zevairouter 1.0.83 → 1.0.84

package/src/lib/oauth/services/kiroGoogleAutomation.js

@@ -96,14 +96,28 @@ const GOOGLE_LOGIN_BUTTON_SELECTORS = [
   'a#social-google',
   'a:has-text("Sign up with Google")',
   'a:has-text("Log in with Google")',
+  'a:has-text("Login with Google")',
+  'a:has-text("Continue with Google")',
+  'a:has-text("Sign in with Google")',
   'button:has-text("Sign up with Google")',
   'button:has-text("Log in with Google")',
+  'button:has-text("Login with Google")',
+  'button:has-text("Continue with Google")',
+  'button:has-text("Sign in with Google")',
   'button:has-text("Google")',
   'a:has-text("Google")',
+  'div[role="button"]:has-text("Continue with Google")',
+  'div[role="button"]:has-text("Login with Google")',
   'div[role="button"]:has-text("Google")',
+  'span:has-text("Continue with Google")',
+  'span:has-text("Login with Google")',
   'span:has-text("Google")',
   '[aria-label*="Google"]',
   '[data-provider*="google" i]',
+  // xAI / Grok device + account pages
+  'button:has-text("Login with Google")',
+  'button:has-text("Continue with Google")',
+  '[data-testid*="google" i]',
 ];
 
 const TERMS_CHECKBOX_SELECTORS = [
@@ -413,55 +427,40 @@ async function waitForFirstVisibleLocator(page, selector, { timeout = 15_000, po
 async function fillInputResilient(locator, value, { timeout = 15_000 } = {}) {
   if (!locator || value == null) return false;
 
-  // Primary: click + type with human-like random delay to avoid CAPTCHA triggers.
-  // Avoid fill() as primary — it sets the value instantly which Google detects.
+  // Prefer fill() first (fast). CloakBrowser already spoofs input events well
+  // enough for Google in practice; slow type is only a fallback for React
+  // controlled fields that reject programmatic fill.
   try {
-    await locator.click({ timeout: 5_000 });
+    await locator.click({ timeout: 3_000 });
   } catch {
     /* noop */
   }
   try {
-    await locator.fill("", { timeout: 3_000 });
+    await locator.fill(String(value), { timeout: Math.min(timeout, 8_000) });
+    const observed = await locator.inputValue().catch(() => "");
+    if (observed === value) return true;
+  } catch {
+    /* fall through to typed input */
+  }
+
+  try {
+    await locator.fill("", { timeout: 2_000 });
   } catch {
     /* noop */
   }
   try {
-    const delay = Math.floor(40 + Math.random() * 80); // 40-120ms per keystroke
-    await locator.type(value, { delay, timeout });
+    // Light humanization only if fill failed — 15–35ms/key (was 40–120ms).
+    const delay = Math.floor(15 + Math.random() * 20);
+    await locator.type(String(value), { delay, timeout });
   } catch {
-    // If type() fails, fall back to fill()
     try {
-      await locator.fill(value, { timeout });
+      await locator.fill(String(value), { timeout });
     } catch {
       return false;
     }
   }
 
   let observed = "";
-  try {
-    observed = await locator.inputValue();
-  } catch {
-    observed = "";
-  }
-  if (observed === value) return true;
-
-  // Final fallback for React/Vue-controlled inputs
-  try {
-    await locator.click({ timeout: 5_000 });
-  } catch {
-    /* noop */
-  }
-  try {
-    await locator.fill("");
-  } catch {
-    /* noop */
-  }
-  try {
-    await locator.type(value, { delay: 50, timeout });
-  } catch {
-    return false;
-  }
-
   try {
     observed = await locator.inputValue();
   } catch {
@@ -622,9 +621,16 @@ async function waitThroughGoogleInterstitials(page, reportStep, { maxWaitMs = 20
 function isProviderPage(page) {
   try {
     const url = new URL(page.url());
-    return /codebuddy\.(ai|cn)$/.test(url.hostname)
-      || url.hostname.endsWith(".codebuddy.ai")
-      || url.hostname.endsWith(".codebuddy.cn");
+    const host = url.hostname || "";
+    return /codebuddy\.(ai|cn)$/.test(host)
+      || host.endsWith(".codebuddy.ai")
+      || host.endsWith(".codebuddy.cn")
+      // xAI / Grok CLI device authorization + account host
+      || host === "accounts.x.ai"
+      || host === "auth.x.ai"
+      || host.endsWith(".x.ai")
+      || host === "grok.com"
+      || host.endsWith(".grok.com");
   } catch {
     return false;
   }
@@ -1188,6 +1194,38 @@ async function handleCodeBuddyStartedAuthorization(page, reportStep) {
   return true;
 }
 
