Upload 137 files

.env.example

@@ -0,0 +1,19 @@
+# OpenAI 自动注册系统 - 环境变量配置示例
+# 复制此文件为 .env 并填写对应值
+
+# ── Web UI 监听地址 ──────────────────────────────────────────
+# 监听主机（默认 0.0.0.0）
+# APP_HOST=0.0.0.0
+
+# 监听端口（默认 8000）
+# APP_PORT=8000
+
+# Web UI 访问密钥（默认 admin123，强烈建议修改）
+# APP_ACCESS_PASSWORD=your_secret_password
+
+# ── 数据库 ───────────────────────────────────────────────────
+# 本地 SQLite（默认，无需配置）
+# APP_DATABASE_URL=data/database.db
+
+# 远程 PostgreSQL（优先）
+# APP_DATABASE_URL=postgresql://user:password@host:5432/dbname

.github/workflows/build.yml

@@ -0,0 +1,111 @@
+name: Multi-platform Build Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version tag, for example v1.0.0"
+        required: false
+        default: "dev"
+
+jobs:
+  build:
+    name: Build ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: windows-latest
+            source_name: codex-console.exe
+            asset_name: codex-console-windows-x64.exe
+          - os: ubuntu-latest
+            source_name: codex-console
+            asset_name: codex-console-linux-x64
+          - os: macos-latest
+            source_name: codex-console
+            asset_name: codex-console-macos-arm64
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          pip install -r requirements.txt pyinstaller
+
+      - name: Build binary
+        run: |
+          pyinstaller codex_register.spec --clean --noconfirm
+
+      - name: Rename packaged binary
+        shell: bash
+        run: |
+          mv "dist/${{ matrix.source_name }}" "dist/${{ matrix.asset_name }}"
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.asset_name }}
+          path: dist/${{ matrix.asset_name }}
+          if-no-files-found: error
+
+  release:
+    name: Create release
+    needs: build
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist/
+          merge-multiple: true
+
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: dist/*
+          generate_release_notes: true
+          body: |
+            ## codex-console
+
+            ### Download
+            | Platform | File |
+            |------|------|
+            | Windows x64 | `codex-console-windows-x64.exe` |
+            | Linux x64 | `codex-console-linux-x64` |
+            | macOS ARM64 | `codex-console-macos-arm64` |
+
+            ### Usage
+            ```bash
+            # Linux/macOS may need execute permission first
+            chmod +x codex-console-*
+
+            # Start Web UI
+            ./codex-console
+
+            # Custom port
+            ./codex-console --port 8080
+
+            # Debug mode
+            ./codex-console --debug
+
+            # Set Web UI password
+            ./codex-console --access-password mypassword
+            ```

.github/workflows/docker-publish.yml

@@ -0,0 +1,68 @@
+name: Docker Image CI
+
+on:
+  push:
+    branches: [ "master", "main" ]
+    # 当发布新版本时触发
+    tags: [ 'v*.*.*' ]
+  pull_request:
+    branches: [ "master", "main" ]
+
+env:
+  # GitHub Container Registry 的地址
+  REGISTRY: ghcr.io
+  # 镜像名称，默认为 GitHub 用户名/仓库名
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      # 如果需要签名生成的镜像，可以使用 id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # 设置 Docker Buildx 用于构建多平台镜像 (可选)
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # 登录到 Docker 镜像仓库
+      # 如果只是在 PR 中测试构建，则跳过登录
+      - name: Log in to the Container registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # 提取 Docker 镜像的元数据（标签、注释等）
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=schedule
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=sha
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      # 构建并推送 Docker 镜像
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.gitignore

@@ -0,0 +1,98 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Virtual Environment
+.venv/
+venv/
+ENV/
+env/
+uv.lock
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# Data and Logs
+data/
+logs/
+*.db
+*.sqlite
+*.sqlite3
+
+# Token files
+token_*.json
+
+# Environment
+.env
+.env.local
+*.local
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Project specific
+backups/
+/out/
+
+# Local diagnostics / migration artifacts
+*.log
+analysis_output.txt
+broken_server_logs.txt
+docker_logs_latest.txt
+latest_*.txt
+logs_*.txt
+logs_198/
+src_23.tar.gz
+src_23/
+src_23_extracted/
+*.recovered
+/.tmp_*.py
+
+# Local one-off scripts
+/check_sync.py
+/clear_and_deploy.py
+/clear_logs_198.py
+/deploy.py
+/deploy2.log
+/deploy_198.py
+/deploy_probe.py
+/download_local.py
+/fetch_198_logs.py
+/fetch_logs.py
+/fetch_logs_198.py
+/login.html
+/probe_auth_flow.py
+/pull_logs.py
+/register_198.py
+/remote_check.py
+/restore_src.py
+/rollback.py
+/run_probe_198.py
+/step1_download_good.py
+/step2_upload_to_broken.py
+/sync_23.py
+/test_openai_js.py
+/test_proxy_chatgpt*.py

