zevairouter 1.0.127 → 1.0.128

package/src/lib/oauth/services/grokXaiEmailAutomation.js

@@ -1,846 +0,0 @@
-/**
- * xAI email signup / login automation for Grok CLI device-code flow.
- * Proven with CloakBrowser (Turnstile) + tempmail.zevai.web.id OTP.
- */
-
-import { pollTempmailXaiOtp } from "./tempmailClient.js";
-
-function wait(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-async function pageText(page) {
-  return page.evaluate(() => document.body?.innerText || "").catch(() => "");
-}
-
-async function clickFirst(page, selectors, { timeout = 3_000 } = {}) {
-  for (const selector of selectors) {
-    try {
-      const loc = page.locator(selector).first();
-      if (await loc.isVisible({ timeout: 400 }).catch(() => false)) {
-        await loc.click({ timeout });
-        return selector;
-      }
-    } catch {
-      // next
-    }
-  }
-  return null;
-}
-
-async function dismissCookies(page) {
-  return clickFirst(page, [
-    "#onetrust-accept-btn-handler",
-    "#onetrust-reject-all-handler",
-    'button:has-text("Accept All Cookies")',
-    'button:has-text("Reject All")',
-  ]);
-}
-
-async function typeSlow(locator, value, delay = 35) {
-  await locator.click();
-  await locator.fill("").catch(() => null);
-  await locator.type(value, { delay });
-}
-
-async function readTurnstileToken(page) {
-  return page.evaluate(() => {
-    const pick = (root) => {
-      const el = root.querySelector?.(
-        "input[name=cf-turnstile-response], textarea[name=cf-turnstile-response], [name=cf-turnstile-response]"
-      );
-      const v = el ? String(el.value || "") : "";
-      return v.length > 20 ? v : "";
-    };
-    let v = pick(document);
-    if (v) return v;
-    // Some widgets stash token in response fields after success
-    for (const el of document.querySelectorAll("[data-sitekey], .cf-turnstile, #cf-turnstile")) {
-      const input = el.querySelector?.("input, textarea");
-      if (input?.value && String(input.value).length > 20) return String(input.value);
-    }
-    return "";
-  }).catch(() => "");
-}
-
-/**
- * Nudge Turnstile the way a human would: scroll into view, move mouse, click
- * the widget / checkbox iframe. CloakBrowser humanize alone is not enough if
- * the checkbox never receives a real click.
- */
-async function interactWithTurnstile(page) {
-  // Scroll any turnstile host into view
-  await page.evaluate(() => {
-    const host = document.querySelector(
-      ".cf-turnstile, [data-sitekey], iframe[src*='turnstile'], iframe[src*='challenges.cloudflare']"
-    );
-    host?.scrollIntoView?.({ block: "center", behavior: "instant" });
-  }).catch(() => null);
-
-  // Prefer clicking the visible iframe box on the main page (Playwright hit-test)
-  const iframeLocators = [
-    'iframe[src*="challenges.cloudflare.com"]',
-    'iframe[src*="turnstile"]',
-    ".cf-turnstile iframe",
-    "iframe[title*='Widget']",
-    "iframe[title*='Cloudflare']",
-  ];
-  for (const sel of iframeLocators) {
-    try {
-      const loc = page.locator(sel).first();
-      if (!(await loc.isVisible({ timeout: 400 }).catch(() => false))) continue;
-      const box = await loc.boundingBox().catch(() => null);
-      if (box && box.width > 10 && box.height > 10) {
-        // Human-ish approach: move near, then click center-left (checkbox side)
-        const x = box.x + Math.min(30, box.width * 0.2);
-        const y = box.y + box.height / 2;
-        await page.mouse.move(x - 40, y - 20, { steps: 8 }).catch(() => null);
-        await wait(120 + Math.floor(Math.random() * 180));
-        await page.mouse.move(x, y, { steps: 6 }).catch(() => null);
