feat(诊断): 用真机复现解出 1ms 成功会话的 collect 明文 —— 归因改写为「cd 槽位序按会话随机」

结论 (已知 #29~#32, 推翻旧 #25/#27 与"collect 逐字节同构"这条否定实验):
  * 同一个 tdc.js URL 每次请求返回不同构建 (4/4 md5 + XTEA 密钥全不同)
  * 同会话同时抓 tdc.js + verify -> 解密出真机 collect 明文 (784B/38 槽, 可打印率 .991)
  * 5 份同日样本 (真机 cap2 / 签到成功-1 / 点选 / login_checkin / 仓库模板) 全部 38 槽、
    同一批取值、同一个 sd, 但槽位序 5/5 互不相同
  * 仓库在用的模板槽位序 == 签到成功-1 那一次; generate_collect_success() 只回填
    轨迹/时间戳/entry_url, 槽位序仍是那一次的

=> 头号可证伪假设 H-LAYOUT: 服务端按"本次会话构建"的槽位表解释 cd, 用别的会话的槽位序
   会被读成自相矛盾的环境 -> 12 (答案错理应是 50/9)。这也解释了为何换 IP / 换遥测后端 /
   换传输指纹 / 换 cookie / 长静默全都无效 —— 它们都不动槽位序。

新增:
  * scripts/analyze_collect_layout.py —— collect 槽位序对比 (复现 #31)
  * tcaptcha/slider_solver.py + test —— 滑块缺口求解 (ZNCC, 真机首轮命中 ret=0)
  * tcaptcha/icon_click_solver.py + test —— 图文点选形状模板求解
  * scripts/bridge_1ms_captcha.py —— 真机桥接三模式 (slider/icon/text) + --probe 题型侦察
  * tools/cdp_eval.js / cdp_click.js / cdp_shot.js / cdp_net_capture.js / cdp_capture.js
  * selftest 纳入 icon_click / slider 两个套件

账本: §一 修正 #25/#27、新增 #29~#32; §三 标注"collect 逐字节同构"否定实验有缺陷;
      §五 重写 12 的归因与下一步 (决定性实验 A + 取槽位表两条路)

tcaptcha/icon_click_solver.py

@@ -0,0 +1,204 @@
+# -*- coding: utf-8 -*-
+"""
+腾讯天御『图标/图文混合点选』求解器 (subcapclass 2408 / 2401 之外的图形点选)
+
+适用题型 (1ms.run aid=195672344 实测，2026-10-11):
+  提示条 `img_index=0` 是 170x50 的**目标原图条**(按点击顺序排列, 例如: "0" + 图标 + "7"),
+  背景图 `img_index=1` 是 672x480 的实景照片, 上面画着若干**纯黑轮廓**的符号
+  (目标 + 干扰项), 部分目标被**旋转/倾斜**。
+
+与 `glyph_solver.TextClickSolver`(汉字点选 2404) 的区别:
+  * 2404: 指令是纯文字 ("请依次点击：本 车 憋"), 背景是**彩色**(橙黄)汉字, 用 HSV 分割 + OCR
+  * 本类: 指令是**图标/数字**, 提示以**图片**给出, 背景符号是**纯黑轮廓**, 且会被旋转
+
+算法 (不重训分类器, 直接利用"提示条给的就是目标原图"这一事实):
+  1. 背景/提示条都按"近黑像素"分割成字形掩膜 (符号是纯黑, 背景是照片)
+  2. 提示条连通域 = 有序目标模板 (按 x 排序)
+  3. 背景连通域 = 候选符号
+  4. 每个目标 vs 每个候选: 二值掩膜归一化(等比缩放到正方形)后做
+     **旋转搜索 + IoU** 相似度 (旋转不变, 正好对付倾斜干扰)
+  5. 用匈牙利/贪心做**一对一**指派, 按提示顺序输出点击坐标
+
+坐标口径: 输出与腾讯 `ans` 相同的**原图坐标系 (672x480)**。
+"""
+from __future__ import annotations
+
+import io
+from dataclasses import dataclass
+from typing import List, Optional, Sequence, Tuple
+
+import cv2
+import numpy as np
+from PIL import Image
+
+# 近黑阈值: 符号是纯黑(<=60), 照片最暗处也远高于此; 用"三通道都暗"避免蓝色天空误检
+DARK_MAX = 95
+MERGE_KERNEL = 5
+MIN_AREA = 80
+MAX_AREA = 9000
+
+
+def _to_bgr(image) -> np.ndarray:
+    if isinstance(image, np.ndarray):
+        return image
+    if isinstance(image, (bytes, bytearray)):
+        arr = np.frombuffer(image, np.uint8)
+        return cv2.imdecode(arr, cv2.IMREAD_COLOR)
+    return cv2.cvtColor(np.asarray(image.convert("RGB")), cv2.COLOR_RGB2BGR)
+
+
+def glyph_mask(bgr: np.ndarray, dark_max: int = DARK_MAX, kernel: int = MERGE_KERNEL,
+               dilate: int = 3) -> np.ndarray:
+    """近黑像素 -> 掩膜 (取三通道最大值, 只有真正的黑色轮廓会通过)。
+
+    kernel>1 时做闭运算合并同一符号的笔画; dilate>0 时再膨胀一点 (分割阶段用)。
+    """
+    mx = bgr.max(axis=2)
+    m = (mx < dark_max).astype(np.uint8) * 255
+    if kernel > 1:
+        m = cv2.morphologyEx(m, cv2.MORPH_CLOSE,
+                             cv2.getStructuringElement(cv2.MORPH_ELLIPSE, (kernel, kernel)))
