parked.size;
+}
+
+/** Has the puzzle gone away? */
+export async function isSolved(challenge: Challenge): Promise<boolean> {
+  return challenge.page
+    .evaluate((selectors: string) => {
+      const el = document.querySelector(selectors);
+      if (!el) return true;
+      const style = getComputedStyle(el);
+      return style.display === 'none' || style.visibility === 'hidden';
+    }, CHALLENGE_SELECTORS)
+    .catch(() => false);
+}