CLAUDE.md

@@ -0,0 +1,181 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## 项目概览
+
+这个仓库是一个基于 Python 3.10+ 与 FastAPI 的 Web 应用，用于通过 Web UI 和带鉴权的外部 API 管理注册任务流程。默认使用 SQLite 持久化运行时状态，也支持 PostgreSQL。
+
+当前分支是一个持续维护的修复版，重点是让注册、登录、获取 token 这些链路继续适配近期上游行为变化，包括 Sentinel POW 处理，以及“先注册、再单独登录拿 token”的拆分流程。
+
+## 常用命令
+
+### 安装依赖
+
+```bash
+uv sync
+```
+
+备用方式：
+
+```bash
+pip install -r requirements.txt
+```
+
+如果使用项目元数据方式安装测试依赖：
+
+```bash
+pip install -e .[dev]
+```
+
+### 本地运行
+
+默认启动 Web UI：
+
+```bash
+python webui.py
+```
+
+指定监听地址和端口：
+
+```bash
+python webui.py --host 0.0.0.0 --port 8080
+```
+
+调试模式（同时启用文档路由）：
+
+```bash
+python webui.py --debug
+```
+
+也可以使用 `pyproject.toml` 中定义的入口：
+
+```bash
+codex-console
+```
+
+### 数据库初始化 / 维护
+
+初始化数据库与默认设置：
+
+```bash
+python -m src.database.init_db
+```
+
+检查数据库连接：
+
+```bash
+python -m src.database.init_db --check
+```
+
+重置数据库（破坏性操作）：
+
+```bash
+python -m src.database.init_db --reset
+```
+
+### 测试
+
+运行全部测试：
+
+```bash
+pytest
+```
+
+运行单个测试文件：
+
+```bash
+pytest tests/test_registration_engine.py
+```
+
+运行单个测试函数：
+
+```bash
+pytest tests/test_registration_engine.py::test_name
+```
+
+### 打包
+
+Windows：
+
+```bash
+build.bat
+```
+
+Linux/macOS：
+
+```bash
+bash build.sh
+```
+
+### Docker
+
+```bash
+docker-compose up -d
+```
+
+## 配置模型
+
+- 运行时配置主要通过 `src/config/settings.py` 存在数据库中，而不是静态配置文件。
+- `webui.py` 启动时仍会读取 `.env` 和命令行参数，然后把生效值写回数据库配置，再启动应用。
+- 从 README 和启动逻辑看，优先级是：命令行参数 > 环境变量 /.env > 数据库设置 > 代码默认值。
+- 本地默认数据库是 `data/database.db` 下的 SQLite；PostgreSQL 连接串会在 `src/database/session.py` 中做标准化处理。
+
+## 高层架构
+
+### 入口层
+
+- `webui.py` 是主进程入口，负责准备 `data/` 与 `logs/`、初始化数据库、重载设置、配置日志并启动 Uvicorn。
+- `src/web/app.py` 负责创建 FastAPI 应用、挂载静态资源和模板、注册 API 与 WebSocket 路由，并处理基于 Cookie 的简易 Web UI 登录。
+
+### Web 层
+
+- `src/web/routes/__init__.py` 统一组装 API：
+  - `/api/registration`：单任务和批量注册
+  - `/api/accounts`、`/api/email-services`、`/api/settings`、`/api/payment`
+  - `/api/upload/*`：CPA / Sub2API / Team Manager 上传集成
+  - `/api/external/*`：给第三方系统调用的外部批次接口
+- `src/web/routes/external/registration.py` 提供外部批次 API，鉴权由 `src/web/deps/external_auth.py` 中的 `X-API-Key` 逻辑控制。
+- `src/web/routes/websocket.py` 与 `src/web/task_manager.py` 负责向 Web UI 实时推送任务日志和状态。
+
+### 注册主流程
+
+- `src/web/routes/registration.py` 是用户触发注册任务的编排层，负责邮箱服务选择、代理来源解析、任务记录，以及注册后的可选上传动作。
+- `src/core/register.py` 中的 `RegistrationEngine` 是核心流程引擎，负责邮箱创建、OAuth / session 初始化、Sentinel 处理、注册/登录推进、token 获取和日志/result 汇总。
+- `src/core/openai/` 放的是与协议细节强相关的模块，例如 OAuth、浏览器/设备指纹、Sentinel POW、支付相关逻辑、token 刷新。
+- `src/core/http_client.py` 统一封装注册流程所需的 HTTP 会话行为。
+
+### 邮箱服务模型
+
+- `src/services/base.py` 定义了所有邮箱服务都要实现的抽象接口。
+- 具体实现位于 `src/services/`。
+- Outlook 相关逻辑明显更复杂，集中在 `src/services/outlook/`，里面包括 provider 实现、token 管理、邮件解析和健康检查。
+- 批量任务中的服务选择逻辑位于 `src/core/service_selection.py`。其中 Outlook 有专门限制，避免同一个已配置邮箱在多条批次任务里被静默复用。
+
+### 外部批次 API
+
+- 外部 API 不是另一套独立实现，而是对现有注册能力的封装。
+- `src/core/external_batches/service.py` 会先持久化批次、预先计算邮箱/上传目标分配、为每个 item 创建一个 `RegistrationTask`，然后复用常规注册路由里的 `run_registration_task` 来执行。
+- 批次状态通过 `ExternalRegistrationBatch` 和 `ExternalRegistrationBatchItem` 持久化，服务重启后的恢复入口挂在 `src/web/app.py` 的 startup 逻辑里。
+- 第三方接入说明文档在 `docs/temp-mail-external-api.md`、`docs/external-api-examples.md`、`docs/external-api-quickstart.md`。
+
+### 持久化层
+
+- ORM 模型定义在 `src/database/models.py`。
+- 本地核心实体主要包括 `Account`、`RegistrationTask`、`EmailService`、`Setting`、`Proxy` 以及各类上传目标配置表。
+- 外部 API 批次状态使用 `ExternalRegistrationBatch` 与 `ExternalRegistrationBatchItem` 两层结构。
+- `src/database/crud.py` 承担大部分业务 CRUD；`src/database/external_batch_crud.py` 处理批次相关持久化。
+- `src/database/session.py` 负责 engine / session 生命周期，也会在启动时执行轻量级 SQLite 自动迁移。
+
+### 上传集成
+
+- `src/core/registration_upload.py` 是注册完成后的上传分发入口。
+- 不同上传渠道的实现位于 `src/core/upload/`。
+- 上传目标选择和邮箱分配逻辑都收敛在 `src/core/service_selection.py`。
+
+## 这个仓库里特别重要的开发说明
+
+- `tests/` 下有比较完整的 pytest 测试，适合验证路由行为、任务/WebSocket 状态推送、服务选择逻辑和注册辅助函数。
+- 仓库根目录里没有发现专门的 lint/format/type-check 配置（如 `ruff`、`flake8`、`black`、`mypy` 等），不要默认认为存在固定的格式化或静态检查命令，除非后续显式加入。
+- `tests/conftest.py` 在 Windows 下 monkeypatch 了 `socket.socketpair`，这是为了让测试在该平台正常运行。
+- 打包使用的是 `codex_register.spec` + PyInstaller；`webui.py` 和 `src/web/app.py` 都对冻结环境（`sys.frozen` / `sys._MEIPASS`）做了特殊处理，修改资源路径逻辑时要特别小心。

