zevairouter 1.0.82 → 1.0.84

package/src/lib/oauth/services/grokXaiEmailAutomation.js

@@ -43,35 +43,194 @@ async function typeSlow(locator, value, delay = 35) {
   await locator.type(value, { delay });
 }
 
+async function readTurnstileToken(page) {
+  return page.evaluate(() => {
+    const pick = (root) => {
+      const el = root.querySelector?.(
+        "input[name=cf-turnstile-response], textarea[name=cf-turnstile-response], [name=cf-turnstile-response]"
+      );
+      const v = el ? String(el.value || "") : "";
+      return v.length > 20 ? v : "";
+    };
+    let v = pick(document);
+    if (v) return v;
+    // Some widgets stash token in response fields after success
+    for (const el of document.querySelectorAll("[data-sitekey], .cf-turnstile, #cf-turnstile")) {
+      const input = el.querySelector?.("input, textarea");
+      if (input?.value && String(input.value).length > 20) return String(input.value);
+    }
+    return "";
+  }).catch(() => "");
+}
+
+/**
+ * Nudge Turnstile the way a human would: scroll into view, move mouse, click
+ * the widget / checkbox iframe. CloakBrowser humanize alone is not enough if
+ * the checkbox never receives a real click.
+ */
+async function interactWithTurnstile(page) {
+  // Scroll any turnstile host into view
+  await page.evaluate(() => {
+    const host = document.querySelector(
+      ".cf-turnstile, [data-sitekey], iframe[src*='turnstile'], iframe[src*='challenges.cloudflare']"
+    );
+    host?.scrollIntoView?.({ block: "center", behavior: "instant" });
+  }).catch(() => null);
+
+  // Prefer clicking the visible iframe box on the main page (Playwright hit-test)
+  const iframeLocators = [
+    'iframe[src*="challenges.cloudflare.com"]',
+    'iframe[src*="turnstile"]',
+    ".cf-turnstile iframe",
+    "iframe[title*='Widget']",
+    "iframe[title*='Cloudflare']",
+  ];
+  for (const sel of iframeLocators) {
+    try {
+      const loc = page.locator(sel).first();
+      if (!(await loc.isVisible({ timeout: 400 }).catch(() => false))) continue;
+      const box = await loc.boundingBox().catch(() => null);
+      if (box && box.width > 10 && box.height > 10) {
+        // Human-ish approach: move near, then click center-left (checkbox side)
+        const x = box.x + Math.min(30, box.width * 0.2);
+        const y = box.y + box.height / 2;
+        await page.mouse.move(x - 40, y - 20, { steps: 8 }).catch(() => null);
+        await wait(120 + Math.floor(Math.random() * 180));
+        await page.mouse.move(x, y, { steps: 6 }).catch(() => null);
+        await wait(80 + Math.floor(Math.random() * 120));
+        await page.mouse.click(x, y).catch(() => null);
+        return "iframe-box";
+      }
+      await loc.click({ timeout: 1_500, force: true }).catch(() => null);
+      return "iframe-click";
+    } catch {
+      // next selector
+    }
+  }
+
+  // Frame-level checkbox (managed challenge)
+  try {
+    for (const frame of page.frames()) {
+      const url = frame.url() || "";
+      if (!/turnstile|challenges\.cloudflare/i.test(url)) continue;
+      const checkbox = frame.locator(
+        "input[type=checkbox], #challenge-stage input, .ctp-checkbox-label, label"
+      ).first();
+      if (await checkbox.isVisible({ timeout: 500 }).catch(() => false)) {
+        await checkbox.click({ timeout: 1_500 }).catch(() => null);
+        return "frame-checkbox";
+      }
+      await frame.locator("body").click({ timeout: 800, position: { x: 24, y: 24 } }).catch(() => null);
+      return "frame-body";
+    }
+  } catch {
+    // ignore
+  }
+
+  // Idle human noise — small mouse jitter helps some managed challenges
+  try {
+    const vp = page.viewportSize() || { width: 1280, height: 900 };
+    await page.mouse.move(
+      80 + Math.floor(Math.random() * (vp.width - 160)),
+      80 + Math.floor(Math.random() * (vp.height - 160)),
+      { steps: 5 }
+    );
+  } catch {
+    // ignore
+  }
+  return null;
+}
+
 /**
- * Wait until Cloudflare Turnstile populates cf-turnstile-response (or times out).
+ * Wait until Cloudflare Turnstile populates cf-turnstile-response.
+ * Actively interacts with the widget (not passive poll-only).
  */
-export async function waitForTurnstile(page, { timeoutMs = 60_000, onStep } = {}) {
