zevairouter 1.0.153 → 1.0.155

package/src/lib/oauth/services/kiroGoogleAutomation.js

@@ -1,2587 +0,0 @@
-const DEFAULT_SHORT_TIMEOUT_MS = 90_000;
-const DEFAULT_MANUAL_TIMEOUT_MS = 15 * 60_000;
-
-// Comma-separated CSS selector. Includes Google's stable ID, mobile/legacy form
-// names, and aria-label fallbacks for English + Indonesian. Multi-language
-// aria-label support matters because Google renders the form in the user's
-// browser locale (so "Email or phone" becomes "Email atau nomor telepon" for
-// id-ID accounts and similar for other locales).
-export const EMAIL_INPUT_SELECTOR = [
-  'input[type="email"]',
-  'input[autocomplete="username"]',
-  'input#identifierId',
-  'input[name="identifier"]',
-  'input[name="Email"]',
-  'input[type="text"][autofocus]',
-  'input[aria-label*="Email" i]',
-  'input[aria-label*="email" i]',
-  'input[aria-label*="phone" i]',
-  'input[aria-label*="telepon" i]',
-].join(", ");
-
-export const PASSWORD_INPUT_SELECTOR = [
-  'input[type="password"]',
-  'input[name="Passwd"]',
-  'input[name="password"]',
-  'input[aria-label*="Password" i]',
-  'input[aria-label*="password" i]',
-  'input[aria-label*="Sandi" i]',
-  'input[aria-label*="kata sandi" i]',
-].join(", ");
-
-const NEXT_BUTTON_SELECTORS = [
-  'button:has-text("Next")',
-  'button:has-text("Berikutnya")',
-  'button:has-text("Continue")',
-  'div[role="button"]:has-text("Next")',
-  'div[role="button"]:has-text("Berikutnya")',
-  '#identifierNext button',
-  '#passwordNext button',
-];
-
-const APPROVE_BUTTON_SELECTORS = [
-  '#submit_approve_access',
-  '#submit_approve_access button',
-  '#confirm',
-  'form#tos_form input[type="submit"]',
-  'button[jsname]:has-text("Allow")',
-  'button:has-text("Allow")',
-  '[role="button"]:has-text("Allow")',
-  'input[type="submit"][value="Allow"]',
-  'input[type="button"][value="Allow"]',
-  'button[jsname]:has-text("Izinkan")',
-  'button:has-text("Izinkan")',
-  '[role="button"]:has-text("Izinkan")',
-  'button:has-text("Continue")',
-  'button:has-text("Next")',
-  'button:has-text("Yes")',
-  'button:has-text("Accept")',
-  'button:has-text("Lanjutkan")',
-  'button:has-text("Berikutnya")',
-  'button:has-text("Setuju")',
-  'button:has-text("Saya mengerti")',
-  'button:has-text("Oke")',
-  'button:has-text("OK")',
-  'button:has-text("Got it")',
-  'button:has-text("I understand")',
-  'div[role="button"]:has-text("Continue")',
-  'div[role="button"]:has-text("Next")',
-  'div[role="button"]:has-text("Allow")',
-  'div[role="button"]:has-text("Lanjutkan")',
-  'div[role="button"]:has-text("Berikutnya")',
-  'div[role="button"]:has-text("Izinkan")',
-  'div[role="button"]:has-text("Setuju")',
-  'div[role="button"]:has-text("Saya mengerti")',
-  'div[role="button"]:has-text("Oke")',
-  'div[role="button"]:has-text("OK")',
-  'div[role="button"]:has-text("Got it")',
-  'div[role="button"]:has-text("I understand")',
-  'input[type="button"][value="Saya mengerti"]',
-  'input[type="submit"][value="Saya mengerti"]',
-];
-
-const SKIP_BUTTON_SELECTORS = [
-  'button:has-text("Skip")',
-  'button:has-text("Lewati")',
-  'button:has-text("Not now")',
-  'button:has-text("Bukan sekarang")',
-  'button:has-text("No thanks")',
-  'button:has-text("Tidak sekarang")',
-  'div[role="button"]:has-text("Skip")',
-  'div[role="button"]:has-text("Not now")',
-];
-
-const GOOGLE_LOGIN_BUTTON_SELECTORS = [
-  '#social-google',
-  'a#social-google',
-  'a:has-text("Sign up with Google")',
-  'a:has-text("Log in with Google")',
-  'a:has-text("Login with Google")',
-  'a:has-text("Continue with Google")',
-  'a:has-text("Sign in with Google")',
-  'button:has-text("Sign up with Google")',
-  'button:has-text("Log in with Google")',
-  'button:has-text("Login with Google")',
-  'button:has-text("Continue with Google")',
-  'button:has-text("Sign in with Google")',
-  // Cloudflare dash: visible label is just "Google", aria is "Continue with Google"
-  'button[aria-label*="Continue with Google" i]',
-  'button[aria-label*="Google" i]',
-  'button:has-text("Google")',
-  'a:has-text("Google")',
-  'div[role="button"]:has-text("Continue with Google")',
-  'div[role="button"]:has-text("Login with Google")',
-  'div[role="button"]:has-text("Google")',
-  'span:has-text("Continue with Google")',
-  'span:has-text("Login with Google")',
-  'span:has-text("Google")',
-  '[aria-label*="Google" i]',
-  '[data-provider*="google" i]',
-  // xAI / Grok device + account pages
-  'button:has-text("Login with Google")',
-  'button:has-text("Continue with Google")',
-  '[data-testid*="google" i]',
-];
-
-/** OneTrust / cookie walls that block the first Google click (Cloudflare login). */
-const COOKIE_DISMISS_SELECTORS = [
-  '#onetrust-accept-btn-handler',
-  '#onetrust-reject-all-handler',
-  '#accept-recommended-btn-handler',
-  'button:has-text("Allow All")',
-  'button:has-text("Reject All")',
-  'button:has-text("Accept All")',
-  'button:has-text("Accept all")',
-  'button:has-text("Confirm My Choices")',
-];
-
-const TERMS_CHECKBOX_SELECTORS = [
-  '#agree-policy-account',
-  '#agree-policy',
-  '#agree-policy-sso',
-  'input[type="checkbox"][id*="agree" i]',
-  'input[type="checkbox"][name*="agree" i]',
-  'input[type="checkbox"][id*="policy" i]',
-  'input[type="checkbox"][name*="policy" i]',
-  'input[type="checkbox"][id*="terms" i]',
-  'input[type="checkbox"][name*="terms" i]',
-  '.login-checkbox input[type="checkbox"]',
-  '[class*="checkbox"] input[type="checkbox"]',
-  '[class*="agree"] input[type="checkbox"]',
-  'input[type="checkbox"]',
-];
-
-const PRIVACY_CONFIRM_BUTTON_SELECTORS = [
-  '.ui-dialog button:has-text("Confirm")',
-  'dialog button:has-text("Confirm")',
-  'button:has-text("Confirm")',
-  'button:has-text("I agree")',
-  'button:has-text("Agree")',
-  'button:has-text("\u540c\u610f")',
-  'button:has-text("\u786e\u8ba4")',
-];
-
-const PROVIDER_ONBOARDING_ACTION_SELECTORS = [
-  'button:has-text("Continue")',
-  '[role="button"]:has-text("Continue")',
-  'button:has-text("Get started")',
-  'button:has-text("GET STARTED")',
-  'input[type="submit"][value="GET STARTED"]',
-  'button:has-text("Start")',
-  'button:has-text("Confirm")',
-  'button:has-text("Done")',
-  'button:has-text("Next")',
-  'button:has-text("Skip")',
-  'button:has-text("Not now")',
-  'button:has-text("Save")',
-  'button:has-text("Create")',
-  'button:has-text("Enter")',
-  'button:has-text("Launch")',
-  'button:has-text("Use CodeBuddy")',
-  'button:has-text("Go to CodeBuddy")',
-];
-
-const PROVIDER_REGION_TRIGGER_SELECTORS = [
-  'select',
-  '[role="combobox"]',
-  '.page-region [role="combobox"]',
-  '.page-region .t-select',
-  '.page-region [class*="t-select"]',
-  '.page-region [class*="select"]',
-  '.page-region input[placeholder]',
-  'button:has-text("Region")',
-  '[role="button"]:has-text("Region")',
-  'button:has-text("Select region")',
-  '[role="button"]:has-text("Select region")',
-  'button:has-text("Data region")',
-  '[aria-label*="region" i]',
-  '[placeholder*="region" i]',
-];
-
-const PROVIDER_REGION_OPTION_SELECTORS = [
-  'text=/^Indonesia$/i',
-  'text=/^ID$/i',
-  'text=/^Singapore$/i',
-  'text=/^SG$/i',
-  'text=/^Japan$/i',
-  'text=/^JP$/i',
-  'text=/^Thailand$/i',
-  'text=/^TH$/i',
-  'text=/^Global$/i',
-  'text=/^International$/i',
-  'text=/^United States$/i',
-  'text=/^US$/i',
-  'text=/^Asia Pacific$/i',
-  'text=/^Hong Kong$/i',
-  'text=/^Default$/i',
-];
-
-const PROVIDER_ONBOARDING_INPUT_DEFAULTS = [
-  { selector: 'input[name*="workspace" i]', value: "Default" },
-  { selector: 'input[placeholder*="workspace" i]', value: "Default" },
-  { selector: 'input[name*="team" i]', value: "Default" },
-  { selector: 'input[placeholder*="team" i]', value: "Default" },
-  { selector: 'input[name*="name" i]', value: "Default" },
-  { selector: 'input[placeholder*="name" i]', value: "Default" },
-];
-
-const INVALID_CREDENTIAL_MARKERS = [
-  "wrong password",
-  "incorrect password",
-  "couldn't find your google account",
-  "couldn\u2019t find your google account",
-  "enter a valid email",
-  "couldn\u2019t sign you in",
-  "couldn't sign you in",
-  "invalid email or password",
-  "password is incorrect",
-];
-
-const MANUAL_ASSIST_MARKERS = [
-  "2-step verification",
-  "2-step verification required",
-  "verify it\u2019s you",
-  "verify it's you",
-  "check your phone",
-  "confirm it\u2019s you",
-  "confirm it's you",
-  "recovery email",
-  "recovery phone",
-  "suspicious sign-in prevented",
-  "unusual activity detected",
-  "captcha",
-  "i'm not a robot",
-  "im not a robot",
-  "not a robot",
-  "recaptcha",
-  "select all images",
-  "select all squares",
-  "try again later",
-  "browser or app may not be secure",
-  "try using a different browser",
-  "couldn\u2019t sign you in",
-  "couldn't sign you in",
-  "this browser or app may not be secure",
-];
-
-const RESTRICTED_ACCOUNT_MARKERS = [
-  "restricted",
-  "account has been restricted",
-  "account is restricted",
-  "account has been suspended",
-  "account is suspended",
-  "account has been disabled",
-  "account is disabled",
-  "account has been banned",
-  "account is banned",
-  "access denied",
-  "account blocked",
-  "your account has been",
-  "violation of terms",
-  "terms of service violation",
-  "temporarily locked",
-  "permanently locked",
-  "account locked",
-  "akun dibatasi",
-  "akun diblokir",
-  "akun ditangguhkan",
-];
-
-const GOOGLE_ONBOARDING_MARKERS = [
-  "welcome to your new google account",
-  "selamat datang di akun google baru anda",
-  "welcome to your new account",
-  "selamat datang di akun baru",
-  "privacy and terms",
-  "privasi dan persyaratan",
-  "personalize your google services",
-  "personalisasikan layanan google anda",
-  "add recovery phone",
-  "tambahkan nomor telepon pemulihan",
-  "choose your settings",
-  "pilih setelan anda",
-];
-
-const GOOGLE_WORKSPACE_WELCOME_MARKERS = [
-  "welcome to your new account",
-  "selamat datang di akun baru",
-  "your administrator decides which",
-  "administrator anda memutuskan layanan",
-  "your organisation administrator manages",
-  "your organization administrator manages",
-];
-
-const KIRO_CALLBACK_PREFIX = "kiro://kiro.kiroAgent/authenticate-success";
-
-function parseCallbackUrl(rawUrl) {
-  if (!rawUrl || !rawUrl.startsWith(KIRO_CALLBACK_PREFIX)) return null;
-
-  const queryIndex = rawUrl.indexOf("?");
-  const params = new URLSearchParams(queryIndex >= 0 ? rawUrl.slice(queryIndex + 1) : "");
-  const code = params.get("code");
-  const state = params.get("state");
-
-  if (!code) return null;
-
-  return {
-    callbackUrl: rawUrl,
-    code,
-    state,
-  };
-}
-
-function getInteractionScopes(page) {
-  const frames = typeof page.frames === "function" ? page.frames() : [];
-  return [page, ...frames.filter((frame) => frame !== page.mainFrame?.())];
-}
-
-async function clickFirstVisible(page, selectors) {
-  for (const scope of getInteractionScopes(page)) {
-    for (const selector of selectors) {
-      const locator = scope.locator(selector).first();
-      const count = await locator.count().catch(() => 0);
-      if (!count) continue;
-
