boss-auto-job

name boss-auto-job description BOSS直聘自动求职: Camoufox隐身搜索→多Agent匹配→生成打招呼→自动投递。4层反爬绕过(TLS/行为/网关/风控)，AST解密zp_stoken，Code 36/32安全停止机制。 BOSS Auto Job Overview General-purpose web platform automation framework demonstrated on BOSS Zhipin. Pattern: login session persistence → data scraping → multi-agent analysis → automated action execution. Adaptable to any web platform requiring cookie-based auth and batch AI processing. When to Use Automating any web platform requiring login/session persistence Scraping structured data from authenticated pages Using multi-agent parallel analysis on scraped content Generating tailored content per-item based on AI analysis Executing browser automation actions (click, type, send) at scale Job hunting, social outreach, e-commerce monitoring, data collection Core Pattern 1. Login & Session Persistence └─ Browser login → Extract cookies → Save to ~/.hermes/credentials/ └─ Subsequent runs: load cookies → validate → refresh if needed 2. Data Scraping └─ Authenticated requests with persisted cookies └─ HTML parsing + API fallback strategy └─ Output structured JSON with delimiters (===JSON_START/END===) 3. Multi-Agent Analysis └─ Delegate each item to subagent with structured prompt └─ Parallel scoring/matching/generation └─ Collect results, filter by threshold 4. Automated Action Execution └─ Generate browser action sequences (navigate, click, type, verify) └─ Agent executes via browser_* tools └─ Rate limiting between actions Prerequisites Resume file at ~/.hermes/credentials/resume.txt (plain text) BOSS account (phone/password or QR code login) Python 3 with requests , beautifulsoup4 installed Workflow (BOSS Zhipin Example) 1. Check/Restore Login └─ Cookie exists? → Valid? → Proceed / Re-login 2. Search Jobs └─ Input job name → Search → Scrape JD list 3. Multi-Agent Match └─ Delegate each JD to subagent → Score 0-100 4. Filter & Rank └─ Sort by score → Keep top N (default 10) 5. Generate Introductions └─ Per JD: analyze requirements → generate tailored intro 6. Send Applications └─ Per target JD: send with generated intro Adaptation Guide To adapt this pattern to another platform: Replace login URL in login.py → target platform login page Replace search endpoint in search.py → target platform search API/HTML Adjust prompt template in match.py → your analysis criteria Adjust generation prompt in generate.py → your output format Adjust selectors in send.py → target platform DOM selectors Step 1: Login & Session First run: python scripts/login.py Opens browser to BOSS login page User completes login manually Saves cookies to ~/.hermes/credentials/boss_cookies.json Subsequent runs: Script loads cookies automatically Validates session with a profile page check If expired, prompts re-login Step 2: Search Jobs Camoufox Mode (PRIMARY — Recommended) Uses Camoufox (C++ level Firefox fingerprint spoofing) to bypass ALL 4 layers of BOSS anti-bot detection. python scripts/search_camoufox.py "产品经理" --city=101010100 --pages=3 Why Camoufox wins: C++ level Canvas/WebGL/Audio/Font fingerprint spoofing (not JS injection) humanize=True: C++ HumanCursor mouse/keyboard/scroll simulation geoip=True: auto timezone/locale from IP BrowserForge: real-world device fingerprint distribution Passes: FingerprintJS, Cloudflare, DataDome, BrowserScan, CreepJS No login cookies required — verified: Code 0 without any cookies Tested result: 普通 Playwright + Cookie → Code 0 (but gets Code 36 after heavy use) Camoufox without Cookie → Code 0 (passes all 4 layers automatically) Legacy: Playwright Mode (Fallback) If Camoufox is not installed, use Playwright with user cookies: python scripts/search_playwright.py "产品经理" 101010100 1 Requires: valid cookies in ~/.agent-browser/auth/boss-zhipin.json Legacy: Chrome CDP Mode (Fallback) Controls user's real Chrome browser via remote debugging port: /Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --remote-debugging-port=9222 --remote-allow-origins= '*' python scripts/search_chrome_cdp.py "产品经理" --city=101010100 --pages=3 Legacy: curl_cffi Mode (HTTP only) TLS fingerprint bypass without browser: