autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/conol-autoreg/references/fastapi-body-pitfall.md

@@ -0,0 +1,47 @@
+# FastAPI Request Body Pitfall
+
+## Symptom
+POST/PUT endpoints return `null` instead of parsed JSON, or FastAPI returns 400/422 with no clear error.
+
+## Root Cause
+When you write `async def endpoint(request: dict):`, FastAPI treats `request` as a **query parameter** named "request", NOT as a JSON body. The endpoint will:
+- Accept requests without error
+- Receive `request = None` (no query param named "request")
+- Return `null` when you try to use it
+
+## Fix
+```python
+from fastapi import FastAPI, HTTPException, Request
+
+# WRONG — request is treated as a query parameter, always None
+@app.post("/api/endpoint")
+async def bad(request: dict):
+    return request  # returns null
+
+# RIGHT — use FastAPI Request + await request.json()
+@app.post("/api/endpoint")
+async def good(request: Request):
+    try:
+        body = await request.json()
+    except Exception:
+        raise HTTPException(400, "Invalid JSON body")
+    return body  # returns the actual JSON
+```
+
+## Alternative: Pydantic model
+```python
+from pydantic import BaseModel
+
+class Item(BaseModel):
+    email: str
+    password: str | None = None
+
+@app.post("/api/endpoint")
+async def good(item: Item):
+    return {"email": item.email, "password": item.password}
+```
+
+## Occurrence
+Hit this bug in `dashboard_server.py` `queue_add` endpoint.
+The `request: dict` signature silently returned `null` for every POST.
+Fixed by importing `Request` and using `await request.json()`.

skills/conol-autoreg/references/recaptcha-v3-pitfall.md

@@ -0,0 +1,117 @@
+# reCAPTCHA v3 Anti-Pattern — Full Investigation Log
+
+## The Problem
+Conol.ai registration returns `CAPTCHA_VERIFICATION_FAILED` for ALL external captcha tokens.
+
+## Endpoint
+- `POST https://conol.ai/api/invites/register`
+- Requires `x-captcha-response` header
+- Without captcha: HTTP 400 `CAPTCHA_MISSING`
+- With invalid captcha: HTTP 403 `CAPTCHA_VERIFICATION_FAILED`
+- With valid on-page captcha: HTTP 200 ✅
+
+## All Captcha Services Tested (ALL FAILED)
+
+| Service | Key | Balance | Result |
+|---------|-----|---------|--------|
+| anti-captcha.com | `CAPTCHA_KEYaa...` | $44.26 | Token solved ✅ → Registration 403 ❌ |
+| 2captcha.com (new API) | `bd9c67bafe...` | $1034 | `ERROR_KEY_DOES_NOT_EXIST` |
+| 2captcha.com (old in.php) | `bd9c67bafe...` | $1034 | `ERROR_KEY_DOES_NOT_EXIST` |
+| rucaptcha.com | `bd9c67bafe...` | $1034 | `ERROR_KEY_DOES_NOT_EXIST` |
+| capmonster.cloud | `bd9c67bafe...` | $1034 | `ERROR_KEY_DOES_NOT_EXIST` |
+| capsolver.com | `CAP-66B...` | $23.39 | `ERROR_ZERO_BALANCE` (balance display was stale) |
+
+**Key insight**: Even when anti-captcha.com successfully solved the recaptcha (task ID 369678282, valid token returned), conol.ai still rejected it with `CAPTCHA_VERIFICATION_FAILED`. This proves Google's server-side verification cross-checks the token origin IP with the request IP.
+
+## Working Pattern (100% Success Rate)
+
+```python
+from playwright.async_api import async_playwright
+
+async def register_via_cdp():
+    async with async_playwright() as p:
+        browser = await p.chromium.connect_over_cdp("http://127.0.0.1:9228")
+        context = browser.contexts[0]
+        page = await context.new_page()
+        
+        # 1. Navigate to signup page
+        await page.goto("https://conol.ai/sign-up", wait_until="domcontentloaded")
+        
+        # 2. Inject and execute recaptcha ON THIS PAGE
+        result = await page.evaluate("""
+            async () => {
+                // Load recaptcha
+                await new Promise((resolve, reject) => {
+                    const s = document.createElement('script');
+                    s.src = 'https://www.recaptcha.net/recaptcha/api.js?render=SITE_KEY';
+                    s.onload = resolve;
+                    s.onerror = reject;
+                    document.head.appendChild(s);
+                });
+                await new Promise(r => grecaptcha.ready(r));
+                
+                // Execute recaptcha ON THIS PAGE
+                const token = await grecaptcha.execute('SITE_KEY', {action: 'sign_up'});
+                
+                // IMMEDIATELY use token from same page context
+                const r = await fetch('/api/invites/register', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'x-captcha-response': token,
+                    },
+                    credentials: 'include',
+                    body: JSON.stringify({
+                        token: null,
+                        email: EMAIL,
+                        password: [REDACTED],
+                        name: NAME,
+                        referrer_share_id: null
+                    })
+                });
+                return {status: r.status, body: await r.text()};
+            }
+        """)
+        # Returns HTTP 200 with user object on success
+```
+
+## Why External Services Fail
+
+Google reCAPTCHA v3 server-side verification:
+1. Receives the token from conol.ai's backend
+2. Calls Google's `/recaptcha/api/siteverify`
+3. Google checks: token origin IP, browser fingerprint, action, site key
+4. If token IP ≠ request IP → low score → rejected
+
+External captcha services generate tokens from their own servers (different IPs, different browser fingerprints). Google marks these as suspicious.
+
+## Site Key
+```
+6Lc3wmAtAAAAAB9YBPXQtT9uGGsH3ul6LQBc5AUu
+```
+Visible in conol.ai's Next.js JS bundle. Used for reCAPTCHA v3 invisible.
+
+## Anti-Captcha API Reference (for other use cases)
+
+Anti-captcha.com works fine for reCAPTCHA on sites that DON'T cross-check IPs:
+```python
+# Create task
+POST https://api.anti-captcha.com/createTask
+{
+    "clientKey": "KEY",
+    "task": {
+        "type": "RecaptchaV3TaskProxyless",
+        "websiteURL": "https://conol.ai/sign-up",
+        "websiteKey": "SITE_KEY",
+        "minScore": 0.3,
+        "pageAction": "sign_up"
+    }
+}
+
+# Poll result
+POST https://api.anti-captcha.com/getTaskResult
+{
+    "clientKey": "KEY",
+    "taskId": TASK_ID
+}
+```