autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/grok-autoreg/references/bpproxy-pool.md

@@ -0,0 +1,42 @@
+# bpproxy Residential Proxy Pool
+
+## Location
+`C:/Users/User/tmp/bpproxy_hardsession_pool.txt`
+
+## Format
+```
+# Account: <account_id>
+http://bpuser-<user>:<password>_hardsession-<session>@residential-x.bpproxy.at:1000
+http://bpuser-<user>:<password>_hardsession-<session>@datacenter-x.bpproxy.at:2000
+```
+
+## Usage
+- **Residential proxies** (port 1000): Use these for Cloudflare-bypass. They rotate IPs and look like real residential connections.
+- **Datacenter proxies** (port 2000): Do NOT use for Cloudflare-protected sites. They get blocked.
+
+## Filtering
+```python
+def load_proxies():
+    proxies = []
+    with open("C:/Users/User/tmp/bpproxy_hardsession_pool.txt", "r") as f:
+        for line in f:
+            line = line.strip()
+            if line.startswith("http://") and "residential" in line:
+                proxies.append(line)
+    return proxies
+```
+
+## Playwright Usage
+```python
+browser = await p.chromium.launch(
+    headless=True,
+    proxy={"server": proxy_url},
+    args=["--no-sandbox"]
+)
+```
+
+## ZTE Proxy (DO NOT USE for Playwright)
+- The ZTE HTTP forward proxy at `127.0.0.1:8888` (`C:/Users/User/Desktop/gh-autoreg/zte_proxy.py`) routes through ZTE MF935 USB modem
+- It works for HTTP requests (curl) but fails for Playwright's CONNECT tunnels
+- Playwright reports `net::ERR_PROXY_CONNECTION_FAILED`
+- Use bpproxy instead for Playwright-based automation

skills/grok-autoreg/references/cf-clearance-bypass.md

@@ -0,0 +1,72 @@
+# cf_clearance Cookie — Cloudflare WAF Bypass for x.ai
+
+## Discovery (v20, 2026-08-13)
+
+When using `channel="chrome"` (real Chrome via Playwright), the Cloudflare Turnstile challenge on `accounts.x.ai/sign-up` auto-solves WITHOUT 2captcha. The `cf_clearance` cookie is set automatically after page load.
+
+**Cookie details:**
+```
+Name: cf_clearance
+Domain: .x.ai
+Value: MeLLMwuSWSia66h6YiouO4tSvXyrcfXDKMrqS4ifanM-178662...
+```
+
+## How to Extract
+
+```python
+# After page load
+cookies = await page.context.cookies()
+cf_clearance = ""
+for c in cookies:
+    if c['name'] == 'cf_clearance':
+        cf_clearance = c['value']
+        break
+```
+
+## Using for API Requests
+
+```python
+import requests
+
+cookies = {"cf_clearance": cf_clearance}
+headers = {
+    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
+    "Accept": "application/json",
+    "Content-Type": "application/json",
+    "Origin": "https://accounts.x.ai",
+    "Referer": "https://accounts.x.ai/sign-up",
+}
+
+resp = requests.post(
+    "https://accounts.x.ai/api/v2/authn/verification_code",
+    json={"email": "user@example.com"},
+    headers=headers,
+    cookies=cookies
+)
+```
+
+## Limitation
+
+Even with `cf_clearance`, ALL x.ai API endpoints return HTML (Next.js page) instead of JSON. The API is not directly accessible behind the Next.js frontend — the frontend catches all API routes and serves the React page.
+
+**Tested endpoints (all return HTML with 200):**
+- `POST /api/v2/authn/verification_code`
+- `POST /api/v2/users/human`
+- `POST /api/v2/users`
+- `POST /api/v2/register`
+- `POST /api/v2/authn`
+- `POST /api/signup`
+- `POST /api/register`
+- `POST /api/v2/signup`
+- `POST /zitadel/v2/users/human`
+- `POST /api/v2beta/users/human`
+
+**Without cf_clearance**, these endpoints return 403 (Cloudflare WAF).
+
+## The Turnstile Widget Distinction
+
+There are TWO Turnstile levels on x.ai:
+1. **Cloudflare WAF Turnstile** — auto-solved by real Chrome, sets `cf_clearance` cookie. This bypasses the WAF but doesn't help with the React form.
+2. **React form Turnstile** — the `cf-turnstile-response` widget on the profile form. This needs 2captcha. The token is injected into the hidden input, but the React event handler may not check it.
+
+The `cf_clearance` solves #1 (WAF bypass) but #2 (form submission) remains unsolved.