+async function providerHasGoogleLogin(page) {
+  try {
+    for (const name of [/continue with google/i, /sign in with google/i, /sign up with google/i, /^google$/i]) {
+      const btn = page.getByRole("button", { name }).first();
+      if (await btn.isVisible({ timeout: 300 }).catch(() => false)) return true;
+      const link = page.getByRole("link", { name }).first();
+      if (await link.isVisible({ timeout: 200 }).catch(() => false)) return true;
+    }
+  } catch {
+    /* ignore */
+  }
+  for (const selector of GOOGLE_LOGIN_BUTTON_SELECTORS) {
+    try {
+      const loc = page.locator(selector).first();
+      if (await loc.isVisible({ timeout: 200 }).catch(() => false)) return true;
+    } catch {
+      /* next */
+    }
+  }
+  return false;
+}
+
+function isXaiProviderPage(page) {
+  try {
+    const host = new URL(page.url()).hostname || "";
+    return host === "accounts.x.ai" || host === "auth.x.ai" || host.endsWith(".x.ai")
+      || host === "grok.com" || host.endsWith(".grok.com");
+  } catch {
+    return false;
+  }
+}
+
 async function handleProviderOnboarding(page, reportStep, serviceLabel) {
   if (!isProviderPage(page) || isGoogleAuthPage(page)) return false;
 
@@ -1208,37 +1246,53 @@ async function handleProviderOnboarding(page, reportStep, serviceLabel) {
     return true;
   }
 
-  const selectedNativeRegion = await selectNativeRegionOption(page);
-  if (selectedNativeRegion) {
-    reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
-    await page.waitForTimeout(700);
-    return true;
-  }
+  // Region / workspace defaults are CodeBuddy-style — not xAI device approve.
+  // False-positive select matches on xAI wasted the session into "Invalid action".
+  if (!isXaiProviderPage(page)) {
+    const selectedNativeRegion = await selectNativeRegionOption(page);
+    if (selectedNativeRegion) {
+      reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
+      await page.waitForTimeout(700);
+      return true;
+    }
+
+    const openedRegionMenu = await clickFirstActionable(page, PROVIDER_REGION_TRIGGER_SELECTORS);
+    if (openedRegionMenu) {
+      reportStep("opening_provider_region_selector", `Opening ${serviceLabel} region selector`);
+      await page.waitForTimeout(500);
+      const selectedRegion = await clickFirstActionable(page, PROVIDER_REGION_OPTION_SELECTORS);
+      if (selectedRegion) {
+        reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
+        await page.waitForTimeout(700);
+      }
+      return true;
+    }
 
-  const openedRegionMenu = await clickFirstActionable(page, PROVIDER_REGION_TRIGGER_SELECTORS);
-  if (openedRegionMenu) {
-    reportStep("opening_provider_region_selector", `Opening ${serviceLabel} region selector`);
-    await page.waitForTimeout(500);
     const selectedRegion = await clickFirstActionable(page, PROVIDER_REGION_OPTION_SELECTORS);
     if (selectedRegion) {
       reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
       await page.waitForTimeout(700);
+      return true;
+    }
+
+    const filledDefaults = await fillProviderOnboardingDefaults(page);
+    if (filledDefaults) {
+      reportStep("filling_provider_onboarding", `Filled ${serviceLabel} onboarding defaults`);
+      await page.waitForTimeout(500);
+      return true;
     }
-    return true;
   }
 
-  const selectedRegion = await clickFirstActionable(page, PROVIDER_REGION_OPTION_SELECTORS);
-  if (selectedRegion) {
-    reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
-    await page.waitForTimeout(700);
-    return true;
+  // xAI device pages: never click generic Continue/Next/Confirm. Those submit
+  // the device form without a session → "Invalid action" and burn 1–3 minutes.
+  // Only Google SSO (login gate) + Allow/Authorize (clickXaiDeviceAuthorize).
+  if (isXaiProviderPage(page)) {
+    return false;
   }
 