+export async function waitForTurnstile(page, { timeoutMs = 120_000, onStep, label = "Turnstile" } = {}) {
   const start = Date.now();
+  let lastInteractAt = 0;
+  let interactCount = 0;
+  let sawWidget = false;
+
+  onStep?.("turnstile_wait", `Waiting for Cloudflare ${label} (auto-click widget)`);
+
   while (Date.now() - start < timeoutMs) {
-    const val = await page.evaluate(() => {
-      const el = document.querySelector("input[name=cf-turnstile-response], [name=cf-turnstile-response]");
-      return el ? String(el.value || "") : "";
-    }).catch(() => "");
-    if (val && val.length > 20) {
-      onStep?.("turnstile_ok", `Cloudflare Turnstile solved (${val.length} chars)`);
+    const val = await readTurnstileToken(page);
+    if (val) {
+      onStep?.("turnstile_ok", `Cloudflare ${label} solved (${val.length} chars)`);
       return { ok: true, length: val.length };
     }
-    // try click challenge iframe
-    try {
-      for (const frame of page.frames()) {
-        const url = frame.url() || "";
-        if (/turnstile|challenges\.cloudflare/i.test(url)) {
-          await frame.locator("input[type=checkbox], body").first().click({ timeout: 800 }).catch(() => null);
-        }
+
+    // Detect widget presence for better logs
+    if (!sawWidget) {
+      sawWidget = await page.evaluate(() => {
+        return !!(
+          document.querySelector(".cf-turnstile, [data-sitekey], iframe[src*='turnstile'], iframe[src*='challenges.cloudflare']")
+          || [...document.querySelectorAll("iframe")].some((f) => /turnstile|cloudflare/i.test(f.src || ""))
+        );
+      }).catch(() => false);
+      if (sawWidget) {
+        onStep?.("turnstile_widget", "Turnstile widget detected — interacting");
       }
-    } catch {
-      // ignore
     }
-    await wait(1_200);
+
+    // Interact every ~2.5s (not every loop) so we don't spam-click
+    const now = Date.now();
+    if (now - lastInteractAt > 2_500) {
+      lastInteractAt = now;
+      interactCount += 1;
+      const how = await interactWithTurnstile(page);
+      if (how && interactCount <= 6) {
+        onStep?.("turnstile_click", `Turnstile interact #${interactCount} (${how})`);
+      }
+    }
+
+    await wait(900 + Math.floor(Math.random() * 400));
   }
-  onStep?.("turnstile_timeout", "Turnstile did not produce a token in time");
-  return { ok: false };
+
+  const final = await readTurnstileToken(page);
+  if (final) {
+    onStep?.("turnstile_ok", `Cloudflare ${label} solved late (${final.length} chars)`);
+    return { ok: true, length: final.length };
+  }
+
+  onStep?.(
+    "turnstile_timeout",
+    `Turnstile did not produce a token in ${Math.round(timeoutMs / 1000)}s (widget=${sawWidget ? "seen" : "missing"}, clicks=${interactCount})`
+  );
+  return { ok: false, sawWidget, interactCount };
+}
+
+/**
+ * Wait for Turnstile with one automatic retry (reload widget / re-click).
+ * Only then should callers surface needs_manual.
+ */
+export async function waitForTurnstileWithRetry(page, { timeoutMs = 90_000, onStep } = {}) {
+  let result = await waitForTurnstile(page, { timeoutMs, onStep, label: "Turnstile" });
+  if (result.ok) return result;
+
+  onStep?.("turnstile_retry", "First Turnstile wait failed — soft refresh + retry");
+  // Soft nudge: re-focus page and re-run widget (xAI often remounts on activity)
+  try {
+    await page.mouse.wheel(0, 120);
+    await wait(400);
+    await page.mouse.wheel(0, -120);
+    await wait(600);
+    // If site exposes turnstile reset
+    await page.evaluate(() => {
+      try {
+        if (window.turnstile?.reset) window.turnstile.reset();
+      } catch { /* ignore */ }
+    }).catch(() => null);
+  } catch {
+    // ignore
+  }
+
+  result = await waitForTurnstile(page, {
+    timeoutMs: Math.max(60_000, Math.floor(timeoutMs * 0.75)),
+    onStep,
+    label: "Turnstile (retry)",
+  });
+  return result;
 }
 
 /**
@@ -109,13 +268,70 @@ export async function runXaiEmailSignup(page, {
   await typeSlow(page.locator("input[type=email], input[name=email]").first(), email, 40);
   await clickFirst(page, ['button:has-text("Sign up")', 'button:has-text("Sign Up")']);
   report("submitted_email", `Submitted sign-up email ${email}`);
-  await wait(2_000);
+  await wait(2_500);
   await dismissCookies(page);
 