skills/grok-autoreg/references/curl-cffi-grpc-web.md

@@ -0,0 +1,74 @@
+# GrokRegister: curl_cffi + gRPC-web Registration
+
+**Location**: `C:\Users\User\tmp\grok_register\grok-register\grok.py`
+
+## Architecture
+
+The registration uses **curl_cffi** (TLS fingerprint emulation, not a real browser) and direct **gRPC-web** API calls to x.ai's Next.js backend.
+
+## Key Components
+
+### 1. Action ID Discovery
+```python
+html = session.get("https://accounts.x.ai/sign-up").text
+js_urls = [urljoin(start_url, m.group(0))
+           for m in re.finditer(r"/_next/static/chunks/[^\"'\s>]+\.js", html)]
+for js_url in js_urls:
+    js_content = session.get(js_url, timeout=15).text
+    match = re.search(r'7f[a-fA-F0-9]{40}', js_content)
+    if match:
+        action_id = match.group(0)
+        break
+```
+
+### 2. gRPC-web OTP Sending
+```python
+def encode_grpc_message(field_id, string_value):
+    key = (field_id << 3) | 2
+    value_bytes = string_value.encode('utf-8')
+    length = len(value_bytes)
+    payload = struct.pack('B', key) + struct.pack('B', length) + value_bytes
+    return b'\x00' + struct.pack('>I', len(payload)) + payload
+
+session.post(f"{site_url}/auth_mgmt.AuthManagement/CreateEmailValidationCode",
+    data=encode_grpc_message(1, email),
+    headers={"content-type": "application/grpc-web+proto", "x-grpc-web": "1",
+             "x-user-agent": "connect-es/2.1.1", "origin": site_url})
+```
+
+### 3. Registration Submission
+```python
+headers = {
+    "user-agent": user_agent, "accept": "text/x-component",
+    "content-type": "text/plain;charset=UTF-8", "origin": site_url,
+    "referer": f"{site_url}/sign-up",
+    "next-router-state-tree": state_tree, "next-action": action_id,
+}
+payload = [{
+    "emailValidationCode": verify_code,
+    "createUserAndSessionRequest": {
+        "email": email, "givenName": name, "familyName": surname,
+        "clearTextPassword": password, "tosAcceptedVersion": "$undefined"
+    },
+    "turnstileToken": token, "promptOnDuplicateEmail": True
+}]
+res = session.post(f"{site_url}/sign-up", json=payload, headers=headers)
+```
+
+### 4. SSO Cookie Extraction
+```python
+match = re.search(r'(https://[^"\s]+set-cookie\?q=[^:"\s]+)1:', res.text)
+if match:
+    verify_url = match.group(1)
+    session.get(verify_url, allow_redirects=True)
+    sso = session.cookies.get("sso")
+```
+
+## Key Insights
+- gRPC-web endpoint: `{site_url}/auth_mgmt.AuthManagement/CreateEmailValidationCode`
+- Content-type: `application/grpc-web+proto` (not JSON)
+- `x-grpc-web: 1` header required
+- `next-action` = action_id from JS chunks
+- `next-router-state-tree` = state tree from HTML
+- Turnstile sitekey: `0x4AAAAAAAhr9JGVDZbrZOo0`
+- SSO from `set-cookie?q=` redirect URL in response

skills/grok-autoreg/references/device-auth-completion.md

@@ -0,0 +1,44 @@
+# Device Auth Flow Completion
+
+## Critical Pattern
+After signup is complete, the device auth CLI does NOT automatically receive the token. The browser must be explicitly navigated back to the device auth URL to complete the authorization.
+
+## Flow
+1. Signup completes (profile form submitted)
+2. **Navigate back to device auth URL**: `await page.goto(url, ...)`
+3. **Click "Continue"**: User is now logged in, so the sign-in page shows the authorization card
+4. **Click "Authorize"** or "Allow": This redirects to the localhost callback URL
+5. Device auth CLI receives the callback and writes the token to `auth.json`
+
+## Working Code
+```python
+# After signup (profile form submitted)
+print(f"Going back to device auth URL: {url}")
+await page.goto(url, timeout=30000, wait_until="domcontentloaded")
+await page.wait_for_timeout(3000)
+
+# Click Continue (should show authorization page now)
+btn = page.locator("button:has-text('Продолжить')").first
+if await btn.count() == 0:
+    btn = page.locator("button:has-text('Continue')").first
+if await btn.count() > 0:
+    await btn.click()
+    await page.wait_for_timeout(5000)
+
+# Click Authorize
+auth_btn = page.locator("button:has-text('Authorize'), button:has-text('Allow')").first
+if await auth_btn.count() > 0:
+    await auth_btn.click()
+    await page.wait_for_timeout(5000)
+
+# Now wait for token in auth.json
+for w in range(60):
+    await asyncio.sleep(2)
+    auth = load_auth()
+    if f"https://auth.x.ai/oauth2/{email_addr}" in auth:
+        # Token received!
+        break
+```
+
+## Common Failure
+Without this step, the account is created but the token is NEVER saved. The device auth CLI times out after 300 seconds waiting for a callback that never arrives because the browser never redirected to localhost.

skills/grok-autoreg/references/duckmail-api.md

@@ -0,0 +1,55 @@
+# DuckMail API Reference
+
+**Base URL**: `https://api.duckmail.sbs`
+**Auth**: Most endpoints require no auth. Only `/messages` and `/messages/{id}` need a Bearer token.
+
+## Endpoints
+
+### GET /domains
+Returns available email domains. No auth needed.
+```bash
+curl https://api.duckmail.sbs/domains
+```
+Returns: `{"hydra:member": [{"domain": "duckmail.sbs", ...}, ...], "hydra:totalItems": 19}`
+
+### POST /accounts
+Create a new temporary email account. No auth needed.
+```bash
+curl -X POST https://api.duckmail.sbs/accounts \
+  -H "Content-Type: application/json" \
+  -d '{"address": "user@duckmail.sbs", "password": "StrongPass123!"}'
+```
+Returns: `{"id": "...", "address": "...", "isActive": false, "expiresAt": "2026-08-14T..."}`
+
+### POST /token
+Get JWT auth token for an account. No auth needed.
+```bash
+curl -X POST https://api.duckmail.sbs/token \
+  -H "Content-Type: application/json" \
+  -d '{"address": "user@duckmail.sbs", "password": "StrongPass123!"}'
+```
+Returns: `{"id": "...", "token": "eyJhbG..."}`
+
+### GET /messages
+List messages in the inbox. Requires Bearer token.
+```bash
+curl https://api.duckmail.sbs/messages \
+  -H "Authorization: Bearer <token>"
+```
+Returns: `{"hydra:member": [...], "hydra:totalItems": 0}`
+
+### GET /messages/{id}
+Get a specific message. Requires Bearer token.
+```bash
+curl https://api.duckmail.sbs/messages/{id} \
+  -H "Authorization: Bearer <token>"
+```
+Returns: Full message with subject, intro, text, html fields.
+
+## Notes
+- mail.tm-compatible API — code written for mail.tm works with s/base URL change
+- No bearer token needed for account creation or token retrieval
+- No rate limiting observed (tested with 170+ accounts in ~7 minutes)
+- 19 domains available, rotates automatically
+- Emails expire after ~24 hours
+- `isActive: false` on creation — accounts are created inactive but still receive email