Dockerfile

@@ -0,0 +1,37 @@
+# 使用官方 Python 基础镜像 (使用 slim 版本减小体积)
+FROM python:3.11-slim
+
+# 设置工作目录
+WORKDIR /app
+
+# 设置环境变量
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    # WebUI 默认配置
+    WEBUI_HOST=0.0.0.0 \
+    WEBUI_PORT=7860 \
+    LOG_LEVEL=info \
+    DEBUG=0 \
+    WEBUI_ACCESS_PASSWORD=admin123
+
+# 安装系统依赖
+# (curl_cffi 等库可能需要编译工具)
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        gcc \
+        python3-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+# 复制依赖文件并安装
+COPY requirements.txt .
+RUN pip install --no-cache-dir --upgrade pip \
+    && pip install --no-cache-dir -r requirements.txt
+
+# 复制项目代码
+COPY . .
+
+# 暴露端口
+EXPOSE 7860
+
+# 启动 WebUI
+CMD ["python", "webui.py", "--host", "0.0.0.0", "--port", "7860", "--access-password", "admin123"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,11 +1,252 @@
 ---
-title: Codex
-emoji: 👀
-colorFrom: yellow
+title: codex-console
+emoji: 🚀
+colorFrom: blue
 colorTo: indigo
 sdk: docker
+app_port: 7860
 pinned: false
-license: apache-2.0
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# codex-console
+
+基于 [cnlimiter/codex-manager](https://github.com/cnlimiter/codex-manager) 持续修复和维护的增强版本。
+
+这个版本的目标很直接: 把近期 OpenAI 注册链路里那些“昨天还能跑，今天突然翻车”的坑补上，让注册、登录、拿 token、打包运行都更稳一点。
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Python](https://img.shields.io/badge/Python-3.10%2B-blue.svg)](https://www.python.org/)
+
+## QQ群
+
+- 交流群: https://qm.qq.com/q/ZTCKxawxeo
+
+## 致谢
+
+首先感谢上游项目作者 [cnlimiter](https://github.com/cnlimiter) 提供的优秀基础工程。
+
+本仓库是在原项目思路和结构之上进行兼容性修复、流程调整和体验优化，适合作为一个“当前可用的修复维护版”继续使用。
+
+## 这个分支修了什么
+
+为适配当前注册链路，这个分支重点补了下面几个问题:
+
+1. 新增 Sentinel POW 求解逻辑  
+   OpenAI 现在会强制校验 Sentinel POW，原先直接传空值已经不行了，这里补上了实际求解流程。
+
+2. 注册和登录拆成两段  
+   现在注册完成后通常不会直接返回可用 token，而是跳转到绑定手机或后续页面。  
+   本分支改成“先注册成功，再单独走一次登录流程拿 token”，避免卡死在旧逻辑里。
+
+3. 去掉重复发送验证码  
+   登录流程里服务端本身会自动发送验证码邮件，旧逻辑再手动发一次，容易让新旧验证码打架。  
+   现在改成直接等待系统自动发来的那封验证码邮件。
+
+4. 修复重新登录流程的页面判断问题  
+   针对重新登录时页面流转变化，调整了登录入口和密码提交逻辑，减少卡在错误页面的情况。
+
+5. 优化终端和 Web UI 提示文案  
+   保留可读性的前提下，把一些提示改得更友好一点，出错时至少不至于像在挨骂。
+
+## 核心能力
+
+- Web UI 管理注册任务和账号数据
+- 支持批量注册、日志实时查看、基础任务管理
+- 支持多种邮箱服务接码
+- 支持 SQLite 和远程 PostgreSQL
+- 支持打包为 Windows/Linux/macOS 可执行文件
+- 更适配当前 OpenAI 注册与登录链路
+
+## 文档
+
+- [Temp Mail 域名池与外部注册 API 说明](docs/temp-mail-external-api.md)
+- [External API 调用示例](docs/external-api-examples.md)
+- [External API 第三方对接速览](docs/external-api-quickstart.md)
+- [第三方技术对接文档](docs/third-party-integration-guide.md)
+- [External API 网站内管理与 API Key 生成方案](docs/external-api-webui-management-plan.md)
+- [HTTP-Only 设备指纹补强建议](docs/http-only-device-fingerprint-hardening.md)
+
+## 环境要求
+
+- Python 3.10+
+- `uv`（推荐）或 `pip`
+
+## 安装依赖
+
+```bash
+# 使用 uv（推荐）
+uv sync
+
+# 或使用 pip
+pip install -r requirements.txt
+```
+
+## 环境变量配置
+
+可选。复制 `.env.example` 为 `.env` 后按需修改:
+
+```bash
+cp .env.example .env
+```
+
+常用变量如下:
+
+| 变量 | 说明 | 默认值 |
+| --- | --- | --- |
+| `APP_HOST` | 监听主机 | `0.0.0.0` |
+| `APP_PORT` | 监听端口 | `8000` |
+| `APP_ACCESS_PASSWORD` | Web UI 访问密钥 | `admin123` |
+| `APP_DATABASE_URL` | 数据库连接字符串 | `data/database.db` |
+
+优先级:
+
+`命令行参数 > 环境变量(.env) > 数据库设置 > 默认值`
+
+## 启动 Web UI
+
+```bash
+# 默认启动（127.0.0.1:8000）
+python webui.py
+
+# 指定地址和端口
+python webui.py --host 0.0.0.0 --port 8080
+
+# 调试模式（热重载）
+python webui.py --debug
+
+# 设置 Web UI 访问密钥
+python webui.py --access-password mypassword
+
+# 组合参数
+python webui.py --host 0.0.0.0 --port 8080 --access-password mypassword
+```
+
+说明:
+
+- `--access-password` 的优先级高于数据库中的密钥设置
+- 该参数只对本次启动生效
+- 打包后的 exe 也支持这个参数
+
+例如:
+
+```bash
+codex-console.exe --access-password mypassword
+```
+
+启动后访问:
+
+[http://127.0.0.1:8000](http://127.0.0.1:8000)
+
+## Docker 部署
+
+### 使用 docker-compose
+
+```bash
+docker-compose up -d
+```
+
+### 使用 docker run
+
+```bash
+docker run -d \
+  -p 7860:7860 \
+  --name codex-console \
+  ghcr.io/<yourname>/codex-console:latest
+```
+
+当前 Dockerfile 已经写死以下启动参数：
+
+- 监听地址：`0.0.0.0`
+- 监听端口：`7860`
+- Web UI 密码：`admin123`
+
+因此不需要再额外传环境变量。
+
+注意：
+
+- 当前方案不做持久化，容器重建后数据库和日志会丢失
+- 当前方案的目标只是保证 Web UI 能启动，不保证完整注册链路在公网容器环境可用
+
+### Hugging Face Spaces
+
+如果你要部署到 Hugging Face Spaces：
+
+1. 新建一个 **Docker Space**
+2. 把当前仓库直接推上去
+3. 不需要配置额外环境变量
+4. 不需要开启持久化存储
+5. 等待平台按仓库根目录下的 `Dockerfile` 自动构建
+
+当前 Dockerfile 会直接启动：
+
+```bash
+python webui.py --host 0.0.0.0 --port 7860 --access-password admin123
+```
+
+部署完成后，直接打开 Space 页面即可。
+
+默认登录密码：
+
+```text
+admin123
+```
+
+如果后续涉及公网 OAuth 回调，还需要把系统里的 `openai.redirect_uri` 改成真实可访问的域名地址，而不是默认的 `localhost`；但这不影响 Web UI 本身启动。
+
+## 使用远程 PostgreSQL
+
+```bash
+export APP_DATABASE_URL="postgresql://user:password@host:5432/dbname"
+python webui.py
+```
+
+也支持 `DATABASE_URL`，但优先级低于 `APP_DATABASE_URL`。
+
+## 打包为可执行文件
+
+```bash
+# Windows
+build.bat
+
+# Linux/macOS
+bash build.sh
+```
+
+Windows 打包完成后，默认会在 `dist/` 目录生成类似下面的文件:
+
+```text
+dist/codex-console-windows-X64.exe
+```
+
+如果打包失败，优先检查:
+
+- Python 是否已加入 PATH
+- 依赖是否安装完整
+- 杀毒软件是否拦截了 PyInstaller 产物
+- 终端里是否有更具体的报错日志
+
+## 项目定位
+
+这个仓库更适合作为:
+
+- 原项目的修复增强版
+- 当前注册链路的兼容维护版
+- 自己二次开发的基础版本
+
+如果你准备公开发布，建议在仓库描述里明确写上:
+
+`Forked and fixed from cnlimiter/codex-manager`
+
+这样既方便别人理解来源，也对上游作者更尊重。
+
+## 仓库命名
+
+当前仓库名:
+
+`codex-console`
+
+## 免责声明
+
+本项目仅供学习、研究和技术交流使用，请遵守相关平台和服务条款，不要用于违规、滥用或非法用途。
+
+因使用本项目产生的任何风险和后果，由使用者自行承担。