-      const visible = await locator.isVisible().catch(() => false);
-      if (!visible) continue;
-
-      await locator.click({ timeout: 5_000 }).catch(() => null);
-      return true;
-    }
-  }
-
-  return false;
-}
-
-async function clickFirstActionable(page, selectors) {
-  for (const scope of getInteractionScopes(page)) {
-    for (const selector of selectors) {
-      const locator = scope.locator(selector).first();
-      const count = await locator.count().catch(() => 0);
-      if (!count) continue;
-
-      await locator.scrollIntoViewIfNeeded().catch(() => null);
-
-      const visible = await locator.isVisible().catch(() => false);
-      if (!visible) continue;
-
-      const enabled = await locator.isEnabled().catch(() => true);
-      if (!enabled) continue;
-
-      const clicked = await locator.click({ timeout: 5_000 }).then(() => true).catch(() => false);
-      if (clicked) return true;
-    }
-  }
-
-  return false;
-}
-
-async function checkFirstVisible(page, selectors) {
-  for (const scope of getInteractionScopes(page)) {
-    for (const selector of selectors) {
-      const locator = scope.locator(selector).first();
-      const count = await locator.count().catch(() => 0);
-      if (!count) continue;
-
-      const checked = await locator.isChecked().catch(() => false);
-      if (checked) return true;
-
-      const visible = await locator.isVisible().catch(() => false);
-      const didCheck = visible
-        ? await locator.check({ force: true, timeout: 5_000 }).then(() => true).catch(() => false)
-        : false;
-      if (didCheck) return true;
-
-      const clicked = visible
-        ? await locator.click({ force: true, timeout: 5_000 }).then(() => true).catch(() => false)
-        : false;
-      if (clicked) return true;
-
-      const domChecked = await scope.evaluate((candidateSelector) => {
-        const input = document.querySelector(candidateSelector);
-        if (!(input instanceof HTMLInputElement)) return false;
-        input.checked = true;
-        input.dispatchEvent(new Event("input", { bubbles: true }));
-        input.dispatchEvent(new Event("change", { bubbles: true }));
-        return input.checked;
-      }, selector).catch(() => false);
-      if (domChecked) return true;
-    }
-  }
-
-  return false;
-}
-
-async function getFirstVisibleLocator(page, selector) {
-  for (const scope of getInteractionScopes(page)) {
-    const locator = scope.locator(selector).first();
-    const count = await locator.count().catch(() => 0);
-    if (!count) continue;
-
-    const visible = await locator.isVisible().catch(() => false);
-    if (!visible) continue;
-
-    return locator;
-  }
-
-  return null;
-}
-
-async function waitForFirstVisibleLocator(page, selector, { timeout = 15_000, pollInterval = 150 } = {}) {
-  const deadline = Date.now() + timeout;
-  while (Date.now() < deadline) {
-    const found = await getFirstVisibleLocator(page, selector);
-    if (found) return found;
-    const remaining = deadline - Date.now();
-    if (remaining <= 0) break;
-    await new Promise((r) => setTimeout(r, Math.min(pollInterval, remaining)));
-  }
-  return null;
-}
-
-/** Tiny yield only — never use multi-second sleeps for “maybe page will load”. */
-function yieldMs(ms = 50) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-
-/**
- * Wait until a condition is true, polling fast. Replaces fixed sleep after clicks.
- * @returns {Promise<boolean>} true if condition met before timeout
- */
-async function waitUntil(checkFn, { timeout = 8_000, interval = 100 } = {}) {
-  const deadline = Date.now() + timeout;
-  while (Date.now() < deadline) {
-    try {
-      if (await checkFn()) return true;
-    } catch {
-      /* retry */
-    }
-    await yieldMs(interval);
-  }
-  return false;
-}
-
-function isGoogleHostname(url) {
-  try {
-    const host = new URL(url).hostname;
-    return host === "accounts.google.com"
-      || host.endsWith(".accounts.google.com")
-      || /^accounts\.google\./i.test(host);
-  } catch {
-    return false;
-  }
-}
-
-/** After navigation/click: wait for URL change or next UI, not a fixed sleep. */
-async function waitForPageAdvance(page, {
-  fromUrl = "",
-  urlMatch = null,
-  selector = null,
-  timeout = 8_000,
-} = {}) {
-  const startUrl = fromUrl || page.url?.() || "";
-  return waitUntil(async () => {
-    const url = page.url?.() || "";
-    if (urlMatch) {
-      if (typeof urlMatch === "function" && urlMatch(url)) return true;
-      if (urlMatch instanceof RegExp && urlMatch.test(url)) return true;
-    }
-    if (url && url !== startUrl && !url.startsWith("about:")) return true;
-    if (selector) {
-      const found = await getFirstVisibleLocator(page, selector);
-      if (found) return true;
-    }
-    return false;
-  }, { timeout, interval: 80 });
-}
-
-async function fillInputResilient(locator, value, { timeout = 15_000 } = {}) {
-  if (!locator || value == null) return false;
-
-  // Prefer fill() first (fast); slow type is only a fallback for React
-  // controlled fields that reject programmatic fill.
-  try {
-    await locator.click({ timeout: 3_000 });
-  } catch {
-    /* noop */
-  }
-  try {
-    await locator.fill(String(value), { timeout: Math.min(timeout, 8_000) });
-    const observed = await locator.inputValue().catch(() => "");
-    if (observed === value) return true;
-  } catch {
-    /* fall through to typed input */
-  }
-
-  try {
-    await locator.fill("", { timeout: 2_000 });
-  } catch {
-    /* noop */
-  }
-  try {
-    // Light humanization only if fill failed — 15–35ms/key (was 40–120ms).
-    const delay = Math.floor(15 + Math.random() * 20);
-    await locator.type(String(value), { delay, timeout });
-  } catch {
-    try {
-      await locator.fill(String(value), { timeout });
-    } catch {
-      return false;
-    }
-  }
-
-  let observed = "";
-  try {
-    observed = await locator.inputValue();
-  } catch {
-    observed = "";
-  }
-  return observed === value;
-}
-
-function parseSelectorList(selector) {
-  return String(selector || "")
-    .split(",")
-    .map((s) => s.trim())
-    .filter(Boolean);
-}
-
-async function readPageText(page) {
-  const chunks = [];
-  for (const scope of getInteractionScopes(page)) {
-    try {
-      chunks.push(await scope.evaluate(() => document.body?.innerText || ""));
-    } catch {
-      // Cross-origin frames can be unreadable; ignore them.
-    }
-  }
-  return chunks.join("\n");
-}
-
-function includesAny(text, markers) {
-  const normalized = String(text || "").toLowerCase();
-  return markers.some((marker) => normalized.includes(marker));
-}
-
-function isGoogleAuthPage(page) {
-  try {
-    const url = new URL(page.url());
-    return url.hostname === "accounts.google.com"
-      || url.hostname.endsWith(".accounts.google.com")
-      || /^accounts\.google\./i.test(url.hostname);
-  } catch {
-    return false;
-  }
-}
-
-/** Fast bulk path: skip multi-second sleeps (Grok, Cloudflare, etc.). */
-function isGrokish(serviceLabel) {
-  return /grok|cloudflare/i.test(String(serviceLabel || ""));
-}
-
-function isCloudflareLoginUrl(url) {
-  try {
-    const u = new URL(url || "");
-    return u.hostname === "dash.cloudflare.com" && u.pathname.includes("/login");
-  } catch {
-    return false;
-  }
-}
-
-async function dismissCookieBanners(page, reportStep) {
-  // Cookie / OneTrust modals steal the first clicks (CF login shows "Allow All").
-  // Fast path: one scan — must stay cheap because the main automation loop
-  // calls this on every tick (dashboard harvest must not burn 2s here).
-  for (const selector of COOKIE_DISMISS_SELECTORS) {
-    try {
-      const loc = page.locator(selector).first();
-      if (await loc.isVisible({ timeout: 100 }).catch(() => false)) {
-        // noWaitAfter: banner click must not wait on any incidental navigation
-        await loc.click({ timeout: 2_000, noWaitAfter: true }).catch(() => null);
-        reportStep?.("dismissing_cookies", "Dismissed cookie / privacy banner");
-        return true;
-      }
-    } catch {
-      /* next */
-    }
-  }
-  const viaApi = await page.evaluate(() => {
-    try {
-      if (typeof window.OneTrust?.AllowAll === "function") {
-        const banner = document.querySelector(
-          "#onetrust-banner-sdk, #onetrust-consent-sdk, #onetrust-accept-btn-handler",
-        );
-        // Only invoke when a banner is actually present — AllowAll on every
-        // loop tick is wasteful and can re-open consent UI.
-        if (!banner) return false;
-        window.OneTrust.AllowAll();
-        return true;
-      }
-      const btn = document.querySelector("#onetrust-accept-btn-handler");
-      if (btn && btn.offsetParent !== null) {
-        btn.click();
-        return true;
-      }
-    } catch {
-      /* ignore */
-    }
-    return false;
-  }).catch(() => false);
-  if (viaApi) {
-    reportStep?.("dismissing_cookies", "Dismissed cookie / privacy banner");
-    return true;
-  }
-  return false;
-}
-
-// Google bounces flagged (headless) browsers:
-// - myaccount.google.com/not-supported
-// - accounts.google.com/v3/signin/rejected ("This browser or app may not be secure")
-// - about.google drift after consent
-function isBlockedBrowserPage(page) {
-  try {
-    const url = new URL(page.url());
-    if (url.pathname.startsWith("/not-supported")) return true;
-    if (url.pathname.includes("/signin/rejected")) return true;
-    if (url.pathname.includes("/rejected")) return true;
-    if (url.hostname === "about.google" || url.hostname.endsWith(".about.google")) return true;
-  } catch {
-    // fall through to body text
-  }
-  return false;
-}
-
-async function isBlockedBrowser(page) {
-  if (isBlockedBrowserPage(page)) return true;
-  const text = await readPageText(page).catch(() => "");
-  return includesAny(text, [
-    "browser or app may not be secure",
-    "try using a different browser",
-    "couldn't sign you in",
-    "couldn\u2019t sign you in",
-    "this browser or app may not be secure",
-    "browser is not secure",
-  ]);
-}
-
-/**
- * Hook successPromise so interstitial waits can exit as soon as the OAuth
- * callback (kiro://) is captured on the network — even while the main frame
- * stays parked on blank SetSID.
- */
-function attachSuccessSettledFlag(successPromise) {
-  if (!successPromise || typeof successPromise.then !== "function") return;
-  if (successPromise.__zevaiSettledHooked) return;
-  successPromise.__zevaiSettledHooked = true;
-  successPromise.then(
-    () => { successPromise.__zevaiSettled = true; },
-    () => { successPromise.__zevaiSettled = true; },
-  );
-}
-
-function isSuccessSettled(successPromise) {
-  return Boolean(successPromise && successPromise.__zevaiSettled);
-}
-
-/**
- * Google often parks on intermediate pages with empty body after password/consent:
- *   accounts.google.com(.xx)/accounts/SetSID
- *   AccountChooser, continue, challenge handoffs
- *
- * Do NOT force-navigate consent/idpresponse from here — that aborts the natural
- * network hop that emits Location: kiro://. Wait for auto-redirect / AccountChooser
- * UI, and bail early when successPromise already settled (CDP/page listeners).