skills/grok-autoreg/references/form-submission-pattern.md

@@ -0,0 +1,66 @@
+# Form Submission Pattern (v16 Working)
+
+## The Problem
+The profile page "Завершить регистрацию" (Complete sign up) form submission is unreliable. After solving the Turnstile and clicking the button, the form sometimes:
+- Redirects to the consent page (success — ~50% of runs)
+- Stays on sign-up page with GET params appended (failure — form submits as GET instead of POST)
+- Stays on sign-up page with no URL change (button click doesn't trigger form)
+
+## Root Cause
+The Turnstile token injection works, but the form submission behavior depends on whether the Cloudflare Turnstile server-side validation accepts the token. When the token is valid:
+- Button click → POST redirect → consent page
+When the token is invalid:
+- Button click → GET params → same page (server rejects the form)
+
+The sitekey is `0x4AAAAAAAhr9JGVDZbrZOo0` (fallback; actual sitekey extracted from iframe `src` attribute).
+
+## Working Pattern (dani.thaler99 run)
+```
+[S10] Turnstile solved!
+[S11] Clicked 'Завершить регистрацию' -> https://accounts.x.ai/account
+[S11] After submit: https://accounts.x.ai/oauth2/consent?...
+[S12] Redirected: https://accounts.x.ai/oauth2/consent?...
+```
+
+The button click redirected to `/account`, then `form.submit()` redirected to `/oauth2/consent`. This was with Chromium (not Chrome), `--disable-blink-features=AutomationControlled`, and `--no-sandbox`.
+
+## Working Pattern (p261250 run, v15)
+```
+[10] Turnstile solved!
+[10] Clicked 'Завершить регистрацию' -> https://accounts.x.ai/oauth2/device?user_code=TGQT-FDR8
+[11] Redirected to: https://accounts.x.ai/oauth2/device?user_code=TGQT-FDR8
+```
+
+This was with `channel="chrome"` (system Chrome), `launch_persistent_context` with temp user_data_dir.
+
+## Non-Working Pattern (bobozkurt, christian.klausch87, felixschade)
+```
+[S10] Turnstile solved!
+[S11] Clicked 'Завершить регистрацию' -> https://accounts.x.ai/sign-up
+[S11] After submit: https://accounts.x.ai/sign-up?email=...&givenName=Max&familyName=Mustermann
+```
+
+The form submits as GET with query params. The account may or may not be created. The OAuth fallback navigates to the OAuth URL but the sign-in page is shown (account not created).
+
+## Code Pattern
+```python
+# Click button
+btn = page.locator(f"button:has-text('Завершить регистрацию'):not([class*='onetrust'])").first
+if await btn.count() > 0:
+    await btn.click()
+    await page.wait_for_timeout(3000)
+    # Force form submission
+    await page.evaluate("""
+        const forms = document.querySelectorAll('form');
+        for (const f of forms) {
+            if (f.querySelector('input[type="password"]')) {
+                f.submit();
+                break;
+            }
+        }
+    """)
+    await page.wait_for_timeout(5000)
+```
+
+## Key Insight
+Even when the form doesn't redirect, the account MIGHT still be created. The OAuth fallback (navigating to the OAuth URL after signup) can still work if the browser is logged in. But if the sign-in page is shown, the account was NOT created.

