zevairouter 1.0.59 → 1.0.61

package/src/lib/oauth/services/bulkImportBrowserEngine.js

@@ -266,7 +266,10 @@ async function launchCloakbrowser({ proxyUrl, headless = false, windowSize = nul
     humanize: true,
   };
   if (proxyUrl) {
+    // CloakBrowser docs: string or { server, username, password }; geoip aligns
+    // timezone/locale to proxy IP (critical for Turnstile / abusive-pattern checks).
     launchOpts.proxy = proxyUrl;
+    launchOpts.geoip = true;
   }
   if (windowSize?.width && windowSize?.height) {
     launchOpts.viewport = { width: windowSize.width, height: windowSize.height };

package/src/lib/oauth/services/grokCliBulkImportManager.js

@@ -188,7 +188,10 @@ class GrokCliBulkImportManager extends KiroBulkImportManager {
     proxyUrl = null,
   } = {}) {
     super({
-      browserLauncher: (job) => browserLauncher(proxyUrl, job?.engine),
+      // Prefer first pool URL from the job so CloakBrowser launches with proxy+geoip
+      // (context-only proxy is not enough for fingerprint/timezone matching).
+      browserLauncher: (job) =>
+        browserLauncher(job?.proxyUrls?.[0] || proxyUrl || null, job?.engine),
       googleAutomation: null,
       socialExchange: null,
       kiroServiceFactory: null,
@@ -263,11 +266,54 @@ class GrokCliBulkImportManager extends KiroBulkImportManager {
       return;
     }
 
-    const { context, page } = await createFreshContext(job.browser, account.proxyUrl);
-    account.runtimeSession = { context, page };
+    // CloakBrowser needs proxy+geoip on launch() for antibot. Shared job.browser may
+    // have no proxy or a different one — spawn a dedicated browser when needed.
+    let browser = job.browser;
+    let ownedBrowser = null;
+    const accountProxy = account.proxyUrl || null;
+    const sharedProxy = job.proxyUrls?.[0] || null;
+    const needsOwnBrowser =
+      job.engine === "cloakbrowser"
+      && accountProxy
+      && accountProxy !== sharedProxy;
+
+    if (needsOwnBrowser || (job.engine === "cloakbrowser" && accountProxy && !sharedProxy)) {
+      try {
+        const { launchBulkImportBrowser } = await import("./bulkImportBrowserEngine.js");
+        ownedBrowser = await launchBulkImportBrowser({
+          engine: "cloakbrowser",
+          proxyUrl: accountProxy,
+          headless: false,
+          windowSize: { width: 1280, height: 900 },
+        });
+        browser = ownedBrowser;
+        this.setAccountStep(
+          account,
+          "proxy_browser",
+          `Launched CloakBrowser with account proxy (geoip)`
+        );
+      } catch (error) {
+        this.finalizeAccount(account, "failed", {
+          error: error.message || "Failed to launch browser with proxy",
+          step: "proxy_launch_failed",
+          message: error.message || "Failed to launch browser with proxy",
+        });
+        await this.persistJobSnapshot(job, { forcePreview: true });
+        return;
+      }
+    }
+
+    // If browser already launched with this proxy, don't double-apply on context
+    const contextProxy = ownedBrowser ? null : accountProxy;
+    const { context, page } = await createFreshContext(browser, contextProxy);
+    account.runtimeSession = { context, page, ownedBrowser };
 
     try {
-      this.setAccountStep(account, "preparing_worker", `Worker ${workerId} preparing CloakBrowser / xAI flow`);
+      this.setAccountStep(
+        account,
+        "preparing_worker",
+        `Worker ${workerId} preparing CloakBrowser / xAI flow${accountProxy ? " (proxied)" : " (direct VPS IP — expect blocks)"}`
+      );
       await this.persistJobSnapshot(job, { forcePreview: true });
 
       const onStep = (step, message) => {
@@ -298,14 +344,21 @@ class GrokCliBulkImportManager extends KiroBulkImportManager {
         });
 
         if (signup.status === "needs_manual") {
-          account.manualSession = { context, page, opened: false, openedAt: null };
+          account.manualSession = {
+            context,
+            page,
+            opened: false,
+            openedAt: null,
+            ownedBrowser,
+          };
           this.finalizeAccount(account, "needs_manual", {
             error: signup.error,
             step: signup.step || "awaiting_manual",
             message: signup.error,
           });
           await this.persistJobSnapshot(job, { forcePreview: true });
-          // keep session open for manual; no token poll yet
+          // keep session open for manual; do not close ownedBrowser here
+          ownedBrowser = null;
           return;
         }
 
