From b6e8445d95fabc2a39fdaa7ae81771cd41ab341c Mon Sep 17 00:00:00 2001
From: chiyi <cyi.cc@outlook.com>
Date: Fri, 17 Jul 2026 21:45:31 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8Dgrok?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/internal/provider/grok/client.go | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/backend/internal/provider/grok/client.go b/backend/internal/provider/grok/client.go
index 0aab659..07a8de6 100644
--- a/backend/internal/provider/grok/client.go
+++ b/backend/internal/provider/grok/client.go
@@ -392,7 +392,7 @@ func (c *Client) ensureChallenge(ctx context.Context, client tlsclient.HttpClien
 	if fresh {
 		return
 	}
-	ch, err := fetchStatsigChallenge(ctx, client, token)
+	ch, err := fetchStatsigChallenge(ctx, client)
 	if err != nil {
 		// Silent fallback to static defaults is the #1 cause of a recurring
 		// "403 anti-bot": the homepage structure changed and we never notice.
@@ -409,7 +409,15 @@ func (c *Client) ensureChallenge(ctx context.Context, client tlsclient.HttpClien
 
 // fetchStatsigChallenge does a browser-free homepage GET and derives a
 // self-consistent (header, salt) pair: header = 0x00 + seed, salt = prefix + F.
-func fetchStatsigChallenge(ctx context.Context, client tlsclient.HttpClient, token string) (statsigChallenge, error) {
+//
+// The request is ANONYMOUS (no sso cookie): grok redirects a request carrying an
+// sso cookie to the sign-in page, whose HTML omits the anti-bot seed <meta> and
+// the curves array — so a cookied fetch silently loses the challenge inputs and
+// statsigID falls back to the stale static recipe (403 anti-bot). The seed/curves
+// are per-build and account-independent (the seed is transmitted inside the
+// x-statsig-id header the server re-verifies), so the anonymous landing page is
+// the reliable source for every session.
+func fetchStatsigChallenge(ctx context.Context, client tlsclient.HttpClient) (statsigChallenge, error) {
 	req, err := http.NewRequest(http.MethodGet, apiBase+"/", nil)
 	if err != nil {
 		return statsigChallenge{}, err
@@ -419,8 +427,7 @@ func fetchStatsigChallenge(ctx context.Context, client tlsclient.HttpClient, tok
 		"accept":            {"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"},
 		"accept-language":   {"en-US,en;q=0.9"},
 		"user-agent":        {userAgent},
-		"cookie":            {"sso=" + token + "; sso-rw=" + token},
-		http.HeaderOrderKey: {"accept", "accept-language", "user-agent", "cookie"},
+		http.HeaderOrderKey: {"accept", "accept-language", "user-agent"},
 	}
 	resp, err := client.Do(req)
 	if err != nil {