zevairouter 1.0.69 → 1.0.72

package/src/lib/oauth/services/kiroBulkImportManager.js

@@ -17,6 +17,8 @@ const TERMINAL_ACCOUNT_STATUSES = new Set([
   "failed_invalid_credentials",
   "failed_exchange",
   "failed_timeout",
+  "failed_restricted",
+  "failed_browser_blocked",
   "cancelled",
 ]);
 
@@ -222,6 +224,8 @@ function getFailedCount(accounts) {
     || account.status === "failed_invalid_credentials"
     || account.status === "failed_exchange"
     || account.status === "failed_timeout"
+    || account.status === "failed_restricted"
+    || account.status === "failed_browser_blocked"
   )).length;
 }
 
@@ -299,7 +303,7 @@ function sanitizeAccount(account) {
     proxyUrl: maskProxyUrl(account.proxyUrl) || null,
     currentStep: account.currentStep || null,
     updatedAt: account.updatedAt || null,
-    logs: (account.logs || []).slice(-8),
+    logs: (account.logs || []).slice(-20),
     manualSessionAvailable: Boolean(account.manualSession?.page) && account.status === "needs_manual",
     manualSessionOpened: Boolean(account.manualSession?.opened),
   };
@@ -354,7 +358,23 @@ export function buildLookupResponse(job, extras = {}) {
 
 async function defaultBrowserLauncher(job) {
   const { launchBulkImportBrowser } = await import("./bulkImportBrowserEngine.js");
-  return launchBulkImportBrowser({ engine: job?.engine || "chromium" });
+  const engine = job?.engine || "chromium";
+  // Google OAuth now rejects stock headless Chromium after email submit with
+  // /v3/signin/rejected ("This browser or app may not be secure"). That is the
+  // real reason Kiro bulk ends in needs_manual — not random captcha.
+  // Default: headed Chromium (Xvfb auto-starts on Linux). Camoufox can stay
+  // headless. Override with ZEVAI_KIRO_HEADLESS=0|1.
+  const envHeadless = process.env.ZEVAI_KIRO_HEADLESS;
+  let headless;
+  if (envHeadless === "1" || envHeadless === "true") headless = true;
+  else if (envHeadless === "0" || envHeadless === "false") headless = false;
+  else if (engine === "camoufox") headless = true;
+  else headless = false;
+  return launchBulkImportBrowser({
+    engine,
+    headless,
+    windowSize: { width: 1280, height: 900 },
+  });
 }
 
 async function defaultSocialExchange(args) {
@@ -417,15 +437,15 @@ export async function createFreshContext(browser, proxy) {
   }
 
   const page = await context.newPage();
-  // Residential proxies often hang on third-party trackers; abort so SPA can boot
+  // Abort third-party trackers only. Do NOT intercept "**/*" with continue() —
+  // Playwright route interception on every request breaks Google→Cognito OAuth
+  // redirect chains (consent 302 → idpresponse 302 → kiro:// Location is dropped
+  // and the main frame parks forever on empty SetSID).
   try {
-    await page.route("**/*", (route) => {
-      const u = route.request().url();
-      if (/googletagmanager|googleadservices|google-analytics|doubleclick|facebook\.net|hotjar|clarity\.ms|hm\.baidu|sentry\.io|browser\.sentry-cdn/i.test(u)) {
-        return route.abort();
-      }
-      return route.continue();
-    });
+    await page.route(
+      /googletagmanager|googleadservices|google-analytics|doubleclick|facebook\.net|hotjar|clarity\.ms|hm\.baidu|sentry\.io|browser\.sentry-cdn/i,
+      (route) => route.abort(),
+    );
   } catch {
     // ignore if route fails
   }

