autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/bulk-account-registration/references/qoder-autoreg.md

@@ -0,0 +1,98 @@
+# Qoder CLI — Registration Target
+
+**Discovered**: 2026-08-08 · **Updated**: 2026-08-08
+
+## Quick facts
+- **Site**: https://qoder.com/ (Alibaba product, 1M+ users)
+- **CLI**: `curl -fsSL https://qoder.com/install | bash`
+- **Trial**: **2-week Pro Trial** + 300 credits free for new users
+- **API**: PAT (Personal Access Token) from Account → Integrations
+- **Models** (confirmed via qoder-proxy CN backend):
+  `qwen3.8-max-preview`, `qwen3.7-max`, `qwen3.7-plus`, `deepseek-v4-pro`,
+  `deepseek-v4-flash`, `glm-5.2`, `kimi-k2.7-code`, `minimax-m2.7`,
+  `qwen3.6-flash`, `qoder-cn`, `auto` — all top-tier models in one account
+- **Auth**: Email, Google, or GitHub signup
+- **CAPTCHA**: Chinese slider CAPTCHA on email signup (not Turnstile)
+
+## Auto-Reg Tools (ranked by quality)
+
+### 1. qoder-creator (okky-x0f/qoder-creator) ⭐ PREFERRED
+- **107 stars**, 46 forks, Python, MIT license, v5.0.0
+- **Full automation with UI interaction** — auto-claims Pro Trial + 300 Credits
+- Playwright + Camoufox + playwright-stealth (anti-detect)
+- **Patches Qoder Desktop data**: fake MAC, machineId, MS device ID, UMID, PKCE
+- Captures device auth URL from Chrome tabs → completes Google OAuth in browser
+- Smart skip (already processed emails), random delays 30-60s
+- Supports macOS, Windows, Linux
+- Accounts format: `email|password` in `qoder_akun.txt`
+- Output: `qoder_sukses.txt`, `qoder_api_keys.txt`, `qoder_failed.txt`
+- **Requires**: Qoder Desktop app installed + Google Chrome
+
+### 2. qoder-autopilot (tistis8321/qoder-autopilot)
+- **14 stars**, Python, MIT license
+- Playwright + Camoufox, temp-mail, 9Router
+- Windows 10/11 only — distributed as .exe (less flexible)
+
+### 3. qoder-proxy (avaritiachaos/qoder-proxy) ⭐ PREFERRED for API
+- **142 stars**, 40 forks, Node.js, MIT license, v1.5.1
+- **OpenAI + Anthropic compatible** HTTP proxy for Qoder CLI
+- Both CN (`qoderclicn`) and Global (`qodercli`) backends
+- Endpoints: `/v1/chat/completions`, `/v1/messages`, `/v1/models`, `/health`
+- Streaming, tool calling, web dashboard, local usage stats
+- Security: 127.0.0.1 only, CORS reject, PROXY_API_KEY auth
+- CN backend uses PAT; Global backend uses `qodercli login` (OAuth)
+
+### 4. qoder-proxy (foxy1402/qoder-proxy) — older
+- **51 stars**, JavaScript, MIT license
+- Simpler, fewer features, 3 months stale
+
+## Registration flow
+1. Web signup: email → password → **Chinese slider CAPTCHA** ⛔
+2. GitHub OAuth: `qoder.com → github.com → DataDome CAPTCHA` ⛔
+3. Google OAuth: `qoder.com → accounts.google.com` ✅ (needs Google account)
+4. After signup: 2-week Pro Trial activates automatically
+5. PAT: Account → Integrations → Create PAT → `qoder_pat_...`
+
+## Strategy for mass registration
+1. **Path A (Google OAuth)**: Use existing Gmail accounts → sign up via Google OAuth
+2. **Path B (qoder-creator)**: Clone repo, prepare `qoder_akun.txt` with email|password pairs, run on desktop with Qoder installed
+3. Extract PATs from `qoder_api_keys.txt`
+4. Deploy `avaritiachaos/qoder-proxy` on VPS → expose as OpenAI-compatible endpoint
+5. Add qoder-proxy as upstream in th-gateway
+
+## Proxy deployment (VPS)
+```bash
+# Install qoderclicn
+npm install -g @qodercn-ai/qoderclicn
+# Clone proxy
+git clone https://github.com/avaritiachaos/qoder-proxy
+cd qoder-proxy && npm install
+# Configure .env
+echo 'CLI_BACKEND=cn' > .env
+echo 'QODERCN_PERSONAL_ACCESS_TOKEN=qoder_pat_...' >> .env
+echo 'PROXY_API_KEY=sk-gateway-key' >> .env
+# Start
+npm start  # → http://127.0.0.1:3000
+```
+
+## API usage
+```bash
+# List models
+curl http://127.0.0.1:3000/v1/models -H "x-api-key: [REDACTED]"
+
+# Chat completion
+curl -X POST http://127.0.0.1:3000/v1/chat/completions \
+  -H "Authorization: Bearer sk-gateway-key" \
+  -H "Content-Type: application/json" \
+  -d '{"model":"qoder-cn","messages":[{"role":"user","content":"hi"}]}'
+```
+
+## Pitfalls
+- **Chinese slider CAPTCHA**: email signup blocked by slider puzzle — not solvable with clicks
+- **GitHub DataDome**: GitHub OAuth redirects to DataDome CAPTCHA on signup
+- **Google OAuth is the path**: use existing Google accounts to bypass CAPTCHA
+- **qoder-creator needs Qoder Desktop**: installed on the machine — not headless
+- **1 trial per user**: multiple accounts from same IP may be flagged
+- **PAT expiration**: PATs can expire — need rotation strategy
+- **CN vs Global**: CN backend (qoder.com.cn) uses PAT; Global (qoder.com) uses OAuth
+- **Credit metering**: Pro Trial has credit limits — monitor usage