autoreg-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:16:32 +03:00
commit f58eafeb48
565 changed files with 60064 additions and 0 deletions
--- a/skills/chatgpt-autoreg/SKILL.md
+++ b/skills/chatgpt-autoreg/SKILL.md
@@ -0,0 +1,231 @@
+---
+name: chatgpt-autoreg
+description: Mass auto-registration of ChatGPT accounts using aBaiAutoplus toolkit — protocol executor, IMAP pool, captcha auto-solver. Covers server lifecycle, task submission, monitoring, and pitfall recovery.
+triggers:
+  - "авторег gpt"
+  - "регистрация chatgpt аккаунтов"
+  - "массовый авторег"
+  - "зарегать аккаунты"
+  - user asks about aBaiAutoplus or oai-register
+---
+
+# ChatGPT Auto-Registration (aBaiAutoplus)
+
+## Quick Start
+
+```bash
+# 1. Start server
+cd "C:/Users/User/Desktop/GPT-AUTOREG/aBaiAutoplus"
+python -u main.py
+# Server listens on port 8000. Web UI at http://localhost:8000
+# No venv activation needed — uses system Python 3.11
+
+# 2. Verify health
+curl -s http://localhost:8000/api/health
+# → {"ok":true,"service":"account-manager-v2"}
+
+# 3. Check accounts
+curl -s "http://localhost:8000/api/accounts?limit=3"
+# Returns total count + account list
+
+# 4. Register N accounts (protocol executor — fastest)
+curl -s -X POST http://localhost:8000/api/tasks/register \
+  -H "Content-Type: application/json" \
+  -d '{"count":10,"concurrency":2,"executor_type":"protocol","captcha_solver":"auto","extra":{"mail_provider":"imap_pool","identity_provider":"mailbox"}}'
+# Returns task_id. Monitor with step 5.
+
+# 5. Monitor task
+curl -s http://localhost:8000/api/tasks/<task_id>
+# Fields: status, progress, success, error_count, errors[]
+```
+
+## Project Layout
+
+```
+GPT-AUTOREG/aBaiAutoplus/
+├── main.py                  # FastAPI entry point, port 8000
+├── gateway.py               # Go gateway (port 8001) — optional, not needed for reg
+├── platforms/chatgpt/
+│   ├── protocol_register.py # Protocol registration worker (curl_cffi impersonation)
+│   ├── browser_register.py  # Headed browser registration (Camoufox)
+│   └── constants.py         # OpenAI auth endpoints, Sentinel config
+├── providers/mailbox/
+│   └── imap_pool.py         # GenericImapMailboxPool — t-online.de IMAP
+├── api/
+│   ├── task_commands.py     # RegisterTaskRequest model
+│   ├── provider_settings.py # Provider settings CRUD
+│   └── health.py
+├── application/
+│   └── task_commands.py     # TaskCommandsService
+├── services/
+│   └── task_runtime.py      # TaskRuntime (max_parallel_tasks=3)
+├── data/
+│   └── .imap_mailbox_pool_state.json  # IMAP pool state — reset to {} on reconfig
+├── account_manager.db       # SQLite DB with all registered accounts
+├── requirements.txt
+└── docker-compose.yml
+```
+
+## Email Pool
+
+- **Active file:** `C:/Users/User/Desktop/GPT-AUTOREG/emails.txt` (t-online.de accounts, format `email:password`)
+- **Provider:** IMAP pool (id=2, provider_type=mailbox, provider_name=imap_pool)
+- **Config path in DB:** stored in `provider_settings` table; update via SQLite if needed:
+  ```sql
+  UPDATE provider_settings SET value = 'C:/Users/User/Desktop/GPT-AUTOREG/emails.txt' WHERE key = 'imap_pool_file';
+  ```
+- **To change email file:** update the path in DB, reset pool state (`echo "{}" > data/.imap_mailbox_pool_state.json`), restart server
+- **Blocked domains:** t-online.de mostly burned — ~80% return `account_deactivated`. Consider rambler.ru for fresh pool.
+
+## Captcha
+
+- **Provider:** RuCaptcha (id=1, provider_key=rucaptcha_api)
+- **Enabled:** true, is_default: true
+- **Solver mode:** `captcha_solver=auto` — system selects automatically
+- **Check config:** `curl -s "http://localhost:8000/api/provider-settings?provider_type=captcha"`
+
+## Concurrency & Performance
+
+- **max_parallel_tasks=3** (hardcoded in task_runtime.py)
+- **Recommended concurrency=2** — stable. Concurrency=3 causes server crashes under heavy IMAP load.