build.bat

@@ -0,0 +1,51 @@
+@echo off
+setlocal
+setlocal enabledelayedexpansion
+
+echo === Build platform: Windows ===
+
+where python >nul 2>nul
+if errorlevel 1 (
+    echo Python was not found in PATH.
+    exit /b 1
+)
+
+if exist requirements.txt (
+    echo Installing project dependencies...
+    python -m pip install -r requirements.txt
+    if errorlevel 1 (
+        echo Failed to install project dependencies.
+        exit /b 1
+    )
+)
+
+echo Installing PyInstaller...
+python -m pip install pyinstaller --quiet
+if errorlevel 1 (
+    echo Failed to install PyInstaller.
+    exit /b 1
+)
+
+echo Running PyInstaller...
+python -m PyInstaller codex_register.spec --clean --noconfirm
+if errorlevel 1 (
+    echo PyInstaller build failed.
+    exit /b 1
+)
+
+if exist dist\codex-console.exe (
+    for /f "tokens=*" %%i in ('powershell -Command "[System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture"') do set ARCH=%%i
+    set OUTPUT=dist\codex-console-windows-!ARCH!.exe
+    if exist "!OUTPUT!" del /F /Q "!OUTPUT!" >nul 2>nul
+    move /Y dist\codex-console.exe "!OUTPUT!" >nul
+    if errorlevel 1 (
+        echo === Build complete, but final rename was blocked. ===
+        echo Close any running copy of !OUTPUT! and rename dist\codex-console.exe manually if needed.
+        echo Fresh binary is available at: dist\codex-console.exe
+        exit /b 0
+    )
+    echo === Build complete: !OUTPUT! ===
+) else (
+    echo === Build failed: dist\codex-console.exe not found ===
+    exit /b 1
+)