+    if dilate > 0:
+        m = cv2.dilate(m, cv2.getStructuringElement(cv2.MORPH_ELLIPSE, (dilate, dilate)))
+    return m
+
+
+def components(mask: np.ndarray, min_area: int = MIN_AREA, max_area: int = MAX_AREA) -> List[Tuple[int, int, int, int, int]]:
+    n, lab, stats, _ = cv2.connectedComponentsWithStats(mask)
+    out = []
+    for i in range(1, n):
+        x, y, w, h, a = (int(v) for v in stats[i])
+        if a < min_area or a > max_area:
+            continue
+        if w < 6 or h < 6:
+            continue
+        out.append((x, y, w, h, a))
+    return out
+
+
+def _norm(bgr: np.ndarray, box, size: int = 64) -> np.ndarray:
+    """把 box 内的符号归一化成 size x size 的二值掩膜 (等比居中, 不拉伸)。
+
+    注意: 画布必须用**白色**填充 —— 黑色会被"近黑"掩膜当成字形 (踩过这个坑)。
+    """
+    x, y, w, h, _ = box
+    crop = bgr[y:y + h, x:x + w]
+    s = max(w, h)
+    canvas = np.full((s, s, 3), 255, np.uint8)
+    canvas[(s - h) // 2:(s - h) // 2 + h, (s - w) // 2:(s - w) // 2 + w] = crop
+    small = cv2.resize(canvas, (size, size), interpolation=cv2.INTER_AREA)
+    return glyph_mask(small, dark_max=140, kernel=3, dilate=0) > 127
+
+
+def _rotated(mask: np.ndarray, ang: float, size: int = 64) -> np.ndarray:
+    M = cv2.getRotationMatrix2D((size / 2, size / 2), ang, 1.0)
+    r = cv2.warpAffine(mask.astype(np.uint8) * 255, M, (size, size))
+    return r > 127
+
+
+def _iou(a: np.ndarray, b: np.ndarray) -> float:
+    inter = np.logical_and(a, b).sum()
+    union = np.logical_or(a, b).sum()
+    return float(inter) / float(union) if union else 0.0
+
+
+@dataclass
+class IconClickResult:
+    points: List[Tuple[int, int]]           # 原图坐标 (672x480 口径)
+    scores: List[float]
+    angles: List[float]
+    boxes: List[Tuple[int, int, int, int]]
+    target_count: int
+
+    @property
+    def ok(self) -> bool:
+        return len(self.points) == self.target_count and self.target_count > 0
+
+    @property
+    def min_score(self) -> float:
+        return min(self.scores) if self.scores else 0.0
+
+    def describe(self) -> str:
+        return " ".join("(%d,%d|%.2f@%d°)" % (p[0], p[1], s, a)
+                        for p, s, a in zip(self.points, self.scores, self.angles))
+
+
+class IconClickSolver:
+    """提示图(目标条) + 背景图 -> 有序点击坐标。"""
+
+    def __init__(self, angles: Sequence[float] = tuple(range(-45, 46, 5)),
+                 size: int = 64, min_area: int = MIN_AREA):
+        self.angles = tuple(angles)
+        self.size = size
+        self.min_area = min_area
+
+    def solve(self, bg, prompt) -> IconClickResult:
+        bg_bgr = _to_bgr(bg)
+        pr_bgr = _to_bgr(prompt)
+
+        targets = sorted(components(glyph_mask(pr_bgr), self.min_area), key=lambda b: b[0])
+        cands = components(glyph_mask(bg_bgr), self.min_area)
+        if not targets or not cands:
+            return IconClickResult([], [], [], [], len(targets))
+
+        tm = [_norm(pr_bgr, b, self.size) for b in targets]
+        cm = [_norm(bg_bgr, b, self.size) for b in cands]