+- **Protocol executor** uses curl_cffi impersonation (firefox144) + Sentinel PoW
+- **Performance:** ~1 success per minute with concurrency=2
+
+## Common Pitfalls
+
+### Server crashes
+Server is unstable at concurrency=3. Restart with:
+```bash
+cd "C:/Users/User/Desktop/GPT-AUTOREG/aBaiAutoplus" && python -u main.py
+```
+Database survives crashes. Incomplete tasks may produce partial results.
+**Note:** server often exits with code 1 on task completion — this is normal; just restart if you need more tasks.
+
+### `account_deactivated`
+OpenAI rejects email: "You do not have an account because it has been deleted or deactivated."
+→ Email was previously used and banned. Move to next email. Large portion of t-online.de pool is burned.
+
+### IMAP timeout (180s)
+Worker waits for verification code from IMAP. If email doesn't arrive within 180s, task errors out.
+→ Affected emails likely have slow IMAP delivery or inbox is full.
+
+### `邮箱池为空` (empty mailbox pool)
+IMAP pool config file missing or empty.
+→ Verify `C:/Users/User/Desktop/GPT-AUTOREG/emails.txt` exists and has entries.
+→ Reset pool state: `echo "{}" > data/.imap_mailbox_pool_state.json`
+
+### Provider settings API blocked
+Only DELETE is allowed for individual settings. No PUT/PATCH.
+→ Workaround: update path directly in SQLite `provider_settings` table, then restart server.
+
+### Stale tasks stuck at N/X
+Worker waiting for IMAP — can take up to 180s. Wait or check server logs.
+
+### Token lifetime — hours, not days
+Session cookies (`__Secure-next-auth.session-token`) expire in ~1-3 hours after registration.
+Extract tokens IMMEDIATELY after task completion. Do not rely on accounts staying valid overnight.
+See `references/token-extraction.md` for the extraction workflow.
+
+### "Unusual activity" on /backend-api/conversation
+New accounts (<24h old) get HTTP 403 `"Unusual activity has been detected from your device"`
+when hitting `/backend-api/conversation`. The `/backend-api/me` endpoint works (read-only).
+→ Accounts need time to «warm up» (24-48h) before API usage.
+→ The only working transport is Camoufox browser — plain httpx/requests are blocked by Cloudflare.
+
+## Full Toolkit Archive
+
+When user asks to gather all autoreg files, consolidate from these sources:
+
+| Source | Contents |
+|---|---|
+| `_PROJECTS/oai-register/aBaiAutoplus/` | Main toolkit (exclude .venv, node_modules, frontend) |
+| `Downloads/Telegram Desktop/working_mails.txt` | 17,893 t-online.de accounts |
+| `Downloads/Telegram Desktop/*Good*Mail*` | 32 mail:pass lists |
+| `SESSION-BASE/autoreg.md` | Reference document |
+| `Desktop/conol_github/*autoreg*` | Conol scripts |
+| `Desktop/velokey_autoreg/` | Velokey autoreg |
+| `Desktop/sepa_autoreg.py` + `~/sepa_autoreg.py` | SEPA autoreg |
+| `~/gorouter_autoreg.py` | Gorouter autoreg |
+| `~/Desktop/baaaai_autoreg.py` | Baia autoreg |
+| `tmp/gmail_autoreg.py` | Gmail autoreg |
+| `tmp/autoreg_v*.py` | 44 iterative versions |
+| `_PROJECTS/grok_proxy_pool.py` + `grok_cli_proxy.py` | Proxy scripts |
+
+**Archive command:** `tar czf GPT-AUTOREG-FULL.tar.gz GPT-AUTOREG-FULL/`
+(Use tar, not zip/7z — only tar+gzip available in Git Bash on this Windows host)
+
+## Account Validity Check
+
+Accounts are auto-checked by LifecycleManager. Statuses:
+- `registered` — just created, not yet verified
+- `valid` — token works, account active
+- `invalid` — token expired or account banned
+
+Check latest account state: `curl -s "http://localhost:8000/api/accounts?limit=3"`
+
+## Token Extraction & API Usage