@@ -317,6 +370,7 @@ class GrokCliBulkImportManager extends KiroBulkImportManager {
           });
           account.runtimeSession = null;
           await context.close().catch(() => null);
+          if (ownedBrowser) await ownedBrowser.close().catch(() => null);
           await this.persistJobSnapshot(job, { forcePreview: true });
           return;
         }
@@ -347,6 +401,7 @@ class GrokCliBulkImportManager extends KiroBulkImportManager {
         await this.finalizeSuccess(job, account, auth.tokens, mode);
         account.runtimeSession = null;
         await context.close().catch(() => null);
+        if (ownedBrowser) await ownedBrowser.close().catch(() => null);
         await this.persistJobSnapshot(job, { forcePreview: true });
         return;
       }
@@ -358,6 +413,7 @@ class GrokCliBulkImportManager extends KiroBulkImportManager {
       });
       account.runtimeSession = null;
       await context.close().catch(() => null);
+      if (ownedBrowser) await ownedBrowser.close().catch(() => null);
       await this.persistJobSnapshot(job, { forcePreview: true });
     } catch (error) {
       if (job.cancelRequested) {
@@ -375,9 +431,11 @@ class GrokCliBulkImportManager extends KiroBulkImportManager {
       }
       account.runtimeSession = null;
       await context.close().catch(() => null);
+      if (ownedBrowser) await ownedBrowser.close().catch(() => null);
       await this.persistJobSnapshot(job, { forcePreview: true });
     } finally {
       account.password = undefined;
+      if (ownedBrowser) await ownedBrowser.close().catch(() => null);
     }
   }
 

package/src/lib/oauth/services/grokXaiEmailAutomation.js

@@ -189,6 +189,96 @@ export async function runXaiEmailSignup(page, {
   return { status: "success", email, password, url };
 }
 
+async function clickRoleButton(page, nameRe) {
+  try {
+    const btn = page.getByRole("button", { name: nameRe }).first();
+    if (await btn.isVisible({ timeout: 600 }).catch(() => false)) {
+      await btn.click({ timeout: 4_000 });
+      return true;
+    }
+  } catch {
+    /* next */
+  }
+  return false;
+}
+
+/** Aggressive consent / continue clicks for xAI device pages. */
+async function clickDeviceAuthorizeControls(page) {
+  // Prefer role-based names (more reliable than CSS text on SPA)
+  const roles = [
+    /^(Allow|Authorize|Approve|Confirm|Yes|Accept)$/i,
+    /Allow|Authorize|Approve|Confirm/i,
+    /^Continue$/i,
+    /Continue/i,
+    /^Next$/i,
+    /Sign in|Log in|Login/i,
+  ];
+  for (const re of roles) {
+    if (await clickRoleButton(page, re)) return true;
+  }
+
+  // Links styled as buttons
+  try {
+    const link = page.getByRole("link", { name: /Allow|Authorize|Continue|Confirm/i }).first();
+    if (await link.isVisible({ timeout: 400 }).catch(() => false)) {
+      await link.click({ timeout: 3_000 });
+      return true;
+    }
+  } catch {
+    /* ignore */
+  }
+
+  return Boolean(
+    await clickFirst(page, [
+      'button:has-text("Allow")',
+      'button:has-text("Authorize")',
+      'button:has-text("Approve")',
+      'button:has-text("Confirm")',
+      'button:has-text("Continue")',
+      'button:has-text("Next")',
+      'button[type=submit]',
+      'input[type=submit]',
+    ])
+  );
+}
+
+async function ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp }) {
+  const report = (step, message) => onStep?.(step, message);
+
+  if (await page.getByRole("button", { name: /Login with email/i }).count()) {
+    await page.getByRole("button", { name: /Login with email/i }).click().catch(() => null);
+    await wait(800);
+  }
+
+  if (await page.locator("input[type=email]").first().isVisible().catch(() => false)) {
+    report("device_login_email", "Entering email on device page");
+    await typeSlow(page.locator("input[type=email]").first(), email, 40);
+    await clickDeviceAuthorizeControls(page);
+    await wait(1_200);
+  }
+  if (await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
+    report("device_login_password", "Entering password on device page");
+    await typeSlow(page.locator("input[type=password]").first(), password, 40);
+    await waitForTurnstile(page, { timeoutMs: 45_000, onStep });
+    await clickFirst(page, ['button:has-text("Login")', 'button:has-text("Log in")', 'button[type=submit]']);
+    await wait(2_500);
+  }
+
+  let text = await pageText(page);
+  if (/security code|Verify your email|one time|confirmation code/i.test(text)) {
+    report("login_otp", "Login requires OTP — polling tempmail");
+    const otp = await pollOtp(email, { timeoutMs: 90_000 });
+    if (otp?.code) {
+      const codeInput = page.locator("input[name=code], input[autocomplete=one-time-code], input[type=text]").first();
+      if (await codeInput.isVisible().catch(() => false)) {
+        await typeSlow(codeInput, otp.code, 80);
+      }
+      await clickDeviceAuthorizeControls(page);
+      await wait(2_000);
+    }
+  }
+}
+
 /**
  * Login with email+password (session), then authorize a Grok CLI device code.
  */
@@ -203,78 +293,55 @@ export async function runXaiEmailDeviceAuthorize(page, {
   cancelCheck,
 } = {}) {
   const report = (step, message) => onStep?.(step, message);
+  const authorized = { done: false };
 