package/src/lib/oauth/services/kiroGoogleAutomation.js

@@ -494,18 +494,120 @@ function isGoogleAuthPage(page) {
   }
 }
 
-// Google bounces flagged (headless) browsers to myaccount.google.com/not-supported
-// at the OAuth consent step; from there the page often drifts to about.google.
-// Newer flows use /v3/signin/rejected with "This browser or app may not be secure".
+// Google bounces flagged (headless) browsers:
+// - myaccount.google.com/not-supported
+// - accounts.google.com/v3/signin/rejected ("This browser or app may not be secure")
+// - about.google drift after consent
 function isBlockedBrowserPage(page) {
   try {
     const url = new URL(page.url());
     if (url.pathname.startsWith("/not-supported")) return true;
     if (url.pathname.includes("/signin/rejected")) return true;
-    return url.hostname === "about.google" || url.hostname.endsWith(".about.google");
+    if (url.pathname.includes("/rejected")) return true;
+    if (url.hostname === "about.google" || url.hostname.endsWith(".about.google")) return true;
   } catch {
-    return false;
+    // fall through to body text
+  }
+  return false;
+}
+
+async function isBlockedBrowser(page) {
+  if (isBlockedBrowserPage(page)) return true;
+  const text = await readPageText(page).catch(() => "");
+  return includesAny(text, [
+    "browser or app may not be secure",
+    "try using a different browser",
+    "couldn't sign you in",
+    "couldn\u2019t sign you in",
+    "this browser or app may not be secure",
+    "browser is not secure",
+  ]);
+}
+
+/**
+ * Hook successPromise so interstitial waits can exit as soon as the OAuth
+ * callback (kiro://) is captured on the network — even while the main frame
+ * stays parked on blank SetSID.
+ */
+function attachSuccessSettledFlag(successPromise) {
+  if (!successPromise || typeof successPromise.then !== "function") return;
+  if (successPromise.__zevaiSettledHooked) return;
+  successPromise.__zevaiSettledHooked = true;
+  successPromise.then(
+    () => { successPromise.__zevaiSettled = true; },
+    () => { successPromise.__zevaiSettled = true; },
+  );
+}
+
+function isSuccessSettled(successPromise) {
+  return Boolean(successPromise && successPromise.__zevaiSettled);
+}
+
+/**
+ * Google often parks on intermediate pages with empty body after password/consent:
+ *   accounts.google.com(.xx)/accounts/SetSID
+ *   AccountChooser, continue, challenge handoffs
+ *
+ * Do NOT force-navigate consent/idpresponse from here — that aborts the natural
+ * network hop that emits Location: kiro://. Wait for auto-redirect / AccountChooser
+ * UI, and bail early when successPromise already settled (CDP/page listeners).
+ *
+ * @returns {boolean} true if still on an interstitial when maxWaitMs elapsed
+ */
+async function waitThroughGoogleInterstitials(page, reportStep, { maxWaitMs = 20_000, successPromise = null } = {}) {
+  const start = Date.now();
+  let lastUrl = "";
+  attachSuccessSettledFlag(successPromise);
+
+  while (Date.now() - start < maxWaitMs) {
+    if (isSuccessSettled(successPromise)) {
+      reportStep?.("waiting_google_redirect", "OAuth callback already received — leaving interstitial wait");
+      return false;
+    }
+
+    const url = page.url?.() || "";
+    const body = String(await readPageText(page).catch(() => "")).trim();
+    const isSetSid = /\/accounts\/SetSID/i.test(url);
+    const isChooser = /\/AccountChooser/i.test(url);
+    const isEmpty = body.length < 30;
+    const isInterstitial = isSetSid || (isEmpty && /accounts\.google\./i.test(url));
+
+    if (!isInterstitial && !isChooser) return false;
+
+    if (url !== lastUrl) {
+      reportStep?.(
+        "waiting_google_redirect",
+        `Waiting for Google redirect (url=${url.slice(0, 120)} empty=${isEmpty})`,
+      );
+      lastUrl = url;
+    }
+
+    // Account chooser: click first account row if present
+    if (isChooser) {
+      const clicked = await clickFirstActionable(page, [
+        'div[data-identifier]',
+        'div[data-email]',
+        'li[data-identifier]',
+        'div[role="link"]',
+        'div[role="button"]',
+      ]);
+      if (clicked) {
+        reportStep?.("selecting_google_account", "Selected account from Google AccountChooser");
+        await page.waitForTimeout(1200);
+        continue;
+      }
+    }
+
+    const waiters = [
+      page.waitForNavigation({ waitUntil: "domcontentloaded", timeout: 4_000 }).catch(() => null),
+      page.waitForTimeout(1_200),
+    ];
+    if (successPromise && !isSuccessSettled(successPromise)) {
+      waiters.push(successPromise.then(() => null).catch(() => null));
+    }
+    await Promise.race(waiters);
   }
+  return true;
 }
 
