zevairouter 1.0.83 → 1.0.85

package/src/lib/oauth/services/kiroGoogleAutomation.js

@@ -96,14 +96,28 @@ const GOOGLE_LOGIN_BUTTON_SELECTORS = [
   'a#social-google',
   'a:has-text("Sign up with Google")',
   'a:has-text("Log in with Google")',
+  'a:has-text("Login with Google")',
+  'a:has-text("Continue with Google")',
+  'a:has-text("Sign in with Google")',
   'button:has-text("Sign up with Google")',
   'button:has-text("Log in with Google")',
+  'button:has-text("Login with Google")',
+  'button:has-text("Continue with Google")',
+  'button:has-text("Sign in with Google")',
   'button:has-text("Google")',
   'a:has-text("Google")',
+  'div[role="button"]:has-text("Continue with Google")',
+  'div[role="button"]:has-text("Login with Google")',
   'div[role="button"]:has-text("Google")',
+  'span:has-text("Continue with Google")',
+  'span:has-text("Login with Google")',
   'span:has-text("Google")',
   '[aria-label*="Google"]',
   '[data-provider*="google" i]',
+  // xAI / Grok device + account pages
+  'button:has-text("Login with Google")',
+  'button:has-text("Continue with Google")',
+  '[data-testid*="google" i]',
 ];
 
 const TERMS_CHECKBOX_SELECTORS = [
@@ -398,7 +412,7 @@ async function getFirstVisibleLocator(page, selector) {
   return null;
 }
 
-async function waitForFirstVisibleLocator(page, selector, { timeout = 15_000, pollInterval = 500 } = {}) {
+async function waitForFirstVisibleLocator(page, selector, { timeout = 15_000, pollInterval = 150 } = {}) {
   const deadline = Date.now() + timeout;
   while (Date.now() < deadline) {
     const found = await getFirstVisibleLocator(page, selector);
@@ -410,58 +424,99 @@ async function waitForFirstVisibleLocator(page, selector, { timeout = 15_000, po
   return null;
 }
 
-async function fillInputResilient(locator, value, { timeout = 15_000 } = {}) {
-  if (!locator || value == null) return false;
+/** Tiny yield only — never use multi-second sleeps for “maybe page will load”. */
+function yieldMs(ms = 50) {
+  return new Promise((r) => setTimeout(r, ms));
+}
 
-  // Primary: click + type with human-like random delay to avoid CAPTCHA triggers.
-  // Avoid fill() as primary — it sets the value instantly which Google detects.
-  try {
-    await locator.click({ timeout: 5_000 });
-  } catch {
-    /* noop */
-  }
-  try {
-    await locator.fill("", { timeout: 3_000 });
-  } catch {
-    /* noop */
-  }
-  try {
-    const delay = Math.floor(40 + Math.random() * 80); // 40-120ms per keystroke
-    await locator.type(value, { delay, timeout });
-  } catch {
-    // If type() fails, fall back to fill()
+/**
+ * Wait until a condition is true, polling fast. Replaces fixed sleep after clicks.
+ * @returns {Promise<boolean>} true if condition met before timeout
+ */
+async function waitUntil(checkFn, { timeout = 8_000, interval = 100 } = {}) {
+  const deadline = Date.now() + timeout;
+  while (Date.now() < deadline) {
     try {
-      await locator.fill(value, { timeout });
+      if (await checkFn()) return true;
     } catch {
-      return false;
+      /* retry */
     }
+    await yieldMs(interval);
   }
+  return false;
+}
 
-  let observed = "";
+function isGoogleHostname(url) {
   try {
-    observed = await locator.inputValue();
+    const host = new URL(url).hostname;
+    return host === "accounts.google.com"
+      || host.endsWith(".accounts.google.com")
+      || /^accounts\.google\./i.test(host);
   } catch {
-    observed = "";
+    return false;
   }
-  if (observed === value) return true;
+}
+
+/** After navigation/click: wait for URL change or next UI, not a fixed sleep. */
+async function waitForPageAdvance(page, {
+  fromUrl = "",
+  urlMatch = null,
+  selector = null,
+  timeout = 8_000,
+} = {}) {
+  const startUrl = fromUrl || page.url?.() || "";
+  return waitUntil(async () => {
+    const url = page.url?.() || "";
+    if (urlMatch) {
+      if (typeof urlMatch === "function" && urlMatch(url)) return true;
+      if (urlMatch instanceof RegExp && urlMatch.test(url)) return true;
+    }
+    if (url && url !== startUrl && !url.startsWith("about:")) return true;
+    if (selector) {
+      const found = await getFirstVisibleLocator(page, selector);
+      if (found) return true;
+    }
+    return false;
+  }, { timeout, interval: 80 });
+}
+
+async function fillInputResilient(locator, value, { timeout = 15_000 } = {}) {
+  if (!locator || value == null) return false;
 
