reverse-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
--- a/research-what-we-did/darktelegram_reverse_report.md
+++ b/research-what-we-did/darktelegram_reverse_report.md
@@ -0,0 +1,466 @@
+# DarkTelegram.pro — Reverse Engineering Report (Public Assets Only)
+
+**Status:** All claims are extracted from publicly served JS bundles (`darktelegram.pro` over plain HTTPS).
+**No auth, no credentials, no mutating requests.** Every endpoint name below is from minified frontend code, not from live API calls.
+**Date:** 2026-09-15
+**Rate limit:** ~20 GET requests total (landing page, main bundles, module chunks, CSS). No fuzzing, no crawling.
+
+---
+
+## 1. Code-Split Chunk Filenames → Product Module Mapping
+
+Chunks are Vite code-split `.js` files served from `https://darktelegram.pro/assets/`. The main entry `index-CQKpAuC4.js` (663 KB) declares the full dependency graph via `__vite__mapDeps`. The dashboard shell is `App-DL7CzC9q.js`.
+
+### Landing / Public Route Pages
+
+| Chunk | Module / Page |
+|---|---|
+| `index-CQKpAuC4.js` | SPA entry, route definitions, core API helpers |
+| `App-DL7CzC9q.js` | Dashboard shell, sidebar, account picker, folder UI, context providers, full dependency map of all 80+ dashboard tab chunks |
+| `Landing-CXQemKrJ.js` | Landing page hero |
+| `AuthPage-CiVnbMr6.js` | Login/Register forms, OAuth, Turnstile (auth-independent header/footer CSS) |
+| `AuthPage-rwu218-r.js` | Auth page shared logic |
+| `ResetPasswordPage-CUxx1NKP.js` | Password reset |
+| `SeoLayout-DI8Ngi0U.js` | SEO layout wrapper |
+| `SeoMeta-Df7W64jI.js` | Dynamic SEO meta injection |
+| `pageMeta-C24qRuxo.js` | Per-page SEO metadata config |
+| `PrivacyPage-BUTds85K.js` | Privacy policy |
+| `TermsPage-CDKHvBhR.js` | Terms of service |
+
+### Product/Marketing Landing Pages (Feature Docs)
+
+| Chunk | Product Module |
+|---|---|
+| `TelegramManager--WBuvWjE.js` | Telegram Account Manager feature page |
+| `AiBroadcast-CtQ819br.js` | AI Mailing feature page (3 modes) |
+| `AiPromoter-OKyXD7VX.js` | AI Promoter / Нейродиалоги feature page |
+| `BuyAccounts-BE-VUlUn.js` | Buy Telegram Accounts marketplace page |
+| `Nakrutka-CmIdulPO.js` | SMM Panel / Накрутка (subscriptions, reactions, views) |
+| `Arbitrage-D8HyljyM.js` | Traffic arbitrage page (dating/betting/crypto) |
+| `AiAssistantsPage-BYjQpdtd.js` | AI Assistants page |
+| `ParseReportPage-Tt5DVO47.js` | Parse report page |
+| `BlogIndex-vXaavkcO.js` | Blog index |
+| `BlogArticle-DkAe3e6J.js` | Blog article |
+| `article-ChKm0xiJ.js` | Blog article (alternate) |
+| `blog-refresh-CDwEFsgE.js` | Blog refresh component |
+| `Converter-C77A1IiI.js` | tdata session converter |
+| `TgStatParser-DtrLk5fl.js` | TgStat Chrome extension parser |
+| `LztTrust-DT9wFtsT.js` | LZT Trust page |
+| `JoinCabinetPage-ChqIw2TJ.js` | Join cabinet page |
+| `kak-nachat-rabotu-v-darktelegram-D-RibygM.js` | How to start article |
+
+### Dashboard Tab Components (authenticated code-split chunks)
+
+Revealed from the sidebar route map in App-DL7CzC9q.js:
+
+| Route | Chunk (when applicable) | Module |
+|---|---|---|
+| `/accounts` | — (in main shell) | Account management |
+| `/proxies` | — (in main shell) | Proxy management |
+| `/market` | MarketTab | LZT Marketplace |
+| `/warmup` | WarmupTab | Account warmup |
+| `/broadcast` | BroadcastTab | AI Broadcast (8 modes) |
+| `/chat-broadcast` | ChatBroadcastTab | Chat broadcast (AI DM broadcast) |
+| `/autoreply` | AutoReplyTab | AI auto-reply |
+| `/promoter` | PromoterTab | AI Promoter / AI sales agent |
+| `/massreaction` | MassReactionTab | Mass reactions |
+| `/nakrutka` | NakrutkaTab | Nakrutka (SMM panel) |
+| `/masslooking` | MassLookingTab | Mass story viewing |
+| `/story-mentions` | StoryMentionsTab | Story mentions |
+| `/neurocommenting` | NeuroCommentingTab | Neuro-commenting |
+| `/neuroshilling` | NeuroshillingTab | Neuro-shilling |
+| `/inviter` | InviterTab | Inviter |
+| `/salesman` | SalesmanTab | AI Sales Agent |
+| `/copier` | CopierTab | Copier |
+| `/audience` | AudienceTab | Channel management |
+| `/groups` | GroupsTab | Group management |
+| `/audience-parse` | AudienceParseTab | Audience parser |
+| `/audience-users` | AudienceUsersTab | Audience user list |
+| `/channel-db` | ChannelDbTab | Channel database |