 function isProviderPage(page) {
@@ -1173,6 +1275,18 @@ async function handleProviderLoginGate(page, reportStep) {
   return false;
 }
 
+/**
+ * Capture Kiro OAuth callback (kiro://…?code=…).
+ *
+ * After password, Google parks the main frame on empty SetSID while the network
+ * completes consent → Cognito idpresponse → 302 Location: kiro://…. Custom-protocol
+ * redirects often never become a page navigation, so we listen on:
+ *   - page + context request / requestfailed / response (Location header)
+ *   - CDP Network (most reliable on headed Chromium / SetSID)
+ *
+ * Never force-navigate idpresponse/consent from the monitor — that aborts the
+ * natural hop before kiro:// is emitted.
+ */
 export function createKiroCallbackMonitor(context, page, timeoutMs = DEFAULT_MANUAL_TIMEOUT_MS) {
   let resolveOuter;
   let rejectOuter;
@@ -1202,34 +1316,80 @@ export function createKiroCallbackMonitor(context, page, timeoutMs = DEFAULT_MAN
     else resolveOuter(result);
   }
 
+  function trySettleFromUrl(rawUrl) {
+    const parsed = parseCallbackUrl(rawUrl || "");
+    if (parsed) settle(parsed);
+    return Boolean(parsed);
+  }
+
+  function trySettleFromResponse(response) {
+    try {
+      trySettleFromUrl(response?.url?.() || "");
+      const headers = typeof response?.headers === "function" ? response.headers() : null;
+      const location = headers?.location || headers?.Location || "";
+      if (location) trySettleFromUrl(location);
+    } catch {
+      /* ignore */
+    }
+  }
+
+  function attachCdpNetwork(trackedPage, ownerCleanups) {
+    void (async () => {
+      try {
+        if (settled) return;
+        const ctx = trackedPage.context?.();
+        if (!ctx?.newCDPSession) return;
+        const session = await ctx.newCDPSession(trackedPage);
+        await session.send("Network.enable").catch(() => null);
+
+        const onCdpResponse = (params) => {
+          try {
+            const headers = params?.response?.headers || {};
+            const loc = headers.location || headers.Location || "";
+            if (loc) trySettleFromUrl(loc);
+            trySettleFromUrl(params?.response?.url || "");
+          } catch {
+            /* ignore */
+          }
+        };
+        const onCdpRequest = (params) => {
+          try {
+            trySettleFromUrl(params?.request?.url || "");
+          } catch {
+            /* ignore */
+          }
+        };
+
+        session.on("Network.responseReceived", onCdpResponse);
+        session.on("Network.requestWillBeSent", onCdpRequest);
+        ownerCleanups.push(() => {
+          try { session.off?.("Network.responseReceived", onCdpResponse); } catch {}
+          try { session.off?.("Network.requestWillBeSent", onCdpRequest); } catch {}
+          void session.detach?.().catch(() => null);
+        });
+      } catch {
+        /* CDP unavailable — page/context listeners remain */
+      }
+    })();
+  }
+
   function registerPage(trackedPage, ownerCleanups) {
     if (!trackedPage || trackedPages.has(trackedPage)) return;
     trackedPages.add(trackedPage);
 