-  // Final fallback for React/Vue-controlled inputs
+  // Prefer fill() first (fast). CloakBrowser already spoofs input events well
+  // enough for Google in practice; slow type is only a fallback for React
+  // controlled fields that reject programmatic fill.
   try {
-    await locator.click({ timeout: 5_000 });
+    await locator.click({ timeout: 3_000 });
   } catch {
     /* noop */
   }
   try {
-    await locator.fill("");
+    await locator.fill(String(value), { timeout: Math.min(timeout, 8_000) });
+    const observed = await locator.inputValue().catch(() => "");
+    if (observed === value) return true;
+  } catch {
+    /* fall through to typed input */
+  }
+
+  try {
+    await locator.fill("", { timeout: 2_000 });
   } catch {
     /* noop */
   }
   try {
-    await locator.type(value, { delay: 50, timeout });
+    // Light humanization only if fill failed — 15–35ms/key (was 40–120ms).
+    const delay = Math.floor(15 + Math.random() * 20);
+    await locator.type(String(value), { delay, timeout });
   } catch {
-    return false;
+    try {
+      await locator.fill(String(value), { timeout });
+    } catch {
+      return false;
+    }
   }
 
+  let observed = "";
   try {
     observed = await locator.inputValue();
   } catch {
@@ -497,12 +552,18 @@ function includesAny(text, markers) {
 function isGoogleAuthPage(page) {
   try {
     const url = new URL(page.url());
-    return url.hostname === "accounts.google.com" || url.hostname.endsWith(".accounts.google.com");
+    return url.hostname === "accounts.google.com"
+      || url.hostname.endsWith(".accounts.google.com")
+      || /^accounts\.google\./i.test(url.hostname);
   } catch {
     return false;
   }
 }
 
+function isGrokish(serviceLabel) {
+  return /grok/i.test(String(serviceLabel || ""));
+}
+
 // Google bounces flagged (headless) browsers:
 // - myaccount.google.com/not-supported
 // - accounts.google.com/v3/signin/rejected ("This browser or app may not be secure")
@@ -602,14 +663,15 @@ async function waitThroughGoogleInterstitials(page, reportStep, { maxWaitMs = 20
       ]);
       if (clicked) {
         reportStep?.("selecting_google_account", "Selected account from Google AccountChooser");
-        await page.waitForTimeout(1200);
+        await waitForPageAdvance(page, { timeout: 5_000 });
         continue;
       }
     }
 
     const waiters = [
-      page.waitForNavigation({ waitUntil: "domcontentloaded", timeout: 4_000 }).catch(() => null),
-      page.waitForTimeout(1_200),
+      page.waitForNavigation({ waitUntil: "domcontentloaded", timeout: 3_000 }).catch(() => null),
+      // Cap idle wait low — exit as soon as URL/body changes or success settles.
+      yieldMs(400),
     ];
     if (successPromise && !isSuccessSettled(successPromise)) {
       waiters.push(successPromise.then(() => null).catch(() => null));
@@ -622,9 +684,16 @@ async function waitThroughGoogleInterstitials(page, reportStep, { maxWaitMs = 20
 function isProviderPage(page) {
   try {
     const url = new URL(page.url());
-    return /codebuddy\.(ai|cn)$/.test(url.hostname)
-      || url.hostname.endsWith(".codebuddy.ai")
-      || url.hostname.endsWith(".codebuddy.cn");
+    const host = url.hostname || "";
+    return /codebuddy\.(ai|cn)$/.test(host)
+      || host.endsWith(".codebuddy.ai")
+      || host.endsWith(".codebuddy.cn")
+      // xAI / Grok CLI device authorization + account host
+      || host === "accounts.x.ai"
+      || host === "auth.x.ai"
+      || host.endsWith(".x.ai")
+      || host === "grok.com"
+      || host.endsWith(".grok.com");
   } catch {
     return false;
   }
@@ -1188,6 +1257,38 @@ async function handleCodeBuddyStartedAuthorization(page, reportStep) {
   return true;
 }
 
+async function providerHasGoogleLogin(page) {
+  try {
+    for (const name of [/continue with google/i, /sign in with google/i, /sign up with google/i, /^google$/i]) {
+      const btn = page.getByRole("button", { name }).first();
+      if (await btn.isVisible({ timeout: 300 }).catch(() => false)) return true;
+      const link = page.getByRole("link", { name }).first();
+      if (await link.isVisible({ timeout: 200 }).catch(() => false)) return true;
+    }
+  } catch {
+    /* ignore */
+  }
+  for (const selector of GOOGLE_LOGIN_BUTTON_SELECTORS) {
+    try {
+      const loc = page.locator(selector).first();
+      if (await loc.isVisible({ timeout: 200 }).catch(() => false)) return true;
+    } catch {
+      /* next */
+    }
+  }
+  return false;
+}
+
+function isXaiProviderPage(page) {
+  try {
+    const host = new URL(page.url()).hostname || "";
+    return host === "accounts.x.ai" || host === "auth.x.ai" || host.endsWith(".x.ai")
+      || host === "grok.com" || host.endsWith(".grok.com");
+  } catch {
+    return false;
+  }
+}
+
 async function handleProviderOnboarding(page, reportStep, serviceLabel) {
   if (!isProviderPage(page) || isGoogleAuthPage(page)) return false;
 
@@ -1208,37 +1309,53 @@ async function handleProviderOnboarding(page, reportStep, serviceLabel) {
     return true;
   }
 
