autoreg-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:16:32 +03:00
commit f58eafeb48
565 changed files with 60064 additions and 0 deletions
--- a/skills/domain-management/SKILL.md
+++ b/skills/domain-management/SKILL.md
@@ -0,0 +1,114 @@
+---
+name: domain-management
+description: Manage DNS records for free subdomains — registration, A/AAAA/CNAME/MX/TXT records, health checks, DNS verification. Covers loc.cc (NodeLoc/domain.nodeloc.com) and similar free subdomain providers.
+---
+
+# Domain Management — DNS Records
+
+Manage DNS records for free subdomains. Covers `loc.cc` (NodeLoc `domain.nodeloc.com`) and similar providers.
+
+## Triggers
+
+- "зарегистрируй домен", "добавь DNS", "A-запись", "пропиши домен"
+- "домен не резолвится", "DNS не работает", "проверь DNS"
+- User gives domain registrar credentials and asks to fix DNS
+
+## Workflow
+
+### 1. Verify current DNS state FIRST
+
+```bash
+# Check authoritative nameservers
+nslookup <domain> ns1.<nsprovider>.com
+nslookup <domain> ns2.<nsprovider>.com
+
+# Check public resolvers
+nslookup <domain> 8.8.8.8
+nslookup <domain> 1.1.1.1
+```
+
+Do NOT claim DNS "works" until at least one public resolver returns the IP. Google DNS (8.8.8.8) is slow to propagate; Cloudflare (1.1.1.1) is faster.
+
+### 2. Get the external IP
+
+```bash
+curl -s ifconfig.me
+```
+
+### 3. NodeLoc (domain.nodeloc.com) — API + Browser
+
+#### Login API
+
+```bash
+curl -s "https://domain.nodeloc.com/api/auth/login" \
+  -H "Content-Type: application/json" \
+  -d '{"email":"<email>","password":"<password>"}'
+# Returns: {"token":"<jwt>","user":{"id":...,"username":"..."}}
+```
+
+#### List domains
+
+```bash
+curl -s "https://domain.nodeloc.com/api/domains" \
+  -H "Authorization: Bearer <token>"
+```
+
+#### Add DNS records — BROWSER REQUIRED
+
+No REST API for DNS records. Must use browser:
+
+1. Login via `browser_navigate` → `browser_type` → `browser_click`
+2. Navigate to domain → click "DNS" button
+3. Click "添加 DNS 记录" (Add DNS Record)
+4. Fill form: Name (`@`), Type (`A`), Value (`<ip>`), TTL (`3600`)
+5. **CRITICAL**: `browser_click` on the "创建" (Create) button may NOT work. Use `browser_console` instead:
+
+```js
+var btns = document.querySelectorAll('button');
+for (var i = 0; i < btns.length; i++) {
+  if (btns[i].textContent.trim() === '创建') { btns[i].click(); break; }
+}
+```
+
+6. Verify record appears in table with "已同步" (Synced) status
+7. Check authoritative NS immediately: `nslookup <domain> ns1.nodelook.com`
+
+#### Pitfalls
+
+- **Token truncation**: `terminal` and `read_file` truncate JWT tokens with `...`. Use `execute_code` + `subprocess.run()` to get the full token. See `hermes-tool-workarounds` for pattern.
+- **Domain suspended**: If domain shows "suspended" with health check failure, adding a valid A record + port forwarding fixes it. Health check needs the server to actually respond on the target IP.
+- **MX records "待处理"**: The provider's DNS sync sometimes shows MX records as pending. This is a provider-side issue; the A record syncs fine.
+- **Google DNS slow**: Google DNS (8.8.8.8) can take hours to propagate. Always verify with authoritative NS first, then Cloudflare (1.1.1.1).