-    const onFrame = (frame) => {
-      const parsed = parseCallbackUrl(frame?.url?.() || "");
-      if (parsed) settle(parsed);
-    };
-    const onRequest = (request) => {
-      const parsed = parseCallbackUrl(request?.url?.() || "");
-      if (parsed) settle(parsed);
-    };
-    const onRequestFailed = (request) => {
-      const parsed = parseCallbackUrl(request?.url?.() || "");
-      if (parsed) settle(parsed);
-    };
-    const onLoadState = () => {
-      const parsed = parseCallbackUrl(trackedPage.url?.() || "");
-      if (parsed) settle(parsed);
-    };
+    const onFrame = (frame) => trySettleFromUrl(frame?.url?.() || "");
+    const onRequest = (request) => trySettleFromUrl(request?.url?.() || "");
+    const onRequestFailed = (request) => trySettleFromUrl(request?.url?.() || "");
+    const onResponse = (response) => trySettleFromResponse(response);
+    const onLoadState = () => trySettleFromUrl(trackedPage.url?.() || "");
     const onClose = () => {
-      // Cancel/force-close: unblock manual followup instead of hanging 15 min
       settle(null, new Error("Browser session closed while waiting for Kiro callback"));
     };
 
     trackedPage.on("framenavigated", onFrame);
     trackedPage.on("request", onRequest);
     trackedPage.on("requestfailed", onRequestFailed);
+    trackedPage.on("response", onResponse);
     trackedPage.on("domcontentloaded", onLoadState);
     trackedPage.on("load", onLoadState);
     trackedPage.on("close", onClose);
@@ -1238,11 +1398,14 @@ export function createKiroCallbackMonitor(context, page, timeoutMs = DEFAULT_MAN
       trackedPage.off("framenavigated", onFrame);
       trackedPage.off("request", onRequest);
       trackedPage.off("requestfailed", onRequestFailed);
+      trackedPage.off("response", onResponse);
       trackedPage.off("domcontentloaded", onLoadState);
       trackedPage.off("load", onLoadState);
       trackedPage.off("close", onClose);
     });
 
+    attachCdpNetwork(trackedPage, ownerCleanups);
+
     const current = parseCallbackUrl(trackedPage.url?.() || "");
     if (current) settle(current);
   }
@@ -1257,10 +1420,20 @@ export function createKiroCallbackMonitor(context, page, timeoutMs = DEFAULT_MAN
     const onClose = () => {
       settle(null, new Error("Browser context closed while waiting for Kiro callback"));
     };
+    const onCtxRequest = (request) => trySettleFromUrl(request?.url?.() || "");
+    const onCtxRequestFailed = (request) => trySettleFromUrl(request?.url?.() || "");
+    const onCtxResponse = (response) => trySettleFromResponse(response);
+
     ctx.on("page", onPage);
     ctx.on("close", onClose);
+    ctx.on("request", onCtxRequest);
+    ctx.on("requestfailed", onCtxRequestFailed);
+    ctx.on("response", onCtxResponse);
     cleanups.push(() => ctx.off("page", onPage));
     cleanups.push(() => ctx.off("close", onClose));
+    cleanups.push(() => ctx.off("request", onCtxRequest));
+    cleanups.push(() => ctx.off("requestfailed", onCtxRequestFailed));
+    cleanups.push(() => ctx.off("response", onCtxResponse));
 
     if (pg) registerPage(pg, cleanups);
   }
@@ -1271,7 +1444,6 @@ export function createKiroCallbackMonitor(context, page, timeoutMs = DEFAULT_MAN
     if (newContext) bind(newContext, newPage);
   };
 
-  // Allow cancel path to force-reject without waiting for timeout
   promise.abort = (reason = "Job cancelled") => {
     settle(null, new Error(reason));
   };
@@ -1392,11 +1564,21 @@ export async function runGoogleAccountAutomation({
     onStep?.(step, message);
   };
 