-  const selectedNativeRegion = await selectNativeRegionOption(page);
-  if (selectedNativeRegion) {
-    reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
-    await page.waitForTimeout(700);
-    return true;
-  }
+  // Region / workspace defaults are CodeBuddy-style — not xAI device approve.
+  // False-positive select matches on xAI wasted the session into "Invalid action".
+  if (!isXaiProviderPage(page)) {
+    const selectedNativeRegion = await selectNativeRegionOption(page);
+    if (selectedNativeRegion) {
+      reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
+      await page.waitForTimeout(700);
+      return true;
+    }
+
+    const openedRegionMenu = await clickFirstActionable(page, PROVIDER_REGION_TRIGGER_SELECTORS);
+    if (openedRegionMenu) {
+      reportStep("opening_provider_region_selector", `Opening ${serviceLabel} region selector`);
+      await page.waitForTimeout(500);
+      const selectedRegion = await clickFirstActionable(page, PROVIDER_REGION_OPTION_SELECTORS);
+      if (selectedRegion) {
+        reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
+        await page.waitForTimeout(700);
+      }
+      return true;
+    }
 
-  const openedRegionMenu = await clickFirstActionable(page, PROVIDER_REGION_TRIGGER_SELECTORS);
-  if (openedRegionMenu) {
-    reportStep("opening_provider_region_selector", `Opening ${serviceLabel} region selector`);
-    await page.waitForTimeout(500);
     const selectedRegion = await clickFirstActionable(page, PROVIDER_REGION_OPTION_SELECTORS);
     if (selectedRegion) {
       reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
       await page.waitForTimeout(700);
+      return true;
+    }
+
+    const filledDefaults = await fillProviderOnboardingDefaults(page);
+    if (filledDefaults) {
+      reportStep("filling_provider_onboarding", `Filled ${serviceLabel} onboarding defaults`);
+      await page.waitForTimeout(500);
+      return true;
     }
-    return true;
   }
 
-  const selectedRegion = await clickFirstActionable(page, PROVIDER_REGION_OPTION_SELECTORS);
-  if (selectedRegion) {
-    reportStep("selecting_provider_region", `Selected ${serviceLabel} region`);
-    await page.waitForTimeout(700);
-    return true;
+  // xAI device pages: never click generic Continue/Next/Confirm. Those submit
+  // the device form without a session → "Invalid action" and burn 1–3 minutes.
+  // Only Google SSO (login gate) + Allow/Authorize (clickXaiDeviceAuthorize).
+  if (isXaiProviderPage(page)) {
+    return false;
   }
 
-  const filledDefaults = await fillProviderOnboardingDefaults(page);
-  if (filledDefaults) {
-    reportStep("filling_provider_onboarding", `Filled ${serviceLabel} onboarding defaults`);
-    await page.waitForTimeout(500);
-    return true;
+  // If Google SSO is still offered, do not mash generic Continue.
+  if (await providerHasGoogleLogin(page)) {
+    return false;
   }
 
   const clickedAction = await clickFirstActionable(page, PROVIDER_ONBOARDING_ACTION_SELECTORS);
@@ -1251,36 +1368,226 @@ async function handleProviderOnboarding(page, reportStep, serviceLabel) {
   return false;
 }
 