-        await wait(80 + Math.floor(Math.random() * 120));
-        await page.mouse.click(x, y).catch(() => null);
-        return "iframe-box";
-      }
-      await loc.click({ timeout: 1_500, force: true }).catch(() => null);
-      return "iframe-click";
-    } catch {
-      // next selector
-    }
-  }
-
-  // Frame-level checkbox (managed challenge)
-  try {
-    for (const frame of page.frames()) {
-      const url = frame.url() || "";
-      if (!/turnstile|challenges\.cloudflare/i.test(url)) continue;
-      const checkbox = frame.locator(
-        "input[type=checkbox], #challenge-stage input, .ctp-checkbox-label, label"
-      ).first();
-      if (await checkbox.isVisible({ timeout: 500 }).catch(() => false)) {
-        await checkbox.click({ timeout: 1_500 }).catch(() => null);
-        return "frame-checkbox";
-      }
-      await frame.locator("body").click({ timeout: 800, position: { x: 24, y: 24 } }).catch(() => null);
-      return "frame-body";
-    }
-  } catch {
-    // ignore
-  }
-
-  // Idle human noise — small mouse jitter helps some managed challenges
-  try {
-    const vp = page.viewportSize() || { width: 1280, height: 900 };
-    await page.mouse.move(
-      80 + Math.floor(Math.random() * (vp.width - 160)),
-      80 + Math.floor(Math.random() * (vp.height - 160)),
-      { steps: 5 }
-    );
-  } catch {
-    // ignore
-  }
-  return null;
-}
-
-/**
- * Wait until Cloudflare Turnstile populates cf-turnstile-response.
- * Actively interacts with the widget (not passive poll-only).
- */
-export async function waitForTurnstile(page, { timeoutMs = 120_000, onStep, label = "Turnstile" } = {}) {
-  const start = Date.now();
-  let lastInteractAt = 0;
-  let interactCount = 0;
-  let sawWidget = false;
-
-  onStep?.("turnstile_wait", `Waiting for Cloudflare ${label} (auto-click widget)`);
-
-  while (Date.now() - start < timeoutMs) {
-    const val = await readTurnstileToken(page);
-    if (val) {
-      onStep?.("turnstile_ok", `Cloudflare ${label} solved (${val.length} chars)`);
-      return { ok: true, length: val.length };
-    }
-
-    // Detect widget presence for better logs
-    if (!sawWidget) {
-      sawWidget = await page.evaluate(() => {
-        return !!(
-          document.querySelector(".cf-turnstile, [data-sitekey], iframe[src*='turnstile'], iframe[src*='challenges.cloudflare']")
-          || [...document.querySelectorAll("iframe")].some((f) => /turnstile|cloudflare/i.test(f.src || ""))
-        );
-      }).catch(() => false);
-      if (sawWidget) {
-        onStep?.("turnstile_widget", "Turnstile widget detected — interacting");
-      }
-    }
-
-    // Interact every ~2.5s (not every loop) so we don't spam-click
-    const now = Date.now();
-    if (now - lastInteractAt > 2_500) {
-      lastInteractAt = now;
-      interactCount += 1;
-      const how = await interactWithTurnstile(page);
-      if (how && interactCount <= 6) {
-        onStep?.("turnstile_click", `Turnstile interact #${interactCount} (${how})`);
-      }
-    }
-
-    await wait(900 + Math.floor(Math.random() * 400));
-  }
-
-  const final = await readTurnstileToken(page);
-  if (final) {
-    onStep?.("turnstile_ok", `Cloudflare ${label} solved late (${final.length} chars)`);
-    return { ok: true, length: final.length };
-  }
-
-  onStep?.(
-    "turnstile_timeout",
-    `Turnstile did not produce a token in ${Math.round(timeoutMs / 1000)}s (widget=${sawWidget ? "seen" : "missing"}, clicks=${interactCount})`
-  );
-  return { ok: false, sawWidget, interactCount };
-}
-
-/**
- * Wait for Turnstile with one automatic retry (reload widget / re-click).
- * Only then should callers surface needs_manual.