python scripts/search_curl_cffi.py "产品经理" --city=101010100 Note: curl_cffi bypasses TLS fingerprint but cannot pass behavior detection (code 37). BOSS renders job cards on <canvas> to prevent DOM scraping. Always use the API ( /wapi/zpgeek/search/joblist.json ) instead of parsing HTML. Output format: [ " https://www.zhipin.com/web/geek/job?query=产品经理&city=101010100&page=1 ", " https://www.zhipin.com/web/geek/job?query=产品经理&city=101010100&page=2 " ] **Agent workflow per URL:** 1. `browser_navigate(url)` — open search page 2. `browser_snapshot(full=true)` — get page HTML 3. Pass HTML to `extract_jobs_from_page()` (built into script) 4. Wait 2-3 seconds between pages **Output format:** ```json [ { "job_id": "123456", "title": "高级产品经理", "company": "某某科技", "salary": "25-40K", "location": "北京·朝阳区", "requirements": ["3-5年经验", "本科", "电商经验"], "jd_text": "负责...", "boss_name": "张先生", "boss_title": "HR" } ] Step 3: Multi-Agent Resume Matching Use delegate_task with parallel subagents. Each subagent receives: One JD (title, requirements, jd_text) Resume content from resume.txt Subagent prompt: You are a professional HR recruiter. Compare this JD against the candidate's resume. JD: {jd_text} Resume: {resume_content} Score 0-100 based on: - Skills match (40%) - Experience relevance (30%) - Education fit (10%) - Industry alignment (20%) Return ONLY JSON: {"score": 85, "reason": "brief explanation"} Parallel execution (max 3 concurrent — batch accordingly): # delegate_task maxes at 3 concurrent children # Batch 10 jobs into 3-4 subagent calls, each scoring 3-4 jobs tasks = [ { "goal" : "Score these 3 jobs" , "context" : f"JDs: {batch1} \nResume: {resume} " , "toolsets" : []}, { "goal" : "Score these 3 jobs" , "context" : f"JDs: {batch2} \nResume: {resume} " , "toolsets" : []}, { "goal" : "Score these 4 jobs" , "context" : f"JDs: {batch3} \nResume: {resume} " , "toolsets" : []}, ] delegate_task(tasks=tasks) Step 4: Filter & Rank Collect all scores, sort descending. Default keep top 10. Step 5: Generate Introduction (Agent-Powered) 不再使用固定模板，也不调外部 API。 招呼语由 Agent 自己根据 JD 和简历的内容直接生成。 Agent 就是 LLM，它读取搜索结果中的 JD 信息和简历内容后，直接写出个性化招呼语。 无需额外的 Python 脚本或 API 配置。 生成规则（Agent 内部遵循） 基于 JD 和简历的实际内容分析 2-3 个匹配亮点（技能/经验/项目） 不使用固定模板，每条消息都独特 语气自然真诚，像在和招聘者对话 不以"您好"千篇一律开头，用更自然的方式切入 体现对该具体公司/岗位的兴趣（从 JD 中提取线索） 控制在 80-150 个中文字符 结尾礼貌表达沟通意愿 Agent 工作流 1. 搜索结果返回后，Agent 读取每个职位的 title、company、requirements、jd_text 2. 读取 resume.txt 3. 对每个职位，Agent 直接生成个性化招呼语（这一步不需要调任何工具） 4. 用 send_camoufox.py <job_id> "招呼语" 发送 Step 6: Send Application Critical: encryptUserId is NOT returned by the search API. You must fetch it from the job detail API: /wapi/zpgeek/job/card.json?encryptJobId={job_id} Or use search_playwright.py which runs inside a browser context where you can call both APIs. python scripts/send_v2.py --job-id=123456 --intro= "生成的介绍" Uses browser automation to open chat Pastes introduction Sends message File Structure boss-auto-job/ SKILL.md # Main docs REVERSE_ENGINEERING.md # BOSS anti-bot reverse engineering report BYPASS_SOLUTION.md # Bypass strategy with GitHub projects scripts/ boss_apply.py # 🎯 One-click pipeline (Camoufox) search_camoufox.py # 🏆 Search via Camoufox (PRIMARY) send_camoufox.py # 🏆 Send via Camoufox (PRIMARY) search_playwright.py # Search via Playwright (legacy) search_chrome_cdp.py # Search via Chrome CDP (legacy) search_curl_cffi.py # Search via curl_cffi (legacy) search_browser.py # Search via browser automation (legacy) search.py # requests-based search (deprecated) match.py # Multi-agent matching orchestrator generate.py # Introduction prompt builder (reference) send_final.py # Message sender (legacy) refresh_cookies.py # Cookie refresh tool login.py # Login helper orchestrator.py # Full pipeline orchestrator Script Priority Priority Script Command Status 🥇 search_camoufox.py python search_camoufox.py "产品经理" ✅ Best stealth 🥇 send_camoufox.py python send_camoufox.py <job_id> "msg" ✅ Best stealth 🥇 boss_apply.py python boss_apply.py "产品经理" --send ✅ One-click 🥈 search_playwright.py python search_playwright.py "产品经理" 101010100 1 ⚠️ Legacy 🥉 search_chrome_cdp.py python