-async function handleProviderLoginGate(page, reportStep) {
+/**
+ * xAI device step 1: "Enter the code shown in your terminal" → Continue.
+ * Only after this do we land on sign-in with "Login with Google".
+ * Never run this after Google login — that re-submits Continue into Invalid action.
+ */
+async function handleXaiDeviceCodeConfirm(page, reportStep, { alreadyAuthed = false } = {}) {
+  if (!isXaiProviderPage(page)) return false;
+  if (alreadyAuthed) return false;
+  // Already on Google SSO wall — past this step.
+  if (await providerHasGoogleLogin(page)) return false;
+
+  const text = await readPageText(page).catch(() => "");
+  // Logged-in device/approve screens — do not re-click Continue.
+  if (/sign out|log out|device authorized|you can close|invalid action/i.test(text)) {
+    return false;
+  }
+
+  const isCodeConfirm =
+    /enter the code shown in your terminal/i.test(text)
+    || /only enter this code if you just initiated/i.test(text)
+    || (/sign in to grok/i.test(text) && /continue/i.test(text) && !/login with/i.test(text));
+  if (!isCodeConfirm) return false;
+
+  const fromUrl = page.url?.() || "";
+  let clicked = false;
+  try {
+    const btn = page.getByRole("button", { name: /^Continue$/i }).first();
+    if (await btn.isVisible({ timeout: 300 }).catch(() => false)) {
+      await btn.click({ timeout: 5_000 });
+      clicked = true;
+    }
+  } catch {
+    /* fall through */
+  }
+  if (!clicked) {
+    clicked = await clickFirstActionable(page, [
+      'button[type="submit"]:has-text("Continue")',
+      'button:has-text("Continue")',
+    ]);
+  }
+  if (!clicked) return false;
+
+  reportStep?.("confirming_device_code", "Confirmed device user code on xAI");
+  // Event-driven: next screen is Login with Google or URL change — no fixed 1.2s sleep.
+  await waitForPageAdvance(page, {
+    fromUrl,
+    urlMatch: (u) => /sign-in|login|oauth/i.test(u) && u !== fromUrl,
+    selector: [
+      ...GOOGLE_LOGIN_BUTTON_SELECTORS.split(", ").slice(0, 8),
+      'button:has-text("Login with Google")',
+      'button:has-text("Login with email")',
+    ].join(", "),
+    timeout: 10_000,
+  });
+  return true;
+}
+
+async function clickGoogleLoginRole(page) {
+  // Role-based matches are more reliable on SPA auth shells (xAI, etc.)
+  // than CSS :has-text alone — especially when the label is nested.
+  const roleNames = [
+    /login with google/i,
+    /log in with google/i,
+    /continue with google/i,
+    /sign up with google/i,
+    /sign in with google/i,
+    /^google$/i,
+  ];
+  for (const name of roleNames) {
+    try {
+      const btn = page.getByRole("button", { name }).first();
+      if (await btn.isVisible({ timeout: 250 }).catch(() => false)) {
+        const enabled = await btn.isEnabled().catch(() => true);
+        if (!enabled) continue;
+        await btn.click({ timeout: 5_000 });
+        return true;
+      }
+    } catch {
+      /* next */
+    }
+    try {
+      const link = page.getByRole("link", { name }).first();
+      if (await link.isVisible({ timeout: 200 }).catch(() => false)) {
+        await link.click({ timeout: 5_000 });
+        return true;
+      }
+    } catch {
+      /* next */
+    }
+  }
+  return false;
+}
+
+async function ensureProviderTermsChecked(page, reportStep) {
+  // Returns true only when we newly checked a box (not when already checked).
+  for (const scope of getInteractionScopes(page)) {
+    for (const selector of TERMS_CHECKBOX_SELECTORS) {
+      try {
+        const locator = scope.locator(selector).first();
+        const count = await locator.count().catch(() => 0);
+        if (!count) continue;
+        const visible = await locator.isVisible().catch(() => false);
+        if (!visible) continue;
+        const already = await locator.isChecked().catch(() => false);
+        if (already) return false;
+        const did = await locator.check({ force: true, timeout: 3_000 }).then(() => true).catch(() => false)
+          || await locator.click({ force: true, timeout: 3_000 }).then(() => true).catch(() => false);
+        if (did) {
+          reportStep?.("accepting_provider_terms", "Accepted provider terms for Google login");
+          // Wait until Google button enables — not a blind sleep.
+          await waitUntil(
+            async () => {
+              try {
+                const btn = page.getByRole("button", { name: /google/i }).first();
+                return (await btn.isVisible().catch(() => false))
+                  && (await btn.isEnabled().catch(() => true));
+              } catch {
+                return true;
+              }
+            },
+            { timeout: 2_000, interval: 80 },
+          );
+          return true;
+        }
+      } catch {
+        /* next */
+      }
+    }
+  }
+  return false;
+}
+
+async function handleProviderLoginGate(page, reportStep, { allowGoogleClick = true } = {}) {
   if (isGoogleAuthPage(page)) return false;
 
   const confirmedExistingDialog = await clickFirstActionable(page, PRIVACY_CONFIRM_BUTTON_SELECTORS);
   if (confirmedExistingDialog) {
     reportStep("accepting_provider_privacy_dialog", "Confirmed provider privacy agreement dialog");
-    await page.waitForTimeout(1000);
     return true;
   }
 
-  const checkedTerms = await checkFirstVisible(page, TERMS_CHECKBOX_SELECTORS);
-  if (checkedTerms) {
-    reportStep("accepting_provider_terms", "Accepted provider terms for Google login");
-    await page.waitForTimeout(400);
+  // Always try terms first — but do NOT treat "already checked" as progress.
+  // Returning true every loop on an already-checked box blocked Google re-click
+  // for ~30–60s after a failed first SSO attempt.
+  const newlyCheckedTerms = await ensureProviderTermsChecked(page, reportStep);
+
+  if (!allowGoogleClick) {
+    return newlyCheckedTerms;
   }
 
-  const clickedGoogle = await clickFirstActionable(page, GOOGLE_LOGIN_BUTTON_SELECTORS);
+  // Prefer explicit Google SSO over generic Continue (device code pages
+  // often have both — clicking Continue without a session yields invalid_code).
+  const clickedGoogleRole = await clickGoogleLoginRole(page);
+  const clickedGoogle = clickedGoogleRole || await clickFirstActionable(page, GOOGLE_LOGIN_BUTTON_SELECTORS);
   if (clickedGoogle) {
     reportStep("selecting_google_login", "Selecting Google login");
-    await page.waitForTimeout(1000);
 