-  const filledDefaults = await fillProviderOnboardingDefaults(page);
-  if (filledDefaults) {
-    reportStep("filling_provider_onboarding", `Filled ${serviceLabel} onboarding defaults`);
-    await page.waitForTimeout(500);
-    return true;
+  // If Google SSO is still offered, do not mash generic Continue.
+  if (await providerHasGoogleLogin(page)) {
+    return false;
   }
 
   const clickedAction = await clickFirstActionable(page, PROVIDER_ONBOARDING_ACTION_SELECTORS);
@@ -1251,36 +1305,217 @@ async function handleProviderOnboarding(page, reportStep, serviceLabel) {
   return false;
 }
 
-async function handleProviderLoginGate(page, reportStep) {
+/**
+ * xAI device step 1: "Enter the code shown in your terminal" → Continue.
+ * Only after this do we land on sign-in with "Login with Google".
+ * Never run this after Google login — that re-submits Continue into Invalid action.
+ */
+async function handleXaiDeviceCodeConfirm(page, reportStep, { alreadyAuthed = false } = {}) {
+  if (!isXaiProviderPage(page)) return false;
+  if (alreadyAuthed) return false;
+  // Already on Google SSO wall — past this step.
+  if (await providerHasGoogleLogin(page)) return false;
+
+  const text = await readPageText(page).catch(() => "");
+  // Logged-in device/approve screens — do not re-click Continue.
+  if (/sign out|log out|device authorized|you can close|invalid action/i.test(text)) {
+    return false;
+  }
+
+  const isCodeConfirm =
+    /enter the code shown in your terminal/i.test(text)
+    || /only enter this code if you just initiated/i.test(text)
+    || (/sign in to grok/i.test(text) && /continue/i.test(text) && !/login with/i.test(text));
+  if (!isCodeConfirm) return false;
+
+  try {
+    const btn = page.getByRole("button", { name: /^Continue$/i }).first();
+    if (await btn.isVisible({ timeout: 600 }).catch(() => false)) {
+      await btn.click({ timeout: 5_000 });
+      reportStep?.("confirming_device_code", "Confirmed device user code on xAI");
+      await page.waitForTimeout(1_200);
+      return true;
+    }
+  } catch {
+    /* fall through */
+  }
+
+  const clicked = await clickFirstActionable(page, [
+    'button[type="submit"]:has-text("Continue")',
+    'button:has-text("Continue")',
+  ]);
+  if (clicked) {
+    reportStep?.("confirming_device_code", "Confirmed device user code on xAI");
+    await page.waitForTimeout(1_200);
+    return true;
+  }
+  return false;
+}
+
+async function clickGoogleLoginRole(page) {
+  // Role-based matches are more reliable on SPA auth shells (xAI, etc.)
+  // than CSS :has-text alone — especially when the label is nested.
+  const roleNames = [
+    /login with google/i,
+    /log in with google/i,
+    /continue with google/i,
+    /sign up with google/i,
+    /sign in with google/i,
+    /^google$/i,
+  ];
+  for (const name of roleNames) {
+    try {
+      const btn = page.getByRole("button", { name }).first();
+      if (await btn.isVisible({ timeout: 250 }).catch(() => false)) {
+        const enabled = await btn.isEnabled().catch(() => true);
+        if (!enabled) continue;
+        await btn.click({ timeout: 5_000 });
+        return true;
+      }
+    } catch {
+      /* next */
+    }
+    try {
+      const link = page.getByRole("link", { name }).first();
+      if (await link.isVisible({ timeout: 200 }).catch(() => false)) {
+        await link.click({ timeout: 5_000 });
+        return true;
+      }
+    } catch {
+      /* next */
+    }
+  }
+  return false;
+}
+
+async function ensureProviderTermsChecked(page, reportStep) {
+  // Returns true only when we newly checked a box (not when already checked).
+  for (const scope of getInteractionScopes(page)) {
+    for (const selector of TERMS_CHECKBOX_SELECTORS) {
+      try {
+        const locator = scope.locator(selector).first();
+        const count = await locator.count().catch(() => 0);
+        if (!count) continue;
+        const visible = await locator.isVisible().catch(() => false);
+        if (!visible) continue;
+        const already = await locator.isChecked().catch(() => false);
+        if (already) return false;
+        const did = await locator.check({ force: true, timeout: 3_000 }).then(() => true).catch(() => false)
+          || await locator.click({ force: true, timeout: 3_000 }).then(() => true).catch(() => false);
+        if (did) {
+          reportStep?.("accepting_provider_terms", "Accepted provider terms for Google login");
+          // xAI enables Google SSO only after the checkbox settles.
+          await page.waitForTimeout(500);
+          return true;
+        }
+      } catch {
+        /* next */
+      }
+    }
+  }
+  return false;
+}
+
+async function handleProviderLoginGate(page, reportStep, { allowGoogleClick = true } = {}) {
   if (isGoogleAuthPage(page)) return false;
 