build.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+# Cross-platform build script. Run it on the target OS you want to package for.
+
+set -e
+
+OS=$(uname -s)
+ARCH=$(uname -m)
+
+case "$OS" in
+  Darwin)
+    PLATFORM="macos"
+    EXT=""
+    ;;
+  Linux)
+    PLATFORM="linux"
+    EXT=""
+    ;;
+  MINGW*|CYGWIN*|MSYS*)
+    PLATFORM="windows"
+    EXT=".exe"
+    ;;
+  *)
+    PLATFORM="$OS"
+    EXT=""
+    ;;
+esac
+
+OUTPUT_NAME="codex-console-${PLATFORM}-${ARCH}${EXT}"
+
+echo "=== Build platform: ${PLATFORM} (${ARCH}) ==="
+echo "=== Output file: dist/${OUTPUT_NAME} ==="
+
+# Install build dependency.
+pip install pyinstaller --quiet 2>/dev/null || \
+  uv run --with pyinstaller pyinstaller --version > /dev/null 2>&1
+
+# Run PyInstaller. Prefer uv when available.
+if command -v uv &>/dev/null; then
+  uv run --with pyinstaller pyinstaller codex_register.spec --clean --noconfirm
+else
+  pyinstaller codex_register.spec --clean --noconfirm
+fi
+
+# Rename the generated binary to include platform metadata.
+rm -f "dist/${OUTPUT_NAME}"
+mv "dist/codex-console${EXT}" "dist/${OUTPUT_NAME}" 2>/dev/null || \
+  mv "dist/codex-console" "dist/${OUTPUT_NAME}" 2>/dev/null
+
+echo "=== Build complete: dist/${OUTPUT_NAME} ==="
+ls -lh "dist/${OUTPUT_NAME}"

codex_register.spec

@@ -0,0 +1,151 @@
+# -*- mode: python ; coding: utf-8 -*-
+
+import sys
+from pathlib import Path
+
+block_cipher = None
+
+a = Analysis(
+    ['webui.py'],
+    pathex=['.'],
+    binaries=[],
+    datas=[
+        ('templates', 'templates'),
+        ('static', 'static'),
+        ('src', 'src'),
+    ],
+    hiddenimports=[
+        'uvicorn.logging',
+        'uvicorn.loops',
+        'uvicorn.loops.auto',
+        'uvicorn.loops.asyncio',
+        'uvicorn.loops.uvloop',
+        'uvicorn.protocols',
+        'uvicorn.protocols.http',
+        'uvicorn.protocols.http.auto',
+        'uvicorn.protocols.http.h11_impl',
+        'uvicorn.protocols.http.httptools_impl',
+        'uvicorn.protocols.websockets',
+        'uvicorn.protocols.websockets.auto',
+        'uvicorn.protocols.websockets.websockets_impl',
+        'uvicorn.protocols.websockets.wsproto_impl',
+        'uvicorn.lifespan',
+        'uvicorn.lifespan.off',
+        'uvicorn.lifespan.on',
+        'fastapi',
+        'fastapi.middleware',
+        'fastapi.middleware.cors',
+        'fastapi.staticfiles',
+        'fastapi.templating',
+        'starlette',
+        'starlette.routing',
+        'starlette.middleware',
+        'starlette.staticfiles',
+        'starlette.templating',
+        'jinja2',
+        'sqlalchemy',
+        'sqlalchemy.orm',
+        'sqlalchemy.orm.session',
+        'sqlalchemy.orm.decl_api',
+        'sqlalchemy.ext.declarative',
+        'sqlalchemy.engine',
+        'sqlalchemy.engine.create',
+        'sqlalchemy.engine.url',
+        'sqlalchemy.pool',
+        'sqlalchemy.sql',
+        'sqlalchemy.sql.schema',
+        'sqlalchemy.sql.sqltypes',
+        'sqlalchemy.dialects',
+        'sqlalchemy.dialects.sqlite',
+        'sqlalchemy.dialects.sqlite.pysqlite',
+        'aiosqlite',
+        'pydantic',
+        'pydantic_settings',
+        'curl_cffi',
+        'curl_cffi.requests',
+        'email.mime',
+        'email.mime.text',
+        'email.mime.multipart',
+        'imaplib',
+        'h11',
+        'anyio',
+        'anyio.lowlevel',
+        'click',
+        'src.web.app',
+        'src.web.routes',
+        'src.config.settings',
+        'src.config.constants',
+        'src.database.models',
+        'src.database.session',
+        'src.database.crud',
+        'src.database.init_db',
+        'src.core.register',
+        'src.core.http_client',
+        'src.core.utils',
+        'src.services.base',
+        'src.services.tempmail',
+        'src.services.moe_mail',
+        'src.services.outlook',
+        'src.services.outlook.account',
+        'src.services.outlook.base',
+        'src.services.outlook.email_parser',
+        'src.services.outlook.health_checker',
+        'src.services.outlook.service',
+        'src.services.outlook.token_manager',
+        'src.services.outlook.providers',
+        'src.services.outlook.providers.base',
+        'src.services.outlook.providers.graph_api',
+        'src.services.outlook.providers.imap_new',
+        'src.services.outlook.providers.imap_old',
+        'src.services.outlook_legacy_mail',
+        'src.core.openai.oauth',
+        'src.core.openai.token_refresh',
+        'src.core.upload.cpa_upload',
+        'src.core.upload.sub2api_upload',
+        'src.core.upload.team_manager_upload',
+        'src.web.routes.accounts',
+        'src.web.routes.email',
+        'src.web.routes.registration',
+        'src.web.routes.settings',
+        'src.web.routes.websocket',
+        'src.web.task_manager',
+    ],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=[
+        'tkinter',
+        'matplotlib',
+        'numpy',
+        'pandas',
+        'PIL',
+        'pytest',
+    ],
+    win_no_prefer_redirects=False,
+    win_private_assemblies=False,
+    cipher=block_cipher,
+    noarchive=False,
+)
+
+pyz = PYZ(a.pure, a.zipped_data, cipher=block_cipher)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.datas,
+    [],
+    name='codex-console',
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=True,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=True,
+    disable_windowed_traceback=False,
+    argv_emulation=False,
+    target_arch=None,
+    codesign_identity=None,
+    entitlements_file=None,
+)