- *
- * @returns {boolean} true if still on an interstitial when maxWaitMs elapsed
- */
-async function waitThroughGoogleInterstitials(page, reportStep, { maxWaitMs = 20_000, successPromise = null } = {}) {
-  const start = Date.now();
-  let lastUrl = "";
-  attachSuccessSettledFlag(successPromise);
-
-  while (Date.now() - start < maxWaitMs) {
-    if (isSuccessSettled(successPromise)) {
-      reportStep?.("waiting_google_redirect", "OAuth callback already received — leaving interstitial wait");
-      return false;
-    }
-
-    const url = page.url?.() || "";
-    const body = String(await readPageText(page).catch(() => "")).trim();
-    const isSetSid = /\/accounts\/SetSID/i.test(url);
-    const isChooser = /\/AccountChooser/i.test(url);
-    const isEmpty = body.length < 30;
-    const isInterstitial = isSetSid || (isEmpty && /accounts\.google\./i.test(url));
-
-    if (!isInterstitial && !isChooser) return false;
-
-    if (url !== lastUrl) {
-      reportStep?.(
-        "waiting_google_redirect",
-        `Waiting for Google redirect (url=${url.slice(0, 120)} empty=${isEmpty})`,
-      );
-      lastUrl = url;
-    }
-
-    // Account chooser: click first account row if present
-    if (isChooser) {
-      const clicked = await clickFirstActionable(page, [
-        'div[data-identifier]',
-        'div[data-email]',
-        'li[data-identifier]',
-        'div[role="link"]',
-        'div[role="button"]',
-      ]);
-      if (clicked) {
-        reportStep?.("selecting_google_account", "Selected account from Google AccountChooser");
-        await waitForPageAdvance(page, { timeout: 5_000 });
-        continue;
-      }
-    }
-
-    const waiters = [
-      page.waitForNavigation({ waitUntil: "domcontentloaded", timeout: 3_000 }).catch(() => null),
-      // Cap idle wait low — exit as soon as URL/body changes or success settles.
-      yieldMs(400),
-    ];
-    if (successPromise && !isSuccessSettled(successPromise)) {
-      waiters.push(successPromise.then(() => null).catch(() => null));
-    }
-    await Promise.race(waiters);
-  }
-  return true;
-}
-
-function isProviderPage(page) {
-  try {
-    const url = new URL(page.url());
-    const host = url.hostname || "";
-    return /codebuddy\.(ai|cn)$/.test(host)
-      || host.endsWith(".codebuddy.ai")
-      || host.endsWith(".codebuddy.cn")
-      // xAI / Grok CLI device authorization + account host
-      || host === "accounts.x.ai"
-      || host === "auth.x.ai"
-      || host.endsWith(".x.ai")
-      || host === "grok.com"
-      || host.endsWith(".grok.com")
-      // Cloudflare dashboard (Workers AI bulk)
-      || host === "dash.cloudflare.com"
-      || host.endsWith(".cloudflare.com");
-  } catch {
-    return false;
-  }
-}
-
-async function handleGoogleConsent(page, reportStep) {
-  if (!isGoogleAuthPage(page)) return false;
-
-  const text = await readPageText(page);
-  const looksLikeConsent = /wants to access|ingin mengakses|akses ke akun google|allow/i.test(text);
-  if (!looksLikeConsent) return false;
-
-  await page.evaluate(() => {
-    const root = document.scrollingElement || document.documentElement || document.body;
-    if (root) root.scrollTop = root.scrollHeight;
-    window.scrollTo(0, document.body?.scrollHeight || document.documentElement?.scrollHeight || 0);
-  }).catch(() => null);
-  await page.waitForTimeout(300);
-
-  const clickedApprove = await clickFirstActionable(page, APPROVE_BUTTON_SELECTORS);
-  if (clickedApprove) {
-    reportStep("approving_google_consent", "Approving Google OAuth consent");
-    await page.waitForTimeout(1000);
-    return true;
-  }
-
-  return false;
-}
-
-async function handleGoogleOnboarding(page, pageText) {
-  const text = String(pageText || "");
-  if (!includesAny(text, GOOGLE_ONBOARDING_MARKERS)) {
-    return false;
-  }
-
-  await page.evaluate(() => {
-    const root = document.scrollingElement || document.documentElement || document.body;
-    if (root) root.scrollTop = root.scrollHeight;
-    window.scrollTo(0, document.body?.scrollHeight || document.documentElement?.scrollHeight || 0);
-  }).catch(() => null);
-  await page.waitForTimeout(500);
-
-  // Workspace welcome ("Welcome to your new account" for @domain.com) has
-  // only one valid action: the primary "I understand" button. There is no
-  // skip option \u2014 clicking nothing leaves the worker stuck polling forever
-  // while the headless tab sits on the consent screen. Prioritise the
-  // primary action selector before the generic skip pass so we don't fall
-  // through to a non-existent "Not now" link.
-  if (includesAny(text, GOOGLE_WORKSPACE_WELCOME_MARKERS)) {
-    const acknowledged = await clickFirstActionable(page, APPROVE_BUTTON_SELECTORS);
-    if (acknowledged) {
-      await page.waitForTimeout(700);
-      return true;
-    }
-    const submittedFromDom = await page.evaluate(() => {
-      const candidates = [
-        document.getElementById("confirm"),
-        document.querySelector('form#tos_form input[type="submit"]'),
-        document.querySelector('input[type="submit"][value="Saya mengerti"]'),
-        document.querySelector('input[type="submit"][value="I understand"]'),
-      ].filter(Boolean);
-      const btn = candidates[0];
-      if (!btn) return false;
-      btn.scrollIntoView({ block: "center" });
-      btn.click();
-      return true;
-    }).catch(() => false);
-    if (submittedFromDom) {
-      await page.waitForTimeout(800);
-      return true;
-    }
-    const formSubmitted = await page.evaluate(() => {
-      const form = document.getElementById("tos_form");
-      if (!form) return false;
-      form.submit();
-      return true;
-    }).catch(() => false);
-    if (formSubmitted) {
-      await page.waitForTimeout(800);
-      return true;
-    }
-  }
-
-  const clickedSkip = await clickFirstActionable(page, SKIP_BUTTON_SELECTORS);
-  if (clickedSkip) {
-    await page.waitForTimeout(700);
-    return true;
-  }
-
-  const clickedContinue = await clickFirstActionable(page, APPROVE_BUTTON_SELECTORS);
-  if (clickedContinue) {
-    await page.waitForTimeout(700);
-    return true;
-  }
-
-  return false;
-}
-
-async function selectNativeRegionOption(page) {
-  const preferred = /global|international|singapore|united states|^us$|asia|hong kong|default/i;
-
-  for (const scope of getInteractionScopes(page)) {
-    const selects = scope.locator("select");
-    const count = await selects.count().catch(() => 0);
-    for (let index = 0; index < count; index += 1) {
-      const select = selects.nth(index);
-      const visible = await select.isVisible().catch(() => false);
-      const enabled = await select.isEnabled().catch(() => true);
-      if (!visible || !enabled) continue;
-
-      const value = await select.evaluate((element, patternSource) => {
-        const matcher = new RegExp(patternSource, "i");
-        const options = [...element.options].filter((option) => !option.disabled && option.value !== "");
-        const preferredOption = options.find((option) => matcher.test(`${option.label} ${option.textContent} ${option.value}`));
-        return (preferredOption || options[0])?.value || "";
-      }, preferred.source).catch(() => "");
-
-      if (!value) continue;
-      const selected = await select.selectOption(value).then(() => true).catch(() => false);
-      if (selected) return true;
-    }
-  }
-
-  return false;
-}
-
-async function fillProviderOnboardingDefaults(page) {
-  let filled = false;
-
-  for (const scope of getInteractionScopes(page)) {
-    for (const { selector, value } of PROVIDER_ONBOARDING_INPUT_DEFAULTS) {
-      const locator = scope.locator(selector).first();
-      const count = await locator.count().catch(() => 0);
-      if (!count) continue;
-
-      const visible = await locator.isVisible().catch(() => false);
-      const enabled = await locator.isEnabled().catch(() => true);
-      if (!visible || !enabled) continue;
-
-      const currentValue = await locator.inputValue().catch(() => "");
-      if (currentValue) continue;
-
-      const didFill = await locator.fill(value, { timeout: 5_000 }).then(() => true).catch(() => false);
-      if (didFill) filled = true;
-    }
-  }
-
-  return filled;
-}
-
-async function clickLocatorCenter(page, locator) {
-  await locator.scrollIntoViewIfNeeded().catch(() => null);
-  const visible = await locator.isVisible().catch(() => false);
-  const enabled = await locator.isEnabled().catch(() => true);
-  if (!visible || !enabled) return false;
-
-  const box = await locator.boundingBox().catch(() => null);
-  if (!box || box.width <= 0 || box.height <= 0) return false;
-
-  const x = box.x + box.width / 2;
-  const y = box.y + box.height / 2;
-  await page.mouse.move(x, y);
-  await page.mouse.down();
-  await page.mouse.up();
-  return true;
-}
-
-async function clickVisibleLocatorByText(page, selector, patterns) {
-  for (const scope of getInteractionScopes(page)) {
-    const locators = scope.locator(selector);
-    const count = Math.min(await locators.count().catch(() => 0), 80);
-    const candidates = [];
-
-    for (let index = 0; index < count; index += 1) {
-      const locator = locators.nth(index);
-      const visible = await locator.isVisible().catch(() => false);
-      if (!visible) continue;
-
-      const text = (await locator.innerText({ timeout: 1_000 }).catch(() => "")
-        || await locator.textContent({ timeout: 1_000 }).catch(() => "")
-        || "").trim();
-      if (!text) continue;
-      candidates.push({ locator, text });
-    }
-
-    for (const pattern of patterns) {
-      const candidate = candidates.find((item) => pattern.test(item.text));
-      if (!candidate) continue;
-      const clicked = await clickLocatorCenter(page, candidate.locator).catch(() => false);
-      if (clicked) return candidate.text;
-    }
-
-    if (candidates[0]) {
-      const clicked = await clickLocatorCenter(page, candidates[0].locator).catch(() => false);
-      if (clicked) return candidates[0].text;
-    }
-  }
-
-  return "";
-}
-
-async function clickFirstVisibleLocatorCenter(page, selectors) {
-  for (const scope of getInteractionScopes(page)) {
-    for (const selector of selectors) {
-      const locators = scope.locator(selector);
-      const count = Math.min(await locators.count().catch(() => 0), 20);
-      for (let index = 0; index < count; index += 1) {
-        const locator = locators.nth(index);
-        const clicked = await clickLocatorCenter(page, locator).catch(() => false);
-        if (clicked) return true;
-      }
-    }
-  }
-
-  return false;
-}
-
-async function handleCodeBuddyRegionPageViaApi(page, reportStep) {
-  if (!isProviderPage(page) || isGoogleAuthPage(page)) return false;
-
-  const result = await page.evaluate(async () => {
-    const bodyText = document.body?.innerText || "";
-    const looksLikeRegionPage = document.querySelector(".page-region")
-      || /select\s+region|region|country|area|get started|complete/i.test(bodyText);
-    if (!looksLikeRegionPage) return null;
-
-    try {
-      const response = await fetch("https://www.codebuddy.ai/console/login/account", {
-        method: "POST",
-        credentials: "include",
-        headers: {
-          accept: "application/json, text/plain, */*",
-          "content-type": "application/json",
-          "x-requested-with": "XMLHttpRequest",
-          "x-domain": window.location.hostname || "www.codebuddy.ai",
-        },
-        referrer: "https://www.codebuddy.ai/register/user/complete",
-        body: JSON.stringify({
-          attributes: {
-            countryCode: ["62"],
-            countryFullName: ["Indonesia"],
-            countryName: ["ID"],
-          },
-        }),
-      });
-
-      const text = await response.text().catch(() => "");
-      let data = null;
-      try {
-        data = text ? JSON.parse(text) : null;
-      } catch {
-        data = { raw: text };
-      }
-
-      if (response.ok && (!data || data.code === 0 || data.code === 200 || typeof data.code === "undefined")) {
-        return { action: "submitted_via_api" };
-      }
-
-      return {
-        action: "api_failed",
-        status: response.status,
-        code: data?.code,
-        message: data?.msg || data?.message || text || `HTTP ${response.status}`,
-      };
-    } catch (error) {
-      return {
-        action: "api_failed",
-        message: error?.message || "region submit request failed",
-      };
-    }
-  }).catch(() => null);
-