+  const interstitialOpts = (maxWaitMs) => ({ maxWaitMs, successPromise });
+  // Prevent re-submitting email/password while Google is still transitioning
+  // (pwd page stays mounted ~1–3s after Next; re-fill aborts the OAuth chain).
+  let passwordSubmittedAt = 0;
+  let emailSubmittedAt = 0;
+  const PASSWORD_RESUBMIT_COOLDOWN_MS = 25_000;
+  const EMAIL_RESUBMIT_COOLDOWN_MS = 12_000;
+
   reportStep(openingStep, openingMessage);
   await page.goto(authUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
   await page.waitForTimeout(2_000);
+  await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
 
   await handleProviderLoginGate(page, reportStep);
+  await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
 
   const emailInput = await waitForFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR, { timeout: 15_000 });
   if (emailInput) {
@@ -1407,10 +1589,12 @@ export async function runGoogleAccountAutomation({
     } else {
       reportStep("submitting_email", "Submitting email");
       await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
+      emailSubmittedAt = Date.now();
       // Wait for the page to transition away from the email step so the
       // polling loop doesn't immediately re-detect the disappearing email
       // field and type the email value into the password input.
-      await page.waitForTimeout(2_500);
+      await page.waitForTimeout(1_500);
+      await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
     }
   }
 
@@ -1436,20 +1620,31 @@ export async function runGoogleAccountAutomation({
       };
     }
 
+    // Unblock SetSID / empty Google interstitials before other handlers
+    const waited = await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
+    if (waited) {
+      continue;
+    }
+
     const handledGoogleConsent = await handleGoogleConsent(page, reportStep);
     if (handledGoogleConsent) {
+      await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
       continue;
     }
 
-    // Headless Chromium gets bounced to myaccount.google.com/not-supported at the
-    // OAuth consent step. From there the broad Google-button selectors wander onto
-    // about.google and loop until timeout. Detect the dead-end and bail to manual
-    // (the Camoufox engine avoids this by not being flagged as headless).
-    if (isBlockedBrowserPage(page)) {
-      reportStep("manual_assist_required", "Google blocked the automated browser (not-supported). Use the Camoufox engine or complete manually.");
+    // Headless Chromium is rejected after email submit → /v3/signin/rejected
+    // ("This browser or app may not be secure"). Fail fast — do not spin 90s.
+    if (await isBlockedBrowser(page)) {
+      const url = page.url?.() || "";
+      reportStep(
+        "browser_blocked_by_google",
+        `Google blocked this browser (url=${url.slice(0, 120)}). Headless Chromium is rejected — use headed mode or Camoufox.`,
+      );
       return {
-        status: "needs_manual",
-        error: "Google blocked the automated browser at the OAuth consent step (not-supported page). Switch to the Camoufox engine or finish this account manually.",
+        status: "failed_browser_blocked",
+        error:
+          "Google blocked the automated browser (\"This browser or app may not be secure\" / signin rejected). " +
+          "Kiro bulk must use headed Chromium (Xvfb on Linux) or the Camoufox engine — not headless Chrome.",
       };
     }
 
@@ -1495,25 +1690,60 @@ export async function runGoogleAccountAutomation({
     // address into whatever field is focused (often the password input).
     const passwordInput = await getFirstVisibleLocator(page, PASSWORD_INPUT_SELECTOR);
     if (passwordInput) {
+      const sincePw = Date.now() - passwordSubmittedAt;
+      if (passwordSubmittedAt && sincePw < PASSWORD_RESUBMIT_COOLDOWN_MS) {
+        // Still on (or animating off) the password form after a recent submit —
+        // do NOT re-fill; wait for SetSID/consent/callback instead.
+        reportStep(
+          "waiting_after_password",
+          `Password already submitted ${Math.round(sincePw / 1000)}s ago — waiting for Google redirect`,
+        );
+        await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
+        await page.waitForTimeout(500);
+        continue;
+      }
+
       reportStep("entering_password", "Entering Google password");
       const filled = await fillInputResilient(passwordInput, password);
       if (filled) {
         reportStep("submitting_password", "Submitting password");
         await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
+        passwordSubmittedAt = Date.now();
+        // Give Google time to leave the password challenge before the next
+        // loop iteration can re-detect the still-mounted password field.
+        await Promise.race([
+          page.waitForNavigation({ waitUntil: "domcontentloaded", timeout: 8_000 }).catch(() => null),
+          page.waitForTimeout(2_500),
+        ]);
+        // Password submit often lands on empty SetSID while network completes
+        // consent→idpresponse→kiro://. Callback monitor (CDP) settles successPromise.
+        await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(25_000));
       } else {
         reportStep("password_fill_failed", "Could not fill the Google password field; retrying loop");
+        await page.waitForTimeout(700);
       }
-      await page.waitForTimeout(700);
       continue;
     }
 