deploy_140.py

@@ -0,0 +1,76 @@
+import os
+import zipfile
+import paramiko
+
+HOST = '23.140.140.70'
+PASSWORD = '33nKDS80L6ipmedJ3y0j'
+PORT = 22
+USER = 'root'
+REMOTE_DIR = '/opt/codex-console'
+
+BASE_DIR = os.path.dirname(os.path.abspath(__file__))
+ZIP_FILE = os.path.join(BASE_DIR, 'deploy.zip')
+EXCLUDE_DIRS = {'.git', '.venv', 'data', 'logs', '__pycache__', '.pytest_cache', '.vscode', '.idea'}
+
+def create_zip():
+    print(f"Creating zip file {ZIP_FILE}...")
+    with zipfile.ZipFile(ZIP_FILE, 'w', zipfile.ZIP_DEFLATED) as zipf:
+        for root, dirs, files in os.walk(BASE_DIR):
+            dirs[:] = [d for d in dirs if d not in EXCLUDE_DIRS]
+            for file in files:
+                if file.endswith('.zip') or file.endswith('.pyc') or file == 'logs*.txt':
+                    continue
+                file_path = os.path.join(root, file)
+                arcname = os.path.relpath(file_path, BASE_DIR)
+                zipf.write(file_path, arcname)
+    print("Zip created successfully.")
+
+def deploy():
+    print(f"\n--- Deploying to {HOST} ---")
+    ssh = paramiko.SSHClient()
+    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+    ssh.connect(HOST, port=PORT, username=USER, password=PASSWORD, timeout=30, banner_timeout=30)
+    print("Connected.")
+
+    ssh.exec_command(f'mkdir -p {REMOTE_DIR}')
+    ssh.exec_command(f'rm -rf {REMOTE_DIR}/logs/*.log')
+    ssh.exec_command(f'rm -rf {REMOTE_DIR}/logs/*.txt')
+    ssh.exec_command(f'mkdir -p {REMOTE_DIR}/data')
+    ssh.exec_command(f'mkdir -p {REMOTE_DIR}/logs')
+
+    print("Uploading zip file...")
+    sftp = ssh.open_sftp()
+    sftp.put(ZIP_FILE, f'{REMOTE_DIR}/deploy.zip')
+    sftp.close()
+    print("Upload complete.")
+
+    print("Extracting and running docker-compose...")
+    commands = [
+        f"cd {REMOTE_DIR}",
+        "unzip -o deploy.zip > /dev/null",
+        "rm deploy.zip",
+        "(docker-compose down || docker compose down || true)",
+        "(docker-compose up -d --build || docker compose up -d --build)"
+    ]
+    command = ' && '.join(commands)
+    stdin, stdout, stderr = ssh.exec_command(command, timeout=120)
+    
+    for line in stdout:
+        print(line.strip())
+    for line in stderr:
+        print("ERR:", line.strip())
+        
+    exit_status = stdout.channel.recv_exit_status()
+    if exit_status == 0:
+        print(f"Deployment to {HOST} successful!")
+    else:
+        print(f"Deployment to {HOST} failed with exit status {exit_status}")
+    
+    ssh.close()
+
+if __name__ == '__main__':
+    create_zip()
+    deploy()
+    if os.path.exists(ZIP_FILE):
+        os.remove(ZIP_FILE)
+        print("Cleaned up local zip file.")

docker-compose.yml

@@ -0,0 +1,19 @@
+version: '3.8'
+
+services:
+  webui:
+    build: .
+    ports:
+      - "1455:1455"
+    environment:
+      - WEBUI_HOST=0.0.0.0
+      - WEBUI_PORT=1455
+      - DEBUG=0
+      - LOG_LEVEL=info
+      # 如果需要访问密码，可以在这里取消注释并设置
+      - WEBUI_ACCESS_PASSWORD=admin123
+    volumes:
+      # 挂载数据目录以持久化数据库和日志
+      - ./data:/app/data
+      - ./logs:/app/logs
+    restart: unless-stopped