+        # 候选旋转缓存
+        rot = [[(a, _rotated(c, a, self.size)) for a in self.angles] for c in cm]
+
+        # 得分矩阵: 每个目标在 (候选, 角度) 上的最大 IoU
+        S = np.zeros((len(tm), len(cm)), np.float32)
+        A = np.zeros((len(tm), len(cm)), np.float32)
+        for ti, t in enumerate(tm):
+            for ci, rs in enumerate(rot):
+                best = (-1.0, 0.0)
+                for ang, r in rs:
+                    v = _iou(t, r)
+                    if v > best[0]:
+                        best = (v, ang)
+                S[ti, ci], A[ti, ci] = best
+
+        # 贪心一对一指派 (按全局得分从高到低)
+        pairs = sorted(((S[i, j], i, j) for i in range(len(tm)) for j in range(len(cm))),
+                       key=lambda x: -x[0])
+        used_t, used_c = set(), set()
+        assign = {}
+        for v, i, j in pairs:
+            if i in used_t or j in used_c:
+                continue
+            used_t.add(i)
+            used_c.add(j)
+            assign[i] = (j, v, A[i, j])
+
+        points, scores, angs, boxes = [], [], [], []
+        for i in range(len(tm)):
+            if i not in assign:
+                continue
+            j, v, ang = assign[i]
+            x, y, w, h, _ = cands[j]
+            points.append((x + w // 2, y + h // 2))
+            scores.append(v)
+            angs.append(ang)
+            boxes.append((x, y, w, h))
+        return IconClickResult(points, scores, angs, boxes, len(tm))
+
+    def annotate(self, bg, result: IconClickResult) -> np.ndarray:
+        """把结果画到背景图上 (自检用)。"""
+        img = _to_bgr(bg).copy()
+        for idx, ((px, py), sc) in enumerate(zip(result.points, result.scores), 1):
+            cv2.circle(img, (px, py), 26, (0, 0, 255), 3)
+            cv2.putText(img, str(idx), (px - 8, py + 8), cv2.FONT_HERSHEY_SIMPLEX,
+                        1.0, (0, 255, 0), 2)
+        return img
+
+
+if __name__ == "__main__":
+    import sys
+    bg = cv2.imread(sys.argv[1] if len(sys.argv) > 1 else "/tmp/1mscap/bg.jpg")
+    pr = cv2.imread(sys.argv[2] if len(sys.argv) > 2 else "/tmp/1mscap/prompt.jpg")
+    s = IconClickSolver()
+    r = s.solve(bg, pr)
+    print("ok=%s points=%s scores=%s angles=%s" % (r.ok, r.points, [round(x, 3) for x in r.scores], r.angles))
+    out = s.annotate(bg, r)
+    cv2.imwrite("/tmp/1mscap/annotated.jpg", out)
+    print("annotated -> /tmp/1mscap/annotated.jpg")

tcaptcha/selftest.py

@@ -14,6 +14,8 @@ ROOT = Path(__file__).resolve().parents[1]
 SUITES = [
     "tcaptcha.tests.test_crypto_core",
     "tcaptcha.tests.test_glyph_solver",
+    "tcaptcha.tests.test_icon_click_solver",
+    "tcaptcha.tests.test_slider_solver",
     "tcaptcha.tests.test_xtea_key",
     "tcaptcha.tests.test_tdc_key",
 ]

tcaptcha/slider_solver.py

@@ -0,0 +1,226 @@
+# -*- coding: utf-8 -*-
+"""
+腾讯天御『滑块拼图』求解器 (drag 型验证, 1ms.run aid=195672344 实测 2026-10-11)
+
+题型结构 (真机 iframe `drag_ele.html` 实测):
+  * 背景图 `img_index=1`: 一张实景照片, 上面画着 **1~2 个缺口** (真缺口 + 干扰缺口)。
+    缺口 = 与拼图块**同形**的挖空, 内部是"同一张图被压暗"的结果, 外沿一圈浅色描边。