     const confirmedDialog = await clickFirstActionable(page, PRIVACY_CONFIRM_BUTTON_SELECTORS);
     if (confirmedDialog) {
       reportStep("accepting_provider_privacy_dialog", "Confirmed provider privacy agreement dialog");
-      await page.waitForTimeout(1000);
+    }
+
+    // Wait for OAuth redirect to Google (or email field) — event-driven.
+    const reached = await waitForPageAdvance(page, {
+      urlMatch: (u) => isGoogleHostname(u),
+      selector: EMAIL_INPUT_SELECTOR,
+      timeout: 12_000,
+    });
+    if (reached || isGoogleAuthPage(page)) {
+      reportStep("google_login_page", "Reached Google sign-in after provider SSO");
+    } else {
+      // Popup-based Google SSO
+      try {
+        const ctx = page.context?.();
+        const pages = ctx?.pages?.() || [];
+        for (let i = pages.length - 1; i >= 0; i -= 1) {
+          const p = pages[i];
+          const u = p.url?.() || "";
+          if (isGoogleHostname(u)) {
+            reportStep("google_login_popup", "Google sign-in opened in a popup");
+            break;
+          }
+        }
+      } catch {
+        /* ignore */
+      }
     }
 
     return true;
   }
 
+  return newlyCheckedTerms;
+}
+
+/** Fast path for xAI device approve after Google session exists. */
+async function clickXaiDeviceAuthorize(page, reportStep) {
+  if (!isXaiProviderPage(page)) return false;
+  // Never approve while Google SSO is still on the page — that was thrashing
+  // Continue / Allow before login and landing on "Invalid action".
+  if (await providerHasGoogleLogin(page)) return false;
+
+  // Prefer exact authorize verbs — avoid bare "Continue" (too many false hits).
+  const roles = [
+    /^(Allow|Authorize|Approve|Confirm)$/i,
+    /^(Allow|Authorize|Approve)\b/i,
+  ];
+  for (const re of roles) {
+    try {
+      const btn = page.getByRole("button", { name: re }).first();
+      if (await btn.isVisible({ timeout: 200 }).catch(() => false)) {
+        const label = (await btn.innerText().catch(() => "")) || "";
+        if (/google/i.test(label)) continue;
+        await btn.click({ timeout: 3_000 });
+        reportStep?.("approving_consent", "Approving xAI device authorization");
+        return true;
+      }
+    } catch {
+      /* next */
+    }
+  }
   return false;
 }
 
@@ -1578,39 +1885,101 @@ export async function runGoogleAccountAutomation({
   // (pwd page stays mounted ~1–3s after Next; re-fill aborts the OAuth chain).
   let passwordSubmittedAt = 0;
   let emailSubmittedAt = 0;
-  const PASSWORD_RESUBMIT_COOLDOWN_MS = 25_000;
-  const EMAIL_RESUBMIT_COOLDOWN_MS = 12_000;
+  let googleLoginSelectedAt = 0;
+  let seenGoogleAuth = false;
+  let deviceApproveAt = 0;
+  let deviceInvalidReopenAt = 0;
+  let deviceInvalidReopenCount = 0;
+  // Cooldowns prevent double-submit only — not artificial pacing.
+  const PASSWORD_RESUBMIT_COOLDOWN_MS = isGrokish(serviceLabel) ? 6_000 : 18_000;
+  const EMAIL_RESUBMIT_COOLDOWN_MS = isGrokish(serviceLabel) ? 3_000 : 8_000;
+  const GOOGLE_SSO_COOLDOWN_MS = isGrokish(serviceLabel) ? 3_000 : 8_000;
+  // Don't hammer Allow — xAI rate_limits rapid device posts.
+  const DEVICE_APPROVE_COOLDOWN_MS = 3_000;
+  const DEVICE_INVALID_REOPEN_COOLDOWN_MS = 4_000;
+  const DEVICE_INVALID_REOPEN_MAX = 3;
+  const isGrokFlow = isGrokish(serviceLabel);
+  // Grok does not need the long Kiro SetSID / kiro:// interstitial window.
+  const postPasswordInterstitialMs = isGrokFlow ? 4_000 : 25_000;
+  // Loop poll: race successPromise — keep tiny so fast networks aren't stalled.
+  const loopTickMs = isGrokFlow ? 120 : 500;
 
