autoreg-skills-max: initial public release (restored, redacted, hardened)

This commit is contained in:
baradok60915d52e8425
2026-10-20 02:16:32 +03:00
commit f58eafeb48
565 changed files with 60064 additions and 0 deletions

View File

@@ -0,0 +1,43 @@
# OAuth Fallback Token Retrieval
After signup completes (profile form submitted), the browser is logged in but the device auth CLI may not have received the callback. The reliable fallback:
## Flow
1. `subprocess.run([grok_exe, "logout"], capture_output=True, timeout=10)` — clear old auth
2. `subprocess.Popen([grok_exe, "login", "--oauth"], ...)` — start OAuth flow
3. Parse OAuth URL from CLI output: `re.search(r'(https://auth\.x\.ai/oauth2/authorize\?\S+)', line)`
4. `page.goto(oauth_url)` — navigate browser to OAuth URL
5. If browser is logged in → auto-redirects to `127.0.0.1:XXXXX/callback?...`
6. If not logged in → try clicking "Continue" or "Allow" buttons
7. `proc.communicate(timeout=30)` — wait for CLI to finish
8. Check `auth.json` for any key with `access_token`
## Code
```python
subprocess.run([GROK_EXE, "logout"], capture_output=True, timeout=10)
proc = subprocess.Popen([GROK_EXE, "login", "--oauth"],
stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, bufsize=1)
oauth_url = None
for line in iter(proc.stdout.readline, ''):
if not line and proc.poll() is not None: break
m = re.search(r'(https://auth\.x\.ai/oauth2/authorize\?\S+)', line)
if m: oauth_url = m.group(1); break
if oauth_url:
await page.goto(oauth_url, timeout=15000)
await page.wait_for_timeout(5000)
for w in range(15):
if "127.0.0.1" in page.url or "localhost" in page.url: break
btn = page.locator("button:has-text('Continue'), button:has-text('Allow')").first
if await btn.count() > 0: await btn.click()
await page.wait_for_timeout(2000)
proc.communicate(timeout=30)
auth = json.load(open(AUTH_JSON))
for key in auth:
tok = auth[key].get("access_token") or auth[key].get("key", "")
if tok: return tok
```
## Why It Works
The OAuth flow is simpler than device auth: the CLI prints an OAuth URL, the browser opens it, and since the browser is already logged in, it auto-redirects to localhost with the authorization code. The CLI picks up the redirect and writes the token to `auth.json`.