- */
-export async function waitForTurnstileWithRetry(page, { timeoutMs = 90_000, onStep } = {}) {
-  let result = await waitForTurnstile(page, { timeoutMs, onStep, label: "Turnstile" });
-  if (result.ok) return result;
-
-  onStep?.("turnstile_retry", "First Turnstile wait failed — soft refresh + retry");
-  // Soft nudge: re-focus page and re-run widget (xAI often remounts on activity)
-  try {
-    await page.mouse.wheel(0, 120);
-    await wait(400);
-    await page.mouse.wheel(0, -120);
-    await wait(600);
-    // If site exposes turnstile reset
-    await page.evaluate(() => {
-      try {
-        if (window.turnstile?.reset) window.turnstile.reset();
-      } catch { /* ignore */ }
-    }).catch(() => null);
-  } catch {
-    // ignore
-  }
-
-  result = await waitForTurnstile(page, {
-    timeoutMs: Math.max(60_000, Math.floor(timeoutMs * 0.75)),
-    onStep,
-    label: "Turnstile (retry)",
-  });
-  return result;
-}
-
-/**
- * Full xAI email signup using tempmail OTP.
- */
-export async function runXaiEmailSignup(page, {
-  email,
-  password,
-  firstName,
-  lastName,
-  pollOtp = pollTempmailXaiOtp,
-  onStep,
-} = {}) {
-  // Callers should pass random names; keep mild defaults only as last resort.
-  if (!firstName || !lastName) {
-    const { generateRandomPersonName } = await import("./tempmailClient.js");
-    const n = generateRandomPersonName();
-    firstName = firstName || n.firstName;
-    lastName = lastName || n.lastName;
-  }
-  const report = (step, message) => onStep?.(step, message);
-
-  report("opening_signup", "Opening xAI email sign-up");
-  await page.goto("https://accounts.x.ai/sign-up", { waitUntil: "domcontentloaded", timeout: 60_000 });
-  await wait(1_200);
-  await dismissCookies(page);
-
-  if (await page.getByRole("button", { name: /Sign up with email/i }).count()) {
-    await page.getByRole("button", { name: /Sign up with email/i }).click();
-    await wait(800);
-    report("signup_with_email", "Selected Sign up with email");
-  }
-
-  await page.waitForSelector("input[type=email], input[name=email]", { timeout: 15_000 });
-  await typeSlow(page.locator("input[type=email], input[name=email]").first(), email, 40);
-  await clickFirst(page, ['button:has-text("Sign up")', 'button:has-text("Sign Up")']);
-  report("submitted_email", `Submitted sign-up email ${email}`);
-  await wait(2_500);
-  await dismissCookies(page);
-
-  // Fail fast if xAI rejected the address / blocked the session before OTP is sent.
-  {
-    const early = await pageText(page);
-    if (/already (have an account|exists|registered)|try a different email|invalid email|not available|something went wrong|access denied|blocked/i.test(early)
-      && !/confirmation code|security code|Verify your email|one.?time/i.test(early)) {
-      return {
-        status: "failed",
-        step: "signup_rejected",
-        error: `xAI rejected sign-up before OTP (page: ${early.slice(0, 160).replace(/\s+/g, " ")})`,
-      };
-    }
-  }
-
-  // Wait until code field / OTP copy appears (proxy latency) before heavy polling.