+| `/darkfather` | DarkFatherTab | DarkFather module |
+| `/session-duplicator` | SessionDuplicatorTab | Session duplicator |
+| `/telegram-folders` | TelegramFoldersTab | Telegram folders |
+| `/links` | LinksTab | Links module |
+| `/integrations` | IntegrationsTab | Integrations (MCP/API) |
+| `/runpod` | RunPodTab | RunPod integration |
+| `/products` | ProductsTab | Products |
+| `/templates` | — | Templates |
+| `/profile` | ProfileTab | User profile |
+| `/wallet` | WalletTab | Wallet/balance |
+| `/subscription` | SubscriptionTab | Subscription management |
+| `/feature-logs` | FeatureLogsTab | Feature change logs |
+| `/tasks` | TasksTab | Active tasks |
+| `/referral` | ReferralTab | Referral program |
+| `/support` | SupportTab | Support |
+
+---
+
+## 2. Dashboard API Surface (Grouped by Module)
+
+All endpoints inferred from fetch() calls in the public JS bundles. Relative to /api/. Returns { detail: ... } on errors.
+
+
+### Auth
+| Method | Path | Notes |
+|---|---|---|
+| POST | /api/auth/login | email + password login |
+| POST | /api/auth/register | registration |
+| POST | /api/auth/oauth/* | OAuth callbacks |
+| POST | /api/auth/reset-password | password reset |
+
+### Accounts
+| Method | Path | Notes |
+|---|---|---|
+| GET | /api/accounts | list |
+| POST | /api/accounts | import |
+| GET | /api/accounts/:id/export | export .session |
+| GET | /api/accounts/:id/export-tdata | export tdata |
+| PATCH | /api/accounts/:id | update |
+| DELETE | /api/accounts/:id | remove |
+| GET | /api/account-folders | list folders |
+| POST | /api/account-folders | create folder |
+| PATCH | /api/account-folders/:id | rename folder |
+| DELETE | /api/account-folders/:id | delete folder |
+
+### Proxies
+| Method | Path | Notes |
+|---|---|---|
+| GET | /api/proxy-folders | list proxy folders |
+| POST | /api/proxy-folders | create folder |
+| PATCH | /api/proxy-folders/:id | rename folder |
+| DELETE | /api/proxy-folders/:id | delete folder |
+
+### Broadcast (AI Mailing)
+| Method | Path | Notes |
+|---|---|---|
+| GET | /api/broadcast/history?page=N | paginated history |
+| GET | /api/broadcast/status | campaign status |
+| POST | /api/broadcast/create | create campaign |
+| POST | /api/broadcast/:id/start | start campaign |
+| POST | /api/broadcast/:id/stop | stop campaign |
+| POST | /api/broadcast/:id/retry | retry failed |
+| GET | /api/broadcast/:id/stats | campaign stats (funnel) |
+| GET | /api/broadcast/:id/recipients | per-recipient report |
+| GET | /api/broadcast/stream/:id | SSE log stream |
+| GET | /api/broadcast/audience-count | audience count query |
+| GET | /api/broadcast/smart/active | active Smart broadcasts |
+| POST | /api/broadcast/smart/:id/pause | pause smart broadcast |
+| POST | /api/broadcast/smart/:id/stop | stop smart broadcast |
+| POST | /api/broadcast/voice | upload voice file |
+| DELETE | /api/broadcast/voice/:id | delete voice file |
+| GET | /api/broadcast/voice/:id/file?token= | stream voice file |
+
+### Audience / Parser
+| Method | Path | Notes |
+|---|---|---|
+| GET | /api/audience-folders | audience folder list |
+| GET | /api/groups-channel-folders | groups/channel folders |
+| POST | /api/audience-parse/start | start parse task |
+
+### AI Promoter / Нейродиалоги
+| Method | Path | Notes |
+|---|---|---|
+| GET | /api/promoter/status | promoter status |
+| GET | /api/promoter/sessions | list past sessions |
+| POST | /api/promoter/start | start session |
+| POST | /api/promoter/stop/:id | stop session |
+| POST | /api/promoter/demo | demo: test message vs product |
+| GET | /api/promoter/stream/:id | SSE log stream |
+| GET | /api/promoter/monitor-targets | list monitorable chats |
+| POST | /api/promoter/preview-scenarios | generate scenario preview |
+
+### Profile / User
+| Method | Path | Notes |
+|---|---|---|
+| GET | /api/profile/limits | user limits |
+| GET | /api/profile/promoter-settings | promoter prompt templates |
+| PUT | /api/profile/promoter-settings | update promoter prompts |
+
+### Products
+| Method | Path | Notes |
+|---|---|---|
+| GET | /api/products | list products with keywords |
+
+---
+
+## 3. AiPromoter (AI Sales Agent) Flow — Detailed
+
+Based on PromoterTab-ClNavCxu.js (dashboard component) and AiPromoter-OKyXD7VX.js (marketing page).