search_chrome_cdp.py "产品经理" ⚠️ Legacy Anti-Bot Research Notes Reusable Pattern: AST Deobfuscation + Token Bypass This pattern applies to any web platform using dynamically loaded obfuscated JS for bot detection: Capture the redirect — Note the 302 location and extract parameters (seed, ts, name) Fetch the security JS — security-js/{name}.js (or equivalent endpoint) AST parse to find the encryption entry point — Look for window.ABC or similar global constructor Execute in Node.js VM — Replicate minimal browser environment ( window , document , navigator , location ) Generate the token — Call the exposed method with correct parameters Inject via CDP — Use Network.setCookie to inject into real browser Navigate to target — Bypass complete AST Deobfuscation Results (BOSS Zhipin) BOSS security-check uses dynamically named JS files ( security-js/{hash}.js ) with the following structure: // IIFE pattern, exposes window.ABC ( function ( ) { window . md5 = ... window . s = ... window . ABC = function ( ) { this . z = function ( seed, ts ) { // Complex string manipulation using md5 + timestamp // Returns base64-like encoded string (265 chars) } } })(); Key parameters: seed : Random string from redirect URL (URL-encoded base64) ts : Timestamp from redirect URL name : JS file identifier (e.g., b23b7024 ) offset : new Date().getTimezoneOffset() (China = -480) Formula: parseInt(ts) + 60 * (480 + offset) * 1000 Security check page flow: Browser hits 302 redirect to security-check.html Page creates iframe, loads security-js/{name}.js JS executes, window.ABC becomes available Page calls new ABC().z(seed, adjusted_ts) → generates __zp_stoken__ Sets cookie: __zp_stoken__={token}; domain=.zhipin.com; path=/; expires={now+2304e5} Redirects to callbackUrl Why requests alone fails: Even with correct zp_stoken , BOSS detects non-browser TLS fingerprint and missing browser APIs. The token alone is necessary but not sufficient. Why CDP works: Chrome CDP controls a real browser instance. When we inject the zp_stoken cookie via Network.setCookie , the browser presents a legitimate environment (correct TLS, canvas, WebGL, etc.), passing all checks. API Error Codes Code Meaning Action 0 Success Process job data 37 Environment abnormal Auto-generate zp_stoken (see below) 36 Account flagged User must manually verify in browser, then run refresh_cookies.py 32 Account banned temporarily More severe than 36. Stop all automation. User must manually verify AND send a message in their browser to restore full access. 1006 Rate limited Wait 10s and retry curl_cffi TLS Fingerprint Bypass curl_cffi with impersonate='chrome120' mimics Chrome's TLS/JA3 fingerprint. This alone is enough to pass Layer 2 (environment fingerprinting) — the page loads as 200 instead of 302. However, if the account itself is flagged (code 36), even correct TLS fingerprint won't help. The user must manually verify first. Tested flow: curl_cffi.get(page_url, impersonate='chrome120') → 200 ✅ (not 302) curl_cffi.get(api_url, impersonate='chrome120') → code 36 or 37 If code 37: generate zp_stoken via Node.js VM, inject cookie, retry → code 0 or 36 If code 36: must run refresh_cookies.py for manual verification Cookie Refresh Workflow When cookies are expired or account is flagged (code 36): cd ~/.hermes/skills/productivity/boss-auto-job/scripts python refresh_cookies.py This opens a visible Chromium window with existing cookies loaded. If verification appears, user completes it manually. Script detects successful login, exports updated cookies to ~/.agent-browser/auth/boss-zhipin.json , and validates the API. Cookie source file: ~/.agent-browser/auth/boss-zhipin.json (Playwright CDP format with cookies array containing name , value , domain , path , expires , httpOnly , secure fields) Adapting to Other Platforms To adapt this bypass pattern to another platform: Trigger the security check — Visit a protected page, capture the 302 redirect URL Identify the JS source — Check the redirect page HTML for <script src="..."> tags Fetch and AST parse — Use Node.js esprima or manual regex to find the global constructor