-  for (let i = 0; i < 20; i++) {
-    const hasCode = await page.locator("input[name=code], input[autocomplete=one-time-code]").first().isVisible().catch(() => false);
-    const t = await pageText(page);
-    if (hasCode || /confirmation code|security code|Verify your email|one.?time|enter (the )?code/i.test(t)) break;
-    await wait(500);
-  }
-
-  report("polling_otp", "Polling tempmail for xAI confirmation code (direct, not via browser proxy)");
-  let otp = null;
-  try {
-    otp = await pollOtp(email, {
-      timeoutMs: 180_000,
-      intervalMs: 3_000,
-      onProgress: (info) => {
-        if (info.error) {
-          report(
-            "polling_otp",
-            `Tempmail inbox error (${info.elapsedSec}s): ${info.error}`
-          );
-          return;
-        }
-        if (info.inboxCount === 0) {
-          report(
-            "polling_otp",
-            `Waiting for xAI mail… ${info.elapsedSec}s (inbox empty — proxy only affects browser; mail is polled direct)`
-          );
-        } else {
-          report(
-            "polling_otp",
-            `Inbox ${info.inboxCount} mail(s) @${info.elapsedSec}s; subjects: ${(info.subjects || []).join(" | ") || "—"}`
-          );
-        }
-      },
-    });
-  } catch (error) {
-    return {
-      status: "failed",
-      step: "otp_timeout",
-      error: error.message || "Tempmail OTP poll failed",
-    };
-  }
-  if (!otp?.code) {
-    return {
-      status: "failed",
-      step: "otp_timeout",
-      error: "No xAI OTP on tempmail after 180s (email may not have been sent — try another residential proxy or check page for blocks)",
-    };
-  }
-  report("otp_received", `OTP ${otp.code} from ${otp.subject || "tempmail"}`);
-
-  const codeInput = page.locator("input[name=code]");
-  if (await codeInput.isVisible().catch(() => false)) {
-    await typeSlow(codeInput, otp.code, 80);
-    await wait(1_200);
-  }
-
-  // Typing OTP often auto-advances; otherwise Confirm email
-  let text = await pageText(page);
-  if (!/Complete your sign up/i.test(text)) {
-    await clickFirst(page, ['button:has-text("Confirm email")']);
-    await wait(2_000);
-  }
-
-  for (let i = 0; i < 20; i++) {
-    text = await pageText(page);
-    if (/Complete your sign up/i.test(text) || await page.locator("input[name=givenName]").count()) break;
-    await wait(500);
-  }
-
-  if (!await page.locator("input[name=givenName]").first().isVisible().catch(() => false)) {
-    return { status: "failed", step: "profile_form_missing", error: "xAI profile form (givenName) not shown after OTP" };
-  }
-
-  report("filling_profile", "Filling name + password");
-  await typeSlow(page.locator("input[name=givenName]").first(), firstName, 35);
-  await typeSlow(page.locator("input[name=familyName]").first(), lastName, 35);
-  await typeSlow(page.locator("input[name=password], input[type=password]").first(), password, 35);
-  // Let Turnstile mount after password focus (proxy latency)
-  await wait(1_500);
-
-  let turnstile = await waitForTurnstileWithRetry(page, { timeoutMs: 90_000, onStep });
-  if (!turnstile.ok) {
-    // Last attempt: wait longer once more before admitting defeat
-    onStep?.("turnstile_last_try", "Final Turnstile wait (120s)");
-    turnstile = await waitForTurnstile(page, { timeoutMs: 120_000, onStep, label: "Turnstile (final)" });
-  }
-  if (!turnstile.ok) {
-    return {
-      status: "needs_manual",
-      step: "turnstile",
-      error:
-        "Cloudflare Turnstile did not solve after auto-clicks + retries. " +
-        "Ensure CloakBrowser headed + Xvfb on VPS, residential proxy with geoip, concurrency 1.",
-    };
-  }
-
-  await clickFirst(page, ['button:has-text("Complete sign up")']);
-  report("completing_signup", "Clicked Complete sign up");
-  await wait(4_000);
-
-  // Retry if still on form but turnstile refreshed after submit
-  text = await pageText(page);
-  if (/Complete your sign up/i.test(text)) {
-    report("completing_signup_retry", "Still on profile form — re-solving Turnstile");
-    await waitForTurnstileWithRetry(page, { timeoutMs: 75_000, onStep });
-    await clickFirst(page, ['button:has-text("Complete sign up")']);
-    await wait(4_000);
-    text = await pageText(page);
-  }
-
-  const url = page.url();
-  const ok =
