jackwener/OpenCLI · error · AuthRequiredError

Xianyu inbox is blocked by verification or risk control

Error message

Xianyu inbox is blocked by verification or risk control

What it means

An AuthRequiredError thrown when the injected page script detects risk-control/verification text (验证码, 安全验证, 异常访问 and mojibake variants) in the body of www.goofish.com/im. Goofish/Xianyu is serving a captcha or security-verification page instead of the inbox, so the command cannot scrape the conversation list and reports it as an access-block condition.

Source

Thrown at clis/xianyu/inbox.js:51

        const resolveIds = Boolean(kwargs['resolve-ids']);
        let currentUrl = '';
        if (page.getCurrentUrl) {
            try {
                currentUrl = await page.getCurrentUrl();
            } catch {
                currentUrl = '';
            }
        }
        if (!/https:\/\/www\.goofish\.com\/im\b/.test(currentUrl)) {
            await page.goto(buildInboxUrl());
        }
        await page.wait(4);
        const payload = requireEvaluateObject(await page.evaluate(buildExtractInboxEvaluate(limit)), 'inbox');
        if (payload?.requiresAuth) {
            throw new AuthRequiredError('www.goofish.com', 'Xianyu inbox requires a logged-in browser session');
        }
        if (payload?.blocked) {
            throw new AuthRequiredError('www.goofish.com', 'Xianyu inbox is blocked by verification or risk control');
        }
        if (!Array.isArray(payload.items)) {
            throw new CommandExecutionError('Xianyu inbox returned malformed conversation list');
        }
        const items = payload.items;
        if (!items.length) {
            throw new EmptyResultError('xianyu inbox', 'No Xianyu inbox conversations were found');
        }
        let conversations = items.slice(0, limit);
        if (unreadOnly) {
            conversations = conversations.filter((item) => Boolean(item.unread));
        }
        if (resolveIds) {
            for (const item of conversations) {
                if (item.item_id && item.peer_user_id) continue;
                const rowIndex = Number(item.row_index);
                if (!Number.isInteger(rowIndex) || rowIndex < 0) continue;
                requireClickResult(await page.evaluate(buildClickInboxConversationEvaluate(rowIndex)), 'inbox resolve-ids click');

View on GitHub (pinned to 49907e53dc)

Solutions

Solve the captcha/verification manually in the automation browser, then re-run the command
Switch to a residential IP or disable the VPN/proxy the browser is using
Slow down request rate — add delays/backoff between inbox polls and avoid parallel sessions
Wait it out: risk-control blocks are often temporary (minutes to hours)
If the account itself is restricted, resolve the restriction in the Xianyu app first

Example fix

// before (aggressive polling triggers risk control)
setInterval(() => runInbox(), 2000);
// after
async function pollInbox() {
  try { return await runInbox(); }
  catch (e) {
    if (String(e).includes('blocked by verification')) await sleep(5 * 60_000);
    return pollInbox();
  }
}

Defensive patterns

Strategy: retry

Validate before calling

null

Type guard

null

Try / catch

try {
  const convos = await runInbox();
} catch (e) {
  if (String(e).includes('blocked by verification or risk control')) {
    await sleep(backoffMs); // exponential backoff, minutes-scale
    // optionally alert operator to solve the captcha manually
  } else throw e;
}

Prevention

Rate-limit inbox polls; use exponential backoff instead of fixed short intervals
Use a residential IP; avoid VPN/datacenter egress for goofish traffic
Avoid running many parallel browser sessions with the same account
If blocked, solve the verification manually in the automation browser before retrying

When it happens

Trigger: Running 'xianyu inbox' when goofish.com's risk control has flagged the session: too-frequent scraping, requests from a datacenter/VPN IP, a suspicious cookie profile, or an account under review — the page body matches the blocked-pattern regex and blocked=true is returned.

Common situations: Polling the inbox in a tight loop from a server IP; running many parallel browser sessions against goofish; using a VPN/proxy flagged for abuse; account flagged after unusual activity (mass messaging).

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/5ce47e397cbd7772. Report an issue: GitHub.