+
+### Data Model
+
+**Product** (from GET /api/products):
+```
+{
+  id: number,
+  name: string,
+  keywords: string[],
+  description?: string,
+  link?: string
+}
+```
+
+**Session Config** (POST /api/promoter/start):
+```
+{
+  product_id: number,
+  account_ids: number[],
+  target_chats: string[],
+  initial_history_count: number,
+  dm_followup?: {
+    enabled: boolean,
+    min_delay: number,  // minutes
+    max_delay: number   // minutes
+  },
+  hyperlink_enabled: boolean,
+  mode: "polling" | "realtime",
+  reaction_delay_min?: number,  // seconds
+  reaction_delay_max?: number,
+  autoreply_prompt_id?: number | null,
+  solve_captcha: boolean  // BETA
+}
+```
+
+### 3-Phase Flow (confirmed from bundle)
+
+**Phase 1 — First message to everyone:**
+- AI writes to every contact in the base from the connected account
+- Message is contextualized using product description + keywords
+
+**Phase 2 — Qualification (criteria matching):**
+- When someone responds, AI evaluates relevance via relevance_prompt:
+  - Variables: {keywords}, {description}, {message}
+  - Output: keywords_matched[], keywords_missed[], matched: boolean
+- If matched, generates public reply via comment_prompt:
+  - Variables: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}, {message}
+- If DM follow-up enabled, generates DM via dm_prompt:
+  - Variables: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}
+
+**Phase 3 — Notification:**
+- Sends Telegram notification via DarkTelegram bot to the user
+- Includes: contact name, what they want, product interest, full dialog history
+- Session log tracks: mentions (public), dm_replies (private), account_ids, product_name
+
+### Demo Endpoint
+POST /api/promoter/demo
+Request: { message: string, product_id: number }
+Response: { matched, reply, dm_message, reasoning, keywords_matched[], keywords_missed[] }
+
+### Custom Prompts (saved via GET/PUT /api/profile/promoter-settings)
+Three editable prompt templates:
+- relevance_prompt: {keywords}, {description}, {message}
+- comment_prompt: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}, {message}
+- dm_prompt: {acc_name}, {acc_bio}, {product_name}, {product_link}, {hyperlink}, {description}
+
+---
+
+## 4. TelegramManager and AiBroadcast Endpoint Shapes
+
+### AiBroadcast (from BroadcastTab-B9lQ9vJz.js)
+
+Eight broadcast modes: single | threephase | postbot | smart | sticker | ttl | contacts | voice
+
+POST /api/broadcast/create body:
+```
+{
+  name, account_ids[], broadcast_mode,
+  audience_folder_ids[], audience_min_messages, audience_has_username,
+  audience_search, audience_only_new,
+  messages_per_hour, schedule_hour_min, schedule_hour_max,
+  enable_ramp_up, enable_dialog_warmup, skip_read_contacted, send_greeting_sticker,
+  followup_enabled?, followup_delay_hours?, followup_text?, followup_entities?,
+  // mode-specific:
+  message_text?, message_entities?, ai_uniquify?,
+  warmup_duration_min?, warmup_duration_max?,
+  greeting_prompt?, link_mode?, link_url?, link_text?, link_prompt?, // threephase
+  reply_timeout_hours?, delay_after_reply_min?, delay_after_reply_max?, skip_autoreply?,
+  postbot_text?,                                                      // postbot
+  smart_mailing?, smart_daily_limit?, smart_min_interval_minutes?,     // smart
+  contacts_include_dialogs?, contacts_quiet_mode?,                     // contacts
+  voice_id?                                                            // voice
+}
+```
+
+Campaign stats (GET /api/broadcast/:id/stats):
+```
+{
+  funnel: { recipients, greetings_sent, replies, links_sent },
+  stats: { sent, replied, link_sent, failed, peer_flood_count,
+           peer_flood_accounts, by_status: { [status]: count } }
+}
+```
+
+### TelegramManager
+The marketing page only (not a dashboard tab). Routes to /accounts.