     const nextEmailInput = await getFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR);
     if (nextEmailInput) {
+      const sinceEmail = Date.now() - emailSubmittedAt;
+      if (emailSubmittedAt && sinceEmail < EMAIL_RESUBMIT_COOLDOWN_MS) {
+        reportStep(
+          "waiting_after_email",
+          `Email already submitted ${Math.round(sinceEmail / 1000)}s ago — waiting for password/next screen`,
+        );
+        await page.waitForTimeout(800);
+        continue;
+      }
+
       reportStep("entering_email", "Entering Google email");
       const filled = await fillInputResilient(nextEmailInput, email);
       if (filled) {
         reportStep("submitting_email", "Submitting email");
         await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
+        emailSubmittedAt = Date.now();
+        await page.waitForTimeout(1_500);
       } else {
         reportStep("email_fill_failed", "Could not fill the Google email field; retrying loop");
       }
@@ -1533,14 +1763,42 @@ export async function runGoogleAccountAutomation({
       continue;
     }
 
-    reportStep("waiting_for_next_screen", `Waiting for the next Google or ${serviceLabel} screen`);
+    // Periodic diagnostics so jobs aren't opaque "waiting" spam
+    if (Math.floor((Date.now() - startTime) / 5000) !== Math.floor((Date.now() - startTime - 700) / 5000)) {
+      const url = page.url?.() || "";
+      const snippet = String(text || (await readPageText(page).catch(() => ""))).slice(0, 100).replace(/\s+/g, " ");
+      reportStep(
+        "waiting_for_next_screen",
+        `Waiting for the next Google or ${serviceLabel} screen (url=${url.slice(0, 100)} body=${snippet})`,
+      );
+    } else {
+      reportStep("waiting_for_next_screen", `Waiting for the next Google or ${serviceLabel} screen`);
+    }
     await page.waitForTimeout(700);
   }
 
-  reportStep("manual_assist_required", `Flow did not complete ${serviceLabel} authorization automatically`);
+  // Final blocked check before generic needs_manual
+  if (await isBlockedBrowser(page)) {
+    reportStep("browser_blocked_by_google", "Google blocked browser at end of automation window");
+    return {
+      status: "failed_browser_blocked",
+      error:
+        "Google blocked the automated browser (\"This browser or app may not be secure\"). " +
+        "Use headed Chromium (Xvfb) or Camoufox engine.",
+    };
+  }
+
+  const finalUrl = page.url?.() || "";
+  const finalBody = String(await readPageText(page).catch(() => "")).slice(0, 120).replace(/\s+/g, " ");
+  reportStep(
+    "manual_assist_required",
+    `Flow did not complete ${serviceLabel} authorization automatically (url=${finalUrl.slice(0, 100)} body=${finalBody})`,
+  );
   return {
     status: "needs_manual",
-    error: `Manual assist required in the browser session because the login flow did not complete ${serviceLabel} authorization automatically.`,
+    error:
+      `Manual assist required — ${serviceLabel} authorization did not finish automatically ` +
+      `(last url: ${finalUrl.slice(0, 140)}). If you see "browser may not be secure", switch to headed Chromium/Camoufox.`,
   };
 }