-  report("polling_otp", "Polling tempmail for xAI confirmation code");
-  const otp = await pollOtp(email, { timeoutMs: 120_000, intervalMs: 3_000 });
+  // Fail fast if xAI rejected the address / blocked the session before OTP is sent.
+  {
+    const early = await pageText(page);
+    if (/already (have an account|exists|registered)|try a different email|invalid email|not available|something went wrong|access denied|blocked/i.test(early)
+      && !/confirmation code|security code|Verify your email|one.?time/i.test(early)) {
+      return {
+        status: "failed",
+        step: "signup_rejected",
+        error: `xAI rejected sign-up before OTP (page: ${early.slice(0, 160).replace(/\s+/g, " ")})`,
+      };
+    }
+  }
+
+  // Wait until code field / OTP copy appears (proxy latency) before heavy polling.
+  for (let i = 0; i < 20; i++) {
+    const hasCode = await page.locator("input[name=code], input[autocomplete=one-time-code]").first().isVisible().catch(() => false);
+    const t = await pageText(page);
+    if (hasCode || /confirmation code|security code|Verify your email|one.?time|enter (the )?code/i.test(t)) break;
+    await wait(500);
+  }
+
+  report("polling_otp", "Polling tempmail for xAI confirmation code (direct, not via browser proxy)");
+  let otp = null;
+  try {
+    otp = await pollOtp(email, {
+      timeoutMs: 180_000,
+      intervalMs: 3_000,
+      onProgress: (info) => {
+        if (info.error) {
+          report(
+            "polling_otp",
+            `Tempmail inbox error (${info.elapsedSec}s): ${info.error}`
+          );
+          return;
+        }
+        if (info.inboxCount === 0) {
+          report(
+            "polling_otp",
+            `Waiting for xAI mail… ${info.elapsedSec}s (inbox empty — proxy only affects browser; mail is polled direct)`
+          );
+        } else {
+          report(
+            "polling_otp",
+            `Inbox ${info.inboxCount} mail(s) @${info.elapsedSec}s; subjects: ${(info.subjects || []).join(" | ") || "—"}`
+          );
+        }
+      },
+    });
+  } catch (error) {
+    return {
+      status: "failed",
+      step: "otp_timeout",
+      error: error.message || "Tempmail OTP poll failed",
+    };
+  }
   if (!otp?.code) {
-    return { status: "failed", step: "otp_timeout", error: "No xAI OTP received on tempmail inbox" };
+    return {
+      status: "failed",
+      step: "otp_timeout",
+      error: "No xAI OTP on tempmail after 180s (email may not have been sent — try another residential proxy or check page for blocks)",
+    };
   }
   report("otp_received", `OTP ${otp.code} from ${otp.subject || "tempmail"}`);
 
@@ -146,13 +362,22 @@ export async function runXaiEmailSignup(page, {
   await typeSlow(page.locator("input[name=givenName]").first(), firstName, 35);
   await typeSlow(page.locator("input[name=familyName]").first(), lastName, 35);
   await typeSlow(page.locator("input[name=password], input[type=password]").first(), password, 35);
+  // Let Turnstile mount after password focus (proxy latency)
+  await wait(1_500);
 
-  const turnstile = await waitForTurnstile(page, { timeoutMs: 60_000, onStep });
+  let turnstile = await waitForTurnstileWithRetry(page, { timeoutMs: 90_000, onStep });
+  if (!turnstile.ok) {
+    // Last attempt: wait longer once more before admitting defeat
+    onStep?.("turnstile_last_try", "Final Turnstile wait (120s)");
+    turnstile = await waitForTurnstile(page, { timeoutMs: 120_000, onStep, label: "Turnstile (final)" });
+  }
   if (!turnstile.ok) {
     return {
       status: "needs_manual",
       step: "turnstile",
-      error: "Cloudflare Turnstile did not solve. Use CloakBrowser headed engine or complete manually.",
+      error:
+        "Cloudflare Turnstile did not solve after auto-clicks + retries. " +
+        "Ensure CloakBrowser headed + Xvfb on VPS, residential proxy with geoip, concurrency 1.",
     };
   }
 
@@ -160,10 +385,11 @@ export async function runXaiEmailSignup(page, {
   report("completing_signup", "Clicked Complete sign up");
   await wait(4_000);
 
