autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/conol-automation/references/recaptcha-cdp.md

@@ -0,0 +1,82 @@
+# Native reCAPTCHA v3 via Chrome CDP
+
+Conol.ai uses reCAPTCHA v3 (site key: `6Lc3wmAtAAAAAB9YBPXQtT9uGGsH3ul6LQBc5AUu`).
+The captcha is **domain-locked** — external solvers (2Captcha, AntiCaptcha, CapSolver) do NOT work.
+
+## Solution: Chrome CDP Native Execution
+
+The browser already has the reCAPTCHA script loaded. Execute `grecaptcha.execute()` directly in the page context.
+
+### Generic reCAPTCHA executor (playwright)
+
+```python
+async def recaptcha(page, action: str) -> str:
+    """Execute reCAPTCHA v3 and return token."""
+    return await page.evaluate(
+        """async ({siteKey, action}) => {
+            // Ensure grecaptcha is loaded
+            if (!window.grecaptcha) {
+                await new Promise((resolve, reject) => {
+                    const old = document.getElementById('eni-recaptcha');
+                    if (old) old.remove();
+                    const script = document.createElement('script');
+                    script.id = 'eni-recaptcha';
+                    script.src = `https://www.recaptcha.net/recaptcha/api.js?render=${encodeURIComponent(siteKey)}`;
+                    script.onload = resolve;
+                    script.onerror = () => reject(new Error('recaptcha load failed'));
+                    document.head.appendChild(script);
+                });
+            }
+            await new Promise((resolve) => window.grecaptcha.ready(resolve));
+            return await window.grecaptcha.execute(siteKey, {action});
+        }""",
+        {"siteKey": SITE_KEY, "action": action},
+    )
+```
+
+### Usage in registration flow
+
+```python
+# Step 1: Sign Up
+signup_token = await recaptcha(page, "sign_up")
+r = await json_fetch(page, "/api/invites/register", method="POST", 
+    captcha=signup_token, body={...})
+
+# Step 2: Send Verification Email
+verify_token = await recaptcha(page, "send_verification_email")
+r = await json_fetch(page, "/api/auth/send-verification-email", method="POST",
+    captcha=verify_token, body={...})
+
+# Step 3: Sign In
+signin_token = await recaptcha(page, "sign_in")
+r = await json_fetch(page, "/api/auth/sign-in/email", method="POST",
+    captcha=signin_token, body={...})
+```
+
+### JSON fetch helper (via page.evaluate)
+
+```python
+async def json_fetch(page, path: str, *, method="GET", body=None, captcha=None):
+    """Fetch API endpoint from page context (uses browser's cookies)."""
+    return await page.evaluate(
+        """async ({path, method, body, captcha}) => {
+            const headers = {Accept: 'application/json'};
+            if (body !== null) headers['Content-Type'] = 'application/json';
+            if (captcha) headers['x-captcha-response'] = captcha;
+            const r = await fetch(path, {method, headers, credentials: 'include',
+                body: body === null ? undefined : JSON.stringify(body)});
+            const text = await r.text();
+            let data = null;
+            try { data = JSON.parse(text); } catch (_) {}
+            return {status: r.status, url: r.url, text: text.slice(0, 2000), data};
+        }""",
+        {"path": path, "method": method, "body": body, "captcha": captcha},
+    )
+```
+
+## Key Points
+
+- Captcha token is sent via `x-captcha-response` header (NOT in body)
+- Use `page.evaluate` to call browser APIs within the origin context
+- Always clear cookies/storage between registrations to avoid session conflicts
+- Increasing delays between accounts (8s + 3s per index) reduces HTTP 429 errors