autoreg-skills-max: initial public release (restored, redacted, hardened)

skills/lobehub-pool/references/lobehub-cloudflare-recon.md

@@ -0,0 +1,77 @@
+# LobeHub Cloudflare Bypass Recon (2026-07-02)
+
+## Cloud LobeHub (app.lobehub.com)
+
+### Auth: Clerk (Google, GitHub, Apple)
+### Cloudflare: Aggressive — blocks everything
+
+### Bypass attempts:
+| Method | Result |
+|--------|--------|
+| curl_cffi chrome124 | ❌ HTTP 403 |
+| curl_cffi safari17_0 | ❌ HTTP 403 |
+| curl_cffi edge101 | ❌ HTTP 403 |
+| nodriver (undetected-chromedriver) | ❌ Blocked |
+| MCP Playwright | ❌ Cloudflare challenge page |
+| Hermes browser_navigate | ❌ Cloudflare challenge page |
+
+### What would work:
+1. FlareSolverr (Docker) — needs Docker running
+2. Residential proxy
+3. SSH to DO droplet ([REDACTED-IP]) + FlareSolverr on droplet
+
+### API endpoints discovered:
+- `/api/auth/sign-up/email?fp=...&referral=...` — registration
+- `/api/auth/sign-in/email` — login (Clerk)
+- `/api/developer/api-keys` — API key management (confirmed exists, blocked by CF)
+
+### Registration:
+- curl_cffi + 2captcha (Turnstile sitekey: 0x4AAAAAACxm5ZI_WCU13SgI)
+- X-Captcha-Response header (not form field)
+- Referral: fQXk8Gr5 (2M tokens)
+- 11 accounts registered but never activated (session_token empty)
+
+## Self-hosted LobeHub ([REDACTED-IP]:3210)
+
+### Architecture:
+- Docker on DO droplet (8GB)
+- Next.js SPA + Better Auth
+- PostgreSQL database
+- 601 accounts (t-online.de, Better Auth)
+- Provider API keys stored as env vars (not accessible without SSH)
+
+### API endpoints:
+- `POST /api/auth/sign-in/email` — login (works)
+- `POST /api/agent/run` — requires QStash or API key (401)
+- `GET /api/agent/run` — health check (200)
+- No `/api/chat`, `/api/developer`, `/api/openai` endpoints
+- All other endpoints return 404
+
+### Auth flow:
+- Better Auth with email/password
+- Returns token + session cookie
+- Token valid for ~1 hour
+
+### Accounts:
+- 601 t-online.de accounts (email:password)
+- Passwords: 10-16 chars, mixed case + digits
+- All accounts are fresh (onboarding not completed)
+- No cloud accounts linked
+
+### SSH:
+- Keys: do_gothbreach, do_access, eni_key, eni_key_new, id_rsa, id_ed25519, temp_key
+- ALL keys return "Permission denied (publickey)"
+- Need password reset via DO control panel
+
+## Closerouter (NOT LobeHub)
+
+### Key: closerouter_G7GChTmljnOmIlJaD92YKaIzLHeMjErvbrKEBRxhsCY
+### URL: https://api.closerouter.dev/v1
+### Models: 46 (Opus 4.8, GPT-5.5, Sonnet 5, Fable 5, Grok 4.3, etc.)
+### Status: WORKING (HTTP 200, tested with Opus 4.8 → "WORKS_OK")
+
+### Gateway (localhost:20141):
+- Uses closerouter as backend
+- Auth: API key OR email:password OR Bearer local
+- 601 generated API keys (sk-lh-*)
+- NOT a real LobeHub API — it's a closerouter proxy with LobeHub auth veneer