skills/grok-autoreg/references/gw46-gateway.md

@@ -0,0 +1,87 @@
+# Grok46 Gateway (gw46.py)
+
+## Location
+`C:\Users\User\Documents\grok46gw\gw46.py`
+
+## Overview
+A ready-made OpenAI-compatible API gateway for xAI's Grok models with OAuth auto-registration, device code flow, and SQLite-based account management.
+
+## Features
+- **OpenAI-compatible API**: `/v1/chat/completions`, `/v1/models`, `/v1/responses`
+- **Multi-model support**: grok-4.6, grok-4.5, grok-4.3, grok-build-0.1
+- **OAuth PKCE flow**: `/oauth/login` → user signs in browser → callback → token
+- **Device code flow**: `/oauth/device` → user_code + verification_uri → `/oauth/device/poll`
+- **SQLite database**: accounts stored in `grok46_accounts.db` with refresh tokens
+- **API key pool**: round-robin rotation across all stored credentials
+- **Token refresh**: automatic refresh for expired tokens (if refresh_token is available)
+
+## Usage
+
+```bash
+# Start the gateway
+cd ~/Documents/grok46gw
+python gw46.py
+# Listens on 127.0.0.1:20146 by default (configurable via GROK46_PORT)
+```
+
+## Getting Tokens via Device Code Flow
+
+1. Start the gateway: `python gw46.py`
+2. Request a device code: `GET http://127.0.0.1:20146/oauth/device`
+3. Response includes `user_code` (e.g. `J2QB-MGQC`) and `verification_uri_complete` (e.g. `https://accounts.x.ai/oauth2/device?user_code=J2QB-MGQC`)
+4. Open the verification URI in a browser
+5. Sign in with an existing x.ai account (or create a new one)
+6. Enter the user_code and authorize the application
+7. Poll for the token: `GET http://127.0.0.1:20146/oauth/device/poll`
+8. When authorized, the response includes the `access_token` and the token is saved to the database
+
+## Account Management
+
+- `GET /accounts` — list all stored accounts and API keys
+- `POST /accounts/api-key?key=...&label=...` — add a manual API key
+- `GET /health` — health check with credential count
+
+## Environment Variables
+
+- `GROK46_PORT` — port (default: 20146)
+- `GROK46_HOST` — bind host (default: 127.0.0.1)
+- `GROK46_DB` — SQLite DB path (default: `./grok46_accounts.db`)
+- `XAI_API_KEYS` — comma-separated xAI API keys to add to the pool
+
+## Database Schema
+
+```sql
+CREATE TABLE accounts (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    email TEXT UNIQUE,
+    access_token TEXT NOT NULL,
+    refresh_token TEXT,
+    expires_at REAL,
+    scope TEXT,
+    created_at REAL DEFAULT (strftime('%s','now')),
+    last_used_at REAL,
+    use_count INTEGER DEFAULT 0
+);
+
+CREATE TABLE api_keys (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    key TEXT UNIQUE NOT NULL,
+    label TEXT,
+    created_at REAL DEFAULT (strftime('%s','now')),
+    last_used_at REAL,
+    use_count INTEGER DEFAULT 0
+);
+```
+
+## OAuth Auto-Registration Flow
+
+The gateway implements the full PKCE OAuth flow:
+1. `GET /oauth/login` — redirects to x.ai OAuth authorization page with PKCE challenge
+2. User signs in and authorizes in the browser
+3. Browser redirects to `http://127.0.0.1:20146/oauth/callback?code=...`
+4. Gateway exchanges the code for tokens using the PKCE verifier
+5. Tokens are saved to the SQLite database and added to the credential pool
+
+## Token Refresh
+
+Tokens with `refresh_token` are automatically refreshed when they expire. The gateway calls the xAI token endpoint with `grant_type=refresh_token` to get new access tokens.

skills/grok-autoreg/references/imap-pattern.md

@@ -0,0 +1,36 @@
+# IMAP Verification Code Extraction Pattern
+
+## Key Lessons
+- `mail.search(None, "ALL")` HANGS on large mailboxes (5000+ emails)
+- **Fix**: Use `mail.search(None, '(UNSEEN FROM "x.ai")')` with fallback to `mail.search(None, "UNSEEN")`
+- **Socket timeout**: Always set `mail = imaplib.IMAP4_SSL(host, port, timeout=30)` and `mail.socket().settimeout(30)`
+- Wrap each search in try/except
+
+## Working Code Snippet
+```python
+def get_verification_code(email_addr, password, timeout=180):
+    import socket
+    mail = imaplib.IMAP4_SSL(IMAP_HOST, IMAP_PORT, timeout=30)
+    mail.socket().settimeout(30)
+    mail.login(email_addr, password)
+    mail.select("INBOX")
+    
+    start = time.time()
+    while time.time() - start < timeout:
+        try:
+            typ, data = mail.search(None, '(UNSEEN FROM "x.ai")')
+            if typ != "OK":
+                typ, data = mail.search(None, "UNSEEN")
+            if typ == "OK" and data[0]:
+                ids = data[0].split()
+                for mid in reversed(ids):
+                    # fetch and parse message
+                    ...
+                    if "x.ai" in sender.lower():
+                        code_match = re.search(r'\b([A-Z0-9]{3}-[A-Z0-9]{3})\b', body)
+                        if code_match:
+                            return code_match.group(1)
+        except Exception as e:
+            print(f"IMAP search error: {e}")
+        time.sleep(5)
+```

skills/grok-autoreg/references/oauth-account-mismatch.md

@@ -0,0 +1,34 @@
+# OAuth Token Account Mismatch
+
+## Problem
+After signup via device auth flow, the OAuth fallback (grok login --oauth) retrieves a token that appears valid but fails API calls with `bad-credentials`.
+
+## Root Cause
+The OAuth flow authorizes the WRONG account:
+1. The signup creates a new account in the browser
+2. grok logout clears the CLI's auth.json
+3. grok login --oauth starts a fresh OAuth session
+4. The browser navigates to the OAuth URL
+5. The browser's session is for the OLD account (from persistent profile), not the new one
+6. The OAuth authorizes the old account and saves the token with the old account's refresh_token
+7. The script stores the token with the new email but the OLD account's credentials
+
+## Detection
+All tokens in the pool have the same refresh_token even though they have different emails.
+
+Check with:
+```bash
+python -c "import json; p=json.load(open(r'C:\Users\User\.grok\token_pool.json')); [print(t.get('refresh_token','')[:20]) for t in p['tokens']]"
+```
+
+If all tokens have the same refresh_token prefix, they are all bound to the same account.
+
+## Fix
+Use v13's fresh browser context (browser.new_context() not launch_persistent_context). This ensures the browser is logged in to the NEW account after signup, so the OAuth fallback authorizes the correct account.
+
+## Verification
+After registration, verify the token with a test API call:
+```bash
+curl -s http://localhost:8318/v1/chat/completions -X POST -H "Content-Type: application/json" -d '{"model":"grok-4.5","messages":[{"role":"user","content":"test"}],"max_tokens":5}'
+```
+If this returns `bad-credentials`, the token is bound to the wrong account.