-    (!/Complete your sign up|Verify your email|You must provide/i.test(text) && !/\/sign-up/i.test(url))
-    || /\/account/i.test(url)
-    || /Welcome/i.test(text);
-
-  if (!ok) {
-    return {
-      status: "failed",
-      step: "signup_incomplete",
-      error: "xAI sign-up did not complete after profile submit",
-      url,
-      text: text.slice(0, 300),
-    };
-  }
-
-  report("signup_ok", `Account ready: ${email}`);
-  return { status: "success", email, password, url };
-}
-
-async function clickRoleButton(page, nameRe) {
-  try {
-    const btn = page.getByRole("button", { name: nameRe }).first();
-    if (await btn.isVisible({ timeout: 600 }).catch(() => false)) {
-      await btn.click({ timeout: 4_000 });
-      return true;
-    }
-  } catch {
-    /* next */
-  }
-  return false;
-}
-
-/** Aggressive consent / continue clicks for xAI device pages. */
-async function clickDeviceAuthorizeControls(page) {
-  // Prefer role-based names (more reliable than CSS text on SPA)
-  const roles = [
-    /^(Allow|Authorize|Approve|Confirm|Yes|Accept)$/i,
-    /Allow|Authorize|Approve|Confirm/i,
-    /^Continue$/i,
-    /Continue/i,
-    /^Next$/i,
-    /Sign in|Log in|Login/i,
-  ];
-  for (const re of roles) {
-    if (await clickRoleButton(page, re)) return true;
-  }
-
-  // Links styled as buttons
-  try {
-    const link = page.getByRole("link", { name: /Allow|Authorize|Continue|Confirm/i }).first();
-    if (await link.isVisible({ timeout: 400 }).catch(() => false)) {
-      await link.click({ timeout: 3_000 });
-      return true;
-    }
-  } catch {
-    /* ignore */
-  }
-
-  return Boolean(
-    await clickFirst(page, [
-      'button:has-text("Allow")',
-      'button:has-text("Authorize")',
-      'button:has-text("Approve")',
-      'button:has-text("Confirm")',
-      'button:has-text("Continue")',
-      'button:has-text("Next")',
-      'button[type=submit]',
-      'input[type=submit]',
-    ])
-  );
-}
-
-async function ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp }) {
-  const report = (step, message) => onStep?.(step, message);
-
-  if (await page.getByRole("button", { name: /Login with email/i }).count()) {
-    await page.getByRole("button", { name: /Login with email/i }).click().catch(() => null);
-    await wait(800);
-  }
-
-  if (await page.locator("input[type=email]").first().isVisible().catch(() => false)) {
-    report("device_login_email", "Entering email on device page");
-    await typeSlow(page.locator("input[type=email]").first(), email, 40);
-    await clickDeviceAuthorizeControls(page);
-    await wait(1_200);
-  }
-  if (await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
-    report("device_login_password", "Entering password on device page");
-    await typeSlow(page.locator("input[type=password]").first(), password, 40);
-    await waitForTurnstileWithRetry(page, { timeoutMs: 75_000, onStep });
-    await clickFirst(page, ['button:has-text("Login")', 'button:has-text("Log in")', 'button[type=submit]']);
-    await wait(2_500);
-  }
-
-  let text = await pageText(page);
-  if (/security code|Verify your email|one time|confirmation code/i.test(text)) {
-    report("login_otp", "Login requires OTP — polling tempmail (direct)");
-    let otp = null;
-    try {
-      otp = await pollOtp(email, {
-        timeoutMs: 120_000,
-        intervalMs: 3_000,
-        onProgress: (info) => {
-          if (info.inboxCount === 0) {
-            report("login_otp", `Waiting OTP… ${info.elapsedSec}s (inbox empty)`);
-          } else if (info.inboxCount > 0) {
-            report("login_otp", `Inbox ${info.inboxCount} @${info.elapsedSec}s: ${(info.subjects || []).join(" | ")}`);
-          } else if (info.error) {
-            report("login_otp", `Tempmail error: ${info.error}`);
-          }
-        },
-      });
-    } catch {
-      otp = null;
-    }
-    if (otp?.code) {
-      const codeInput = page.locator("input[name=code], input[autocomplete=one-time-code], input[type=text]").first();
-      if (await codeInput.isVisible().catch(() => false)) {
-        await typeSlow(codeInput, otp.code, 80);
-      }
-      await clickDeviceAuthorizeControls(page);
-      await wait(2_000);
-    }
-  }
-}
-
-/**
- * Authorize Grok CLI device code via **Google OAuth** (GSuite / Gmail).