-  if (!result?.action) return false;
-
-  if (result.action === "submitted_via_api") {
-    reportStep("submitting_codebuddy_region", "Submitted CodeBuddy region via account API");
-    await page.waitForTimeout(1500);
-    return true;
-  }
-
-  reportStep(
-    "codebuddy_region_api_failed",
-    result.message
-      ? `CodeBuddy region API submit failed: ${result.message}`
-      : "CodeBuddy region API submit failed"
-  );
-  return false;
-}
-
-async function handleCodeBuddyRegionPageWithMouse(page, reportStep) {
-  if (!isProviderPage(page) || isGoogleAuthPage(page)) return false;
-
-  const isRegionPage = await page.locator(".page-region").first().count().then(Boolean).catch(() => false);
-  if (!isRegionPage) return false;
-
-  const optionPatterns = [
-    /indonesia|^id$|\u5370\u5ea6\u5c3c\u897f\u4e9a/i,
-    /singapore|^sg$|\u65b0\u52a0\u5761/i,
-    /japan|^jp$|\u65e5\u672c/i,
-    /thailand|^th$|\u6cf0\u56fd/i,
-    /global|international|default/i,
-  ];
-
-  const submitClicked = await clickFirstVisibleLocatorCenter(page, [
-    ".page-region [class*='28B894']",
-    ".page-region button:has-text('Get started')",
-    ".page-region button:has-text('Start')",
-    ".page-region button:has-text('Submit')",
-    ".page-region button:has-text('Continue')",
-    ".page-region [role='button']:has-text('Get started')",
-    ".page-region [role='button']:has-text('Start')",
-    ".page-region [role='button']:has-text('Submit')",
-    ".page-region [role='button']:has-text('Continue')",
-  ]);
-  if (submitClicked) {
-    reportStep("submitting_codebuddy_region", "Submitted CodeBuddy region selection");
-    await page.waitForTimeout(1200);
-    return true;
-  }
-
-  const visibleOption = await clickVisibleLocatorByText(
-    page,
-    "ul.dropdown-section li, .dropdown-section li, [role='option'], .t-select-option, [class*='option']",
-    optionPatterns
-  );
-  if (visibleOption) {
-    reportStep("selecting_codebuddy_region", `Selected CodeBuddy region: ${visibleOption}`);
-    await page.waitForTimeout(900);
-    return true;
-  }
-
-  const opened = await clickFirstVisibleLocatorCenter(page, [
-    ".page-region .t-select",
-    ".page-region [class*='t-select']",
-    ".page-region [role='combobox']",
-    ".page-region input[placeholder]",
-    ".page-region [class*='select']",
-    ".page-region [class*='cursor-pointer']",
-  ]);
-  if (!opened) return false;
-
-  reportStep("opening_codebuddy_region_selector", "Opening CodeBuddy region selector");
-  await page.waitForTimeout(600);
-
-  const openedOption = await clickVisibleLocatorByText(
-    page,
-    "ul.dropdown-section li, .dropdown-section li, [role='option'], .t-select-option, [class*='option']",
-    optionPatterns
-  );
-  if (openedOption) {
-    reportStep("selecting_codebuddy_region", `Selected CodeBuddy region: ${openedOption}`);
-    await page.waitForTimeout(900);
-  }
-
-  return true;
-}
-
-async function handleCodeBuddyRegionPage(page, reportStep) {
-  if (!isProviderPage(page) || isGoogleAuthPage(page)) return false;
-
-  const handledViaApi = await handleCodeBuddyRegionPageViaApi(page, reportStep);
-  if (handledViaApi) return true;
-
-  const handledWithMouse = await handleCodeBuddyRegionPageWithMouse(page, reportStep);
-  if (handledWithMouse) return true;
-
-  for (const scope of getInteractionScopes(page)) {
-    const result = await scope.evaluate(() => {
-      const visible = (element) => {
-        if (!(element instanceof HTMLElement)) return false;
-        const style = window.getComputedStyle(element);
-        if (style.visibility === "hidden" || style.display === "none" || Number(style.opacity) === 0) return false;
-        const rect = element.getBoundingClientRect();
-        return rect.width > 0 && rect.height > 0;
-      };
-
-      const root = document.querySelector(".page-region");
-      const bodyText = document.body?.innerText || "";
-      const looksLikeRegionPage = root
-        || /select\s+region|region|country|area|get started|complete/i.test(bodyText);
-      if (!looksLikeRegionPage) return null;
-
-      const clickElement = (element) => {
-        element.scrollIntoView({ block: "center", inline: "center" });
-        for (const type of ["pointerdown", "mousedown", "pointerup", "mouseup", "click"]) {
-          element.dispatchEvent(new MouseEvent(type, {
-            bubbles: true,
-            cancelable: true,
-            view: window,
-            buttons: type.endsWith("down") ? 1 : 0,
-          }));
-        }
-      };
-
-      const optionPatterns = [
-        /indonesia|^id$|\u5370\u5ea6\u5c3c\u897f\u4e9a/i,
-        /singapore|^sg$|\u65b0\u52a0\u5761/i,
-        /japan|^jp$|\u65e5\u672c/i,
-        /thailand|^th$|\u6cf0\u56fd/i,
-        /global|international|default/i,
-      ];
-
-      const searchRoot = root || document.body;
-      const submitSelectors = [
-        "button",
-        "[role='button']",
-        "input[type='submit']",
-        ".t-button",
-        "[class*='button']",
-        "[class*='28B894']",
-      ];
-      const submitButtons = [...searchRoot.querySelectorAll(submitSelectors.join(","))]
-        .filter(visible)
-        .filter((element) => {
-          const text = `${element.innerText || ""} ${element.getAttribute("aria-label") || ""} ${element.getAttribute("value") || ""}`;
-          const className = element.getAttribute("class") || "";
-          return /submit|start|continue|confirm|done|get started|complete|\u5b8c\u6210|\u5f00\u59cb|\u786e\u5b9a|\u4e0b\u4e00\u6b65/i.test(text)
-            || className.includes("28B894");
-        });
-
-      if (submitButtons.length) {
-        clickElement(submitButtons[0]);
-        return { action: "submitted" };
-      }
-
-      const optionSelectors = [
-        "ul.dropdown-section li",
-        ".dropdown-section li",
-        "[role='option']",
-        ".t-select-option",
-        "[class*='option']",
-        "[class*='dropdown'] li",
-      ];
-      const options = [...document.querySelectorAll(optionSelectors.join(","))]
-        .filter(visible)
-        .filter((element) => (element.innerText || element.textContent || "").trim());
-
-      if (options.length) {
-        const option = optionPatterns
-          .map((pattern) => options.find((element) => pattern.test((element.innerText || element.textContent || "").trim())))
-          .find(Boolean) || options[0];
-        const label = (option.innerText || option.textContent || "").trim();
-        clickElement(option);
-        return { action: "selected", label };
-      }
-
-      const controlSelectors = [
-        "[role='combobox']",
-        ".t-select",
-        "[class*='t-select']",
-        "[class*='select']",
-        "input[placeholder]",
-        ".text-sm",
-        "[class*='cursor-pointer']",
-      ];
-      const controls = [...searchRoot.querySelectorAll(controlSelectors.join(","))]
-        .filter(visible)
-        .filter((element) => {
-          const text = `${element.innerText || ""} ${element.getAttribute("placeholder") || ""} ${element.getAttribute("aria-label") || ""}`;
-          return /region|country|area|select|placeholder|\u5730\u533a|\u56fd\u5bb6|\u9009\u62e9/i.test(text)
-            || element.matches?.(".t-select,[class*='t-select'],input[placeholder],[class*='select']");
-        });
-
-      if (controls.length) {
-        clickElement(controls[0]);
-        return { action: "opened" };
-      }
-
-      return null;
-    }).catch(() => null);
-
-    if (!result?.action) continue;
-
-    if (result.action === "selected") {
-      reportStep("selecting_codebuddy_region", `Selected CodeBuddy region${result.label ? `: ${result.label}` : ""}`);
-      await page.waitForTimeout(700);
-      return true;
-    }
-
-    if (result.action === "submitted") {
-      reportStep("submitting_codebuddy_region", "Submitted CodeBuddy region selection");
-      await page.waitForTimeout(1200);
-      return true;
-    }
-
-    reportStep("opening_codebuddy_region_selector", "Opening CodeBuddy region selector");
-    await page.waitForTimeout(700);
-    return true;
-  }
-
-  return false;
-}
-
-async function handleCodeBuddyStartedAuthorization(page, reportStep) {
-  if (!isProviderPage(page) || isGoogleAuthPage(page)) return false;
-
-  const result = await page.evaluate(async () => {
-    const url = new URL(window.location.href);
-    if (!/\/started\/?$/.test(url.pathname)) return null;
-
-    const platform = url.searchParams.get("platform") || "CLI";
-    const state = url.searchParams.get("state");
-    if (!state) return null;
-
-    const domains = [window.location.hostname || "www.codebuddy.ai"].filter(Boolean);
-    for (const domain of [...new Set(domains)]) {
-      const authUrl = new URL("/console/auth/login", window.location.origin);
-      authUrl.searchParams.set("platform", platform);
-      authUrl.searchParams.set("state", state);
-      authUrl.searchParams.set("domain", domain);
-
-      try {
-        const response = await fetch(authUrl.toString(), {
-          method: "GET",
-          credentials: "include",
-          redirect: "manual",
-          headers: {
-            "x-requested-with": "XMLHttpRequest",
-            "X-Domain": domain,
-          },
-        });
-        if (response.type === "opaqueredirect" || (response.status >= 300 && response.status < 400)) {
-          return { action: "attempted", domain, message: "redirected" };
-        }
-        const text = await response.text();
-        let data = null;
-        try {
-          data = text ? JSON.parse(text) : null;
-        } catch {
-          data = { raw: text };
-        }
-        if (response.ok && (!data || data.code === 0 || data.code === 200 || typeof data.code === "undefined")) {
-          return { action: "authorized", domain };
-        }
-        if (response.ok) {
-          return { action: "attempted", domain, code: data?.code, message: data?.msg || data?.message || "" };
-        }
-      } catch (error) {
-        // Try the next domain variant.
-      }
-    }
-
-    return { action: "failed" };
-  }).catch(() => null);
-
-  if (!result?.action || result.action === "failed") return false;
-
-  if (result.action === "authorized") {
-    reportStep("authorizing_codebuddy_cli_state", "Authorized CodeBuddy CLI login state");
-    await page.waitForTimeout(1200);
-    return true;
-  }
-
-  reportStep(
-    "authorizing_codebuddy_cli_state",
-    result.message
-      ? `Attempted CodeBuddy CLI login state authorization: ${result.message}`
-      : "Attempted CodeBuddy CLI login state authorization"
-  );
-  await page.waitForTimeout(1200);
-  return true;
-}
-
-async function providerHasGoogleLogin(page) {
-  try {
-    for (const name of [/continue with google/i, /sign in with google/i, /sign up with google/i, /^google$/i]) {
-      const btn = page.getByRole("button", { name }).first();
-      if (await btn.isVisible({ timeout: 300 }).catch(() => false)) return true;
-      const link = page.getByRole("link", { name }).first();
-      if (await link.isVisible({ timeout: 200 }).catch(() => false)) return true;
-    }
-  } catch {
-    /* ignore */
-  }
-  for (const selector of GOOGLE_LOGIN_BUTTON_SELECTORS) {
-    try {
-      const loc = page.locator(selector).first();
-      if (await loc.isVisible({ timeout: 200 }).catch(() => false)) return true;
-    } catch {
-      /* next */
-    }
-  }
-  return false;
-}
-
-function isXaiProviderPage(page) {
-  try {
-    const host = new URL(page.url()).hostname || "";
-    return host === "accounts.x.ai" || host === "auth.x.ai" || host.endsWith(".x.ai")
-      || host === "grok.com" || host.endsWith(".grok.com");
-  } catch {
-    return false;
-  }
-}
-
-async function handleProviderOnboarding(page, reportStep, serviceLabel) {
-  if (!isProviderPage(page) || isGoogleAuthPage(page)) return false;
-
-  const confirmedPrivacy = await clickFirstActionable(page, PRIVACY_CONFIRM_BUTTON_SELECTORS);
-  if (confirmedPrivacy) {
-    reportStep("accepting_provider_privacy_dialog", `Confirmed ${serviceLabel} privacy or terms dialog`);
-    await page.waitForTimeout(800);
-    return true;
-  }
-
-  const handledCodeBuddyStarted = await handleCodeBuddyStartedAuthorization(page, reportStep);
-  if (handledCodeBuddyStarted) {
-    return true;
-  }
-
-  const handledCodeBuddyRegion = await handleCodeBuddyRegionPage(page, reportStep);
-  if (handledCodeBuddyRegion) {
-    return true;
-  }
-
-  // Region / workspace defaults are CodeBuddy-style — not xAI device approve.
