fix(browser_login): add CDP-based __zp_stoken__ hydration as fallback

[ParkerLLL]

Problem

Fixes #21

QR code login successfully obtains wt2, wbg, and zp_at cookies, but cannot obtain __zp_stoken__ because it is generated by Boss Zhipin's client-side JavaScript on page load — not returned by any HTTP endpoint.

The existing Camoufox headless browser fallback is sometimes detected and blocked by Boss Zhipin's anti-bot fingerprinting, leaving users without __zp_stoken__ and unable to use the search command.

Solution

Add a Chrome DevTools Protocol (CDP) hydration path that connects to a real Chrome instance the user already has running, navigates to zhipin.com, and harvests __zp_stoken__ after the page's JavaScript executes.

A real browser session is not subject to headless-browser fingerprint checks, making this approach significantly more reliable.

New strategy in browser_qr_login()

1. CDP first — connect to Chrome on localhost:9222, navigate to zhipin.com, extract __zp_stoken__ (most reliable, real browser)
2. Camoufox fallback — existing headless browser path (used when Chrome is not running)
3. Clear hint on failure — if both fail, user sees an actionable message:

   如需完整功能，请以 --remote-debugging-port=9222 启动 Chrome 后重试
   

New function: _hydrate_stoken_via_cdp()

• Uses only stdlib (urllib.request, json, time) + optional websocket-client
• Silently skipped when websocket-client is not installed or Chrome is not running
• No new required dependencies

Usage

Launch Chrome with the debugging port before running boss login --qrcode:

# macOS
open -a "Google Chrome" --args --remote-debugging-port=9222 --user-data-dir=/tmp/boss-chrome

# Linux
google-chrome --remote-debugging-port=9222 --user-data-dir=/tmp/boss-chrome

# Windows
chrome.exe --remote-debugging-port=9222 --user-data-dir=%TEMP%\boss-chrome

Then install the optional dependency and log in:

pip install websocket-client
boss login --qrcode

Test plan

• QR login with Chrome running on port 9222 → __zp_stoken__ obtained via CDP
• QR login without Chrome running → CDP skipped, Camoufox attempted
• QR login without websocket-client installed → CDP silently skipped, Camoufox attempted
• boss search works after CDP-assisted login

🤖 Generated with Claude Code