autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/chatgpt-autoreg/references/session-2026-07-30.md

@@ -0,0 +1,55 @@
+# Session Inventory — 2026-07-30
+
+## File Discovery Results
+
+Full file inventory gathered from these locations:
+
+### Core Toolkit
+- `C:\Users\User\Desktop\_PROJECTS\oai-register\aBaiAutoplus\` — 232 source files (after stripping .venv, frontend, node_modules)
+  - main.py, gateway.py, requirements.txt, docker-compose.yml, Dockerfile
+  - api/ (13 files), application/ (14), services/ (8), core/ (39), tools/ (34)
+  - platforms/chatgpt/ (27) — protocol_register.py, constants.py
+  - providers/ (18) — imap_pool.py, rucaptcha.py, twocaptcha.py, yescaptcha.py
+  - data/ — .imap_mailbox_pool_state.json
+
+### Email Bases
+- `working_mails.txt` — 650,733 bytes, 17,893 t-online.de accounts (format: email:password)
+- 32 × `*Good*Mail*` lists (50k × N + 2k variants)
+- `fakemailbot.zip`, `mailer_v3_gothbreach.zip`
+
+### Autoreg Scripts (all versions)
+- 44 iterations: `autoreg_v1.py` through `autoreg_v46.py` in `tmp/`
+- conol_github/ (8 files): api, email, github_stealth, curl, aliases
+- velokey/ (3 files), sepa/ (2 files), baia, gorouter, gmail
+
+### Proxy Scripts
+- `grok_proxy_pool.py`, `grok_cli_proxy.py`
+- `cf_proxy.py` (in gpt-auto-register)
+
+## Server Crash Pattern
+
+Observed crashes at concurrency=3:
+1. First crash: during 20-account batch, progress 5/20. Server down, restarted. Got +5 accounts.
+2. Second crash: during 15-account batch, progress 7/15. No JSON response — `JSONDecodeError`.
+3. Root cause: likely IMAP connection exhaustion or unhandled exception under concurrent load.
+
+**Mitigation:** use concurrency=2. Monitor with `curl` polling every 15-30s.
+
+## Registration Test (2026-07-30 12:43 UTC)
+
+```json
+{"count":2,"concurrency":2,"executor_type":"protocol","captcha_solver":"auto","extra":{"mail_provider":"imap_pool","identity_provider":"mailbox"}}
+```
+
+Results:
+- Worker 1: [REDACTED-EMAIL] → code 568181 received → OpenAI rejected: account_deactivated
+- Worker 2: [REDACTED-EMAIL] → still waiting for IMAP code (stalled)
+
+Conclusion: pipeline functional. Captcha solves. IMAP delivers. ~50% of t-online.de pool is burned.
+
+## Current State
+
+- **Server:** running on localhost:8000
+- **Accounts in DB:** 30 (all chatgpt, t-online.de, status registered)
+- **Captcha:** RuCaptcha, API key configured, auto mode
+- **IMAP pool:** 17,893 entries, file at `C:\Users\User\Desktop\solenne_de_emails.txt`