-  // False-positive select matches on xAI wasted the session into "Invalid action".
-  if (!isXaiProviderPage(page)) {
-    const selectedNativeRegion = await selectNativeRegionOption(page);
-    if (selectedNativeRegion) {
-      reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
-      await page.waitForTimeout(700);
-      return true;
-    }
-
-    const openedRegionMenu = await clickFirstActionable(page, PROVIDER_REGION_TRIGGER_SELECTORS);
-    if (openedRegionMenu) {
-      reportStep("opening_provider_region_selector", `Opening ${serviceLabel} region selector`);
-      await page.waitForTimeout(500);
-      const selectedRegion = await clickFirstActionable(page, PROVIDER_REGION_OPTION_SELECTORS);
-      if (selectedRegion) {
-        reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
-        await page.waitForTimeout(700);
-      }
-      return true;
-    }
-
-    const selectedRegion = await clickFirstActionable(page, PROVIDER_REGION_OPTION_SELECTORS);
-    if (selectedRegion) {
-      reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
-      await page.waitForTimeout(700);
-      return true;
-    }
-
-    const filledDefaults = await fillProviderOnboardingDefaults(page);
-    if (filledDefaults) {
-      reportStep("filling_provider_onboarding", `Filled ${serviceLabel} onboarding defaults`);
-      await page.waitForTimeout(500);
-      return true;
-    }
-  }
-
-  // xAI device pages: never click generic Continue/Next/Confirm. Those submit
-  // the device form without a session → "Invalid action" and burn 1–3 minutes.
-  // Only Google SSO (login gate) + Allow/Authorize (clickXaiDeviceAuthorize).
-  if (isXaiProviderPage(page)) {
-    return false;
-  }
-
-  // Cloudflare dashboard / login: "Allow All" cookie + "Sign in" must not be
-  // treated as provider onboarding Continues.
-  try {
-    const host = new URL(page.url()).hostname || "";
-    if (host === "dash.cloudflare.com" || host.endsWith(".cloudflare.com")) {
-      return false;
-    }
-  } catch {
-    /* ignore */
-  }
-
-  // If Google SSO is still offered, do not mash generic Continue.
-  if (await providerHasGoogleLogin(page)) {
-    return false;
-  }
-
-  const clickedAction = await clickFirstActionable(page, PROVIDER_ONBOARDING_ACTION_SELECTORS);
-  if (clickedAction) {
-    reportStep("continuing_provider_onboarding", `Continuing ${serviceLabel} onboarding`);
-    await page.waitForTimeout(1000);
-    return true;
-  }
-
-  return false;
-}
-
-/**
- * xAI device step 1: "Enter the code shown in your terminal" → Continue.
- * Only after this do we land on sign-in with "Login with Google".
- * Never run this after Google login — that re-submits Continue into Invalid action.
- */
-async function handleXaiDeviceCodeConfirm(page, reportStep, { alreadyAuthed = false } = {}) {
-  if (!isXaiProviderPage(page)) return false;
-  if (alreadyAuthed) return false;
-  // Already on Google SSO wall — past this step.
-  if (await providerHasGoogleLogin(page)) return false;
-
-  const text = await readPageText(page).catch(() => "");
-  // Logged-in device/approve screens — do not re-click Continue.
-  if (/sign out|log out|device authorized|you can close|invalid action/i.test(text)) {
-    return false;
-  }
-
-  const isCodeConfirm =
-    /enter the code shown in your terminal/i.test(text)
-    || /only enter this code if you just initiated/i.test(text)
-    || (/sign in to grok/i.test(text) && /continue/i.test(text) && !/login with/i.test(text));
-  if (!isCodeConfirm) return false;
-
-  const fromUrl = page.url?.() || "";
-  let clicked = false;
-  try {
-    const btn = page.getByRole("button", { name: /^Continue$/i }).first();
-    if (await btn.isVisible({ timeout: 300 }).catch(() => false)) {
-      await btn.click({ timeout: 5_000 });
-      clicked = true;
-    }
-  } catch {
-    /* fall through */
-  }
-  if (!clicked) {
-    clicked = await clickFirstActionable(page, [
-      'button[type="submit"]:has-text("Continue")',
-      'button:has-text("Continue")',
-    ]);
-  }
-  if (!clicked) return false;
-
-  reportStep?.("confirming_device_code", "Confirmed device user code on xAI");
-  // Event-driven: next screen is Login with Google or URL change — no fixed 1.2s sleep.
-  // GOOGLE_LOGIN_BUTTON_SELECTORS is a string[] — never .split() it.
-  await waitForPageAdvance(page, {
-    fromUrl,
-    urlMatch: (u) => /sign-in|login|oauth/i.test(u) && u !== fromUrl,
-    selector: [
-      ...GOOGLE_LOGIN_BUTTON_SELECTORS.slice(0, 8),
-      'button:has-text("Login with Google")',
-      'button:has-text("Login with email")',
-    ].join(", "),
-    timeout: 10_000,
-  });
-  return true;
-}
-
-/**
- * Click a Google SSO control without waiting for the cross-origin navigation.
- *
- * Playwright's default click() waits for navigations started by the action.
- * CF → accounts.google.com through a residential proxy often exceeds 5s, so the
- * click "fails" even though OAuth already started — then we re-click for 30–40s.
- */
-async function clickSsoControl(page, locator) {
-  const enabled = await locator.isEnabled().catch(() => true);
-  if (!enabled) return false;
-  await locator.scrollIntoViewIfNeeded().catch(() => null);
-  const clicked = await locator
-    .click({ timeout: 2_500, force: true, noWaitAfter: true })
-    .then(() => true)
-    .catch(() => false);
-  if (clicked) return true;
-  // Trusted mouse path (also does not wait on navigation).
-  return clickLocatorCenter(page, locator).catch(() => false);
-}
-
-async function clickGoogleLoginRole(page) {
-  // Role-based matches are more reliable on SPA auth shells (xAI, CF, etc.)
-  // than CSS :has-text alone — especially when the label is nested / aria-only.
-  const roleNames = [
-    /continue with google/i,
-    /login with google/i,
-    /log in with google/i,
-    /sign up with google/i,
-    /sign in with google/i,
-    /^google$/i,
-  ];
-  for (const name of roleNames) {
-    try {
-      const btn = page.getByRole("button", { name }).first();
-      if (await btn.isVisible({ timeout: 250 }).catch(() => false)) {
-        if (await clickSsoControl(page, btn)) return true;
-      }
-    } catch {
-      /* next */
-    }
-    try {
-      const link = page.getByRole("link", { name }).first();
-      if (await link.isVisible({ timeout: 200 }).catch(() => false)) {
-        if (await clickSsoControl(page, link)) return true;
-      }
-    } catch {
-      /* next */
-    }
-  }
-  // Cloudflare: button text "Google", aria-label "Continue with Google"
-  try {
-    const ariaBtn = page.locator('button[aria-label*="Google" i]').first();
-    if (await ariaBtn.isVisible({ timeout: 200 }).catch(() => false)) {
-      if (await clickSsoControl(page, ariaBtn)) return true;
-    }
-  } catch {
-    /* ignore */
-  }
-  // Last resort: CSS text match with noWaitAfter
-  try {
-    const textBtn = page.locator('button:has-text("Google")').first();
-    if (await textBtn.isVisible({ timeout: 150 }).catch(() => false)) {
-      if (await clickSsoControl(page, textBtn)) return true;
-    }
-  } catch {
-    /* ignore */
-  }
-  return false;
-}
-
-async function ensureProviderTermsChecked(page, reportStep) {
-  // Returns true only when we newly checked a box (not when already checked).
-  for (const scope of getInteractionScopes(page)) {
-    for (const selector of TERMS_CHECKBOX_SELECTORS) {
-      try {
-        const locator = scope.locator(selector).first();
-        const count = await locator.count().catch(() => 0);
-        if (!count) continue;
-        const visible = await locator.isVisible().catch(() => false);
-        if (!visible) continue;
-        const already = await locator.isChecked().catch(() => false);
-        if (already) return false;
-        const did = await locator.check({ force: true, timeout: 3_000 }).then(() => true).catch(() => false)
-          || await locator.click({ force: true, timeout: 3_000 }).then(() => true).catch(() => false);
-        if (did) {
-          reportStep?.("accepting_provider_terms", "Accepted provider terms for Google login");
-          // Wait until Google button enables — not a blind sleep.
-          await waitUntil(
-            async () => {
-              try {
-                const btn = page.getByRole("button", { name: /google/i }).first();
-                return (await btn.isVisible().catch(() => false))
-                  && (await btn.isEnabled().catch(() => true));
-              } catch {
-                return true;
-              }
-            },
-            { timeout: 2_000, interval: 80 },
-          );
-          return true;
-        }
-      } catch {
-        /* next */
-      }
-    }
-  }
-  return false;
-}
-
-async function handleProviderLoginGate(page, reportStep, { allowGoogleClick = true } = {}) {
-  if (isGoogleAuthPage(page)) return false;
-
-  await dismissCookieBanners(page, reportStep);
-
-  const confirmedExistingDialog = await clickFirstActionable(page, PRIVACY_CONFIRM_BUTTON_SELECTORS);
-  if (confirmedExistingDialog) {
-    reportStep("accepting_provider_privacy_dialog", "Confirmed provider privacy agreement dialog");
-    return true;
-  }
-
-  // Always try terms first — but do NOT treat "already checked" as progress.
-  // Returning true every loop on an already-checked box blocked Google re-click
-  // for ~30–60s after a failed first SSO attempt.
-  const newlyCheckedTerms = await ensureProviderTermsChecked(page, reportStep);
-
-  if (!allowGoogleClick) {
-    return newlyCheckedTerms;
-  }
-
-  // Prefer explicit Google SSO over generic Continue (device code pages
-  // often have both — clicking Continue without a session yields invalid_code).
-  // Cloudflare: click Google SSO only — never the CF email "Sign in" form.
-  const clickedGoogleRole = await clickGoogleLoginRole(page);
-  let clickedGoogle = clickedGoogleRole;
-  if (!clickedGoogle) {
-    // Selector fallback with noWaitAfter (clickFirstActionable waits on nav — bad for SSO).
-    for (const selector of GOOGLE_LOGIN_BUTTON_SELECTORS.slice(0, 16)) {
-      try {
-        const loc = page.locator(selector).first();
-        if (await loc.isVisible({ timeout: 100 }).catch(() => false)) {
-          if (await clickSsoControl(page, loc)) {
-            clickedGoogle = true;
-            break;
-          }
-        }
-      } catch {
-        /* next */
-      }
-    }
-  }
-  if (clickedGoogle) {
-    reportStep("selecting_google_login", "Selecting Google login");
-
-    const confirmedDialog = await clickFirstActionable(page, PRIVACY_CONFIRM_BUTTON_SELECTORS);
-    if (confirmedDialog) {
-      reportStep("accepting_provider_privacy_dialog", "Confirmed provider privacy agreement dialog");
-    }
-
-    // Wait for OAuth redirect to Google (or email field) — event-driven.
-    // CF→Google through proxy can take a few seconds; click already returned (noWaitAfter).