+Capabilities: built-in marketplace, auto-proxy, 1-click warmup (95% survival), AI tools, audience parsing, real-time monitoring, session/tdata import, parallel execution.
+
+---
+
+## 5. Cloudflare Turnstile Wiring
+
+- Loaded via script src="https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit" in HTML head
+- Widget rendered into div.auth-turnstile (centered, min-height: 65px)
+- Token submitted alongside email/password in auth form POST body
+- Turnstile is NOT on API endpoints — only on auth pages
+- Gated: exact form field name (cf-turnstile-response by convention, not confirmed without auth form JS logic)
+
+---
+
+## 6. Feature-Gap Table: DarkTelegram.pro vs T-Pilot
+
+Legend: ✅ Present | ⚠️ Partial | ❌ Missing
+
+### Core Infrastructure
+
+| Capability | DT | T-Pilot |
+|---|---|---|
+| Multi-account management | ✅ | ✅ |
+| Proxy management + auto-rotation | ✅ built-in pool | ⚠️ user-provided only |
+| Account import (.session / tdata) | ✅ both | ⚠️ converter exists |
+| 24/7 cloud execution | ✅ | ⚠️ local-first |
+| Embedded Telegram Web | ✅ ($20) | ❌ |
+| API/MCP integrations | ✅ | ⚠️ partial |
+| Auto-captcha solving (~85%) | ✅ | ❌ |
+
+### Account Management
+| Capability | DT | T-Pilot |
+|---|---|---|
+| Marketplace (buy accounts) | ✅ | ❌ |
+| Warmup | ✅ | ✅ |
+| Trust Score | ✅ | ✅ |
+| Session duplicator | ✅ | ✅ |
+| Profile fill | ✅ | ✅ |
+| Number checker | ✅ | ✅ |
+| Chat creator | ✅ | ✅ |
+| Dialog cleaner | ✅ | ✅ |
+| Restrictions removal | ✅ | ✅ |
+| AI Protection | ✅ | ✅ |
+| Telegram folders sync | ✅ | ❌ |
+| Cloner | ✅ | ✅ |
+
+### Broadcasting
+| Capability | DT | T-Pilot |
+|---|---|---|
+| Single message broadcast | ✅ | ⚠️ basic exists |
+| Multi-phase (threephase) | ✅ | ❌ |
+| PostBot broadcast | ✅ | ❌ |
+| Smart broadcast | ✅ | ❌ |
+| Sticker broadcast | ✅ | ❌ |
+| TTL broadcast | ✅ | ❌ |
+| Voice broadcast | ✅ | ❌ |
+| Contacts broadcast | ✅ | ❌ |
+| AI uniqueization | ✅ | ⚠️ AIPostGenerator |
+| Audience filters | ✅ | ❌ |
+| Campaign stats/funnel | ✅ | ❌ |
+| Per-recipient report | ✅ | ❌ |
+| SSE live logs | ✅ | ❌ |
+
+### AI / Sales
+| Capability | DT | T-Pilot |
+|---|---|---|
+| AI auto-reply | ✅ | ✅ |
+| AI Promoter (Нейродиалоги) | ✅ ($50) | ❌ |
+| AI Sales Agent (SalesmanTab) | ✅ | ❌ |
+| Neuro-commenting | ✅ | ⚠️ basic |
+| Neuro-shilling | ✅ | ❌ |
+| AI Assistants | ✅ | ⚠️ partial |
+| Lead qualification | ✅ | ❌ |
+| Scenario preview | ✅ | ❌ |
+| Products with keywords | ✅ | ❌ |
+| ROI Predictor | ❌ | ✅ (TP differentiator) |
+| Lead Catcher | ❌ | ✅ (TP differentiator) |
+
+### Audience / Parsing
+| Capability | DT | T-Pilot |
+|---|---|---|
+| Channel parser | ✅ | ✅ |
+| Group parsing | ✅ | ⚠️ forum_scraper.py |
+| Audience users list | ✅ | ❌ |
+| Channel database | ✅ | ❌ |
+| TGStat parser | ✅ | ❌ |
+| Audience filters | ✅ | ❌ |
+
+### Growth / Social
+| Capability | DT | T-Pilot |
+|---|---|---|
+| Mass reactions | ✅ | ⚠️ basic |
+| Mass story viewing | ✅ | ❌ |