skills/grok-autoreg/references/oauth-fallback-token.md

@@ -0,0 +1,43 @@
+# OAuth Fallback Token Retrieval
+
+After signup completes (profile form submitted), the browser is logged in but the device auth CLI may not have received the callback. The reliable fallback:
+
+## Flow
+1. `subprocess.run([grok_exe, "logout"], capture_output=True, timeout=10)` — clear old auth
+2. `subprocess.Popen([grok_exe, "login", "--oauth"], ...)` — start OAuth flow
+3. Parse OAuth URL from CLI output: `re.search(r'(https://auth\.x\.ai/oauth2/authorize\?\S+)', line)`
+4. `page.goto(oauth_url)` — navigate browser to OAuth URL
+5. If browser is logged in → auto-redirects to `127.0.0.1:XXXXX/callback?...`
+6. If not logged in → try clicking "Continue" or "Allow" buttons
+7. `proc.communicate(timeout=30)` — wait for CLI to finish
+8. Check `auth.json` for any key with `access_token`
+
+## Code
+```python
+subprocess.run([GROK_EXE, "logout"], capture_output=True, timeout=10)
+proc = subprocess.Popen([GROK_EXE, "login", "--oauth"],
+    stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, bufsize=1)
+oauth_url = None
+for line in iter(proc.stdout.readline, ''):
+    if not line and proc.poll() is not None: break
+    m = re.search(r'(https://auth\.x\.ai/oauth2/authorize\?\S+)', line)
+    if m: oauth_url = m.group(1); break
+
+if oauth_url:
+    await page.goto(oauth_url, timeout=15000)
+    await page.wait_for_timeout(5000)
+    for w in range(15):
+        if "127.0.0.1" in page.url or "localhost" in page.url: break
+        btn = page.locator("button:has-text('Continue'), button:has-text('Allow')").first
+        if await btn.count() > 0: await btn.click()
+        await page.wait_for_timeout(2000)
+    proc.communicate(timeout=30)
+
+auth = json.load(open(AUTH_JSON))
+for key in auth:
+    tok = auth[key].get("access_token") or auth[key].get("key", "")
+    if tok: return tok
+```
+
+## Why It Works
+The OAuth flow is simpler than device auth: the CLI prints an OAuth URL, the browser opens it, and since the browser is already logged in, it auto-redirects to localhost with the authorization code. The CLI picks up the redirect and writes the token to `auth.json`.

skills/grok-autoreg/references/oauth-timing-account-binding.md

@@ -0,0 +1,39 @@
+# OAuth Timing & Account Binding Issue
+
+## The Problem
+`grok login --oauth` starts a local HTTP server that listens for a callback. The CLI times out after ~2 minutes. If the signup flow takes 3-5 minutes (IMAP code retrieval + Turnstile solving), the CLI times out BEFORE the callback arrives.
+
+## Symptom
+```
+[12] Callback!
+[12] ❌ No token in auth.json
+```
+
+The callback was received by the browser (redirected to `http://127.0.0.1:PORT/callback`), but the CLI had already timed out and exited. The token is never saved to auth.json.
+
+## Fix (v16)
+Start OAuth AFTER signup, not before:
+1. Use device auth (`grok login --device-auth`) for the signup flow
+2. After signup completes (form submitted, account created), start `grok login --oauth`
+3. Navigate browser to the OAuth URL
+4. Browser is already logged in → consent page is shown immediately
+5. Click "Authorize" → callback arrives within seconds
+6. CLI saves token to auth.json
+
+## Account Binding
+Even with the timing fix, the OAuth flow authorizes the account that the BROWSER is logged into. If the signup created the account and the browser is logged in, the token is for the new account. If the signup failed (form didn't submit), the browser is NOT logged in, and the OAuth page shows the sign-in page.
+
+## Token Validation
+Always validate tokens after extraction:
+```python
+import urllib.request, json
+req = urllib.request.Request('https://api.x.ai/v1/models', 
+    headers={'Authorization': f'Bearer {token}'})
+try:
+    with urllib.request.urlopen(req, timeout=10) as r:
+        print(f"Valid: {r.status}")
+except Exception as e:
+    print(f"Invalid: {e}")
+```
+
+A 403 response means the token is bound to the wrong account (OAuth authorized the old account from the previous session).

skills/grok-autoreg/references/playwright-stealth-setup.md

@@ -0,0 +1,46 @@
+# Playwright Stealth Setup for x.ai
+
+## Installation
+
+```bash
+pip install playwright-stealth
+```
+
+## Import Pattern (2026-08-14 verified)
+
+```python
+from playwright_stealth import Stealth
+
+# Correct usage:
+stealth = Stealth()
+await stealth.apply_stealth_async(page)
+
+# WRONG - does NOT work:
+# from playwright_stealth import stealth_async  # ImportError
+# from playwright_stealth import stealth         # module, not callable
+# await stealth(page)                            # TypeError
+```
+
+## Why Stealth Is Needed
+
+Without stealth, Cloudflare detects the automated browser and blocks the Clerk JS library from loading. The page HTML loads fine, but `window.Clerk` is `undefined`. The form submission triggers a 403 error from Cloudflare.
+
+With stealth applied, the Clerk JS loads successfully and form submission works (when combined with residential proxy).
+
+## Stealth + Residential Proxy
+
+Stealth alone may not be enough — Cloudflare also checks the IP. Always combine with:
+- bpproxy residential hardsession proxies (`C:/Users/User/tmp/bpproxy_hardsession_pool.txt`)
+- Filter for `residential` lines (port 1000), not `datacenter` (port 2000)
+
+## Launch Args
+
+```python
+browser = await p.chromium.launch(
+    headless=headless,
+    proxy={"server": proxy_url},
+    args=["--no-sandbox"]  # --disable-blink-features=AutomationControlled breaks stealth
+)
+```
+
+Do NOT use `--disable-blink-features=AutomationControlled` with stealth — stealth handles this internally.