-    const onCf = isCloudflareLoginUrl(page.url?.() || "");
-    const reached = await waitForPageAdvance(page, {
-      urlMatch: (u) => isGoogleHostname(u),
-      selector: EMAIL_INPUT_SELECTOR,
-      timeout: onCf ? 10_000 : 12_000,
-    });
-    if (reached || isGoogleAuthPage(page)) {
-      reportStep("google_login_page", "Reached Google sign-in after provider SSO");
-    } else {
-      // Popup-based Google SSO
-      try {
-        const ctx = page.context?.();
-        const pages = ctx?.pages?.() || [];
-        for (let i = pages.length - 1; i >= 0; i -= 1) {
-          const p = pages[i];
-          const u = p.url?.() || "";
-          if (isGoogleHostname(u)) {
-            reportStep("google_login_popup", "Google sign-in opened in a popup");
-            break;
-          }
-        }
-      } catch {
-        /* ignore */
-      }
-    }
-
-    return true;
-  }
-
-  return newlyCheckedTerms;
-}
-
-/** Fast path for xAI device approve after Google session exists. */
-async function clickXaiDeviceAuthorize(page, reportStep) {
-  if (!isXaiProviderPage(page)) return false;
-  // Never approve while Google SSO is still on the page — that was thrashing
-  // Continue / Allow before login and landing on "Invalid action".
-  if (await providerHasGoogleLogin(page)) return false;
-
-  // Prefer exact authorize verbs — avoid bare "Continue" (too many false hits).
-  const roles = [
-    /^(Allow|Authorize|Approve|Confirm)$/i,
-    /^(Allow|Authorize|Approve)\b/i,
-  ];
-  for (const re of roles) {
-    try {
-      const btn = page.getByRole("button", { name: re }).first();
-      if (await btn.isVisible({ timeout: 200 }).catch(() => false)) {
-        const label = (await btn.innerText().catch(() => "")) || "";
-        if (/google/i.test(label)) continue;
-        await btn.click({ timeout: 3_000 });
-        reportStep?.("approving_consent", "Approving xAI device authorization");
-        return true;
-      }
-    } catch {
-      /* next */
-    }
-  }
-  return false;
-}
-
-/**
- * Capture Kiro OAuth callback (kiro://…?code=…).
- *
- * After password, Google parks the main frame on empty SetSID while the network
- * completes consent → Cognito idpresponse → 302 Location: kiro://…. Custom-protocol
- * redirects often never become a page navigation, so we listen on:
- *   - page + context request / requestfailed / response (Location header)
- *   - CDP Network (most reliable on headed Chromium / SetSID)
- *
- * Never force-navigate idpresponse/consent from the monitor — that aborts the
- * natural hop before kiro:// is emitted.
- */
-export function createKiroCallbackMonitor(context, page, timeoutMs = DEFAULT_MANUAL_TIMEOUT_MS) {
-  let resolveOuter;
-  let rejectOuter;
-  const promise = new Promise((resolve, reject) => {
-    resolveOuter = resolve;
-    rejectOuter = reject;
-  });
-
-  let settled = false;
-  const trackedPages = new Set();
-  const contextCleanups = new Map();
-  const timeoutHandle = setTimeout(() => {
-    settle(null, new Error("Timed out waiting for Kiro callback"));
-  }, timeoutMs);
-
-  function settle(result, error = null) {
-    if (settled) return;
-    settled = true;
-    clearTimeout(timeoutHandle);
-    for (const fns of contextCleanups.values()) {
-      for (const fn of fns) {
-        try { fn(); } catch {}
-      }
-    }
-    contextCleanups.clear();
-    if (error) rejectOuter(error);
-    else resolveOuter(result);
-  }
-
-  function trySettleFromUrl(rawUrl) {
-    const parsed = parseCallbackUrl(rawUrl || "");
-    if (parsed) settle(parsed);
-    return Boolean(parsed);
-  }
-
-  function trySettleFromResponse(response) {
-    try {
-      trySettleFromUrl(response?.url?.() || "");
-      const headers = typeof response?.headers === "function" ? response.headers() : null;
-      const location = headers?.location || headers?.Location || "";
-      if (location) trySettleFromUrl(location);
-    } catch {
-      /* ignore */
-    }
-  }
-
-  function attachCdpNetwork(trackedPage, ownerCleanups) {
-    void (async () => {
-      try {
-        if (settled) return;
-        const ctx = trackedPage.context?.();
-        if (!ctx?.newCDPSession) return;
-        const session = await ctx.newCDPSession(trackedPage);
-        await session.send("Network.enable").catch(() => null);
-
-        const onCdpResponse = (params) => {
-          try {
-            const headers = params?.response?.headers || {};
-            const loc = headers.location || headers.Location || "";
-            if (loc) trySettleFromUrl(loc);
-            trySettleFromUrl(params?.response?.url || "");
-          } catch {
-            /* ignore */
-          }
-        };
-        const onCdpRequest = (params) => {
-          try {
-            trySettleFromUrl(params?.request?.url || "");
-          } catch {
-            /* ignore */
-          }
-        };
-
-        session.on("Network.responseReceived", onCdpResponse);
-        session.on("Network.requestWillBeSent", onCdpRequest);
-        ownerCleanups.push(() => {
-          try { session.off?.("Network.responseReceived", onCdpResponse); } catch {}
-          try { session.off?.("Network.requestWillBeSent", onCdpRequest); } catch {}
-          void session.detach?.().catch(() => null);
-        });
-      } catch {
-        /* CDP unavailable — page/context listeners remain */
-      }
-    })();
-  }
-
-  function registerPage(trackedPage, ownerCleanups) {
-    if (!trackedPage || trackedPages.has(trackedPage)) return;
-    trackedPages.add(trackedPage);
-
-    const onFrame = (frame) => trySettleFromUrl(frame?.url?.() || "");
-    const onRequest = (request) => trySettleFromUrl(request?.url?.() || "");
-    const onRequestFailed = (request) => trySettleFromUrl(request?.url?.() || "");
-    const onResponse = (response) => trySettleFromResponse(response);
-    const onLoadState = () => trySettleFromUrl(trackedPage.url?.() || "");
-    const onClose = () => {
-      settle(null, new Error("Browser session closed while waiting for Kiro callback"));
-    };
-
-    trackedPage.on("framenavigated", onFrame);
-    trackedPage.on("request", onRequest);
-    trackedPage.on("requestfailed", onRequestFailed);
-    trackedPage.on("response", onResponse);
-    trackedPage.on("domcontentloaded", onLoadState);
-    trackedPage.on("load", onLoadState);
-    trackedPage.on("close", onClose);
-
-    ownerCleanups.push(() => {
-      trackedPage.off("framenavigated", onFrame);
-      trackedPage.off("request", onRequest);
-      trackedPage.off("requestfailed", onRequestFailed);
-      trackedPage.off("response", onResponse);
-      trackedPage.off("domcontentloaded", onLoadState);
-      trackedPage.off("load", onLoadState);
-      trackedPage.off("close", onClose);
-    });
-
-    attachCdpNetwork(trackedPage, ownerCleanups);
-
-    const current = parseCallbackUrl(trackedPage.url?.() || "");
-    if (current) settle(current);
-  }
-
-  function bind(ctx, pg) {
-    if (settled) return;
-    if (contextCleanups.has(ctx)) return;
-    const cleanups = [];
-    contextCleanups.set(ctx, cleanups);
-
-    const onPage = (newPage) => registerPage(newPage, cleanups);
-    const onClose = () => {
-      settle(null, new Error("Browser context closed while waiting for Kiro callback"));
-    };
-    const onCtxRequest = (request) => trySettleFromUrl(request?.url?.() || "");
-    const onCtxRequestFailed = (request) => trySettleFromUrl(request?.url?.() || "");
-    const onCtxResponse = (response) => trySettleFromResponse(response);
-
-    ctx.on("page", onPage);
-    ctx.on("close", onClose);
-    ctx.on("request", onCtxRequest);
-    ctx.on("requestfailed", onCtxRequestFailed);
-    ctx.on("response", onCtxResponse);
-    cleanups.push(() => ctx.off("page", onPage));
-    cleanups.push(() => ctx.off("close", onClose));
-    cleanups.push(() => ctx.off("request", onCtxRequest));
-    cleanups.push(() => ctx.off("requestfailed", onCtxRequestFailed));
-    cleanups.push(() => ctx.off("response", onCtxResponse));
-
-    if (pg) registerPage(pg, cleanups);
-  }
-
-  bind(context, page);
-
-  promise.rebind = ({ context: newContext, page: newPage } = {}) => {
-    if (newContext) bind(newContext, newPage);
-  };
-
-  promise.abort = (reason = "Job cancelled") => {
-    settle(null, new Error(reason));
-  };
-
-  return promise;
-}
-
-// Parse any OAuth redirect callback URL (e.g. http://localhost:8080/callback?code=...)
-// against a configurable prefix. Returns { callbackUrl, code, state } or null.
-function parseCallbackUrlWithPrefix(rawUrl, prefix) {
-  if (!rawUrl || !prefix || !rawUrl.startsWith(prefix)) return null;
-  const queryIndex = rawUrl.indexOf("?");
-  const params = new URLSearchParams(queryIndex >= 0 ? rawUrl.slice(queryIndex + 1) : "");
-  const code = params.get("code");
-  const state = params.get("state");
-  if (!code) return null;
-  return { callbackUrl: rawUrl, code, state };
-}
-
-// Generic version of createKiroCallbackMonitor for authorization_code providers
-// whose redirect_uri is an http(s) loopback (e.g. Antigravity → http://localhost:8080/callback).
-// The browser may fail to actually load the loopback (connection refused), but the
-// request/framenavigated/requestfailed events still fire with the URL+code, which we capture.
-export function createGenericCallbackMonitor(context, page, { prefix, timeoutMs = DEFAULT_MANUAL_TIMEOUT_MS } = {}) {
-  let resolveOuter;
-  let rejectOuter;
-  const promise = new Promise((resolve, reject) => {
-    resolveOuter = resolve;
-    rejectOuter = reject;
-  });
-
-  let settled = false;
-  const trackedPages = new Set();
-  const contextCleanups = new Map();
-  const timeoutHandle = setTimeout(() => {
-    settle(null, new Error("Timed out waiting for OAuth callback"));
-  }, timeoutMs);
-
-  function settle(result, error = null) {
-    if (settled) return;
-    settled = true;
-    clearTimeout(timeoutHandle);
-    for (const fns of contextCleanups.values()) {
-      for (const fn of fns) {
-        try { fn(); } catch {}
-      }
-    }
-    contextCleanups.clear();
-    if (error) rejectOuter(error);
-    else resolveOuter(result);
-  }
-
-  function registerPage(trackedPage, ownerCleanups) {
-    if (!trackedPage || trackedPages.has(trackedPage)) return;
-    trackedPages.add(trackedPage);
-
-    const check = (url) => {
-      const parsed = parseCallbackUrlWithPrefix(url || "", prefix);
-      if (parsed) settle(parsed);
-    };
-    const onFrame = (frame) => check(frame?.url?.() || "");
-    const onRequest = (request) => check(request?.url?.() || "");
-    const onRequestFailed = (request) => check(request?.url?.() || "");
-    const onLoadState = () => check(trackedPage.url?.() || "");
-
-    trackedPage.on("framenavigated", onFrame);
-    trackedPage.on("request", onRequest);
-    trackedPage.on("requestfailed", onRequestFailed);
-    trackedPage.on("domcontentloaded", onLoadState);
-    trackedPage.on("load", onLoadState);
-
-    ownerCleanups.push(() => {
-      trackedPage.off("framenavigated", onFrame);
-      trackedPage.off("request", onRequest);
-      trackedPage.off("requestfailed", onRequestFailed);
-      trackedPage.off("domcontentloaded", onLoadState);
-      trackedPage.off("load", onLoadState);
-    });
-
-    check(trackedPage.url?.() || "");
-  }
-
-  function bind(ctx, pg) {
-    if (settled) return;
-    if (contextCleanups.has(ctx)) return;
-    const cleanups = [];
-    contextCleanups.set(ctx, cleanups);
-    const onPage = (newPage) => registerPage(newPage, cleanups);
-    ctx.on("page", onPage);
-    cleanups.push(() => ctx.off("page", onPage));
-    if (pg) registerPage(pg, cleanups);
-  }
-
-  bind(context, page);
-  promise.rebind = ({ context: newContext, page: newPage } = {}) => {
-    if (newContext) bind(newContext, newPage);
-  };
-
-  return promise;
-}
-
-export async function runGoogleAccountAutomation({
-  page,
-  authUrl,
-  email,
-  password,
-  successPromise,
-  shortTimeoutMs = DEFAULT_SHORT_TIMEOUT_MS,
-  serviceLabel = "provider",
-  openingStep = "opening_google_oauth",
-  openingMessage = "Opening Google OAuth page",
-  successStep = "oauth_success_received",
-  successMessage = "OAuth success received",
-  onStep,
-  /** When true, skip page.goto(authUrl) — caller already navigated (e.g. CF pre-click Google). */
-  skipGoto = false,
-  /** Caller already clicked Google SSO; wait for accounts.google.com before re-clicking. */
-  expectGoogleSoon = false,
-}) {
-  const startTime = Date.now();
-  const reportStep = (step, message) => {
-    onStep?.(step, message);
-  };
-
-  const interstitialOpts = (maxWaitMs) => ({ maxWaitMs, successPromise });
-  // Prevent re-submitting email/password while Google is still transitioning
-  // (pwd page stays mounted ~1–3s after Next; re-fill aborts the OAuth chain).