   const confirmedExistingDialog = await clickFirstActionable(page, PRIVACY_CONFIRM_BUTTON_SELECTORS);
   if (confirmedExistingDialog) {
     reportStep("accepting_provider_privacy_dialog", "Confirmed provider privacy agreement dialog");
-    await page.waitForTimeout(1000);
+    await page.waitForTimeout(500);
     return true;
   }
 
-  const checkedTerms = await checkFirstVisible(page, TERMS_CHECKBOX_SELECTORS);
-  if (checkedTerms) {
-    reportStep("accepting_provider_terms", "Accepted provider terms for Google login");
-    await page.waitForTimeout(400);
+  // Always try terms first — but do NOT treat "already checked" as progress.
+  // Returning true every loop on an already-checked box blocked Google re-click
+  // for ~30–60s after a failed first SSO attempt.
+  const newlyCheckedTerms = await ensureProviderTermsChecked(page, reportStep);
+
+  if (!allowGoogleClick) {
+    return newlyCheckedTerms;
   }
 
-  const clickedGoogle = await clickFirstActionable(page, GOOGLE_LOGIN_BUTTON_SELECTORS);
+  // Prefer explicit Google SSO over generic Continue (device code pages
+  // often have both — clicking Continue without a session yields invalid_code).
+  const clickedGoogleRole = await clickGoogleLoginRole(page);
+  const clickedGoogle = clickedGoogleRole || await clickFirstActionable(page, GOOGLE_LOGIN_BUTTON_SELECTORS);
   if (clickedGoogle) {
     reportStep("selecting_google_login", "Selecting Google login");
-    await page.waitForTimeout(1000);
+    await page.waitForTimeout(500);
 
     const confirmedDialog = await clickFirstActionable(page, PRIVACY_CONFIRM_BUTTON_SELECTORS);
     if (confirmedDialog) {
       reportStep("accepting_provider_privacy_dialog", "Confirmed provider privacy agreement dialog");
-      await page.waitForTimeout(1000);
+      await page.waitForTimeout(500);
+    }
+
+    // Wait for OAuth redirect to Google (or popup) — short timeout; loop retries.
+    try {
+      await page.waitForURL(
+        (url) => {
+          try {
+            const host = new URL(url).hostname;
+            return host === "accounts.google.com"
+              || host.endsWith(".accounts.google.com")
+              || /^accounts\.google\./i.test(host);
+          } catch {
+            return false;
+          }
+        },
+        { timeout: 8_000 },
+      );
+      reportStep("google_login_page", "Reached Google sign-in after provider SSO");
+    } catch {
+      // Popup-based Google SSO: try the newest page
+      try {
+        const ctx = page.context?.();
+        const pages = ctx?.pages?.() || [];
+        for (let i = pages.length - 1; i >= 0; i -= 1) {
+          const p = pages[i];
+          const u = p.url?.() || "";
+          if (/accounts\.google\.com/i.test(u)) {
+            reportStep("google_login_popup", "Google sign-in opened in a popup");
+            break;
+          }
+        }
+      } catch {
+        /* ignore */
+      }
     }
 
     return true;
   }
 
+  return newlyCheckedTerms;
+}
+
+/** Fast path for xAI device approve after Google session exists. */
+async function clickXaiDeviceAuthorize(page, reportStep) {
+  if (!isXaiProviderPage(page)) return false;
+  // Never approve while Google SSO is still on the page — that was thrashing
+  // Continue / Allow before login and landing on "Invalid action".
+  if (await providerHasGoogleLogin(page)) return false;
+
+  // Prefer exact authorize verbs — avoid bare "Continue" (too many false hits).
+  const roles = [
+    /^(Allow|Authorize|Approve|Confirm)$/i,
+    /^(Allow|Authorize|Approve)\b/i,
+  ];
+  for (const re of roles) {
+    try {
+      const btn = page.getByRole("button", { name: re }).first();
+      if (await btn.isVisible({ timeout: 250 }).catch(() => false)) {
+        const label = (await btn.innerText().catch(() => "")) || "";
+        if (/google/i.test(label)) continue;
+        await btn.click({ timeout: 3_000 });
+        reportStep?.("approving_consent", "Approving xAI device authorization");
+        await page.waitForTimeout(600);
+        return true;
+      }
+    } catch {
+      /* next */
+    }
+  }
   return false;
 }
 
