autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/bulk-account-registration/references/gmail-playwright-flow.md

@@ -0,0 +1,106 @@
+# Gmail Playwright Anti-Detection Registration Flow
+
+> Reference for `bulk-account-registration` — Google/Gmail-specific browser automation.
+> Built 2026-06-23 at `C:\home\user\gmail_autoreg\`
+
+## Architecture
+
+```
+main.py                  # CLI menu + batch runner
+config/settings.py       # 50+ configurable parameters
+core/stealth.py          # Playwright anti-detection: fingerprint, WebGL/Canvas/Audio spoof
+core/behavior.py         # Human-like: Bezier mouse, per-char typing, scrolls
+core/proxy_manager.py    # Proxy rotation, health-check, blacklist
+core/sms_manager.py      # 5sim.net integration
+creators/gmail_signup.py # 6-step Gmail signup flow
+```
+
+## Key Anti-Detection Techniques
+
+### Browser Level (stealth.py)
+- Navigator: `webdriver=false`, `plugins=5`, `languages=['en-US','en']`, `hardwareConcurrency=4`, `deviceMemory=8`
+- WebGL spoofed to Intel Iris OpenGL Engine
+- Canvas fingerprint: random pixel XOR before `toDataURL()`
+- AudioContext fingerprint: intercept `getFloatFrequencyData`
+- Chrome launch args: `--disable-blink-features=AutomationControlled`
+- Random viewport from 7 real resolutions (1920x1080, 1366x768, etc.)
+- Random timezone + geolocation (US-based, matches proxy)
+- Init script injected before any page load
+
+### Behavior Level (behavior.py)
+- `human_type()`: per-character input with 80-250ms delays, 5% micro-pause chance
+- `human_click()`: cubic Bezier curve mouse movement (15-30 steps) before click
+- `human_scroll()`: smooth scroll in 3-8 steps
+- `random_mouse_movement()`: idle cursor wandering
+- `warmup_session()`: visit 3 random sites (Google, Wikipedia, YouTube, BBC, Reddit) before signup
+
+## 6-Step Gmail Signup Flow
+
+1. **Open** `accounts.google.com/signup/v2/webcreateaccount`
+2. **Name**: First + Last (from names.txt or generated) → Next
+3. **Birthday + Gender**: Month/Day/Year selectors + gender select → Next
+4. **Username**: Click "Create your own Gmail address" → type username → Next
+5. **Password**: Type password (from config or auto-generated 12-char) → Next
+6. **Phone**: Skip/5sim/alternative → Terms of Service "I Agree"
+
+## Phone Bypass Strategies
+
+| Strategy | Method |
+|----------|--------|
+| `skip` | Scan 9 selectors for Skip button (English/Arabic) |
+| `auto` | Skip → "Try another way" → Recovery email |
+| `5sim` | Buy number via API → wait SMS (regex `G-XXXXXX`) → input code → Verify |
+| `manual` | Leave phone screen open for user |
+
+## 5sim SMS Flow
+
+```
+buy_number(country, operator, "google") → phone_number
+wait_for_sms(timeout=120s, poll=5s) → code (extracted via regex)
+confirm_order() → cleanup
+```
+
+Retry: if SMS timeout, cancel order (refund) and retry with different number.
+
+## Proxy Rotation
+
+- Round-robin + random + "best" (lowest fail count)
+- Health-check via `api.ipify.org`
+- Auto-blacklist after 3 consecutive failures
+- Auto-switch proxy between account creation retries
+
+## Session Persistence
+
+All accounts created in a single browser context (shared cookies). This mimics a real user creating multiple accounts from the same browser — avoids triggering Google's "suspicious activity" detection that fires when every signup comes from a fresh browser.
+
+## Startup
+
+```bash
+pip install -r requirements.txt
+playwright install chromium
+python main.py          # Interactive menu
+python main.py -n 5     # 5 accounts batch
+```
+
+## Key Config Options (config/settings.py)
+
+```python
+PHONE_BYPASS_STRATEGY = "skip"   # skip | auto | 5sim | manual
+ENGINE = "playwright"             # playwright | selenium
+HEADLESS = False                  # MUST be False — Google blocks headless
+STEALTH_MODE = True
+RANDOM_VIEWPORT = True
+MOUSE_CURVE = True                # Bezier curve movement
+TYPING_DELAY_MIN = 80             # ms
+TYPING_DELAY_MAX = 250
+MAX_RETRIES = 2
+SMS_MAX_WAIT = 120                # seconds
+```
+
+## Pitfalls
+
+1. **Headless = instant detection**: Google actively blocks headless Chrome. `HEADLESS` MUST be `False`.
+2. **Fast typing = bot**: Type delays < 50ms trigger Google's keystroke dynamics detection. Keep > 80ms.
+3. **No warmup = suspicious**: Fresh browser going straight to signup is a bot signal. Warmup with 3 random sites first.
+4. **Same IP + many accounts = phone required**: After ~3 accounts from same IP, Google FORCES phone verification. Use proxies or limit batch size.
+5. **5sim number already used**: Some 5sim numbers were previously used for Google — they get rejected. Retry with different number/operator.