   reportStep(openingStep, openingMessage);
   await page.goto(authUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-  await page.waitForTimeout(2_000);
-  await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
-
-  await handleProviderLoginGate(page, reportStep);
-  await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
-
-  const emailInput = await waitForFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR, { timeout: 15_000 });
-  if (emailInput) {
-    reportStep("entering_email", "Entering Google email");
-    const filled = await fillInputResilient(emailInput, email);
-    if (!filled) {
-      reportStep("email_fill_failed", "Could not fill the Google email field; will retry in the polling loop");
-    } else {
-      reportStep("submitting_email", "Submitting email");
-      await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
-      emailSubmittedAt = Date.now();
-      // Wait for the page to transition away from the email step so the
-      // polling loop doesn't immediately re-detect the disappearing email
-      // field and type the email value into the password input.
-      await page.waitForTimeout(1_500);
-      await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
+  // Wait for interactive UI (Continue / Google / email), not a fixed sleep.
+  await waitUntil(
+    async () =>
+      isGoogleAuthPage(page)
+      || (await getFirstVisibleLocator(page, 'button:has-text("Continue"), button:has-text("Login with Google"), button:has-text("Google")'))
+      || (await getFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR)),
+    { timeout: isGrokFlow ? 6_000 : 12_000, interval: 80 },
+  );
+  if (!isGrokFlow) {
+    await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
+  }
+
+  // Provider shells (xAI device, CodeBuddy, …) must pick Google SSO first.
+  // Never type credentials into provider user_code / email fields.
+  // xAI: confirm device user_code first, then Google SSO — event-driven retries.
+  for (let attempt = 0; attempt < (isGrokFlow ? 6 : 2); attempt += 1) {
+    if (isGoogleAuthPage(page)) break;
+    if (await handleXaiDeviceCodeConfirm(page, reportStep)) {
+      continue;
+    }
+    if (await handleProviderLoginGate(page, reportStep)) {
+      googleLoginSelectedAt = Date.now();
+      if (isGoogleAuthPage(page)) break;
+      // Gate already waited for Google URL; only brief yield if still on provider.
+      await yieldMs(50);
+      continue;
     }
+    // SPA not ready — poll for buttons, don't sleep 600ms blindly.
+    const ready = await waitUntil(
+      async () =>
+        (await providerHasGoogleLogin(page))
+        || /enter the code|login with google|continue/i.test(await readPageText(page).catch(() => "")),
+      { timeout: 800, interval: 80 },
+    );
+    if (!ready) await yieldMs(100);
+  }
+  if (!isGrokFlow) {
+    await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(6_000));
+  }
+
+  // Only fill Google email once we are actually on accounts.google.com.
+  if (isGoogleAuthPage(page)) {
+    seenGoogleAuth = true;
+    const emailInput = await waitForFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR, { timeout: 10_000 });
+    if (emailInput) {
+      reportStep("entering_email", "Entering Google email");
+      const filled = await fillInputResilient(emailInput, email);
+      if (!filled) {
+        reportStep("email_fill_failed", "Could not fill the Google email field; will retry in the polling loop");
+      } else {
+        reportStep("submitting_email", "Submitting email");
+        await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
+        emailSubmittedAt = Date.now();
+        // Wait for password field (or leave email step) — not fixed sleep.
+        await waitForPageAdvance(page, {
+          selector: PASSWORD_INPUT_SELECTOR,
+          timeout: isGrokFlow ? 8_000 : 12_000,
+        });
+        if (!isGrokFlow) {
+          await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
+        }
+      }
+    }
+  } else if (isProviderPage(page)) {
+    reportStep(
+      "waiting_for_google_sso",
+      `Provider page still open (${(page.url?.() || "").slice(0, 80)}) — will keep selecting Google login`,
+    );
   }
 
   while (Date.now() - startTime < shortTimeoutMs) {
     const successResult = await Promise.race([
       successPromise.then((result) => ({ kind: "success", result })).catch((error) => ({ kind: "success_error", error })),
-      new Promise((resolve) => setTimeout(() => resolve(null), 800)),
+      new Promise((resolve) => setTimeout(() => resolve(null), loopTickMs)),
     ]);
 
     if (successResult?.kind === "success") {
@@ -1630,14 +1999,22 @@ export async function runGoogleAccountAutomation({
     }
 
     // Unblock SetSID / empty Google interstitials before other handlers
-    const waited = await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
+    const waited = await waitThroughGoogleInterstitials(
+      page,
+      reportStep,
+      interstitialOpts(isGrokFlow ? 2_500 : 8_000),
+    );
     if (waited) {
       continue;
     }
 
     const handledGoogleConsent = await handleGoogleConsent(page, reportStep);
     if (handledGoogleConsent) {
-      await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
+      if (!isGrokFlow) {
+        await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(12_000));
+      } else {
+        await waitForPageAdvance(page, { timeout: 4_000 });
+      }
       continue;
     }
 
@@ -1696,92 +2073,179 @@ export async function runGoogleAccountAutomation({
       continue;
     }
 
-    const handledProviderOnboarding = await handleProviderOnboarding(page, reportStep, serviceLabel);
-    if (handledProviderOnboarding) {
-      continue;
+    // xAI rate-limits device authorize after rapid retries — fail fast.
+    if (
+      isProviderPage(page)
+      && (/rate[_ ]?limit/i.test(text) || /error=rate_limited/i.test(page.url?.() || ""))
+    ) {
+      reportStep("device_rate_limited", "xAI device authorization rate-limited");
+      return {
+        status: "failed",
+        error: "xAI rate-limited device authorization. Wait a few minutes and retry (too many rapid device-code attempts).",
+      };
     }
 