+
+After successful registration, extract tokens from the SQLite DB for API use:
+
+```python
+# Query valid accounts with tokens
+import sqlite3, json
+db = sqlite3.connect("C:/Users/User/Desktop/GPT-AUTOREG/aBaiAutoplus/account_manager.db")
+rows = db.execute("""
+    SELECT ao.account_id, ao.remote_email, ac.key, ac.value
+    FROM account_overviews ao
+    JOIN account_credentials ac ON ao.account_id = ac.account_id
+    WHERE ao.validity_status = 'valid' AND ac.credential_type IN ('token','cookie')
+""").fetchall()
+```
+
+### accounts_tokens.json format
+
+The image API server (`image_api_server.py` in `GPT-AUTOREG/`) expects:
+
+```json
+{
+  "accounts": [
+    {
+      "email": "[REDACTED-EMAIL]",
+      "tokens": {
+        "session_token": "eyJhbG...",
+        "access_token": "eyJhbG...",
+        "legacy_token": "eyJhbG...",
+        "csrf_token": "abc123%7Cdef456",
+        "cookies": "{'__Secure-next-auth.session-token': '...', ...}"
+      }
+    }
+  ]
+}
+```
+
+### image_api_server.py
+
+FastAPI server on port 8400. Uses Camoufox browser to bypass Cloudflare and call
+`chatgpt.com/backend-api/conversation` for DALL-E image generation.
+
+```bash
+cd "C:/Users/User/Desktop/GPT-AUTOREG" && python -u image_api_server.py
+# Endpoints: GET /health, GET /accounts, POST /generate
+```
+
+**Known limitation:** accounts <24h old return 403 "Unusual activity".
+The `/me` endpoint works; conversation endpoint needs aged accounts.
+
+### Camoufox transport
+
+Only Camoufox (Firefox-based anti-detection browser) bypasses Cloudflare for `chatgpt.com`.
+Playwright Chromium and httpx both get blocked with 403 challenge pages.
+
+```python
+from camoufox.async_api import AsyncCamoufox
+
+async with AsyncCamoufox(headless=True, locale="en-US", block_webrtc=True) as browser:
+    page = await browser.new_page()
+    await page.goto("https://chatgpt.com/")
+    await page.context.add_cookies(cookies_list)
+    # Now fetch() from page.evaluate() inherits cookies + TLS fingerprint
+```
+
+See `references/token-extraction.md` for full workflow.
--- a/skills/chatgpt-autoreg/references/session-2026-07-30.md
+++ b/skills/chatgpt-autoreg/references/session-2026-07-30.md
@@ -0,0 +1,55 @@
+# Session Inventory — 2026-07-30
+
+## File Discovery Results
+
+Full file inventory gathered from these locations:
+
+### Core Toolkit
+- `C:\Users\User\Desktop\_PROJECTS\oai-register\aBaiAutoplus\` — 232 source files (after stripping .venv, frontend, node_modules)
+  - main.py, gateway.py, requirements.txt, docker-compose.yml, Dockerfile
+  - api/ (13 files), application/ (14), services/ (8), core/ (39), tools/ (34)
+  - platforms/chatgpt/ (27) — protocol_register.py, constants.py
+  - providers/ (18) — imap_pool.py, rucaptcha.py, twocaptcha.py, yescaptcha.py
+  - data/ — .imap_mailbox_pool_state.json
+
+### Email Bases
+- `working_mails.txt` — 650,733 bytes, 17,893 t-online.de accounts (format: email:password)
+- 32 × `*Good*Mail*` lists (50k × N + 2k variants)
+- `fakemailbot.zip`, `mailer_v3_gothbreach.zip`
+
+### Autoreg Scripts (all versions)
+- 44 iterations: `autoreg_v1.py` through `autoreg_v46.py` in `tmp/`
+- conol_github/ (8 files): api, email, github_stealth, curl, aliases
+- velokey/ (3 files), sepa/ (2 files), baia, gorouter, gmail
+
+### Proxy Scripts
+- `grok_proxy_pool.py`, `grok_cli_proxy.py`
+- `cf_proxy.py` (in gpt-auto-register)
+
+## Server Crash Pattern
+
+Observed crashes at concurrency=3:
+1. First crash: during 20-account batch, progress 5/20. Server down, restarted. Got +5 accounts.