+  * 拼图块 `img_index=0`: 一张**精灵图**, 里面同时含拖动柄和拼图块本体。页面用
+    `background-position` / `background-size` 把拼图块那一块裁出来, 显示在滑轨左侧。
+  * 拖动柄(滑轨)与拼图块**同步横移**, 位移 1:1 (见 `har/1ms_dianxuan/PROGRESS.md`)。
+
+为什么不用"轮廓/暗区阈值"直接找缺口:
+  背景照片本身有大量强边缘和暗区, 阈值法的召回/精确率都不够 (实测: 用局部变暗比
+  找缺口会被照片自身的暗部淹没)。但有一个**结构性**事实可以用:
+
+      "拼图块里装的是**未被压暗的原始内容**, 而缺口里装的是**同一块内容被压暗**的结果。"
+
+  于是 ZNCC(拼图块内容, 背景图窗口) 的峰值必然落在**真缺口**上; 干扰缺口内部装的是
+  **别处**的内容, 相关性明显更低。实测区分度 (本仓库 fixture):
+
+      真缺口     0.732
+      干扰缺口   0.551
+      拼图块当前位置 -0.136   (拼图块盖住的是完好的背景, 那里没有洞)
+      其余局部峰值 <= 0.28
+
+坐标口径 (重要):
+  * 输入 `piece_x_image` / `piece_y_image` 是**背景图坐标系**(原始像素, 未经页面缩放);
+  * 输出 `dx_display` 是**页面显示像素**的横向拖动距离, 即 `dx_image * scale`,
+    其中 `scale = 背景图显示宽度 / 背景图原始宽度`。
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import List, Optional, Sequence, Tuple
+
+import cv2
+import numpy as np
+
+# 拼图块精灵图/背景图的 alpha 阈值 (精灵图是 RGBA, 背景是照片)
+DEFAULT_ALPHA_MIN = 128
+# 局部峰值去重半径 (背景图坐标): 同一个峰附近的点算同一个候选
+DEFAULT_NEIGHBOR = 20
+# 纵向搜索范围 (背景图坐标): 允许上下抖 ±N 像素, 吸收取整/描边误差
+DEFAULT_Y_JITTER = 3
+
+
+def _to_bgr(image) -> np.ndarray:
+    """把 bytes / PIL / ndarray 统一成 BGR 三通道 ndarray。"""
+    if isinstance(image, np.ndarray):
+        if image.ndim == 3 and image.shape[2] == 4:
+            return cv2.cvtColor(image, cv2.COLOR_BGRA2BGR)
+        return image
+    if isinstance(image, (bytes, bytearray)):
+        arr = np.frombuffer(image, np.uint8)
+        return cv2.imdecode(arr, cv2.IMREAD_COLOR)
+    return cv2.cvtColor(np.asarray(image.convert("RGB")), cv2.COLOR_RGB2BGR)
+
+
+def sprite_region(bg_position: Sequence[float], bg_size: Sequence[float],
+                  elem_size: Sequence[float], sprite_shape: Sequence[int]) -> Tuple[int, int, int, int]:
+    """把 CSS 的 `background-position` / `background-size` 换算成精灵图里的像素区域。
+
+    参数:
+        bg_position: 元素上的 background-position, 形如 (-70.8333, -247.917) (CSS px)
+        bg_size:     元素上的 background-size, 形如 (345.06, 313.69) (CSS px, 已缩放后的整图)
+        elem_size:   元素的显示尺寸, 形如 (60.7143, 60.7143) (CSS px)
+        sprite_shape: 精灵图原始尺寸 (H, W)
+
+    返回 (x, y, w, h), 即该元素在**精灵图原始像素**里对应的矩形。
+    """
+    sx, sy = float(bg_size[0]), float(bg_size[1])
+    h_sprite, w_sprite = int(sprite_shape[0]), int(sprite_shape[1])
+    kx, ky = w_sprite / sx, h_sprite / sy                    # CSS px -> 精灵图 px
+    x = int(round(-float(bg_position[0]) * kx))
+    y = int(round(-float(bg_position[1]) * ky))
+    w = int(round(float(elem_size[0]) * kx))
+    h = int(round(float(elem_size[1]) * ky))
+    return x, y, w, h
+
+
+def piece_mask(piece, alpha_min: int = DEFAULT_ALPHA_MIN) -> np.ndarray:
+    """从拼图块裁剪图里取**不透明**区域掩膜 (bool)。
+
+    精灵图是 RGBA: 只要 alpha 通道。若调用方给的是三通道图 (例如直接截屏裁的),
+    退化成"排除近白像素" (精灵图的空白处是纯白/全透明)。
+    """
+    arr = np.asarray(piece)
+    if arr.ndim == 3 and arr.shape[2] == 4:
+        return arr[..., 3] > alpha_min
+    bgr = _to_bgr(arr)
+    return bgr.min(axis=2) < 245
+
+
+def zncc_curve(bg_gray: np.ndarray, patch: np.ndarray, mask: np.ndarray,