@@ -1578,39 +1813,78 @@ export async function runGoogleAccountAutomation({
   // (pwd page stays mounted ~1–3s after Next; re-fill aborts the OAuth chain).
   let passwordSubmittedAt = 0;
   let emailSubmittedAt = 0;
-  const PASSWORD_RESUBMIT_COOLDOWN_MS = 25_000;
-  const EMAIL_RESUBMIT_COOLDOWN_MS = 12_000;
+  let googleLoginSelectedAt = 0;
+  let seenGoogleAuth = false;
+  let deviceApproveAt = 0;
+  let deviceInvalidReopenAt = 0;
+  let deviceInvalidReopenCount = 0;
+  const PASSWORD_RESUBMIT_COOLDOWN_MS = 18_000;
+  const EMAIL_RESUBMIT_COOLDOWN_MS = 8_000;
+  // Short cooldown: long values blocked re-click after a no-op first SSO attempt.
+  const GOOGLE_SSO_COOLDOWN_MS = 8_000;
+  // Don't hammer Allow — xAI returns rate_limited after rapid device posts.
+  const DEVICE_APPROVE_COOLDOWN_MS = 8_000;
+  const DEVICE_INVALID_REOPEN_COOLDOWN_MS = 8_000;
+  const DEVICE_INVALID_REOPEN_MAX = 3;
+  const isGrokFlow = /grok/i.test(String(serviceLabel || ""));
+  // Grok does not need the long Kiro SetSID / kiro:// interstitial window.
+  const postPasswordInterstitialMs = isGrokFlow ? 10_000 : 25_000;
+  const loopTickMs = isGrokFlow ? 400 : 800;
 
   reportStep(openingStep, openingMessage);
   await page.goto(authUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-  await page.waitForTimeout(2_000);
-  await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
-
-  await handleProviderLoginGate(page, reportStep);
-  await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
-
-  const emailInput = await waitForFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR, { timeout: 15_000 });
-  if (emailInput) {
-    reportStep("entering_email", "Entering Google email");
-    const filled = await fillInputResilient(emailInput, email);
-    if (!filled) {
-      reportStep("email_fill_failed", "Could not fill the Google email field; will retry in the polling loop");
-    } else {
-      reportStep("submitting_email", "Submitting email");
-      await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
-      emailSubmittedAt = Date.now();
-      // Wait for the page to transition away from the email step so the
-      // polling loop doesn't immediately re-detect the disappearing email
-      // field and type the email value into the password input.
-      await page.waitForTimeout(1_500);
-      await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
+  await page.waitForTimeout(isGrokFlow ? 700 : 2_000);
+  await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(isGrokFlow ? 4_000 : 12_000));
+
+  // Provider shells (xAI device, CodeBuddy, …) must pick Google SSO first.
+  // Never type credentials into provider user_code / email fields — that
+  // produced email_fill_failed + invalid_code on accounts.x.ai/oauth2/device.
+  // xAI: confirm device user_code first, then Google SSO.
+  // Retry briefly while SPA mounts Login with Google.
+  for (let attempt = 0; attempt < (isGrokFlow ? 8 : 2); attempt += 1) {
+    if (isGoogleAuthPage(page)) break;
+    if (await handleXaiDeviceCodeConfirm(page, reportStep)) {
+      continue;
+    }
+    if (await handleProviderLoginGate(page, reportStep)) {
+      googleLoginSelectedAt = Date.now();
+      if (isGoogleAuthPage(page)) break;
+    }
+    await page.waitForTimeout(600);
+  }
+  await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(isGrokFlow ? 4_000 : 8_000));
+
+  // Only fill Google email once we are actually on accounts.google.com.
+  if (isGoogleAuthPage(page)) {
+    seenGoogleAuth = true;
+    const emailInput = await waitForFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR, { timeout: 12_000 });
+    if (emailInput) {
+      reportStep("entering_email", "Entering Google email");
+      const filled = await fillInputResilient(emailInput, email);
+      if (!filled) {
+        reportStep("email_fill_failed", "Could not fill the Google email field; will retry in the polling loop");
+      } else {
+        reportStep("submitting_email", "Submitting email");
+        await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
+        emailSubmittedAt = Date.now();
+        // Wait for the page to transition away from the email step so the
+        // polling loop doesn't immediately re-detect the disappearing email
+        // field and type the email value into the password input.
+        await page.waitForTimeout(isGrokFlow ? 700 : 1_500);
+        await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(isGrokFlow ? 5_000 : 12_000));
+      }
     }
+  } else if (isProviderPage(page)) {
+    reportStep(
+      "waiting_for_google_sso",
+      `Provider page still open (${(page.url?.() || "").slice(0, 80)}) — will keep selecting Google login`,
+    );
   }
 