-    // Check password BEFORE email — after submitting the email the password
-    // page loads and during the transition the old email input can briefly
-    // remain visible; if we checked email first we'd re-type the email
-    // address into whatever field is focused (often the password input).
-    const passwordInput = await getFirstVisibleLocator(page, PASSWORD_INPUT_SELECTOR);
-    if (passwordInput) {
-      const sincePw = Date.now() - passwordSubmittedAt;
-      if (passwordSubmittedAt && sincePw < PASSWORD_RESUBMIT_COOLDOWN_MS) {
-        // Still on (or animating off) the password form after a recent submit —
-        // do NOT re-fill; wait for SetSID/consent/callback instead.
-        reportStep(
-          "waiting_after_password",
-          `Password already submitted ${Math.round(sincePw / 1000)}s ago — waiting for Google redirect`,
-        );
-        await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
-        await page.waitForTimeout(500);
-        continue;
-      }
-
-      reportStep("entering_password", "Entering Google password");
-      const filled = await fillInputResilient(passwordInput, password);
-      if (filled) {
-        reportStep("submitting_password", "Submitting password");
-        await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
-        passwordSubmittedAt = Date.now();
-        // Give Google time to leave the password challenge before the next
-        // loop iteration can re-detect the still-mounted password field.
-        await Promise.race([
-          page.waitForNavigation({ waitUntil: "domcontentloaded", timeout: 8_000 }).catch(() => null),
-          page.waitForTimeout(2_500),
-        ]);
-        // Password submit often lands on empty SetSID while network completes
-        // consent→idpresponse→kiro://. Callback monitor (CDP) settles successPromise.
-        await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(25_000));
-      } else {
-        reportStep("password_fill_failed", "Could not fill the Google password field; retrying loop");
-        await page.waitForTimeout(700);
-      }
+    // xAI often lands on /oauth2/device/approve with "Invalid action" after
+    // Google consent when the approve form was double-submitted. Re-open the
+    // original device URL (with user_code) a few times — not every loop tick.
+    if (
+      isProviderPage(page)
+      && /invalid action|invalid[_ ]?code|code (has )?expired|expired code/i.test(text)
+      && authUrl
+      && seenGoogleAuth
+      && deviceInvalidReopenCount < DEVICE_INVALID_REOPEN_MAX
+      && Date.now() - deviceInvalidReopenAt > DEVICE_INVALID_REOPEN_COOLDOWN_MS
+    ) {
+      deviceInvalidReopenCount += 1;
+      deviceInvalidReopenAt = Date.now();
+      deviceApproveAt = 0;
+      reportStep(
+        "device_invalid_reopen",
+        `Device page error — reopening auth URL (${deviceInvalidReopenCount}/${DEVICE_INVALID_REOPEN_MAX})`,
+      );
+      await page.goto(authUrl, { waitUntil: "domcontentloaded", timeout: 60_000 }).catch(() => null);
+      await waitUntil(
+        async () =>
+          (await getFirstVisibleLocator(page, 'button:has-text("Continue"), button:has-text("Allow"), button:has-text("Authorize")'))
+          || (await providerHasGoogleLogin(page)),
+        { timeout: 4_000, interval: 80 },
+      );
       continue;
     }
 
-    const nextEmailInput = await getFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR);
-    if (nextEmailInput) {
-      const sinceEmail = Date.now() - emailSubmittedAt;
-      if (emailSubmittedAt && sinceEmail < EMAIL_RESUBMIT_COOLDOWN_MS) {
-        reportStep(
-          "waiting_after_email",
-          `Email already submitted ${Math.round(sinceEmail / 1000)}s ago — waiting for password/next screen`,
-        );
-        await page.waitForTimeout(800);
-        continue;
-      }
+    const googleAuthed = Boolean(seenGoogleAuth && passwordSubmittedAt);
 
-      reportStep("entering_email", "Entering Google email");
-      const filled = await fillInputResilient(nextEmailInput, email);
-      if (filled) {
-        reportStep("submitting_email", "Submitting email");
-        await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
-        emailSubmittedAt = Date.now();
-        await page.waitForTimeout(1_500);
-      } else {
-        reportStep("email_fill_failed", "Could not fill the Google email field; retrying loop");
-      }
-      await page.waitForTimeout(700);
+    // xAI device user_code confirm (Continue) — only before Google login.
+    if (await handleXaiDeviceCodeConfirm(page, reportStep, { alreadyAuthed: googleAuthed })) {
       continue;
     }
 
-    const handledProviderGate = await handleProviderLoginGate(page, reportStep);
+    // Provider Google SSO BEFORE generic onboarding Continues.
+    // Cooldown: re-clicking Google mid-redirect restarts OAuth and wastes time.
+    const allowGoogleClick =
+      !googleAuthed
+      && (!googleLoginSelectedAt || Date.now() - googleLoginSelectedAt > GOOGLE_SSO_COOLDOWN_MS);
+    const handledProviderGate = await handleProviderLoginGate(page, reportStep, { allowGoogleClick });
     if (handledProviderGate) {
+      if (allowGoogleClick) googleLoginSelectedAt = Date.now();
       continue;
     }
 
-    const clickedApprove = await clickFirstVisible(page, APPROVE_BUTTON_SELECTORS);
-    if (clickedApprove) {
-      reportStep("approving_consent", `Approving Google or ${serviceLabel} consent`);
-      await page.waitForTimeout(700);
+    // xAI device approve ONLY after Google password submitted.
+    if (
+      googleAuthed
+      && Date.now() - deviceApproveAt > DEVICE_APPROVE_COOLDOWN_MS
+      && await clickXaiDeviceAuthorize(page, reportStep)
+    ) {
+      deviceApproveAt = Date.now();
       continue;
     }
 