+               y0: int, y_span: int = DEFAULT_Y_JITTER) -> Tuple[np.ndarray, int]:
+    """在背景图的 y=y0±y_span 行上, 横向逐像素做零均值归一化互相关。
+
+    返回 (curve, best_y)。curve[x] 是"把拼图块左上角放在背景图 (x, best_y)"时的 ZNCC。
+    curve 只在 x ∈ [0, W-w] 上有定义。
+    """
+    h, w = mask.shape
+    H, W = bg_gray.shape
+    if h > H or w > W:
+        raise ValueError(f"拼图块 ({w}x{h}) 比背景图 ({W}x{H}) 还大")
+
+    # 只取掩膜内的像素, 后续每列都按同一批下标取样 -> 可以向量化成一次大矩阵运算
+    idx_y, idx_x = np.nonzero(mask)
+    p = patch[idx_y, idx_x].astype(np.float32)
+    p = p - p.mean()
+    pn = float(np.sqrt((p * p).sum()))
+    if pn <= 1e-6:
+        raise ValueError("拼图块内容方差为 0, 无法做相关")
+
+    xs = np.arange(0, W - w + 1, dtype=np.int32)
+    curve = np.zeros(xs.shape, dtype=np.float32)
+    best_y, best_curve = y0, None
+    for y in range(max(0, y0 - y_span), min(H - h, y0 + y_span) + 1):
+        # 一次性把所有候选窗口的掩膜内像素取成 (len(xs), len(idx)) 矩阵
+        base = bg_gray[y + idx_y]                      # (N, W)
+        cols = xs[:, None] + idx_x[None, :]            # (X, N)
+        q = base[np.arange(base.shape[0])[None, :], cols]  # (X, N)
+        q = q.astype(np.float32)
+        q = q - q.mean(axis=1, keepdims=True)
+        denom = np.sqrt((q * q).sum(axis=1)) * pn
+        cur = np.where(denom > 1e-6, (q * p[None, :]).sum(axis=1) / np.maximum(denom, 1e-9), 0.0)
+        if best_curve is None or cur.max() > best_curve.max():
+            best_y, best_curve = y, cur
+    curve = best_curve if best_curve is not None else curve
+    return curve.astype(np.float64), best_y
+
+
+def _peaks(curve: np.ndarray, neighbor: int, limit: int = 5) -> List[Tuple[int, float]]:
+    """按分数从高到低取**互不相邻**(间距 > neighbor) 的局部峰值。"""
+    order = np.argsort(-curve)
+    picked: List[Tuple[int, float]] = []
+    for x in order:
+        xi = int(x)
+        if all(abs(xi - p[0]) > neighbor for p in picked):
+            picked.append((xi, float(curve[xi])))
+        if len(picked) >= limit:
+            break
+    return picked
+
+
+@dataclass
+class SliderResult:
+    """滑块求解结果。坐标均为**背景图原始像素**, 除 dx_display 外。"""
+    ok: bool
+    dx_image: float
+    dx_display: float
+    score: float
+    runner_up: float
+    margin: float
+    piece_x_image: float
+    target_x_image: float
+    scale: float
+    y_image: int = 0
+    candidates: List[Tuple[int, float]] = field(default_factory=list)
+
+    def describe(self) -> str:
+        return (f"dx_image={self.dx_image:.1f} dx_display={self.dx_display:.1f}px "
+                f"score={self.score:.3f} runner_up={self.runner_up:.3f} margin={self.margin:.3f} "
+                f"cands={[(x, round(s, 3)) for x, s in self.candidates]}")
+
+
+class SliderSolver:
+    """滑块缺口求解器 (需权重为 0: 纯几何 + 相关, 不需要训练/模型文件)。"""
+
+    def __init__(self, min_score: float = 0.45, min_margin: float = 0.08,
+                 neighbor: int = DEFAULT_NEIGHBOR, alpha_min: int = DEFAULT_ALPHA_MIN,
+                 y_jitter: int = DEFAULT_Y_JITTER) -> None:
+        self.min_score = float(min_score)