+
+### 4. Verify external accessibility
+
+After DNS resolves, verify the port is actually reachable:
+
+```bash
+curl -s --connect-timeout 5 http://<ip>:<port>/health
+```
+
+Timeout = port not forwarded. Check:
+- Windows firewall: `netsh advfirewall firewall show rule name=all dir=in | grep <port>`
+- Router: `curl -s --connect-timeout 3 http://<router-ip>` to identify router type (ASUS = `/Main_Login.asp`)
+
+### 5. Port forwarding checklist
+
+If external access times out:
+1. Windows firewall rule exists for the port? → `netsh advfirewall firewall show rule`
+2. Router port forwarding configured? → Router admin panel
+3. ISP blocks the port? → Try port 443 or use Cloudflare Tunnel
+
+## Verification
+
+```bash
+# Authoritative DNS
+nslookup <domain> <ns1>  # Must return IP
+
+# Public DNS (at least one)
+nslookup <domain> 1.1.1.1  # Cloudflare — fast
+nslookup <domain> 8.8.8.8  # Google — slow
+
+# External access
+curl -s http://<domain>:<port>/health  # Must return 200
+```
--- a/skills/domain-management/references/nodeloc.md
+++ b/skills/domain-management/references/nodeloc.md
@@ -0,0 +1,106 @@
+# NodeLoc (domain.nodeloc.com) Reference
+
+## Provider Details
+
+- **Service**: Free subdomains by NodeLoc community
+- **URL**: https://domain.nodeloc.com
+- **Root domains**: loc.cc, and others
+- **Nameservers**: ns1.nodelook.com, ns2.nodelook.com (IP: [REDACTED-IP])
+- **DNS backend**: PowerDNS (has "Sync from PowerDNS" button)
+- **Health checks**: Automatic — domain gets suspended if health check fails for extended period
+
+## API Endpoints
+
+| Method | Endpoint | Auth | Purpose |
+|--------|----------|------|---------|
+| POST | `/api/auth/login` | None | Login, returns JWT token |
+| GET | `/api/domains` | Bearer | List user's domains |
+| GET | `/api/domains` + query | Bearer | Domain details |
+
+DNS record management has NO REST API. Must use browser UI.
+
+## Login Response Shape
+
+```json
+{
+  "message": "success.login",
+  "token": "[REDACTED-JWT]...<full JWT>",
+  "user": {
+    "id": 3375,
+    "username": "[REDACTED-NAME]",
+    "email": "user@example.com",
+    "email_verified": false,
+    "is_admin": false,
+    "user_level": "normal",
+    "domain_quota": 2,
+    "invite_code": "...",
+    "total_invites": 0,
+    "successful_invites": 0,
+    "status": "active",
+    "created_at": "2026-07-16T10:39:49.944849Z",
+    "last_login_at": "..."
+  }
+}
+```
+
+JWT is HS256. Payload: `{"user_id":...,"username":"...","email":"...","is_admin":false,"exp":...,"iat":...}`
+
+## Domain Response Shape
+
+```json
+{
+  "domains": [{
+    "id": 4901,
+    "full_domain": "[REDACTED-NAME].loc.cc",
+    "root_domain": {"id": 1, "domain": "loc.cc", ...},
+    "nameservers": "[\"ns1.nodelook.com\",\"ns2.nodelook.com\"]",
+    "registered_at": "2026-07-16T10:52:26.925642Z",
+    "expires_at": "2036-07-16T10:52:26.925642Z",
+    "dns_synced": false,
+    "auto_renew": false,
+    "first_failed_at": "2026-07-16T16:03:45.845029Z"
+  }]
+}
+```
+
+## DNS Record States
+
+| Status | Chinese | Meaning |
+|--------|---------|---------|
+| `已同步` | Synced | Record active and propagated |
+| `待处理` | Pending | Record submitted but not yet synced to PowerDNS |
+
+## Domain Statuses
+
+| Status | Meaning |
+|--------|---------|
+| `suspended` | Health check failed repeatedly. Domain will be auto-deleted in ~19 days if not fixed. |
+| `active` | Normal operation |
+
+## Health Check Behavior
+
+- Runs periodically against the domain
+- Checks if the domain resolves AND responds
+- After repeated failures: domain gets suspended
+- After suspension: ~19 days until auto-deletion
+- Adding a valid A record + making the server respond fixes the health check
+
+## Browser UI Navigation
+
+1. Login → Dashboard (`/`)
+2. "我的域名" → Domain list
+3. Click domain → Domain detail (status, health, DNS button)
+4. "DNS" button → DNS management page with record table
+5. "添加 DNS 记录" → Add record dialog
+
+## DNS Record Form
+
+- Name: `@` (root) or subdomain name
+- Type: A, AAAA, CNAME, ALIAS, MX, TXT, NS, SRV, CAA
+- Value: IP or hostname
+- TTL: seconds (default 3600)
+- Button: "创建" (Create) — may require JS click workaround
+
+## Expiration
+
+Domains are free and expire in 20 years (2036 for domains registered in 2026). Auto-renewal is off by default.