-  let passwordSubmittedAt = 0;
-  let emailSubmittedAt = 0;
-  let googleLoginSelectedAt = 0;
-  let seenGoogleAuth = false;
-  let deviceApproveAt = 0;
-  let deviceInvalidReopenAt = 0;
-  let deviceInvalidReopenCount = 0;
-  // Cooldowns prevent double-submit only — not artificial pacing.
-  const PASSWORD_RESUBMIT_COOLDOWN_MS = isGrokish(serviceLabel) ? 6_000 : 18_000;
-  // Longer email cooldown for fast bulk — Google identifier page can sit 5–10s
-  // after Next; re-typing the whole email wastes another 10–15s.
-  const EMAIL_RESUBMIT_COOLDOWN_MS = isGrokish(serviceLabel) ? 12_000 : 8_000;
-  const GOOGLE_SSO_COOLDOWN_MS = isGrokish(serviceLabel) ? 3_000 : 8_000;
-  // Don't hammer Allow — xAI rate_limits rapid device posts.
-  const DEVICE_APPROVE_COOLDOWN_MS = 3_000;
-  const DEVICE_INVALID_REOPEN_COOLDOWN_MS = 4_000;
-  const DEVICE_INVALID_REOPEN_MAX = 3;
-  const isGrokFlow = isGrokish(serviceLabel);
-  // Grok does not need the long Kiro SetSID / kiro:// interstitial window.
-  const postPasswordInterstitialMs = isGrokFlow ? 4_000 : 25_000;
-  // Loop poll: race successPromise — keep tiny so fast networks aren't stalled.
-  const loopTickMs = isGrokFlow ? 120 : 500;
-
-  let alreadyOnGoogle = skipGoto && isGoogleAuthPage(page);
-  if (!skipGoto) {
-    reportStep(openingStep, openingMessage);
-    await page.goto(authUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-    await dismissCookieBanners(page, reportStep);
-  } else if (alreadyOnGoogle) {
-    reportStep("google_login_page", "Already on Google sign-in — filling credentials");
-  } else if (expectGoogleSoon) {
-    // CF (etc.) already clicked Google — wait for redirect, do NOT re-goto / re-click yet.
-    reportStep("waiting_google_redirect", "Waiting for Google after provider SSO click");
-    const reached = await waitUntil(() => isGoogleAuthPage(page), {
-      timeout: 25_000,
-      interval: 100,
-    });
-    if (reached) {
-      alreadyOnGoogle = true;
-      googleLoginSelectedAt = Date.now();
-      reportStep("google_login_page", "Reached Google sign-in after provider SSO");
-    } else {
-      reportStep("google_redirect_slow", "Google redirect slow — will retry SSO click");
-    }
-  } else {
-    reportStep(openingStep, openingMessage);
-    await dismissCookieBanners(page, reportStep);
-  }
-
-  // Cloudflare login always shows email/password fields — do NOT treat those as
-  // "ready for Google email fill". Wait for Google SSO button / Google page only.
-  const onCfLogin = isCloudflareLoginUrl(page.url?.() || "") || /cloudflare/i.test(String(serviceLabel || ""));
-
-  if (!alreadyOnGoogle) {
-    await waitUntil(
-      async () => {
-        if (isGoogleAuthPage(page)) return true;
-        if (await getFirstVisibleLocator(
-          page,
-          'button[aria-label*="Google" i], button:has-text("Continue with Google"), button:has-text("Login with Google"), button:has-text("Google")',
-        )) {
-          return true;
-        }
-        if (!onCfLogin && (await getFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR))) {
-          return true;
-        }
-        if (!onCfLogin && (await getFirstVisibleLocator(page, 'button:has-text("Continue")'))) {
-          return true;
-        }
-        return false;
-      },
-      { timeout: isGrokFlow ? 8_000 : 12_000, interval: 80 },
-    );
-    if (!isGrokFlow) {
-      await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
-    }
-
-    // Provider shells (xAI device, CodeBuddy, Cloudflare, …) must pick Google SSO first.
-    // Never type credentials into provider email fields (CF has its own email/password).
-    for (let attempt = 0; attempt < (isGrokFlow || onCfLogin ? 8 : 2); attempt += 1) {
-      if (isGoogleAuthPage(page)) break;
-      await dismissCookieBanners(page, reportStep);
-      if (await handleXaiDeviceCodeConfirm(page, reportStep)) {
-        continue;
-      }
-      if (await handleProviderLoginGate(page, reportStep)) {
-        googleLoginSelectedAt = Date.now();
-        if (isGoogleAuthPage(page)) break;
-        // Gate already waited for Google URL; only brief yield if still on provider.
-        await yieldMs(50);
-        continue;
-      }
-      // SPA not ready — poll for Google SSO (not CF email form).
-      const ready = await waitUntil(
-        async () =>
-          isGoogleAuthPage(page)
-          || (await providerHasGoogleLogin(page))
-          || /enter the code|login with google|continue with google/i.test(
-            await readPageText(page).catch(() => ""),
-          ),
-        { timeout: 600, interval: 80 },
-      );
-      if (!ready) await yieldMs(80);
-    }
-    if (!isGrokFlow) {
-      await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(6_000));
-    }
-  }
-
-  // Only fill Google email once we are actually on accounts.google.com.
-  if (isGoogleAuthPage(page)) {
-    seenGoogleAuth = true;
-    const emailInput = await waitForFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR, { timeout: 10_000 });
-    if (emailInput) {
-      reportStep("entering_email", "Entering Google email");
-      const filled = await fillInputResilient(emailInput, email);
-      if (!filled) {
-        reportStep("email_fill_failed", "Could not fill the Google email field; will retry in the polling loop");
-      } else {
-        reportStep("submitting_email", "Submitting email");
-        await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
-        emailSubmittedAt = Date.now();
-        // Wait for password field (or leave email step) — not fixed sleep.
-        await waitForPageAdvance(page, {
-          selector: PASSWORD_INPUT_SELECTOR,
-          timeout: isGrokFlow ? 8_000 : 12_000,
-        });
-        if (!isGrokFlow) {
-          await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
-        }
-      }
-    }
-  } else if (isProviderPage(page)) {
-    reportStep(
-      "waiting_for_google_sso",
-      `Provider page still open (${(page.url?.() || "").slice(0, 80)}) — will keep selecting Google login`,
-    );
-  }
-
-  while (Date.now() - startTime < shortTimeoutMs) {
-    const successResult = await Promise.race([
-      successPromise.then((result) => ({ kind: "success", result })).catch((error) => ({ kind: "success_error", error })),
-      new Promise((resolve) => setTimeout(() => resolve(null), loopTickMs)),
-    ]);
-
-    if (successResult?.kind === "success") {
-      reportStep(successStep, successMessage);
-      return {
-        status: "success",
-        ...successResult.result,
-      };
-    }
-
-    if (successResult?.kind === "success_error") {
-      reportStep("oauth_timeout", `Timed out waiting for ${serviceLabel} authorization`);
-      return {
-        status: "failed_timeout",
-        error: successResult.error?.message || `Timed out waiting for ${serviceLabel} authorization`,
-      };
-    }
-
-    // Cloudflare: after Google password, land on dash — park on harvest promise.
-    // Do NOT thrash cookie dismiss / generic Approve (starves token API work).
-    if (
-      isGrokFlow
-      && seenGoogleAuth
-      && passwordSubmittedAt
-      && /cloudflare/i.test(String(serviceLabel || ""))
-    ) {
-      try {
-        const u = new URL(page.url?.() || "");
-        const onDash =
-          u.hostname === "dash.cloudflare.com"
-          && !u.pathname.includes("/login")
-          && !u.href.includes("oidcJwt");
-        if (onDash) {
-          reportStep(
-            "waiting_cf_harvest",
-            "On Cloudflare dashboard — waiting for Workers AI token harvest",
-          );
-          // Yield the page: only race success (longer tick while harvesting).
-          const parked = await Promise.race([
-            successPromise
-              .then((result) => ({ kind: "success", result }))
-              .catch((error) => ({ kind: "success_error", error })),
-            yieldMs(2_000).then(() => null),
-          ]);
-          if (parked?.kind === "success") {
-            reportStep(successStep, successMessage);
-            return { status: "success", ...parked.result };
-          }
-          if (parked?.kind === "success_error") {
-            reportStep("oauth_timeout", `Timed out waiting for ${serviceLabel} authorization`);
-            return {
-              status: "failed_timeout",
-              error: parked.error?.message || `Timed out waiting for ${serviceLabel} authorization`,
-            };
-          }
-          continue;
-        }
-      } catch {
-        /* fall through */
-      }
-    }
-
-    // Unblock SetSID / empty Google interstitials before other handlers
-    const waited = await waitThroughGoogleInterstitials(
-      page,
-      reportStep,
-      interstitialOpts(isGrokFlow ? 2_500 : 8_000),
-    );
-    if (waited) {
-      continue;
-    }
-
-    const handledGoogleConsent = await handleGoogleConsent(page, reportStep);
-    if (handledGoogleConsent) {
-      if (!isGrokFlow) {
-        await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
-      } else {
-        await waitForPageAdvance(page, { timeout: 4_000 });
-      }
-      continue;
-    }
-
-    // Headless Chromium is rejected after email submit → /v3/signin/rejected
-    // ("This browser or app may not be secure"). Fail fast — do not spin 90s.
-    if (await isBlockedBrowser(page)) {
-      const url = page.url?.() || "";
-      reportStep(
-        "browser_blocked_by_google",
-        `Google blocked this browser (url=${url.slice(0, 120)}). Use headed CloakBrowser (Xvfb on Linux).`,
-      );
-      return {
-        status: "failed_browser_blocked",
-        error:
-          "Google blocked the automated browser (\"This browser or app may not be secure\" / signin rejected). " +
-          "Kiro bulk must use headed CloakBrowser (Xvfb on Linux), not headless Chrome.",
-      };
-    }
-
-    const text = await readPageText(page);
-    if (includesAny(text, INVALID_CREDENTIAL_MARKERS)) {
-      reportStep("invalid_credentials", "Google rejected the supplied email or password");
-      return {
-        status: "failed_invalid_credentials",
-        error: "Google rejected the supplied email or password.",
-      };
-    }
-
-    if (includesAny(text, RESTRICTED_ACCOUNT_MARKERS)) {
-      reportStep("account_restricted", "Account is restricted, suspended, or banned by the provider");
-      return {
-        status: "failed_restricted",
-        error: "Account is restricted, suspended, or banned. Skipping.",
-      };
-    }
-
-    if (includesAny(text, MANUAL_ASSIST_MARKERS)) {
-      const isCaptcha = /captcha|recaptcha|not a robot|select all images|select all squares/i.test(text);
-      reportStep(
-        isCaptcha ? "google_captcha" : "manual_assist_required",
-        isCaptcha
-          ? "Google CAPTCHA / bot check"
-          : "Google requested CAPTCHA, 2FA, or recovery verification",
-      );
-      return {
-        status: "needs_manual",
-        error: isCaptcha
-          ? "Google CAPTCHA (bot check). Not fixed by lowering workers — use headed CloakBrowser with Xvfb, a residential proxy, and avoid blocking Google domains. Open manual assist to solve CAPTCHA once."