+        self.min_margin = float(min_margin)
+        self.neighbor = int(neighbor)
+        self.alpha_min = int(alpha_min)
+        self.y_jitter = int(y_jitter)
+
+    def solve(self, bg, piece, piece_x_image: float, scale: float = 1.0,
+              piece_y_image: Optional[float] = None) -> SliderResult:
+        """求拖动距离。
+
+        bg            背景图 (含缺口; 对应 `img_index=1`)
+        piece         拼图块裁剪图 (RGBA 精灵图里裁出来的那一块; 对应 `img_index=0`)
+        piece_x_image 拼图块裁剪图左边缘在背景图坐标系里的 x
+        scale         背景图显示宽度 / 背景图原始宽度 (页面缩放系数)
+        piece_y_image 拼图块裁剪图上边缘在背景图坐标系里的 y (缺省 0)
+        """
+        bg_bgr = _to_bgr(bg)
+        bg_gray = bg_bgr.mean(axis=2).astype(np.float32)
+        cand = np.asarray(piece)
+        patch = _to_bgr(cand).mean(axis=2).astype(np.float32)
+        mask = piece_mask(cand, self.alpha_min)
+        if mask.sum() < 50:
+            return SliderResult(False, 0.0, 0.0, 0.0, 0.0, 0.0,
+                                float(piece_x_image), float(piece_x_image), float(scale))
+
+        y0 = int(round(piece_y_image or 0))
+        curve, best_y = zncc_curve(bg_gray, patch, mask, y0, self.y_jitter)
+        peaks = _peaks(curve, self.neighbor)
+        if not peaks:
+            return SliderResult(False, 0.0, 0.0, 0.0, 0.0, 0.0,
+                                float(piece_x_image), float(piece_x_image), float(scale), best_y)
+
+        best_x, best_s = peaks[0]
+        runs = peaks[1][1] if len(peaks) > 1 else 0.0
+        margin = best_s - runs
+        dx_image = float(best_x) - float(piece_x_image)
+        ok = bool(best_s >= self.min_score and margin >= self.min_margin)
+        return SliderResult(ok=ok, dx_image=dx_image, dx_display=dx_image * float(scale),
+                            score=best_s, runner_up=runs, margin=margin,
+                            piece_x_image=float(piece_x_image),
+                            target_x_image=float(best_x), scale=float(scale),
+                            y_image=best_y, candidates=peaks)
+
+    # --- 调试辅助 -------------------------------------------------------
+    @staticmethod
+    def annotate(bg, result: SliderResult, piece_w: int, piece_h: int) -> np.ndarray:
+        """在背景图上标出"拼图块当前位置"与"目标位置", 用于人工核对。"""
+        img = _to_bgr(bg).copy()
+        px, py = int(round(result.piece_x_image)), int(result.y_image)
+        tx = int(round(result.target_x_image))
+        cv2.rectangle(img, (px, py), (px + piece_w, py + piece_h), (0, 255, 0), 2)
+        cv2.rectangle(img, (tx, py), (tx + piece_w, py + piece_h), (0, 0, 255), 2)
+        cv2.arrowedLine(img, (px + piece_w // 2, py + piece_h + 14),
+                        (tx + piece_w // 2, py + piece_h + 14), (255, 255, 0), 2, tipLength=0.25)
+        return img

tcaptcha/tests/test_icon_click_solver.py

@@ -0,0 +1,73 @@
+# -*- coding: utf-8 -*-
+"""
+图标/图文点选求解器 回归测试 (AGENTS.md §5.9)
+
+固化的性质:
+  1. 提示条(目标原图) -> 背景图 的**形状模板匹配**在真机样本上给出正确、有序的点击点;
+  2. 能处理**旋转**目标 (样本里"图表"图标被倾斜 ~-30°);
+  3. 能排除干扰图标 (样本里的笑脸/银行).