- * Same pattern as Kiro/CodeBuddy bulk: open device URL → Continue with Google →
- * shared Google automation → poll device token as successPromise.
- *
- * Prefer this over tempmail signup when you already have Google accounts.
- */
-export async function runXaiGoogleDeviceAuthorize(page, {
-  email,
-  password,
-  verificationUrl,
-  pollToken,
-  deviceCode,
-  onStep,
-  cancelCheck,
-  shortTimeoutMs = 5 * 60_000,
-} = {}) {
-  const report = (step, message) => onStep?.(step, message);
-  const { runGoogleAccountAutomation } = await import("./googleAutomation.js");
-
-  const pollPromise = (async () => {
-    const start = Date.now();
-    // Poll ASAP after authorize; back off only on slow_down.
-    let interval = 800;
-    while (Date.now() - start < 12 * 60_000) {
-      if (cancelCheck?.()) throw new Error("Job cancelled during token polling");
-      const result = await pollToken(deviceCode);
-      if (result?.success && result.tokens) return { tokens: result.tokens };
-      if (result?.pending || result?.error === "authorization_pending") {
-        await wait(interval);
-        interval = Math.min(interval + 200, 2_000);
-        continue;
-      }
-      if (result?.error === "slow_down") {
-        interval = Math.min(interval + 1_000, 8_000);
-        await wait(interval);
-        continue;
-      }
-      if (result?.error && !["authorization_pending", "slow_down"].includes(result.error)) {
-        report("token_poll_note", `Poll: ${result.error}`);
-      }
-      await wait(interval);
-    }
-    throw new Error("Timed out waiting for Grok CLI OAuth token after Google login");
-  })();
-  // Prevent unhandled rejection if Google path fails first
-  pollPromise.catch(() => null);
-
-  report("opening_device_google", "Opening Grok device auth — will use Google login");
-  const automation = await runGoogleAccountAutomation({
-    page,
-    authUrl: verificationUrl,
-    email,
-    password,
-    successPromise: pollPromise,
-    shortTimeoutMs,
-    serviceLabel: "Grok CLI",
-    openingStep: "opening_device_google",
-    openingMessage: "Opening Grok device page (Google OAuth)",
-    successStep: "grok_token_received",
-    successMessage: "Grok CLI OAuth token received",
-    onStep,
-  });
-
-  if (automation.status === "success") {
-    // tokens may be nested from successPromise spread
-    const tokens = automation.tokens || automation.result?.tokens || null;
-    if (tokens?.accessToken || tokens?.access_token) {
-      return { status: "success", tokens };
-    }
-    // successPromise resolved but shape unknown — try one more poll
-    try {
-      const result = await pollToken(deviceCode);
-      if (result?.success && result.tokens) return { status: "success", tokens: result.tokens };
-    } catch {
-      /* fall through */
-    }
-    return {
-      status: "failed",
-      error: "Google login finished but Grok device token was not captured",
-    };
-  }
-
-  // After Google SSO, xAI sometimes parks on /account. Re-open device URL and
-  // authorize while the device token poll is still alive — no multi-second sleeps.