docs/anti-detection-critical-analysis.md

@@ -0,0 +1,149 @@
+# HTTP-Only 设备指纹补强方案 — 批判性深度分析（v2 修订版）
+
+> 以反检测专家视角，**结合代码实查**，对原始分析文档以及 v1 批判报告的逐项复核。  
+> ⚠️ v2 修正了 v1 中 3 处事实性错误，并新增了 3 个代码中发现的**真实 bug**。
+
+---
+
+## v1 → v2 勘误表
+
+| v1 中的说法 | 判决 | 原因 |
+|---|---|---|
+| "严重低估 Turnstile" → P0 威胁 | ❌ **说错了** | 注册链路用的是 `openai-sentinel-token`（PoW only），不是 `openai-sentinel-turnstile-token`（VM 字节码）。两条链路完全独立。项目能跑通即为实证。 |
+| "`oai-echo-logs` 是 P0 级遗漏" | ❌ **说错了** | `oai-echo-logs` 是 **ChatGPT 对话链路**（`/backend-anon/f/conversation`）的 header，注册链路（`auth.openai.com/api/accounts/*`）从未出现过。混淆了两条链路。 |
+| "Auth0 内置 ML bot detection" | ⚠️ **不准确** | 代码中 OpenAI 使用的是 **自有 auth 端点**（`auth.openai.com/api/accounts/authorize/continue` 等），不是标准 Auth0 Universal Login。不能直接套用 Auth0 商业版的 bot detection 文档。 |
+| Traceparent / Datadog 应降至 P2 | ✅ **方向对但理由需修正** | 实际代码中存在格式 bug（见下文），这些 header 不仅是低 ROI，而且目前的实现**有害**。 |
+| Cookie 属性一致性是盲区 | ✅ **依然成立** | `curl_cffi` 的 cookie jar 自动处理 `Set-Cookie` 属性，不需要手动模拟。但如果有**手动硬编码 cookie**，需要确认属性匹配。 |
+| Client Hints 不完整 | ✅ **依然成立，比想象中更严重** | 整个 `src/` 目录中 **零个** `sec-ch-ua` header。 |
+
+---
+
+## 🔴 代码实查发现的真实 Bug
+
+### Bug 1：`impersonate` 版本与 User-Agent 不匹配
+
+```python
+# http_client.py L29 — 注册链路使用的 impersonate
+impersonate: str = "chrome"  # 泛版本，curl_cffi 自动选最新
+
+# http_client.py L258-259 — 硬编码的 User-Agent
+"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ... Chrome/120.0.0.0 Safari/537.36"
+```
+
+**问题**：`impersonate="chrome"` 让 curl_cffi 使用最新 Chrome 的 TLS/HTTP2 指纹（可能是 Chrome 131+），但 User-Agent 写死了 `Chrome/120.0.0.0`。TLS 指纹说 Chrome 131，UA 说 Chrome 120 —— **这是一个典型的指纹分裂信号**。
+
+**对比**：项目其他模块统一使用 `impersonate="chrome110"`，至少内部一致。
+
+**修复建议**：将 impersonate 固定为具体版本（如 `chrome120`），或动态匹配 UA 版本。
+
+---
+
+### Bug 2：`traceparent` 与 `x-datadog-trace-id` 不一致
+
+```python
+# register.py L279-288
+def _make_trace_headers(self) -> Dict[str, str]:
+    trace_id = random.randint(10 ** 17, 10 ** 18 - 1)      # 十进制整数
+    parent_id = random.randint(10 ** 17, 10 ** 18 - 1)      # 十进制整数
+    return {
+        "traceparent": f"00-{uuid.uuid4().hex}-{format(parent_id, '016x')}-01",
+        #                    ^^^^^^^^^^^^^^^^ 这是 uuid4 的 32 位 hex
+        "x-datadog-trace-id": str(trace_id),
+        #                     ^^^^^^^^^^^^^ 这是另一个随机数的十进制
+    }
+```
+
+**问题**：`traceparent` 里的 trace-id 是 `uuid4().hex`（32位hex），但 `x-datadog-trace-id` 是另一个完全不相关的十进制随机数。真实 Datadog RUM SDK 中，这两个值**必须对应同一个 trace**。这个不一致比不发这些 header 更糟糕 —— 它变成了一个"我在伪造追踪头"的强信号。
+
+**修复建议**：要么不发这些 header（推荐），要么从同一个 trace-id 派生两个值。
+
+---
+
+### Bug 3：`_submit_login_password` 发送裸 headers
+
+```python
+# register.py L456-464
+response = self.session.post(
+    OPENAI_API_ENDPOINTS["password_verify"],
+    headers={
+        "referer": "https://auth.openai.com/log-in/password",
+        "accept": "application/json",
+        "content-type": "application/json",
+    },  # ← 没有 oai-device-id, 没有 sentinel, 没有 trace, 没有 origin
+    data=json.dumps({"password": self.password}),
+)
+```
+
+**问题**：对比 `_submit_auth_start`（提交邮箱阶段），它会注入 `openai-sentinel-token`。但 `_submit_login_password`（提交密码阶段）**完全没有 sentinel**，也没有 `oai-device-id`。这造成了同一会话中两个连续请求之间的 header 风格突变。
+
+**风险**：这正是原始分析文档说的"同一会话像多个不同浏览器"的问题。
+
+**修复建议**：用 `_build_oauth_json_headers` 统一构建 headers，至少加 `origin` 和 `oai-device-id`。
+
+---
+
+## ✅ 原始文档经代码验证后的评级调整
+
+### 原文档 P0 项验证
+
+| 原文档建议 | 代码现状 | 验证结论 |
+|---|---|---|
+| **统一 session 级浏览器 profile** | `sec-ch-ua` 全项缺失；`impersonate` 与 UA 版本不匹配 | ✅ **确实是 P0**，且比文档描述的更急迫 |
+| **`oai-did` 跨域同步** | `_get_device_id` 从 `Set-Cookie` 读取，`_build_oauth_json_headers` 会注入 `oai-device-id` | ⚠️ **部分已做**，但 `_submit_login_password` 等路径丢失了 |
+| **Sentinel 按 flow 生成** | `check_sentinel` 和 `_submit_auth_start` 都硬编码 `flow: "authorize_continue"`，`password_verify` 无 sentinel | ✅ **确实需要补**，至少 password_verify 应有自己的 sentinel |
+| **Sentinel 请求补 client hints** | sentinel 请求（`http_client.py L376-380`）只有 origin/referer/content-type，无 `sec-ch-ua` | ✅ **确认缺失** |
+
+---
+
+## 修订后的优先级排序（v2 代码实证版）
+
+### P0（代码中已确认的问题）
+
+| 项目 | 证据 |
+|---|---|
+| **修复 impersonate 与 UA 版本分裂** | `impersonate="chrome"` + `Chrome/120.0.0.0` UA，TLS 层与应用层对不上 |
+| **统一关键路径的 header 构建** | `_submit_login_password` 是裸请求，和同会话其他请求风格不一致 |
+| **补 `sec-ch-ua` 系列 header** | 整个 src/ 中零个 `sec-ch-ua`，真实 Chrome 每个请求都带 |
+| **修复或移除 traceparent/datadog 头** | 当前实现的 trace-id 不一致问题反而暴露自动化 |
+
+### P1（原文档建议 + 代码验证确认有价值）
+
+| 项目 | 理由 |
+|---|---|
+| **Sentinel 按 flow 分类** | `password_verify` 完全无 sentinel，和 `authorize_continue` 形成断层 |
+| **`oai-did` 在所有 auth 请求中统一注入** | 部分路径丢失 |
+| **建立 TLS 指纹自测** | `impersonate="chrome"` 的实际行为依赖 `curl_cffi` 版本，需要客观验证 |
+
+### P2（灰度验证 / 长期观察）
+
+| 项目 | 理由 |
+|---|---|
+| `ext-oai-did` / `auth_session_logging_id` | 前端语义增强，按原文档灰度引入即可 |
+| `oai-sc` cookie 研究 | 需要抓包确认注册流程是否涉及 |
+| 注册链路 Turnstile 监控 | 当前不需要，但未来可能引入，建议在 sentinel 响应异常时记录完整响应体 |
+
+---
+
+## v1 中仍然准确的部分
+
+1. **"一致性 > 随机性"** — 核心判断正确，代码中 Bug 1-3 都是一致性问题
+2. **Cookie 属性关注** — `curl_cffi` 自动处理 `Set-Cookie` 属性，但值得确认无手动覆盖
+3. **网络环境是指纹的一部分** — datacenter IP + `curl_cffi` 的 TLS 即使匹配也不够
+4. **请求时序模拟** — 虽然 `oai-echo-logs` 不适用于 auth 链路，但步骤间延迟仍是好建议
+5. **不堆随机** — 代码实证再次证明，不一致远比缺少更危险
+
+---
+
+## 最终建议（v2）
+
+> [!IMPORTANT]
+> **最大的威胁不是"缺什么 header"，而是已经发的 header 自相矛盾。** 你的注册链路能跑通，说明 PoW + oai-did 这条路线是可行的。现在最值得投入的是修复 Bug 1-3 这种**自我暴露**的问题，而不是追加更多 header。
+
+**建议落地顺序**：
+1. 修 impersonate/UA 版本对齐（10 分钟）
+2. 统一 `_submit_login_password` 的 header 构建（30 分钟）
+3. 修复或移除 traceparent/datadog 头（15 分钟）
+4. 补 `sec-ch-ua` 系列，绑定到 session profile（1-2 小时）
+5. 后续按 P1/P2 灰度推进
+
+> 关于 headless browser 兜底：v1 的建议仍成立，但紧迫度降低。当前注册链路能跑通，先把 HTTP-only 的一致性全面修复，headless 作为长期保险即可。