-  // Retry if still on form but turnstile refreshed
+  // Retry if still on form but turnstile refreshed after submit
   text = await pageText(page);
   if (/Complete your sign up/i.test(text)) {
-    await waitForTurnstile(page, { timeoutMs: 20_000, onStep });
+    report("completing_signup_retry", "Still on profile form — re-solving Turnstile");
+    await waitForTurnstileWithRetry(page, { timeoutMs: 75_000, onStep });
     await clickFirst(page, ['button:has-text("Complete sign up")']);
     await wait(4_000);
     text = await pageText(page);
@@ -259,15 +485,32 @@ async function ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp }
   if (await page.locator("input[type=password]").first().isVisible().catch(() => false)) {
     report("device_login_password", "Entering password on device page");
     await typeSlow(page.locator("input[type=password]").first(), password, 40);
-    await waitForTurnstile(page, { timeoutMs: 45_000, onStep });
+    await waitForTurnstileWithRetry(page, { timeoutMs: 75_000, onStep });
     await clickFirst(page, ['button:has-text("Login")', 'button:has-text("Log in")', 'button[type=submit]']);
     await wait(2_500);
   }
 
   let text = await pageText(page);
   if (/security code|Verify your email|one time|confirmation code/i.test(text)) {
-    report("login_otp", "Login requires OTP — polling tempmail");
-    const otp = await pollOtp(email, { timeoutMs: 90_000 });
+    report("login_otp", "Login requires OTP — polling tempmail (direct)");
+    let otp = null;
+    try {
+      otp = await pollOtp(email, {
+        timeoutMs: 120_000,
+        intervalMs: 3_000,
+        onProgress: (info) => {
+          if (info.inboxCount === 0) {
+            report("login_otp", `Waiting OTP… ${info.elapsedSec}s (inbox empty)`);
+          } else if (info.inboxCount > 0) {
+            report("login_otp", `Inbox ${info.inboxCount} @${info.elapsedSec}s: ${(info.subjects || []).join(" | ")}`);
+          } else if (info.error) {
+            report("login_otp", `Tempmail error: ${info.error}`);
+          }
+        },
+      });
+    } catch {
+      otp = null;
+    }
     if (otp?.code) {
       const codeInput = page.locator("input[name=code], input[autocomplete=one-time-code], input[type=text]").first();
       if (await codeInput.isVisible().catch(() => false)) {
@@ -279,6 +522,145 @@ async function ensureEmailLoginOnPage(page, { email, password, onStep, pollOtp }
   }
 }
 
