From 0822628bfc70823777e2dc0957be2e2933ac66f7 Mon Sep 17 00:00:00 2001 From: chiyi Date: Mon, 13 Jul 2026 10:14:52 +0800 Subject: [PATCH] =?UTF-8?q?=E6=9B=B4=E6=96=B0grok=E7=AE=97=E6=B3=95?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- backend/internal/provider/grok/client.go | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/backend/internal/provider/grok/client.go b/backend/internal/provider/grok/client.go index 55f8e4d..0aab659 100644 --- a/backend/internal/provider/grok/client.go +++ b/backend/internal/provider/grok/client.go @@ -458,14 +458,14 @@ func fetchStatsigChallenge(ctx context.Context, client tlsclient.HttpClient, tok seedB64: mm[1], curvesJSON: string(curvesJSON), } - // Best-effort static derivation (the old hand-ported algorithm) as fallback. - if seed, err := decodeStatsigSeed(mm[1]); err == nil { - if tail, err := computeStatsigTail(seed, curves); err == nil { - ch.header = append([]byte{0x00}, seed...) - ch.suffix = statsigSaltPrefix + tail - ch.trailer = defaultStatsigTrailer - } - } + // NOTE: the old hand-ported per-session derivation (0x00+seed header + + // computeStatsigTail salt) is intentionally NOT applied here. Verified + // 2026-07-13 against /rest/app-chat/conversations/new: that dynamic token is + // rejected ("Request rejected by anti-bot rules.", 403), while the static + // (header, salt) defaults are accepted (200) — so we keep the static values + // as the fallback. When the goja signer (ensureEngine above) locates and + // verifies grok's own chunk it still takes over via seedB64/curvesJSON in + // statsigID; computeStatsigTail is retained only for reference/tests. return ch, nil }