+    const handledProviderOnboarding = await handleProviderOnboarding(page, reportStep, serviceLabel);
+    if (handledProviderOnboarding) {
+      continue;
+    }
+
+    // Credentials only on accounts.google.com — never into provider shells.
+    if (isGoogleAuthPage(page)) {
+      seenGoogleAuth = true;
+      // Check password BEFORE email — after submitting the email the password
+      // page loads and during the transition the old email input can briefly
+      // remain visible; if we checked email first we'd re-type the email
+      // address into whatever field is focused (often the password input).
+      const passwordInput = await getFirstVisibleLocator(page, PASSWORD_INPUT_SELECTOR);
+      if (passwordInput) {
+        const sincePw = Date.now() - passwordSubmittedAt;
+        if (passwordSubmittedAt && sincePw < PASSWORD_RESUBMIT_COOLDOWN_MS) {
+          // Still on (or animating off) the password form after a recent submit —
+          // do NOT re-fill; wait for SetSID/consent/callback instead.
+          reportStep(
+            "waiting_after_password",
+            `Password already submitted ${Math.round(sincePw / 1000)}s ago — waiting for Google redirect`,
+          );
+          await waitThroughGoogleInterstitials(
+            page,
+            reportStep,
+            interstitialOpts(isGrokFlow ? 2_000 : 6_000),
+          );
+          continue;
+        }
+
+        reportStep("entering_password", "Entering Google password");
+        const filled = await fillInputResilient(passwordInput, password);
+        if (filled) {
+          reportStep("submitting_password", "Submitting password");
+          const prePwUrl = page.url?.() || "";
+          await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
+          passwordSubmittedAt = Date.now();
+          // Leave password challenge via navigation / URL change / success — no 2.5s sleep.
+          await Promise.race([
+            page.waitForNavigation({ waitUntil: "domcontentloaded", timeout: isGrokFlow ? 6_000 : 10_000 }).catch(() => null),
+            waitForPageAdvance(page, { fromUrl: prePwUrl, timeout: isGrokFlow ? 6_000 : 10_000 }),
+            successPromise.then(() => null).catch(() => null),
+          ]);
+          await waitThroughGoogleInterstitials(
+            page,
+            reportStep,
+            interstitialOpts(postPasswordInterstitialMs),
+          );
+        } else {
+          reportStep("password_fill_failed", "Could not fill the Google password field; retrying loop");
+          await yieldMs(100);
+        }
+        continue;
+      }
+
+      const nextEmailInput = await getFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR);
+      if (nextEmailInput) {
+        const sinceEmail = Date.now() - emailSubmittedAt;
+        if (emailSubmittedAt && sinceEmail < EMAIL_RESUBMIT_COOLDOWN_MS) {
+          reportStep(
+            "waiting_after_email",
+            `Email already submitted ${Math.round(sinceEmail / 1000)}s ago — waiting for password/next screen`,
+          );
+          await waitForPageAdvance(page, {
+            selector: PASSWORD_INPUT_SELECTOR,
+            timeout: Math.max(200, EMAIL_RESUBMIT_COOLDOWN_MS - sinceEmail),
+          });
+          continue;
+        }
+
+        reportStep("entering_email", "Entering Google email");
+        const filled = await fillInputResilient(nextEmailInput, email);
+        if (filled) {
+          reportStep("submitting_email", "Submitting email");
+          await clickFirstVisible(page, NEXT_BUTTON_SELECTORS);
+          emailSubmittedAt = Date.now();
+          await waitForPageAdvance(page, {
+            selector: PASSWORD_INPUT_SELECTOR,
+            timeout: isGrokFlow ? 6_000 : 10_000,
+          });
+        } else {
+          reportStep("email_fill_failed", "Could not fill the Google email field; retrying loop");
+          await yieldMs(80);
+        }
+        continue;
+      }
+    }
+
+    // On xAI before Google login, APPROVE selectors match "Continue with Google"
+    // via :has-text("Continue") and wreck the device code → Invalid action loop.
+    const mayGenericApprove =
+      isGoogleAuthPage(page)
+      || (seenGoogleAuth && passwordSubmittedAt && !(await providerHasGoogleLogin(page)));
+    if (mayGenericApprove) {
+      const clickedApprove = await clickFirstVisible(page, APPROVE_BUTTON_SELECTORS);
+      if (clickedApprove) {
+        reportStep("approving_consent", `Approving Google or ${serviceLabel} consent`);
+        deviceApproveAt = Date.now();
+        await waitForPageAdvance(page, { timeout: isGrokFlow ? 2_000 : 4_000 });
+        continue;
+      }
+    }
+
     // Periodic diagnostics so jobs aren't opaque "waiting" spam
-    if (Math.floor((Date.now() - startTime) / 5000) !== Math.floor((Date.now() - startTime - 700) / 5000)) {
+    if (Math.floor((Date.now() - startTime) / 5000) !== Math.floor((Date.now() - startTime - loopTickMs) / 5000)) {
       const url = page.url?.() || "";
       const snippet = String(text || (await readPageText(page).catch(() => ""))).slice(0, 100).replace(/\s+/g, " ");
       reportStep(
@@ -1791,7 +2255,8 @@ export async function runGoogleAccountAutomation({
     } else {
       reportStep("waiting_for_next_screen", `Waiting for the next Google or ${serviceLabel} screen`);
     }
-    await page.waitForTimeout(700);
+    // Only yield — next loop races successPromise + handlers. Fast net = fast exit.
+    await yieldMs(loopTickMs);
   }
 
   // Final blocked check before generic needs_manual