   while (Date.now() - startTime < shortTimeoutMs) {
     const successResult = await Promise.race([
       successPromise.then((result) => ({ kind: "success", result })).catch((error) => ({ kind: "success_error", error })),
-      new Promise((resolve) => setTimeout(() => resolve(null), 800)),
+      new Promise((resolve) => setTimeout(() => resolve(null), loopTickMs)),
     ]);
 
     if (successResult?.kind === "success") {
@@ -1630,14 +1904,22 @@ export async function runGoogleAccountAutomation({
     }
 
     // Unblock SetSID / empty Google interstitials before other handlers
-    const waited = await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
+    const waited = await waitThroughGoogleInterstitials(
+      page,
+      reportStep,
+      interstitialOpts(isGrokFlow ? 4_000 : 8_000),
+    );
     if (waited) {
       continue;
     }
 
     const handledGoogleConsent = await handleGoogleConsent(page, reportStep);
     if (handledGoogleConsent) {
-      await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
+      await waitThroughGoogleInterstitials(
+        page,
+        reportStep,
+        interstitialOpts(isGrokFlow ? 5_000 : 12_000),
+      );
       continue;
     }
 
@@ -1696,92 +1978,167 @@ export async function runGoogleAccountAutomation({
       continue;
     }
 
-    const handledProviderOnboarding = await handleProviderOnboarding(page, reportStep, serviceLabel);
-    if (handledProviderOnboarding) {
-      continue;
+    // xAI rate-limits device authorize after rapid retries — fail fast.
+    if (
+      isProviderPage(page)
+      && (/rate[_ ]?limit/i.test(text) || /error=rate_limited/i.test(page.url?.() || ""))
+    ) {
+      reportStep("device_rate_limited", "xAI device authorization rate-limited");
+      return {
+        status: "failed",
+        error: "xAI rate-limited device authorization. Wait a few minutes and retry (too many rapid device-code attempts).",
+      };
     }
 
-    // Check password BEFORE email — after submitting the email the password
-    // page loads and during the transition the old email input can briefly
-    // remain visible; if we checked email first we'd re-type the email
-    // address into whatever field is focused (often the password input).
-    const passwordInput = await getFirstVisibleLocator(page, PASSWORD_INPUT_SELECTOR);
-    if (passwordInput) {
-      const sincePw = Date.now() - passwordSubmittedAt;
-      if (passwordSubmittedAt && sincePw < PASSWORD_RESUBMIT_COOLDOWN_MS) {
-        // Still on (or animating off) the password form after a recent submit —
-        // do NOT re-fill; wait for SetSID/consent/callback instead.
-        reportStep(
-          "waiting_after_password",
-          `Password already submitted ${Math.round(sincePw / 1000)}s ago — waiting for Google redirect`,
-        );
-        await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
-        await page.waitForTimeout(500);
-        continue;
-      }
-
-      reportStep("entering_password", "Entering Google password");
-      const filled = await fillInputResilient(passwordInput, password);
-      if (filled) {
-        reportStep("submitting_password", "Submitting password");
-        await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
-        passwordSubmittedAt = Date.now();
-        // Give Google time to leave the password challenge before the next
-        // loop iteration can re-detect the still-mounted password field.
-        await Promise.race([
-          page.waitForNavigation({ waitUntil: "domcontentloaded", timeout: 8_000 }).catch(() => null),
-          page.waitForTimeout(2_500),
-        ]);
-        // Password submit often lands on empty SetSID while network completes
-        // consent→idpresponse→kiro://. Callback monitor (CDP) settles successPromise.
-        await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(25_000));
-      } else {
-        reportStep("password_fill_failed", "Could not fill the Google password field; retrying loop");
-        await page.waitForTimeout(700);
-      }
+    // xAI often lands on /oauth2/device/approve with "Invalid action" after
+    // Google consent when the approve form was double-submitted. Re-open the
+    // original device URL (with user_code) a few times — not every loop tick.
+    if (
+      isProviderPage(page)
+      && /invalid action|invalid[_ ]?code|code (has )?expired|expired code/i.test(text)
+      && authUrl
+      && seenGoogleAuth
+      && deviceInvalidReopenCount < DEVICE_INVALID_REOPEN_MAX
+      && Date.now() - deviceInvalidReopenAt > DEVICE_INVALID_REOPEN_COOLDOWN_MS
+    ) {
+      deviceInvalidReopenCount += 1;
+      deviceInvalidReopenAt = Date.now();
+      deviceApproveAt = 0;
+      reportStep(
+        "device_invalid_reopen",
+        `Device page error — reopening auth URL (${deviceInvalidReopenCount}/${DEVICE_INVALID_REOPEN_MAX})`,
+      );
+      await page.goto(authUrl, { waitUntil: "domcontentloaded", timeout: 60_000 }).catch(() => null);
+      await page.waitForTimeout(1_800);
       continue;
     }
 