+
+样本: tcaptcha/tests/fixtures/1ms_icon_click_1_{prompt,bg}.jpg
+      取自 1ms.run (aid=195672344) 真机页面上弹出的验证码 (2026-10-11),
+      题面 = "0" + 图表图标 + "7", 期望点击顺序与坐标见 EXPECTED。
+
+运行:
+    .venv/bin/python -m tcaptcha.tests.test_icon_click_solver
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import cv2
+
+ROOT = Path(__file__).resolve().parents[2]
+if str(ROOT) not in sys.path:
+    sys.path.insert(0, str(ROOT))
+
+from tcaptcha.icon_click_solver import IconClickSolver  # noqa: E402
+
+FIX = ROOT / "tcaptcha" / "tests" / "fixtures"
+# 期望点击顺序: ("0" 右下) -> (倾斜的图表图标 左上) -> ("7" 中上)，坐标是 672x480 原图口径
+EXPECTED = [(520, 440), (200, 40), (360, 120)]
+TOL = 12          # 允许的像素误差 (连通域中心 vs 目视中心)
+
+_fails: list = []
+
+
+def check(name: str, cond: bool, detail: str = "") -> None:
+    print(f"  [{'PASS' if cond else 'FAIL'}] {name}" + (f"  {detail}" if detail else ""))
+    if not cond:
+        _fails.append(name)
+
+
+def main() -> int:
+    pr = cv2.imread(str(FIX / "1ms_icon_click_1_prompt.jpg"))
+    bg = cv2.imread(str(FIX / "1ms_icon_click_1_bg.jpg"))
+    check("fixture 可读", pr is not None and bg is not None)
+
+    print("1) 求解")
+    res = IconClickSolver().solve(bg, pr)
+    check("目标数=3", res.target_count == 3, str(res.target_count))
+    check("求解成功", res.ok, res.describe())
+
+    print("2) 点击顺序与坐标")
+    for i, (exp, got) in enumerate(zip(EXPECTED, res.points)):
+        dx, dy = abs(exp[0] - got[0]), abs(exp[1] - got[1])
+        check(f"第{i+1}个点 ~{exp}", dx <= TOL and dy <= TOL,
+              f"got={got} (Δ={dx},{dy}) score={res.scores[i]:.3f}")
+
+    print("3) 旋转与干扰项")
+    check("命中倾斜图标 (角度非 0)", any(abs(a) >= 10 for a in res.angles), str(res.angles))
+    check("所有匹配分数 > 0.45", res.min_score > 0.45, f"min={res.min_score:.3f}")
+
+    print()
+    if _fails:
+        print(f"❌ test_icon_click_solver 失败 {len(_fails)} 项: {_fails}")
+        return 1
+    print("✅ test_icon_click_solver 全部通过")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

tcaptcha/tests/test_slider_solver.py

@@ -0,0 +1,115 @@
+# -*- coding: utf-8 -*-
+"""
+滑块拼图求解器 回归测试 (AGENTS.md §5.9)
+
+固化的性质 (样本取自 1ms.run aid=195672344 真机页面 2026-10-11 的滑块验证码):
+  1. `sprite_region` 能把 CSS 的 background-position/size 正确换算成精灵图像素区域;
+  2. ZNCC 峰值落在**真缺口**上, 而不是干扰缺口, 也不是拼图块当前位置;
+  3. 通过 y 方向小抖动吸收取整误差, 结果稳定;
+  4. `ok` 的判定 (分数 + 与次峰间距) 在该样本上成立。
+
+样本: tcaptcha/tests/fixtures/1ms_slider_1_{bg.jpg,sprite.png}
+      bg     = 页面 `img_index=1` 的背景图 (672x390, 含真缺口 + 干扰缺口)
+      sprite = 页面 `img_index=0` 的精灵图 (682x620, 含拖动柄 + 拼图块)
+
+DOM 实测口径 (drag_ele.html iframe 内):
+      slideBg       rect=(10, 68.78)  显示 340 x 242.857  -> scale = 340/672 = 0.50595238
+      拼图块元素     rect=(35.2976, 133.53)  显示 60.7143 x 60.7143
+                    background-position: -70.8333px -247.917px
+                    background-size:     345.06px 313.69px
+      => 拼图块裁剪图在背景图坐标系里的左上角 = (50.0, 127.97)
+
+运行:
+    .venv/bin/python -m tcaptcha.tests.test_slider_solver
+"""
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+import cv2
+
+ROOT = Path(__file__).resolve().parents[2]