-  if (!["failed_browser_blocked", "failed_invalid_credentials", "failed_restricted"].includes(automation.status)) {
-    report("device_reopen_after_google", "Re-opening device URL after Google automation window");
-    try {
-      await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 45_000 });
-      await dismissCookies(page);
-      for (let i = 0; i < 6; i += 1) {
-        if (cancelCheck?.()) break;
-        const googleVisible = await page.getByRole("button", { name: /google/i }).first()
-          .isVisible({ timeout: 200 }).catch(() => false);
-        if (googleVisible) {
-          report("device_google_again", "Google login still required on device page");
-          break;
-        }
-        const clicked = await clickDeviceAuthorizeControls(page);
-        if (clicked) {
-          report("device_click", `Clicked authorize control after Google (${i + 1})`);
-        }
-        const raced = await Promise.race([
-          pollPromise.then((r) => ({ ok: true, r })).catch(() => null),
-          wait(900).then(() => null),
-        ]);
-        if (raced?.ok && raced.r?.tokens) {
-          return { status: "success", tokens: raced.r.tokens };
-        }
-        const text = await pageText(page);
-        if (/Device Authorized|device has been authorized|you can close|successfully authorized/i.test(text)) {
-          report("device_authorized", "Device authorized in browser after Google");
-          const result = await pollToken(deviceCode).catch(() => null);
-          if (result?.success && result.tokens) return { status: "success", tokens: result.tokens };
-        }
-        if (/rate[_ ]?limit/i.test(text) || /error=rate_limited/i.test(page.url?.() || "")) {
-          report("device_rate_limited", "xAI rate-limited on reopen");
-          break;
-        }
-      }
-    } catch (e) {
-      report("device_reopen_note", String(e?.message || e).slice(0, 120));
-    }
-  }
-
-  // If Google finished but token poll still pending, keep authorize UI loop briefly
-  if (automation.status === "needs_manual" || automation.status === "failed_restricted") {
-    return {
-      status: automation.status,
-      error: automation.error || "Google automation needs manual assist",
-    };
-  }
-
-  return {
-    status: automation.status || "failed",
-    error: automation.error || "Google device authorization failed",
-  };
-}
-
-/**
- * Login with email+password (session), then authorize a Grok CLI device code.
- */
-export async function runXaiEmailDeviceAuthorize(page, {
-  email,
-  password,
-  verificationUrl,
-  pollToken,
-  deviceCode,
-  pollOtp = pollTempmailXaiOtp,
-  onStep,
-  cancelCheck,
-} = {}) {
-  const report = (step, message) => onStep?.(step, message);
-  const authorized = { done: false };
-
-  // Ensure session via sign-in if not already on account
-  const cur = page.url();
-  if (!/\/account/i.test(cur) && !/accounts\.x\.ai/i.test(cur)) {
-    report("opening_signin", "Opening xAI email login");
-    await page.goto("https://accounts.x.ai/sign-in", { waitUntil: "domcontentloaded", timeout: 60_000 });
-    await wait(1_000);
-    await dismissCookies(page);
-    await ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp });
-  }
-
-  report("opening_device", "Opening Grok Build device authorization");
-  await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-  await wait(1_500);
-  await dismissCookies(page);
-  await clickDeviceAuthorizeControls(page);
-  await wait(2_000);
-
-  // If bounced to login again, do email login on this page
-  const bounced = await page.getByRole("button", { name: /Login with email/i }).count()
-    || await page.locator("input[type=email]").first().isVisible().catch(() => false);
-  if (bounced) {
-    report("device_needs_login", "Device page requires login — signing in");
-    await ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp });
-    await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-    await wait(1_500);
-    await dismissCookies(page);
-    await clickDeviceAuthorizeControls(page);
-    await wait(2_000);
-  }
-
-  // Snapshot first device page for debugging stuck authorize
-  try {
-    const snap = (await pageText(page)).replace(/\s+/g, " ").slice(0, 160);
-    report("device_page", `Device page: ${page.url().slice(0, 80)} · ${snap}`);
-  } catch {
-    /* ignore */
-  }
-
-  const pollPromise = (async () => {
-    const start = Date.now();
-    let interval = 4_000;
-    while (Date.now() - start < 12 * 60_000) {
-      if (cancelCheck?.()) throw new Error("Job cancelled during token polling");
-      if (authorized.done) {
-        // short burst after UI says authorized
-        await wait(1_500);
-      }
-      const result = await pollToken(deviceCode);