skills/grok-autoreg/references/profile-turnstile-timing.md

@@ -0,0 +1,36 @@
+# Profile Turnstile Detection Timing
+
+## Problem
+The v13 script checks for the profile Turnstile at line 406:
+```python
+turnstile2 = page.locator("iframe[src*='challenges.cloudflare.com']").first
+if await turnstile2.count() > 0:
+    sitekey = await turnstile2.get_attribute("src")
+    ...
+```
+
+But `count()` returns 0 if the Turnstile iframe hasn't loaded yet. The profile form renders BEFORE the Turnstile widget, so the script misses it and submits without solving the captcha.
+
+## Fix
+Replace the `count()` + `get_attribute()` pattern with `wait_for_selector()` + explicit timeout:
+
+```python
+try:
+    turnstile_iframe = page.locator("iframe[src*='challenges.cloudflare.com']").first
+    await turnstile_iframe.wait_for(state="attached", timeout=10000)
+    # Extract sitekey from the fully loaded iframe
+    src = await turnstile_iframe.get_attribute("src")
+    sk = re.search(r'sitekey=([^&]+)', src or "")
+    if sk:
+        sitekey = sk.group(1)
+        token = await solve_turnstile(sitekey, page.url, timeout=45)
+        if token:
+            await page.evaluate(f"""document.querySelector('input[name="cf-turnstile-response"]').value = {json.dumps(token)}""")
+except Exception:
+    print("  Profile Turnstile: not found or timed out")
+```
+
+## Sitekey
+Profile page Turnstile uses sitekey `0x4AAAAAAAhr9JGVDZbrZOo0` — this IS solvable via 2captcha (~30s avg).
+
+Code page Turnstile uses sitekey `0x4AAAAAAADnQ4F4U8W2nQyH` — ALWAYS unsolvable via 2captcha. Do not wait more than 30s for it.

skills/grok-autoreg/references/react-form-filling.md

@@ -0,0 +1,46 @@
+# React Form Filling Pattern for Browser Automation
+
+## Problem
+React controlled inputs ignore `Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, 'value').set` — the form validation sees empty values and refuses to submit.
+
+## Solution
+Use `locator.fill()` + dispatch `input` event after each fill.
+
+## Working Code Snippet
+```python
+# Fill name
+name_input = page.locator("input[autocomplete='given-name']").first
+await name_input.click()
+await name_input.fill("Max")
+await page.evaluate("""
+    document.querySelector('input[autocomplete="given-name"]')
+        ?.dispatchEvent(new Event('input', {bubbles: true}));
+""")
+
+# Fill surname
+surname_input = page.locator("input[autocomplete='family-name']").first
+await surname_input.click()
+await surname_input.fill("Mustermann")
+await page.evaluate("""
+    document.querySelector('input[autocomplete="family-name"]')
+        ?.dispatchEvent(new Event('input', {bubbles: true}));
+""")
+
+# Fill password (use fill() NOT JS value setter!)
+pwd_input = page.locator("input[type='password']").first
+await pwd_input.click()
+await pwd_input.fill(password)
+await page.evaluate("""
+    document.querySelector('input[type="password"]')
+        ?.dispatchEvent(new Event('input', {bubbles: true}));
+""")
+
+# Click submit — use Playwright locator, NOT JS querySelector with :has-text()
+btn = page.locator("button:has-text('Завершить регистрацию')").first
+await btn.click()
+```
+
+## Pitfalls
+- **`:has-text()` in JS**: `document.querySelector('button:has-text("...")')` throws SyntaxError. `:has-text()` is a Playwright pseudo-selector, not valid CSS.
+- **JS fallback**: Use `textContent.includes()` loop if JS click is needed
+- **OneTrust buttons**: `button:has-text('Подтвердить')` matches cookie consent buttons. Check `class` attribute for "onetrust" and skip.