-    const nextEmailInput = await getFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR);
-    if (nextEmailInput) {
-      const sinceEmail = Date.now() - emailSubmittedAt;
-      if (emailSubmittedAt && sinceEmail < EMAIL_RESUBMIT_COOLDOWN_MS) {
-        reportStep(
-          "waiting_after_email",
-          `Email already submitted ${Math.round(sinceEmail / 1000)}s ago — waiting for password/next screen`,
-        );
-        await page.waitForTimeout(800);
-        continue;
-      }
+    const googleAuthed = Boolean(seenGoogleAuth && passwordSubmittedAt);
 
-      reportStep("entering_email", "Entering Google email");
-      const filled = await fillInputResilient(nextEmailInput, email);
-      if (filled) {
-        reportStep("submitting_email", "Submitting email");
-        await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
-        emailSubmittedAt = Date.now();
-        await page.waitForTimeout(1_500);
-      } else {
-        reportStep("email_fill_failed", "Could not fill the Google email field; retrying loop");
-      }
-      await page.waitForTimeout(700);
+    // xAI device user_code confirm (Continue) — only before Google login.
+    if (await handleXaiDeviceCodeConfirm(page, reportStep, { alreadyAuthed: googleAuthed })) {
       continue;
     }
 
-    const handledProviderGate = await handleProviderLoginGate(page, reportStep);
+    // Provider Google SSO BEFORE generic onboarding Continues.
+    // Cooldown: re-clicking Google mid-redirect restarts OAuth and wastes time.
+    const allowGoogleClick =
+      !googleAuthed
+      && (!googleLoginSelectedAt || Date.now() - googleLoginSelectedAt > GOOGLE_SSO_COOLDOWN_MS);
+    const handledProviderGate = await handleProviderLoginGate(page, reportStep, { allowGoogleClick });
     if (handledProviderGate) {
+      if (allowGoogleClick) googleLoginSelectedAt = Date.now();
       continue;
     }
 
-    const clickedApprove = await clickFirstVisible(page, APPROVE_BUTTON_SELECTORS);
-    if (clickedApprove) {
-      reportStep("approving_consent", `Approving Google or ${serviceLabel} consent`);
-      await page.waitForTimeout(700);
+    // xAI device approve ONLY after Google password submitted.
+    if (
+      googleAuthed
+      && Date.now() - deviceApproveAt > DEVICE_APPROVE_COOLDOWN_MS
+      && await clickXaiDeviceAuthorize(page, reportStep)
+    ) {
+      deviceApproveAt = Date.now();
+      continue;
+    }
+
+    const handledProviderOnboarding = await handleProviderOnboarding(page, reportStep, serviceLabel);
+    if (handledProviderOnboarding) {
       continue;
     }
 