+2. Second crash: during 15-account batch, progress 7/15. No JSON response — `JSONDecodeError`.
+3. Root cause: likely IMAP connection exhaustion or unhandled exception under concurrent load.
+
+**Mitigation:** use concurrency=2. Monitor with `curl` polling every 15-30s.
+
+## Registration Test (2026-07-30 12:43 UTC)
+
+```json
+{"count":2,"concurrency":2,"executor_type":"protocol","captcha_solver":"auto","extra":{"mail_provider":"imap_pool","identity_provider":"mailbox"}}
+```
+
+Results:
+- Worker 1: [REDACTED-EMAIL] → code 568181 received → OpenAI rejected: account_deactivated
+- Worker 2: [REDACTED-EMAIL] → still waiting for IMAP code (stalled)
+
+Conclusion: pipeline functional. Captcha solves. IMAP delivers. ~50% of t-online.de pool is burned.
+
+## Current State
+
+- **Server:** running on localhost:8000
+- **Accounts in DB:** 30 (all chatgpt, t-online.de, status registered)
+- **Captcha:** RuCaptcha, API key configured, auto mode
+- **IMAP pool:** 17,893 entries, file at `C:\Users\User\Desktop\solenne_de_emails.txt`
--- a/skills/chatgpt-autoreg/references/token-extraction.md
+++ b/skills/chatgpt-autoreg/references/token-extraction.md
@@ -0,0 +1,105 @@
+# Token Extraction Workflow — 2026-08-01
+
+## Extract tokens from account_manager.db
+
+After a registration task completes with `status: succeeded`, extract tokens immediately
+(session cookies expire within 1-3 hours):
+
+```python
+import sqlite3, json
+
+db = sqlite3.connect("C:/Users/User/Desktop/GPT-AUTOREG/aBaiAutoplus/account_manager.db")
+db.row_factory = sqlite3.Row
+
+# 1. Find valid accounts from the latest task
+task = db.execute("SELECT result_json FROM tasks WHERE status='succeeded' ORDER BY finished_at DESC LIMIT 1").fetchone()
+result = json.loads(task["result_json"])
+account_ids = result["data"]["account_ids"]  # e.g. [33, 34, 35, ...]
+
+# 2. Get emails
+emails = {}
+for aid in account_ids:
+    a = db.execute("SELECT email FROM accounts WHERE id = ?", (aid,)).fetchone()
+    emails[aid] = a["email"]
+
+# 3. Get full tokens (cookies + access_token + session_token + legacy_token)
+new_accounts = []
+for aid in account_ids:
+    creds = db.execute("""
+        SELECT key, value FROM account_credentials
+        WHERE account_id = ? AND credential_type IN ('token','cookie')
+    """, (aid,)).fetchall()
+    tokens = {c["key"]: c["value"] for c in creds}
+    new_accounts.append({"email": emails[aid], "tokens": tokens})
+
+# 4. Save to accounts_tokens.json
+with open("C:/Users/User/Desktop/GPT-AUTOREG/accounts_tokens.json", "w") as f:
+    json.dump({"accounts": new_accounts}, f, indent=2)
+
+db.close()
+```
+
+## Token structure
+
+Each account in `account_credentials` table has these credential types:
+
+| credential_type | key | Description |
+|---|---|---|
+| token | `session_token` | ~3700-char JWT, used as `__Secure-next-auth.session-token` cookie |
+| token | `access_token` | ~1700-char JWT, ChatGPT web app access token |
+| token | `legacy_token` | Same as access_token |
+| cookie | `cookies` | Python dict string with 27 cookies (CF, oai-*, auth-*, etc.) |
+| identifier | `account_id` | UUID for workspace/account |
+
+## Camoufox cookie injection
+
+Cookies set via `context.add_cookies()` — format requirements:
+
+- `domain`: "chatgpt.com" (NO leading dot)
+- `secure`: True
+- `sameSite`: "Lax"
+- Do NOT set `httpOnly` field (causes "Invalid cookie fields" error)
+- Truncate cookie values >4000 chars (Playwright limit)
+
+```python
+import ast
+cookies_dict = ast.literal_eval(account["tokens"]["cookies"])