-      if (result?.success && result.tokens) return { tokens: result.tokens };
-      if (result?.pending || result?.error === "authorization_pending") {
-        await wait(interval);
-        continue;
-      }
-      if (result?.error === "slow_down") {
-        interval = Math.min(interval + 5_000, 30_000);
-        await wait(interval);
-        continue;
-      }
-      if (result?.error && !["authorization_pending", "slow_down"].includes(result.error)) {
-        report("token_poll_note", `Poll: ${result.error}`);
-        await wait(interval);
-        continue;
-      }
-      await wait(interval);
-    }
-    throw new Error("Timed out waiting for Grok CLI OAuth token (device may not have been authorized in the browser)");
-  })();
-
-  // UI authorize loop — keep going until poll succeeds or timeout (~same window)
-  const uiLoop = (async () => {
-    const start = Date.now();
-    let i = 0;
-    while (Date.now() - start < 11 * 60_000) {
-      if (cancelCheck?.()) return;
-      if (authorized.done) {
-        await wait(2_000);
-        continue;
-      }
-
-      const text = await pageText(page);
-      const url = page.url();
-
-      if (/Device Authorized|device has been authorized|you can close|successfully authorized/i.test(text)) {
-        authorized.done = true;
-        report("device_authorized", "Device authorized in browser");
-        return;
-      }
-
-      // Login wall again mid-flow
-      if (/Login with email|Sign in to continue|log in to continue/i.test(text)
-        || await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
-        report("device_relogin", "Re-login required on device page");
-        await ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp });
-        await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 }).catch(() => null);
-        await wait(1_500);
-        continue;
-      }
-
-      // Consent / identity
-      if (/Authorize Grok|Grok Build|Verify your identity|Confirm your identity|device code|user code/i.test(text)
-        || /oauth2\/device|device\/verify/i.test(url)) {
-        const clicked = await clickDeviceAuthorizeControls(page);
-        if (clicked && i % 3 === 0) {
-          report("device_click", `Clicked authorize control (${i + 1})`);
-        }
-        // Only burn time on Turnstile when the widget is actually on the page.
-        // Old code always waited 12s even with widget=missing → looked stuck / needs_manual.
-        const hasWidget = await page.evaluate(() => !!(
-          document.querySelector(".cf-turnstile, [data-sitekey], iframe[src*='turnstile'], iframe[src*='challenges.cloudflare']")
-          || [...document.querySelectorAll("iframe")].some((f) => /turnstile|cloudflare/i.test(f.src || f.title || ""))
-        )).catch(() => false);
-        const tokenAlready = await readTurnstileToken(page);
-        if (hasWidget && !tokenAlready) {
-          await waitForTurnstile(page, {
-            timeoutMs: 45_000,
-            onStep: i % 3 === 0 ? onStep : undefined,
-            label: "device Turnstile",
-          });
-        }
-        await wait(1_200);
-        i += 1;
-        continue;
-      }
-
-      // Redirected away from device flow
-      if (/Redirecting/i.test(text) || (/\/account/i.test(url) && !/device/i.test(url))) {
-        report("device_reopen", "Re-opening device authorization URL");
-        await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-        await wait(1_500);
-        await dismissCookies(page);
-        await clickDeviceAuthorizeControls(page);
-        await wait(1_500);
-        i += 1;
-        continue;
-      }
-
-      // Generic: keep trying primary actions + occasional reload
-      await clickDeviceAuthorizeControls(page);
-      if (i > 0 && i % 8 === 0) {
-        report("device_reload", `Reload device page (attempt ${i}) · ${url.slice(0, 60)}`);
-        await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 }).catch(() => null);
-        await wait(1_200);
-        await clickDeviceAuthorizeControls(page);
-      }
-      await wait(1_800);
-      i += 1;
-    }
-  })();
-
-  report("polling_token", "Waiting for device token after authorization");
-  try {
-    const [tokenResult] = await Promise.all([
-      pollPromise,
-      uiLoop.catch((e) => {
-        report("device_ui_note", String(e?.message || e).slice(0, 120));
-        return null;
-      }),
-    ]);
-    return { status: "success", tokens: tokenResult.tokens };
-  } catch (error) {
-    const snap = (await pageText(page).catch(() => "")).replace(/\s+/g, " ").slice(0, 200);
-    return {
-      status: "failed",
-      error: `${error.message || error} · page: ${page.url()} · ${snap}`,
-    };
-  }
-}