   // Ensure session via sign-in if not already on account
   const cur = page.url();
-  if (!/\/account/i.test(cur)) {
+  if (!/\/account/i.test(cur) && !/accounts\.x\.ai/i.test(cur)) {
     report("opening_signin", "Opening xAI email login");
     await page.goto("https://accounts.x.ai/sign-in", { waitUntil: "domcontentloaded", timeout: 60_000 });
     await wait(1_000);
     await dismissCookies(page);
-
-    if (await page.getByRole("button", { name: /Login with email/i }).count()) {
-      await page.getByRole("button", { name: /Login with email/i }).click();
-      await wait(800);
-    }
-
-    if (await page.locator("input[type=email]").first().isVisible().catch(() => false)) {
-      await typeSlow(page.locator("input[type=email]").first(), email, 40);
-      await clickFirst(page, ['button:has-text("Next")', 'button:has-text("Continue")']);
-      await wait(1_500);
-    }
-    if (await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
-      await typeSlow(page.locator("input[type=password]").first(), password, 40);
-      await waitForTurnstile(page, { timeoutMs: 45_000, onStep });
-      await clickFirst(page, ['button:has-text("Login")', 'button:has-text("Log in")']);
-      await wait(3_000);
-    }
-
-    let text = await pageText(page);
-    if (/security code|Verify your email|one time/i.test(text)) {
-      report("login_otp", "Login requires OTP — polling tempmail");
-      const otp = await pollOtp(email, { timeoutMs: 90_000 });
-      if (otp?.code) {
-        await typeSlow(page.locator("input[name=code]").first(), otp.code, 80);
-        await clickFirst(page, ['button:has-text("Confirm email")', 'button:has-text("Continue")']);
-        await wait(2_500);
-      }
-    }
+    await ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp });
   }
 
   report("opening_device", "Opening Grok Build device authorization");
   await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-  await wait(1_200);
+  await wait(1_500);
   await dismissCookies(page);
-  await clickFirst(page, ['button:has-text("Continue")']);
+  await clickDeviceAuthorizeControls(page);
   await wait(2_000);
 
   // If bounced to login again, do email login on this page
-  if (await page.getByRole("button", { name: /Login with email/i }).count()) {
-    await page.getByRole("button", { name: /Login with email/i }).click();
-    await wait(800);
-    if (await page.locator("input[type=email]").first().isVisible().catch(() => false)) {
-      await typeSlow(page.locator("input[type=email]").first(), email, 40);
-      await clickFirst(page, ['button:has-text("Next")']);
-      await wait(1_200);
-    }
-    if (await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
-      await typeSlow(page.locator("input[type=password]").first(), password, 40);
-      await waitForTurnstile(page, { timeoutMs: 45_000, onStep });
-      await clickFirst(page, ['button:has-text("Login")', 'button:has-text("Log in")']);
-      await wait(3_000);
-    }
-    // re-open device after login
+  const bounced = await page.getByRole("button", { name: /Login with email/i }).count()
+    || await page.locator("input[type=email]").first().isVisible().catch(() => false);
+  if (bounced) {
+    report("device_needs_login", "Device page requires login — signing in");
+    await ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp });
     await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-    await wait(1_200);
-    await clickFirst(page, ['button:has-text("Continue")']);
+    await wait(1_500);
+    await dismissCookies(page);
+    await clickDeviceAuthorizeControls(page);
     await wait(2_000);
   }
 
+  // Snapshot first device page for debugging stuck authorize
+  try {
+    const snap = (await pageText(page)).replace(/\s+/g, " ").slice(0, 160);
+    report("device_page", `Device page: ${page.url().slice(0, 80)} · ${snap}`);
+  } catch {
+    /* ignore */
+  }
+
   const pollPromise = (async () => {
     const start = Date.now();
-    let interval = 5_000;
-    while (Date.now() - start < 15 * 60_000) {
+    let interval = 4_000;
+    while (Date.now() - start < 12 * 60_000) {
       if (cancelCheck?.()) throw new Error("Job cancelled during token polling");
+      if (authorized.done) {
+        // short burst after UI says authorized
+        await wait(1_500);
+      }
       const result = await pollToken(deviceCode);
       if (result?.success && result.tokens) return { tokens: result.tokens };
       if (result?.pending || result?.error === "authorization_pending") {
@@ -287,57 +354,99 @@ export async function runXaiEmailDeviceAuthorize(page, {
         continue;
       }
       if (result?.error && !["authorization_pending", "slow_down"].includes(result.error)) {
-        // keep polling a bit — page may still authorize
+        report("token_poll_note", `Poll: ${result.error}`);
         await wait(interval);
         continue;
       }
       await wait(interval);
     }
-    throw new Error("Timed out waiting for Grok CLI OAuth token");
+    throw new Error("Timed out waiting for Grok CLI OAuth token (device may not have been authorized in the browser)");
   })();
 