+| Story mentions | ✅ | ⚠️ StoryTags |
+| Nakrutka (SMM panel) | ✅ | ❌ |
+| Inviter | ✅ | ✅ |
+| Mass subscribe/unsubscribe | ✅ | ✅ |
+| Boost | ✅ | ✅ |
+| Username checker | ✅ | ✅ |
+| Text randomizer | ✅ | ✅ |
+
+### Business / Monetization
+| Capability | DT | T-Pilot |
+|---|---|---|
+| Products (for AI Promoter) | ✅ | ❌ |
+| Templates | ✅ | ❌ |
+| Referral program | ✅ | ❌ |
+| Subscription tiers + modules | ✅ | ❌ (open) |
+| Wallet / balance | ✅ | ❌ |
+| One-click setup | ✅ | ❌ |
+| Support ticket system | ✅ | ❌ |
+| Feature change logs | ✅ | ❌ |
+
+### T-Pilot Differentiators (not in DT)
+| Capability | DT | T-Pilot |
+|---|---|---|
+| AI Post Generator | ❌ | ✅ |
+| SEO Bot | ❌ | ✅ |
+| Telegraph Poster | ❌ | ✅ |
+| Email Sender | ❌ | ✅ |
+| Traffic Generator | ❌ | ✅ |
+| Forum Scraper | ❌ | ✅ |
+| Blast Control | ❌ | ✅ |
+| News Module | ❌ | ✅ |
+
+---
+
+## 7. Prioritised Recommendations for T-Pilot
+
+Cheapest-highest-value first.
+
+### Tier 1: Low Effort, High Value (1-2 days each)
+1. Broadcast audience filters — Folders, min_messages, has_username. Reuse existing parser. ~1 day.
+2. Campaign history + basic stats — Persist completed campaigns. T-Pilot tracks task state. ~1 day.
+3. AI message uniqueization — Wrap existing AI to rewrite per recipient. ~1 day.
+
+### Tier 2: Medium Effort, High Value (2-4 days)
+4. AI Promoter (Нейродиалоги) — Closes DT largest gap. Reuse NeuroChat/NeuroComment. ~3 days.
+5. Multi-phase (threephase) broadcast — State machine on broadcasting.py. ~2 days.
+6. SMART broadcast — Rate limiter + daily cap. ~1 day.
+
+### Tier 3: Higher Effort, Strategic (3-5 days)
+7. Built-in account marketplace — Largest DT conversion driver. ~5 days.
+8. Per-recipient campaign report — Chain viewer. ~2 days.
+9. Auto-captcha solving — ML/heuristic for Telegram. ~3 days.
+
+### Tier 4: Differentiators (4-7 days)
+10. Nakrutka — Subscriptions + reactions + views with own farm. ~3 days.
+11. Embedded Telegram Web — WebK/Telethon mini-client. ~5 days.
+12. Traffic arbitrage funnel — Pre-configured vertical scenarios. ~4 days.
+
+### Top 6 by Value
+| # | Feature | DT price | TP effort | Impact |
+|---|---|---|---|---|
+| 1 | Broadcast audience filters | bundled | 1 day | Direct conversion |
+| 2 | Campaign stats/funnel | bundled | 1 day | User retention |
+| 3 | AI uniqueization | bundled | 1 day | Spam safety |
+| 4 | AI Promoter | $50/mo | 3 days | Closes biggest gap |
+| 5 | Multi-phase broadcast | $20/mo | 2 days | 3-5x conversion |
+| 6 | SMART broadcast | $20/mo | 1 day | Stealth dispatch |
+
+---
+
+## Compliance Confirmation
+
+- No authentication attempt — all data from public HTTP(S) fetches of .js bundles
+- No mutating requests — GET only
+- No credentials or session tokens used or transmitted
+- No customer data scraped or enumerated
+- Rate limit observed — ~20 requests total
+- Gated resources noted as such
+- Turnstile token field name is gated (not in extracted CSS-only auth chunk)