+    // Credentials only on accounts.google.com — never into provider shells.
+    if (isGoogleAuthPage(page)) {
+      seenGoogleAuth = true;
+      // Check password BEFORE email — after submitting the email the password
+      // page loads and during the transition the old email input can briefly
+      // remain visible; if we checked email first we'd re-type the email
+      // address into whatever field is focused (often the password input).
+      const passwordInput = await getFirstVisibleLocator(page, PASSWORD_INPUT_SELECTOR);
+      if (passwordInput) {
+        const sincePw = Date.now() - passwordSubmittedAt;
+        if (passwordSubmittedAt && sincePw < PASSWORD_RESUBMIT_COOLDOWN_MS) {
+          // Still on (or animating off) the password form after a recent submit —
+          // do NOT re-fill; wait for SetSID/consent/callback instead.
+          reportStep(
+            "waiting_after_password",
+            `Password already submitted ${Math.round(sincePw / 1000)}s ago — waiting for Google redirect`,
+          );
+          await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
+          await page.waitForTimeout(500);
+          continue;
+        }
+
+        reportStep("entering_password", "Entering Google password");
+        const filled = await fillInputResilient(passwordInput, password);
+        if (filled) {
+          reportStep("submitting_password", "Submitting password");
+          await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
+          passwordSubmittedAt = Date.now();
+          // Give Google time to leave the password challenge before the next
+          // loop iteration can re-detect the still-mounted password field.
+          await Promise.race([
+            page.waitForNavigation({ waitUntil: "domcontentloaded", timeout: 8_000 }).catch(() => null),
+            page.waitForTimeout(2_500),
+          ]);
+          // Password submit often lands on empty SetSID while network completes
+          // consent→idpresponse→kiro://. Callback monitor (CDP) settles successPromise.
+          // Grok device poll settles faster — shorter interstitial wait.
+          await waitThroughGoogleInterstitials(
+            page,
+            reportStep,
+            interstitialOpts(postPasswordInterstitialMs),
+          );
+        } else {
+          reportStep("password_fill_failed", "Could not fill the Google password field; retrying loop");
+          await page.waitForTimeout(500);
+        }
+        continue;
+      }
+
+      const nextEmailInput = await getFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR);
+      if (nextEmailInput) {
+        const sinceEmail = Date.now() - emailSubmittedAt;
+        if (emailSubmittedAt && sinceEmail < EMAIL_RESUBMIT_COOLDOWN_MS) {
+          reportStep(
+            "waiting_after_email",
+            `Email already submitted ${Math.round(sinceEmail / 1000)}s ago — waiting for password/next screen`,
+          );
+          await page.waitForTimeout(500);
+          continue;
+        }
+
+        reportStep("entering_email", "Entering Google email");
+        const filled = await fillInputResilient(nextEmailInput, email);
+        if (filled) {
+          reportStep("submitting_email", "Submitting email");
+          await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
+          emailSubmittedAt = Date.now();
+          await page.waitForTimeout(isGrokFlow ? 600 : 1_500);
+        } else {
+          reportStep("email_fill_failed", "Could not fill the Google email field; retrying loop");
+        }
+        await page.waitForTimeout(400);
+        continue;
+      }
+    }
+
+    // On xAI before Google login, APPROVE selectors match "Continue with Google"
+    // via :has-text("Continue") and wreck the device code → Invalid action loop.
+    const mayGenericApprove =
+      isGoogleAuthPage(page)
+      || (seenGoogleAuth && passwordSubmittedAt && !(await providerHasGoogleLogin(page)));
+    if (mayGenericApprove) {
+      const clickedApprove = await clickFirstVisible(page, APPROVE_BUTTON_SELECTORS);
+      if (clickedApprove) {
+        reportStep("approving_consent", `Approving Google or ${serviceLabel} consent`);
+        deviceApproveAt = Date.now();
+        await page.waitForTimeout(isGrokFlow ? 500 : 700);
+        continue;
+      }
+    }
+
     // Periodic diagnostics so jobs aren't opaque "waiting" spam
-    if (Math.floor((Date.now() - startTime) / 5000) !== Math.floor((Date.now() - startTime - 700) / 5000)) {
+    if (Math.floor((Date.now() - startTime) / 5000) !== Math.floor((Date.now() - startTime - loopTickMs) / 5000)) {
       const url = page.url?.() || "";
       const snippet = String(text || (await readPageText(page).catch(() => ""))).slice(0, 100).replace(/\s+/g, " ");
       reportStep(
@@ -1791,7 +2148,7 @@ export async function runGoogleAccountAutomation({
     } else {
       reportStep("waiting_for_next_screen", `Waiting for the next Google or ${serviceLabel} screen`);
     }
-    await page.waitForTimeout(700);
+    await page.waitForTimeout(loopTickMs);
   }
 
   // Final blocked check before generic needs_manual