-  // UI authorize loop in parallel with poll
+  // UI authorize loop — keep going until poll succeeds or timeout (~same window)
   const uiLoop = (async () => {
-    for (let i = 0; i < 20; i++) {
+    const start = Date.now();
+    let i = 0;
+    while (Date.now() - start < 11 * 60_000) {
       if (cancelCheck?.()) return;
+      if (authorized.done) {
+        await wait(2_000);
+        continue;
+      }
+
       const text = await pageText(page);
-      if (/Device Authorized|device has been authorized|you can close/i.test(text)) {
+      const url = page.url();
+
+      if (/Device Authorized|device has been authorized|you can close|successfully authorized/i.test(text)) {
+        authorized.done = true;
         report("device_authorized", "Device authorized in browser");
         return;
       }
-      // signed-in consent
-      if (/Authorize Grok Build|Verify your identity|Confirm your identity/i.test(text)) {
-        await clickFirst(page, [
-          'button:has-text("Allow")',
-          'button:has-text("Authorize")',
-          'button:has-text("Approve")',
-          'button:has-text("Continue")',
-          'button:has-text("Confirm")',
-        ]);
+
+      // Login wall again mid-flow
+      if (/Login with email|Sign in to continue|log in to continue/i.test(text)
+        || await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
+        report("device_relogin", "Re-login required on device page");
+        await ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp });
+        await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 }).catch(() => null);
         await wait(1_500);
         continue;
       }
-      if (/Redirecting/i.test(text) || /\/account/i.test(page.url())) {
+
+      // Consent / identity
+      if (/Authorize Grok|Grok Build|Verify your identity|Confirm your identity|device code|user code/i.test(text)
+        || /oauth2\/device|device\/verify/i.test(url)) {
+        const clicked = await clickDeviceAuthorizeControls(page);
+        if (clicked && i % 3 === 0) {
+          report("device_click", `Clicked authorize control (${i + 1})`);
+        }
+        // Turnstile sometimes reappears on consent
+        await waitForTurnstile(page, { timeoutMs: 12_000, onStep: i % 5 === 0 ? onStep : undefined });
+        await wait(1_800);
+        i += 1;
+        continue;
+      }
+
+      // Redirected away from device flow
+      if (/Redirecting/i.test(text) || (/\/account/i.test(url) && !/device/i.test(url))) {
+        report("device_reopen", "Re-opening device authorization URL");
         await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
         await wait(1_500);
-        await clickFirst(page, ['button:has-text("Continue")']);
+        await dismissCookies(page);
+        await clickDeviceAuthorizeControls(page);
         await wait(1_500);
+        i += 1;
         continue;
       }
-      await clickFirst(page, [
-        'button:has-text("Continue")',
-        'button:has-text("Allow")',
-        'button:has-text("Authorize")',
-      ]);
-      await wait(1_500);
+
+      // Generic: keep trying primary actions + occasional reload
+      await clickDeviceAuthorizeControls(page);
+      if (i > 0 && i % 8 === 0) {
+        report("device_reload", `Reload device page (attempt ${i}) · ${url.slice(0, 60)}`);
+        await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 60_000 }).catch(() => null);
+        await wait(1_200);
+        await clickDeviceAuthorizeControls(page);
+      }
+      await wait(1_800);
+      i += 1;
     }
   })();
 
   report("polling_token", "Waiting for device token after authorization");
-  const [tokenResult] = await Promise.all([
-    pollPromise,
-    uiLoop.catch(() => null),
-  ]);
-
-  return { status: "success", tokens: tokenResult.tokens };
+  try {
+    const [tokenResult] = await Promise.all([
+      pollPromise,
+      uiLoop.catch((e) => {
+        report("device_ui_note", String(e?.message || e).slice(0, 120));
+        return null;
+      }),
+    ]);
+    return { status: "success", tokens: tokenResult.tokens };
+  } catch (error) {
+    const snap = (await pageText(page).catch(() => "")).replace(/\s+/g, " ").slice(0, 200);
+    return {
+      status: "failed",
+      error: `${error.message || error} · page: ${page.url()} · ${snap}`,
+    };
+  }
 }