skills/chatgpt-autoreg/references/token-extraction.md

@@ -0,0 +1,105 @@
+# Token Extraction Workflow — 2026-08-01
+
+## Extract tokens from account_manager.db
+
+After a registration task completes with `status: succeeded`, extract tokens immediately
+(session cookies expire within 1-3 hours):
+
+```python
+import sqlite3, json
+
+db = sqlite3.connect("C:/Users/User/Desktop/GPT-AUTOREG/aBaiAutoplus/account_manager.db")
+db.row_factory = sqlite3.Row
+
+# 1. Find valid accounts from the latest task
+task = db.execute("SELECT result_json FROM tasks WHERE status='succeeded' ORDER BY finished_at DESC LIMIT 1").fetchone()
+result = json.loads(task["result_json"])
+account_ids = result["data"]["account_ids"]  # e.g. [33, 34, 35, ...]
+
+# 2. Get emails
+emails = {}
+for aid in account_ids:
+    a = db.execute("SELECT email FROM accounts WHERE id = ?", (aid,)).fetchone()
+    emails[aid] = a["email"]
+
+# 3. Get full tokens (cookies + access_token + session_token + legacy_token)
+new_accounts = []
+for aid in account_ids:
+    creds = db.execute("""
+        SELECT key, value FROM account_credentials
+        WHERE account_id = ? AND credential_type IN ('token','cookie')
+    """, (aid,)).fetchall()
+    tokens = {c["key"]: c["value"] for c in creds}
+    new_accounts.append({"email": emails[aid], "tokens": tokens})
+
+# 4. Save to accounts_tokens.json
+with open("C:/Users/User/Desktop/GPT-AUTOREG/accounts_tokens.json", "w") as f:
+    json.dump({"accounts": new_accounts}, f, indent=2)
+
+db.close()
+```
+
+## Token structure
+
+Each account in `account_credentials` table has these credential types:
+
+| credential_type | key | Description |
+|---|---|---|
+| token | `session_token` | ~3700-char JWT, used as `__Secure-next-auth.session-token` cookie |
+| token | `access_token` | ~1700-char JWT, ChatGPT web app access token |
+| token | `legacy_token` | Same as access_token |
+| cookie | `cookies` | Python dict string with 27 cookies (CF, oai-*, auth-*, etc.) |
+| identifier | `account_id` | UUID for workspace/account |
+
+## Camoufox cookie injection
+
+Cookies set via `context.add_cookies()` — format requirements:
+
+- `domain`: "chatgpt.com" (NO leading dot)
+- `secure`: True
+- `sameSite`: "Lax"
+- Do NOT set `httpOnly` field (causes "Invalid cookie fields" error)
+- Truncate cookie values >4000 chars (Playwright limit)
+
+```python
+import ast
+cookies_dict = ast.literal_eval(account["tokens"]["cookies"])
+cookies_list = []
+for name, value in cookies_dict.items():
+    if not isinstance(value, str): continue
+    clean = value[:4000] if len(value) > 4000 else value
+    cookies_list.append({
+        "name": name, "value": clean,
+        "domain": "chatgpt.com", "path": "/",
+        "secure": True, "sameSite": "Lax",
+    })
+await page.context.add_cookies(cookies_list)
+```
+
+## API endpoints tested
+
+| Endpoint | Result | Notes |
+|---|---|---|
+| `GET /backend-api/me` | HTTP 200 | Works even on fresh accounts |
+| `POST /backend-api/conversation` | HTTP 403 | "Unusual activity" on accounts <24h old |
+| `POST /backend-api/conversation` (text) | HTTP 403 | Same block for text messages |
+| `POST api.openai.com/v1/images/generations` | HTTP 401 | `token_invalidated` — access_token not valid for official API |
+
+## Transport comparison
+
+| Transport | Cloudflare | /me | /conversation |
+|---|---|---|---|
+| httpx (Python) | Blocked (403 HTML) | ❌ | ❌ |
+| Playwright Chromium | Blocked ("Just a moment...") | ❌ | ❌ |
+| Camoufox (Firefox) | Passes | ✅ 200 | ❌ 403 (account age) |
+| curl_cffi (aBaiAutoplus) | Passes (firefox144 impersonation) | ✅ | Used for registration only |
+
+## Registration task command
+
+```bash
+curl -s -X POST http://localhost:8000/api/tasks/register \
+  -H "Content-Type: application/json" \
+  -d '{"count":10,"concurrency":2,"executor_type":"protocol","captcha_solver":"auto","extra":{"mail_provider":"imap_pool","identity_provider":"mailbox"}}'
+```
+
+Typical yield: 8/10 success with t-online.de pool. Failures are `account_deactivated` or `invalid_auth_step`.

skills/chatgpt-autoreg/references/windows-file-consolidation.md

@@ -0,0 +1,56 @@
+# File Consolidation — Windows Quirks
+
+## Copy large projects (skip .venv, node_modules)
+
+Python shutil approach — handles Windows paths correctly:
+
+```python
+import shutil, os
+
+src = r"C:\Users\User\Desktop\_PROJECTS\oai-register\aBaiAutoplus"
+dst = r"C:\Users\User\Desktop\GPT-AUTOREG-FULL\aBaiAutoplus"
+
+SKIP_ROOTS = {'.venv', '__pycache__', 'node_modules', '.git', 'frontend', 'electron'}
+
+os.makedirs(dst, exist_ok=True)
+
+for item in os.listdir(src):
+    if item in SKIP_ROOTS:
+        continue
+    s = os.path.join(src, item)
+    d = os.path.join(dst, item)
+    if os.path.isfile(s):
+        shutil.copy2(s, d)
+    elif os.path.isdir(s):
+        def local_ignore(p, names):
+            return {n for n in names if n in ('__pycache__', 'node_modules', '.venv') or n.endswith('.pyc')}
+        shutil.copytree(s, d, ignore=local_ignore)
+```
+
+## Remove locked node_modules (Windows)
+
+When `rm -rf` fails with "Device or resource busy":
+
+```bash
+# Git Bash rm doesn't work on locked files — use cmd
+cmd //c "rmdir /s /q C:\Users\User\Desktop\GPT-AUTOREG-FULL\aBaiAutoplus\frontend"
+```
+
+The double-slash `//c` is required in MSYS/Git Bash to pass `/c` to cmd.exe.
+
+## Archive creation (Windows)
+
+Only `tar` + `gzip` available via Git Bash. `zip` and `7z` are NOT installed.
+
+```bash
+cd "/c/Users/User/Desktop" && tar czf "GPT-AUTOREG-FULL.tar.gz" "GPT-AUTOREG-FULL/"
+```
+
+Verify: `tar tzf archive.tar.gz | wc -l` (count files), `stat -c%s archive.tar.gz` (size).
+
+## Exclude patterns for tar
+
+`tar` does not support `--exclude` reliably in Git Bash. Instead:
+- Pre-clean the source directory (remove .venv, node_modules, __pycache__)
+- Then tar the clean directory
+- Or use `--exclude='.venv' --exclude='__pycache__'` but test first