+cookies_list = []
+for name, value in cookies_dict.items():
+    if not isinstance(value, str): continue
+    clean = value[:4000] if len(value) > 4000 else value
+    cookies_list.append({
+        "name": name, "value": clean,
+        "domain": "chatgpt.com", "path": "/",
+        "secure": True, "sameSite": "Lax",
+    })
+await page.context.add_cookies(cookies_list)
+```
+
+## API endpoints tested
+
+| Endpoint | Result | Notes |
+|---|---|---|
+| `GET /backend-api/me` | HTTP 200 | Works even on fresh accounts |
+| `POST /backend-api/conversation` | HTTP 403 | "Unusual activity" on accounts <24h old |
+| `POST /backend-api/conversation` (text) | HTTP 403 | Same block for text messages |
+| `POST api.openai.com/v1/images/generations` | HTTP 401 | `token_invalidated` — access_token not valid for official API |
+
+## Transport comparison
+
+| Transport | Cloudflare | /me | /conversation |
+|---|---|---|---|
+| httpx (Python) | Blocked (403 HTML) | ❌ | ❌ |
+| Playwright Chromium | Blocked ("Just a moment...") | ❌ | ❌ |
+| Camoufox (Firefox) | Passes | ✅ 200 | ❌ 403 (account age) |
+| curl_cffi (aBaiAutoplus) | Passes (firefox144 impersonation) | ✅ | Used for registration only |
+
+## Registration task command
+
+```bash
+curl -s -X POST http://localhost:8000/api/tasks/register \
+  -H "Content-Type: application/json" \
+  -d '{"count":10,"concurrency":2,"executor_type":"protocol","captcha_solver":"auto","extra":{"mail_provider":"imap_pool","identity_provider":"mailbox"}}'
+```
+
+Typical yield: 8/10 success with t-online.de pool. Failures are `account_deactivated` or `invalid_auth_step`.
--- a/skills/chatgpt-autoreg/references/windows-file-consolidation.md
+++ b/skills/chatgpt-autoreg/references/windows-file-consolidation.md
@@ -0,0 +1,56 @@
+# File Consolidation — Windows Quirks
+
+## Copy large projects (skip .venv, node_modules)
+
+Python shutil approach — handles Windows paths correctly:
+
+```python
+import shutil, os
+
+src = r"C:\Users\User\Desktop\_PROJECTS\oai-register\aBaiAutoplus"
+dst = r"C:\Users\User\Desktop\GPT-AUTOREG-FULL\aBaiAutoplus"
+
+SKIP_ROOTS = {'.venv', '__pycache__', 'node_modules', '.git', 'frontend', 'electron'}
+
+os.makedirs(dst, exist_ok=True)
+
+for item in os.listdir(src):
+    if item in SKIP_ROOTS:
+        continue
+    s = os.path.join(src, item)
+    d = os.path.join(dst, item)
+    if os.path.isfile(s):
+        shutil.copy2(s, d)
+    elif os.path.isdir(s):
+        def local_ignore(p, names):
+            return {n for n in names if n in ('__pycache__', 'node_modules', '.venv') or n.endswith('.pyc')}
+        shutil.copytree(s, d, ignore=local_ignore)
+```
+
+## Remove locked node_modules (Windows)
+
+When `rm -rf` fails with "Device or resource busy":
+
+```bash
+# Git Bash rm doesn't work on locked files — use cmd
+cmd //c "rmdir /s /q C:\Users\User\Desktop\GPT-AUTOREG-FULL\aBaiAutoplus\frontend"
+```
+
+The double-slash `//c` is required in MSYS/Git Bash to pass `/c` to cmd.exe.
+
+## Archive creation (Windows)
+
+Only `tar` + `gzip` available via Git Bash. `zip` and `7z` are NOT installed.
+
+```bash
+cd "/c/Users/User/Desktop" && tar czf "GPT-AUTOREG-FULL.tar.gz" "GPT-AUTOREG-FULL/"
+```
+
+Verify: `tar tzf archive.tar.gz | wc -l` (count files), `stat -c%s archive.tar.gz` (size).
+
+## Exclude patterns for tar
+
+`tar` does not support `--exclude` reliably in Git Bash. Instead:
+- Pre-clean the source directory (remove .venv, node_modules, __pycache__)
+- Then tar the clean directory
+- Or use `--exclude='.venv' --exclude='__pycache__'` but test first