skills/grok-autoreg/references/sso-to-oauth-conversion.md

@@ -0,0 +1,123 @@
+# SSO → OAuth Conversion via Device Auth Flow
+
+## Overview
+
+Converts SSO session cookies (from GrokRegister) to OAuth access tokens via x.ai's OAuth device code flow. Uses DrissionPage to automate the browser authorization step.
+
+## Prerequisites
+
+- Python 3.11+ with `httpx`, `sqlite3`
+- DrissionPage (`pip install DrissionPage`) — run with `python -s` to avoid Hermes venv path collisions
+- Chrome installed at `C:\Program Files\Google\Chrome\Application\chrome.exe`
+- gw46 gateway DB at `~/Documents/grok46gw/grok46_accounts.db`
+
+## Script Location
+
+`C:\Users\User\tmp\grok_register\grok-register\sso2oauth.py`
+
+## Flow Detail
+
+### Step 1: Start Device Code Flow
+```
+POST https://auth.x.ai/oauth2/device/code
+Content-Type: application/x-www-form-urlencoded
+
+client_id=b1a00492-073a-47ea-816f-4c329264a828&
+scope=openid+profile+email+offline_access+grok-cli:access+api:access
+
+Response:
+{
+  "device_code": "...",
+  "user_code": "ABCD-1234",
+  "verification_uri": "https://accounts.x.ai/oauth2/device",
+  "verification_uri_complete": "https://accounts.x.ai/oauth2/device?user_code=ABCD-1234",
+  "interval": 5,
+  "expires_in": 600
+}
+```
+
+### Step 2: Authorize Device with SSO (DrissionPage)
+```python
+from DrissionPage import ChromiumPage
+
+page = ChromiumPage()
+page.get("https://accounts.x.ai/sign-in")
+page.run_js(f"""
+    document.cookie = "sso={sso_token}; domain=.accounts.x.ai; path=/; Secure;";
+    document.cookie = "sso={sso_token}; domain=.x.ai; path=/; Secure;";
+""")
+page.get(verification_uri_complete)  # includes user_code in URL
+# Click "Продолжить" (Continue) to submit the code
+page.ele("tag:button@@text()=Продолжить").click()
+# Wait for authorization page
+# Click "Authorize" / "Разрешить"
+page.ele("tag:button@@text()=Разрешить").click()
+```
+
+### Step 3: Poll for Token
+```
+POST https://auth.x.ai/oauth2/token
+Content-Type: application/x-www-form-urlencoded
+
+grant_type=urn:ietf:params:oauth:grant-type:device_code&
+device_code={device_code}&
+client_id=b1a00492-073a-47ea-816f-4c329264a828
+
+Response (200):
+{
+  "access_token": "eyJ0eX...",
+  "refresh_token": "m9Vzs...",
+  "expires_in": 3600,
+  "scope": "openid profile email offline_access grok-cli:access api:access",
+  "id_token": "eyJ0eX..."
+}
+```
+
+### Step 4: Store in SQLite
+```sql
+INSERT INTO accounts (email, access_token, refresh_token, expires_at, scope)
+VALUES (?, ?, ?, ?, ?);
+```
+
+## Token Validation
+
+The OAuth token JWT contains:
+- `iss: https://auth.x.ai`
+- `aud: b1a00492-073a-47ea-816f-4c329264a828` (correct client_id)
+- `scope: openid profile email offline_access grok-cli:access api:access`
+- `principal_type: User`
+- `exp: <timestamp>` (6 hours from issue)
+
+## Known Limitations
+
+### 1. DrissionPage Concurrency (PageDisconnectedError)
+DrissionPage [REDACTED-IP]b14 crashes with `PageDisconnectedError` (与页面的连接已断开) when multiple `ChromiumPage` instances are created in the same process. The background CDP event handler thread raises an unhandled exception. Cause is a shared CDP connection state across instances.
+
+**Fix:** Force sequential processing (`--concurrent 1`). Split large batches into chunks of 10-15 with process restarts between chunks.
+
+### 2. No API Credits
+OAuth tokens are valid (authenticate correctly) but accounts have no API credits. All API calls return:
+```json
+{"code":"personal-team-blocked:spending-limit",
+ "error":"You have run out of credits or need a Grok subscription."}
+```
+The gw46 gateway shows `credentials: N` in health but every request fails with 402.
+
+### 3. gw46 KeyPool Refresh
+The gateway reads the DB only during startup. External DB writes (via `sso2oauth.py`) are invisible until restart:
+```bash
+taskkill /F /PID <PID>
+cd ~/Documents/grok46gw && python gw46.py
+```
+
+## Session Performance (2026-08-13)
+
+| Metric | Value |
+|--------|-------|
+| Accounts created | 171 |
+| SSO → OAuth converted | 74 |
+| Sequential time per account | ~10-15s |
+| Total conversion time | ~12 min |
+| Batch size before crash | ~10-15 |
+| DrissionPage chunks | 5 (restart between) |
+| Valid API tokens | 0 (all 402) |

skills/grok-autoreg/references/tonline-email-pool.md

@@ -0,0 +1,45 @@
+# t-online.de Email Pool
+
+## Location
+`C:/Users/User/Desktop/_PROJECTS/GPT-AUTOREG/emails.txt`
+
+## Count
+17,893 t-online.de email accounts with IMAP passwords.
+
+## Format
+```
+[REDACTED-EMAIL]:[REDACTED]
+```
+
+Comments start with `#`. Separator lines with `---` are skipped.
+
+## IMAP Settings
+- **Server**: `secureimap.t-online.de`
+- **Port**: `993`
+- **SSL**: Yes
+
+## Code Extraction Pattern
+```python
+import imaplib, email, re
+
+mail = imaplib.IMAP4_SSL("secureimap.t-online.de", 993)
+mail.login(addr, pw)
+mail.select("inbox")
+_, msgs = mail.search(None, "UNSEEN")
+if not msgs[0]:
+    _, msgs = mail.search(None, "ALL")
+for num in msgs[0].split()[-5:]:  # Check last 5 messages
+    _, data = mail.fetch(num, "(RFC822)")
+    for part in data:
+        if not isinstance(part, tuple): continue
+        msg = email.message_from_bytes(part[1])
+        # Extract body...
+        codes = re.findall(r"\b(\d{6,8})\b", body)
+        if codes and codes[0] != "000000":  # Filter false positives
+            return codes[0]
+```
+
+## Pitfalls
+- **False positive "000000"**: Some emails contain this string (timestamps, IDs). Filter it out.
+- **UNSEEN filter**: Use `UNSEEN` first, fall back to `ALL` (last 5 messages) to avoid scanning thousands of messages.
+- **Gmail accounts are dead**: The Gmail accounts from `C:/Users/User/Desktop/_PROJECTS/tusk-gateway/tusk_gmail_accounts.json` have expired 2FA app passwords. Do NOT use them for IMAP.