+if str(ROOT) not in sys.path:
+    sys.path.insert(0, str(ROOT))
+
+from tcaptcha.slider_solver import SliderSolver, piece_mask, sprite_region  # noqa: E402
+
+FIX = ROOT / "tcaptcha" / "tests" / "fixtures"
+
+# 真机 DOM 口径
+BG_POS = (-70.8333, -247.917)
+BG_SIZE = (345.06, 313.69)
+ELEM_SIZE = (60.7143, 60.7143)
+SLIDE_W = 340.0
+BG_NATURAL_W = 672.0
+SCALE = SLIDE_W / BG_NATURAL_W          # 0.50595238
+PIECE_X_IMAGE = 50.0
+PIECE_Y_IMAGE = 128.0
+
+EXPECTED_DX_IMAGE = 293.0               # 真缺口 x - 拼图块 x
+EXPECTED_DECOY_X = 489                  # 干扰缺口在背景图坐标里的 x
+
+_fails: list = []
+
+
+def check(name: str, cond: bool, detail: str = "") -> None:
+    print(f"  [{'PASS' if cond else 'FAIL'}] {name}" + (f"  {detail}" if detail else ""))
+    if not cond:
+        _fails.append(name)
+
+
+def main() -> int:
+    bg = cv2.imread(str(FIX / "1ms_slider_1_bg.jpg"))
+    sprite = cv2.imread(str(FIX / "1ms_slider_1_sprite.png"), cv2.IMREAD_UNCHANGED)
+    if bg is None or sprite is None:
+        print("缺少 fixture, 请确认 tcaptcha/tests/fixtures/1ms_slider_1_* 存在")
+        return 1
+    print(f"bg={bg.shape} sprite={sprite.shape}")
+
+    print("\n[1] 精灵图区域换算")
+    x, y, w, h = sprite_region(BG_POS, BG_SIZE, ELEM_SIZE, sprite.shape[:2])
+    check("sprite_region == (140, 490, 120, 120)", (x, y, w, h) == (140, 490, 120, 120), f"got={(x, y, w, h)}")
+
+    crop = sprite[y:y + h, x:x + w]
+    mask = piece_mask(crop)
+    check("拼图块掩膜非空且不过分满", 500 < int(mask.sum()) < w * h * 0.9,
+          f"mask={int(mask.sum())}/{w * h}")
+
+    print("\n[2] 缺口定位 (ZNCC)")
+    res = SliderSolver().solve(bg, crop, piece_x_image=PIECE_X_IMAGE, scale=SCALE,
+                               piece_y_image=PIECE_Y_IMAGE)
+    print(f"      {res.describe()}")
+    check("ok", res.ok)
+    check("分数 >= 0.65", res.score >= 0.65, f"score={res.score:.3f}")
+    check("与次峰间距 >= 0.15", res.margin >= 0.15, f"margin={res.margin:.3f}")
+    check("落在真缺口 (误差 <= 4 背景像素)", abs(res.target_x_image - (PIECE_X_IMAGE + EXPECTED_DX_IMAGE)) <= 4,
+          f"target_x={res.target_x_image}")
+
+    print("\n[3] 干扰缺口没有被选中")
+    decoy = [x0 for x0, _ in res.candidates if abs(x0 - EXPECTED_DECOY_X) <= 6]
+    check("次峰就是干扰缺口", bool(decoy), f"candidates={res.candidates}")
+    check("真缺口分数严格高于干扰缺口", res.score > res.runner_up + 0.1,
+          f"{res.score:.3f} vs {res.runner_up:.3f}")
+
+    print("\n[4] 显示坐标换算")
+    check("dx_display == dx_image * scale",
+          abs(res.dx_display - res.dx_image * SCALE) < 1e-6,
+          f"{res.dx_display:.2f} == {res.dx_image:.2f} * {SCALE:.6f}")
+    check("dx_display 落在 [140, 160]", 140 <= res.dx_display <= 160, f"{res.dx_display:.2f}")
+
+    print("\n[5] 拼图块当前位置不是答案 (那里没有洞)")
+    near_piece = [s for x0, s in res.candidates if abs(x0 - PIECE_X_IMAGE) <= 8]
+    check("拼图块自身位置的分数很低", all(s < 0.3 for s in near_piece),
+          f"{near_piece}")
+
+    print(f"\n{'=' * 62}")
+    if _fails:
+        print(f"❌ slider_solver 测试失败: {_fails}")
+        return 1
+    print("✅ slider_solver 测试全部通过")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())