-          : "Manual assist required in the browser session (CAPTCHA, 2FA, recovery, or suspicious-login challenge).",
-      };
-    }
-
-    const handledOnboarding = await handleGoogleOnboarding(page, text);
-    if (handledOnboarding) {
-      reportStep("google_onboarding", "Accepted Google onboarding or privacy prompt");
-      continue;
-    }
-
-    // xAI rate-limits device authorize after rapid retries — fail fast.
-    if (
-      isProviderPage(page)
-      && (/rate[_ ]?limit/i.test(text) || /error=rate_limited/i.test(page.url?.() || ""))
-    ) {
-      reportStep("device_rate_limited", "xAI device authorization rate-limited");
-      return {
-        status: "failed",
-        error: "xAI rate-limited device authorization. Wait a few minutes and retry (too many rapid device-code attempts).",
-      };
-    }
-
-    // xAI often lands on /oauth2/device/approve with "Invalid action" after
-    // Google consent when the approve form was double-submitted. Re-open the
-    // original device URL (with user_code) a few times — not every loop tick.
-    if (
-      isProviderPage(page)
-      && /invalid action|invalid[_ ]?code|code (has )?expired|expired code/i.test(text)
-      && authUrl
-      && seenGoogleAuth
-      && deviceInvalidReopenCount < DEVICE_INVALID_REOPEN_MAX
-      && Date.now() - deviceInvalidReopenAt > DEVICE_INVALID_REOPEN_COOLDOWN_MS
-    ) {
-      deviceInvalidReopenCount += 1;
-      deviceInvalidReopenAt = Date.now();
-      deviceApproveAt = 0;
-      reportStep(
-        "device_invalid_reopen",
-        `Device page error — reopening auth URL (${deviceInvalidReopenCount}/${DEVICE_INVALID_REOPEN_MAX})`,
-      );
-      await page.goto(authUrl, { waitUntil: "domcontentloaded", timeout: 60_000 }).catch(() => null);
-      await waitUntil(
-        async () =>
-          (await getFirstVisibleLocator(page, 'button:has-text("Continue"), button:has-text("Allow"), button:has-text("Authorize")'))
-          || (await providerHasGoogleLogin(page)),
-        { timeout: 4_000, interval: 80 },
-      );
-      continue;
-    }
-
-    const googleAuthed = Boolean(seenGoogleAuth && passwordSubmittedAt);
-
-    // xAI device user_code confirm (Continue) — only before Google login.
-    if (await handleXaiDeviceCodeConfirm(page, reportStep, { alreadyAuthed: googleAuthed })) {
-      continue;
-    }
-
-    // Provider Google SSO BEFORE generic onboarding Continues.
-    // Cooldown: re-clicking Google mid-redirect restarts OAuth and wastes time.
-    const allowGoogleClick =
-      !googleAuthed
-      && (!googleLoginSelectedAt || Date.now() - googleLoginSelectedAt > GOOGLE_SSO_COOLDOWN_MS);
-    const handledProviderGate = await handleProviderLoginGate(page, reportStep, { allowGoogleClick });
-    if (handledProviderGate) {
-      if (allowGoogleClick) googleLoginSelectedAt = Date.now();
-      continue;
-    }
-
-    // xAI device approve ONLY after Google password submitted.
-    if (
-      googleAuthed
-      && Date.now() - deviceApproveAt > DEVICE_APPROVE_COOLDOWN_MS
-      && await clickXaiDeviceAuthorize(page, reportStep)
-    ) {
-      deviceApproveAt = Date.now();
-      continue;
-    }
-
-    const handledProviderOnboarding = await handleProviderOnboarding(page, reportStep, serviceLabel);
-    if (handledProviderOnboarding) {
-      continue;
-    }
-
-    // Credentials only on accounts.google.com — never into provider shells.
-    if (isGoogleAuthPage(page)) {
-      seenGoogleAuth = true;
-      // Check password BEFORE email — after submitting the email the password
-      // page loads and during the transition the old email input can briefly
-      // remain visible; if we checked email first we'd re-type the email
-      // address into whatever field is focused (often the password input).
-      const passwordInput = await getFirstVisibleLocator(page, PASSWORD_INPUT_SELECTOR);
-      if (passwordInput) {
-        const sincePw = Date.now() - passwordSubmittedAt;
-        if (passwordSubmittedAt && sincePw < PASSWORD_RESUBMIT_COOLDOWN_MS) {
-          // Still on (or animating off) the password form after a recent submit —
-          // do NOT re-fill; wait for SetSID/consent/callback instead.
-          reportStep(
-            "waiting_after_password",
-            `Password already submitted ${Math.round(sincePw / 1000)}s ago — waiting for Google redirect`,
-          );
-          await waitThroughGoogleInterstitials(
-            page,
-            reportStep,
-            interstitialOpts(isGrokFlow ? 2_000 : 6_000),
-          );
-          continue;
-        }
-
-        reportStep("entering_password", "Entering Google password");
-        const filled = await fillInputResilient(passwordInput, password);
-        if (filled) {
-          reportStep("submitting_password", "Submitting password");
-          const prePwUrl = page.url?.() || "";
-          await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
-          passwordSubmittedAt = Date.now();
-          // Leave password challenge via navigation / URL change / success — no 2.5s sleep.
-          await Promise.race([
-            page.waitForNavigation({ waitUntil: "domcontentloaded", timeout: isGrokFlow ? 6_000 : 10_000 }).catch(() => null),
-            waitForPageAdvance(page, { fromUrl: prePwUrl, timeout: isGrokFlow ? 6_000 : 10_000 }),
-            successPromise.then(() => null).catch(() => null),
-          ]);
-          await waitThroughGoogleInterstitials(
-            page,
-            reportStep,
-            interstitialOpts(postPasswordInterstitialMs),
-          );
-        } else {
-          reportStep("password_fill_failed", "Could not fill the Google password field; retrying loop");
-          await yieldMs(100);
-        }
-        continue;
-      }
-
-      const nextEmailInput = await getFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR);
-      if (nextEmailInput) {
-        const sinceEmail = Date.now() - emailSubmittedAt;
-        if (emailSubmittedAt && sinceEmail < EMAIL_RESUBMIT_COOLDOWN_MS) {
-          reportStep(
-            "waiting_after_email",
-            `Email already submitted ${Math.round(sinceEmail / 1000)}s ago — waiting for password/next screen`,
-          );
-          await waitForPageAdvance(page, {
-            selector: PASSWORD_INPUT_SELECTOR,
-            timeout: Math.max(200, EMAIL_RESUBMIT_COOLDOWN_MS - sinceEmail),
-          });
-          continue;
-        }
-
-        reportStep("entering_email", "Entering Google email");
-        const filled = await fillInputResilient(nextEmailInput, email);
-        if (filled) {
-          reportStep("submitting_email", "Submitting email");
-          await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
-          emailSubmittedAt = Date.now();
-          await waitForPageAdvance(page, {
-            selector: PASSWORD_INPUT_SELECTOR,
-            timeout: isGrokFlow ? 6_000 : 10_000,
-          });
-        } else {
-          reportStep("email_fill_failed", "Could not fill the Google email field; retrying loop");
-          await yieldMs(80);
-        }
-        continue;
-      }
-    }
-
-    // On xAI before Google login, APPROVE selectors match "Continue with Google"
-    // via :has-text("Continue") and wreck the device code → Invalid action loop.
-    // On Cloudflare login, "Allow All" cookies + "Sign in" must not be mashed.
-    await dismissCookieBanners(page, reportStep);
-    const onCfHost = (() => {
-      try {
-        const h = new URL(page.url()).hostname || "";
-        return h === "dash.cloudflare.com" || h.endsWith(".cloudflare.com");
-      } catch {
-        return false;
-      }
-    })();
-    const mayGenericApprove =
-      isGoogleAuthPage(page)
-      || (
-        seenGoogleAuth
-        && passwordSubmittedAt
-        && !(await providerHasGoogleLogin(page))
-        && !isCloudflareLoginUrl(page.url?.() || "")
-      );
-    if (mayGenericApprove && !isCloudflareLoginUrl(page.url?.() || "")) {
-      // Avoid OneTrust "Allow All" as if it were OAuth approve when still mid-flow
-      const clickedApprove = await clickFirstVisible(page, APPROVE_BUTTON_SELECTORS);
-      if (clickedApprove) {
-        reportStep("approving_consent", `Approving Google or ${serviceLabel} consent`);
-        deviceApproveAt = Date.now();
-        await waitForPageAdvance(page, { timeout: isGrokFlow ? 2_000 : 4_000 });
-        continue;
-      }
-    }
-    // Cloudflare login stuck: keep hammering Google SSO only
-    if (onCfHost && !seenGoogleAuth && (await handleProviderLoginGate(page, reportStep))) {
-      googleLoginSelectedAt = Date.now();
-      continue;
-    }
-
-    // Periodic diagnostics so jobs aren't opaque "waiting" spam
-    if (Math.floor((Date.now() - startTime) / 5000) !== Math.floor((Date.now() - startTime - loopTickMs) / 5000)) {
-      const url = page.url?.() || "";
-      const snippet = String(text || (await readPageText(page).catch(() => ""))).slice(0, 100).replace(/\s+/g, " ");
-      reportStep(
-        "waiting_for_next_screen",
-        `Waiting for the next Google or ${serviceLabel} screen (url=${url.slice(0, 100)} body=${snippet})`,
-      );
-    } else {
-      reportStep("waiting_for_next_screen", `Waiting for the next Google or ${serviceLabel} screen`);
-    }
-    // Only yield — next loop races successPromise + handlers. Fast net = fast exit.
-    await yieldMs(loopTickMs);
-  }
-
-  // Final blocked check before generic needs_manual
-  if (await isBlockedBrowser(page)) {
-    reportStep("browser_blocked_by_google", "Google blocked browser at end of automation window");
-    return {
-      status: "failed_browser_blocked",
-      error:
-        "Google blocked the automated browser (\"This browser or app may not be secure\"). " +
-        "Use headed CloakBrowser (Xvfb).",
-    };
-  }
-
-  const finalUrl = page.url?.() || "";
-  const finalBody = String(await readPageText(page).catch(() => "")).slice(0, 120).replace(/\s+/g, " ");
-  reportStep(
-    "manual_assist_required",
-    `Flow did not complete ${serviceLabel} authorization automatically (url=${finalUrl.slice(0, 100)} body=${finalBody})`,
-  );
-  return {
-    status: "needs_manual",
-    error:
-      `Manual assist required — ${serviceLabel} authorization did not finish automatically ` +
-      `(last url: ${finalUrl.slice(0, 140)}). If you see "browser may not be secure", use headed CloakBrowser.`,
-  };
-}
-
-export async function runKiroGoogleAutomation({
-  page,
-  authUrl,
-  email,
-  password,
-  callbackPromise,
-  shortTimeoutMs = DEFAULT_SHORT_TIMEOUT_MS,
-  onStep,
-}) {
-  return runGoogleAccountAutomation({
-    page,
-    authUrl,
-    email,
-    password,
-    successPromise: callbackPromise,
-    shortTimeoutMs,
-    serviceLabel: "Kiro",
-    openingStep: "opening_google_oauth",
-    openingMessage: "Opening Google OAuth page",
-    successStep: "kiro_callback_received",
-    successMessage: "Kiro callback received",
-    onStep,
-  });
-}
-
-export {
-  handleCodeBuddyRegionPage,
-  handleProviderOnboarding,
-  handleCodeBuddyStartedAuthorization,
-  isProviderPage,
-};
-
-export const __test__ = {
-  waitForFirstVisibleLocator,
-  fillInputResilient,
-  parseSelectorList,
-  getFirstVisibleLocator,
-  waitForPageAdvance,
-  waitUntil,
-  handleXaiDeviceCodeConfirm,
-  GOOGLE_LOGIN_BUTTON_SELECTORS,
-  isGrokish,
-  dismissCookieBanners,
-  clickGoogleLoginRole,
-  isCloudflareLoginUrl,
-};