skills/grok-autoreg/references/turnstile-json-escape.md

@@ -0,0 +1,38 @@
+# Turnstile Token JSON Escaping
+
+The Turnstile token returned by 2Captcha is a long opaque string like:
+```
+1.7iQyv0Qs12EGBU8PpuyVlKig_yZf_G8Q-Tcu8r0OY7mDbX0QjCk...
+```
+
+This string can contain dots, underscores, dashes, and other characters that break JavaScript string literals when interpolated directly.
+
+## ❌ Never Do This
+```python
+await page.evaluate(f"el.value = '{token}';")
+# Causes: SyntaxError: Invalid left-hand side in assignment
+# When token contains dots or special chars: el.value = 1.7iQyv0Qs... (invalid)
+```
+
+## ✅ Always Do This
+```python
+import json
+await page.evaluate(f"const el = document.querySelector('input[name=\"cf-turnstile-response\"]'); if (el) el.value = {json.dumps(token)};")
+```
+
+`json.dumps()` produces a properly escaped JavaScript string literal:
+- Strings with dots: `"1.7iQyv0Qs..."` (valid JS)
+- Strings with quotes: `"it's \"good\""` (properly escaped)
+- Null/None: `null` (valid JS)
+
+## Full Injection Pattern
+```python
+token = await solve_turnstile(sitekey, pageurl)
+if token:
+    [REDACTED] json
+    await page.evaluate(f"const el = document.querySelector('input[name=\"cf-turnstile-response\"]'); if (el) el.value = {json.dumps(token)};")
+    await page.wait_for_timeout(500)
+```
+
+## Why 2Captcha Returns "unsolvable"
+The Turnstile on the verification page is often reported as "unsolvable" by 2Captcha. This is a known issue with Cloudflare Turnstile — the challenge is intentionally easy for humans but hard for automated solvers. The page still advances without the Turnstile being solved (the code submission itself triggers the next step). So treat "unsolvable" as a non-fatal warning, not an error.

skills/grok-autoreg/references/turnstile-shadow-dom-bypass.md

@@ -0,0 +1,58 @@
+# Turnstile Shadow DOM Bypass
+
+## Discovery
+
+The Cloudflare Turnstile widget on `accounts.x.ai` uses **shadow DOM** to encapsulate the challenge iframe. The standard approach of injecting the token into `cf-turnstile-response` hidden inputs often fails because the React SPA reads the token from the widget's callback, not from the DOM.
+
+## The Bypass
+
+The DrissionPage-based approach (from ReinerBRO/grok-register) directly accesses the shadow root of the Turnstile widget container and clicks the challenge button inside the iframe. This triggers the Turnstile challenge, which is auto-solved because the browser's `MouseEvent.screenX/screenY` are patched to realistic values.
+
+## Code Pattern
+
+```python
+# Find the cf-turnstile-response input
+challengeSolution = page.ele("@name=cf-turnstile-response")
+# Get its parent (the widget container with shadow DOM)
+challengeWrapper = challengeSolution.parent()
+# Access the shadow root to get the iframe
+challengeIframe = challengeWrapper.shadow_root.ele("tag:iframe")
+# Inject JavaScript into the iframe to patch MouseEvent
+challengeIframe.run_js("""
+    window.dtp = 1
+    function getRandomInt(min, max) {
+        return Math.floor(Math.random() * (max - min + 1)) + min;
+    }
+    let screenX = getRandomInt(800, 1200);
+    let screenY = getRandomInt(400, 600);
+    Object.defineProperty(MouseEvent.prototype, 'screenX', { value: screenX });
+    Object.defineProperty(MouseEvent.prototype, 'screenY', { value: screenY });
+""")
+# Access the iframe's body shadow root to find the challenge button
+challengeIframeBody = challengeIframe.ele("tag:body").shadow_root
+challengeButton = challengeIframeBody.ele("tag:input")
+# Click the button to trigger the challenge
+challengeButton.click()
+```
+
+## Why It Works
+
+Cloudflare Turnstile uses behavioral detection to determine if the visitor is human. One signal is the `screenX/screenY` coordinates of mouse events. In headless/automated browsers, these are often 0 or unrealistic values. By patching `MouseEvent.prototype.screenX/screenY` to random values between 800-1200 (x) and 400-600 (y), the behavioral detection passes, and the Turnstile auto-solves without showing a challenge.
+
+## When to Use
+
+- When 2captcha fails to solve the profile-page Turnstile (sitekey `0x4AAAAAAAhr9JGVDZbrZOo0`)
+- When you need faster account creation without external captcha services
+- The code-page Turnstile (sitekey `0x4AAAAAAADnQ4F4U8W2nQyH`) is also bypassed by this method
+
+## Requirements
+
+- DrissionPage library (`pip install DrissionPage==[REDACTED-IP]`)
+- Chrome/Chromium browser
+- The Turnstile Patcher Chrome extension (in `turnstilePatch/` directory of the repo) — this patches MouseEvent at the content script level for the initial page load
+
+## Limitations
+
+- This only works with DrissionPage (not Playwright) because DrissionPage provides `shadow_root` access
+- The Chrome extension must be loaded at browser startup
+- Some Turnstile challenges may still require manual solving if the behavioral detection is more sophisticated