+/**
+ * Authorize Grok CLI device code via **Google OAuth** (GSuite / Gmail).
+ * Same pattern as Kiro/CodeBuddy bulk: open device URL → Continue with Google →
+ * shared Google automation → poll device token as successPromise.
+ *
+ * Prefer this over tempmail signup when you already have Google accounts.
+ */
+export async function runXaiGoogleDeviceAuthorize(page, {
+  email,
+  password,
+  verificationUrl,
+  pollToken,
+  deviceCode,
+  onStep,
+  cancelCheck,
+  shortTimeoutMs = 5 * 60_000,
+} = {}) {
+  const report = (step, message) => onStep?.(step, message);
+  const { runGoogleAccountAutomation } = await import("./googleAutomation.js");
+
+  const pollPromise = (async () => {
+    const start = Date.now();
+    // Start aggressive (2s) — device authorize is often ready within seconds
+    // of the UI click; 4s+ intervals left ~half a minute on the table.
+    let interval = 2_000;
+    while (Date.now() - start < 12 * 60_000) {
+      if (cancelCheck?.()) throw new Error("Job cancelled during token polling");
+      const result = await pollToken(deviceCode);
+      if (result?.success && result.tokens) return { tokens: result.tokens };
+      if (result?.pending || result?.error === "authorization_pending") {
+        await wait(interval);
+        continue;
+      }
+      if (result?.error === "slow_down") {
+        interval = Math.min(interval + 2_000, 12_000);
+        await wait(interval);
+        continue;
+      }
+      // expired_token / access_denied — stop early
+      if (result?.error && !["authorization_pending", "slow_down"].includes(result.error)) {
+        report("token_poll_note", `Poll: ${result.error}`);
+      }
+      await wait(interval);
+    }
+    throw new Error("Timed out waiting for Grok CLI OAuth token after Google login");
+  })();
+  // Prevent unhandled rejection if Google path fails first
+  pollPromise.catch(() => null);
+
+  report("opening_device_google", "Opening Grok device auth — will use Google login");
+  const automation = await runGoogleAccountAutomation({
+    page,
+    authUrl: verificationUrl,
+    email,
+    password,
+    successPromise: pollPromise,
+    shortTimeoutMs,
+    serviceLabel: "Grok CLI",
+    openingStep: "opening_device_google",
+    openingMessage: "Opening Grok device page (Google OAuth)",
+    successStep: "grok_token_received",
+    successMessage: "Grok CLI OAuth token received",
+    onStep,
+  });
+
+  if (automation.status === "success") {
+    // tokens may be nested from successPromise spread
+    const tokens = automation.tokens || automation.result?.tokens || null;
+    if (tokens?.accessToken || tokens?.access_token) {
+      return { status: "success", tokens };
+    }
+    // successPromise resolved but shape unknown — try one more poll
+    try {
+      const result = await pollToken(deviceCode);
+      if (result?.success && result.tokens) return { status: "success", tokens: result.tokens };
+    } catch {
+      /* fall through */
+    }
+    return {
+      status: "failed",
+      error: "Google login finished but Grok device token was not captured",
+    };
+  }
+
+  // After Google SSO, xAI sometimes parks on /account. Re-open device URL and
+  // mash authorize controls while the device token poll is still alive.
+  if (!["failed_browser_blocked", "failed_invalid_credentials", "failed_restricted"].includes(automation.status)) {
+    report("device_reopen_after_google", "Re-opening device URL after Google automation window");
+    try {
+      await page.goto(verificationUrl, { waitUntil: "domcontentloaded", timeout: 45_000 });
+      await wait(1_500);
+      await dismissCookies(page);
+      for (let i = 0; i < 8; i += 1) {
+        if (cancelCheck?.()) break;
+        // Prefer Google again if login wall reappeared
+        const googleVisible = await page.getByRole("button", { name: /google/i }).first()
+          .isVisible({ timeout: 400 }).catch(() => false);
+        if (googleVisible) {
+          report("device_google_again", "Google login still required on device page");
+          break;
+        }
+        const clicked = await clickDeviceAuthorizeControls(page);
+        if (clicked) {
+          report("device_click", `Clicked authorize control after Google (${i + 1})`);
+        }
+        // Race poll briefly
+        const raced = await Promise.race([
+          pollPromise.then((r) => ({ ok: true, r })).catch(() => null),
+          wait(2_500).then(() => null),
+        ]);
+        if (raced?.ok && raced.r?.tokens) {
+          return { status: "success", tokens: raced.r.tokens };
+        }
+        const text = await pageText(page);
+        if (/Device Authorized|device has been authorized|you can close|successfully authorized/i.test(text)) {
+          report("device_authorized", "Device authorized in browser after Google");
+          const result = await pollToken(deviceCode).catch(() => null);
+          if (result?.success && result.tokens) return { status: "success", tokens: result.tokens };
+        }
+      }
+    } catch (e) {
+      report("device_reopen_note", String(e?.message || e).slice(0, 120));
+    }
+  }
+
+  // If Google finished but token poll still pending, keep authorize UI loop briefly
+  if (automation.status === "needs_manual" || automation.status === "failed_restricted") {
+    return {
+      status: automation.status,
+      error: automation.error || "Google automation needs manual assist",
+    };
+  }
+
+  return {
+    status: automation.status || "failed",
+    error: automation.error || "Google device authorization failed",
+  };
+}
+
 /**
  * Login with email+password (session), then authorize a Grok CLI device code.
  */
@@ -400,9 +782,21 @@ export async function runXaiEmailDeviceAuthorize(page, {
         if (clicked && i % 3 === 0) {
           report("device_click", `Clicked authorize control (${i + 1})`);
         }
-        // Turnstile sometimes reappears on consent
-        await waitForTurnstile(page, { timeoutMs: 12_000, onStep: i % 5 === 0 ? onStep : undefined });
-        await wait(1_800);
+        // Only burn time on Turnstile when the widget is actually on the page.
+        // Old code always waited 12s even with widget=missing → looked stuck / needs_manual.
+        const hasWidget = await page.evaluate(() => !!(
+          document.querySelector(".cf-turnstile, [data-sitekey], iframe[src*='turnstile'], iframe[src*='challenges.cloudflare']")
+          || [...document.querySelectorAll("iframe")].some((f) => /turnstile|cloudflare/i.test(f.src || f.title || ""))
+        )).catch(() => false);
+        const tokenAlready = await readTurnstileToken(page);
+        if (hasWidget && !tokenAlready) {
+          await waitForTurnstile(page, {
+            timeoutMs: 45_000,
+            onStep: i % 3 === 0 ? onStep : undefined,
+            label: "device Turnstile",
+          });
+        }
+        await wait(1_200);
         i += 1;
         continue;
       }