docs/anti-detection-final-recommendations.md

@@ -0,0 +1,416 @@
+# HTTP-Only 注册链路反检测 — 最终完整修复建议
+
+> **版本**：v3 全量版（合并 3 轮分析）  
+> **方法论**：逐行代码审计 + 真实 Chrome 行为对照 + codex-suite-win 参考实现对比 + 防御者视角 10 维度 threat model  
+> **范围**：覆盖外壳层（HTTP/TLS）、行为层（时序/流量形状）、内核层（Sentinel PoW 载荷）
+
+---
+
+## 检测维度总览
+
+```
+┌─ 外壳层（HTTP 请求长什么样）──────────────────────────────┐
+│  TLS/H2 指纹 · HTTP headers · Client Hints · sec-fetch-*  │
+│  traceparent/datadog · 首请求导航特征                       │
+├─ 行为层（请求的节奏和模式）──────────────────────────────┤
+│  步骤间延迟 · 流量入口形状 · 跨账号统计关联              │
+│  密码/名字/生日的统计指纹                                   │
+├─ 内核层（PoW token 里嵌的环境数据）──────────────────────┤
+│  时区 vs IP 地理 · 语言签名 vs Accept-Language              │
+│  屏幕分辨率 · navigator/window 属性池 · 哈希算法版本        │
+└──────────────────────────────────────────────────────────┘
+```
+
+---
+
+## 注册链路完整请求地图
+
+| # | 端点 | 代码位置 | headers 来源 |
+|---|---|---|---|
+| ① | `GET auth.openai.com/oauth/authorize?...` | `register.py:248` | **无自定义 headers** |
+| ② | `POST sentinel.openai.com/backend-api/sentinel/req` | `http_client.py:374` | origin + referer + content-type |
+| ③ | `POST auth.openai.com/api/accounts/authorize/continue` | `register.py:372` | referer + accept + content-type + sentinel |
+| ④ | `POST auth.openai.com/api/accounts/password/verify` | `register.py:457` | **裸 headers** |
+| ⑤ | `POST auth.openai.com/api/accounts/email-otp/validate` | `register.py:2193` | **裸 headers** |
+| ⑥ | `POST auth.openai.com/api/accounts/create_account` | `register.py:2281` | **裸 headers** |
+| ⑦ | `POST auth.openai.com/oauth/token` | `oauth.py:160` | **独立一次性会话** |
+
+---
+
+## 全部问题清单与优先级
+
+### 🔴 P0 — 立即修复（每项都是可被直接检测的暴露点）
+
+---
+
+#### P0-1. Sentinel PoW 语言签名 vs Accept-Language 矛盾
+
+**代码位置**：`sentinel.py:18` vs `http_client.py:261`
+
+```python
+# sentinel.py — PoW 内部声称浏览器语言
+_LANGUAGE_SIGNATURE = "en-US,es-US,en,es"     # ← 包含西班牙语
+
+# http_client.py — HTTP 请求头
+"Accept-Language": "en-US,en;q=0.9"           # ← 只有英语
+```
+
+**问题**：同一个浏览器的语言配置在 PoW 载荷和 HTTP 请求中对不上。服务端解码 PoW 后可直接比对。
+
+**修复**：统一为 `"en-US,en"` 或从 BrowserProfile 中读取。
+
+**工时**：5 分钟
+
+---
+
+#### P0-2. Sentinel PoW 时区硬编码 EST，与代理 IP 地理位置冲突
+
+**代码位置**：`sentinel.py:29`
+
+```python
+browser_now = datetime.now(timezone(timedelta(hours=-5)))
+# → "GMT-0500 (Eastern Standard Time)"
+```
+
+**问题**：PoW 永远声称浏览器在美东时区。如果代理 IP 在欧洲/亚洲，IP 地理位置 vs PoW 时区 = 矛盾。
+
+**修复**：改用 UTC（`time.gmtime()` + `"GMT+0000 (Coordinated Universal Time)"`），和 codex-suite-win 保持一致。UTC 不暴露地理位置。
+
+**工时**：5 分钟
+
+---
+
+#### P0-3. Sentinel PoW 屏幕分辨率不是真实值
+
+**代码位置**：`sentinel.py:17`
+
+```python
+_SCREEN_SIGNATURES = (3000, 3120, 4000, 4160)
+# 没有任何真实显示器是这些分辨率
+```
+
+**修复**：替换为真实常见值，如 `"1920x1080"`、`"2560x1440"`、`"1366x768"`。codex-suite-win 使用 `"1920x1080"`。
+
+**工时**：5 分钟
+
+---
+
+#### P0-4. impersonate 版本与 User-Agent 版本分裂
+
+**代码位置**：`http_client.py:29` + `http_client.py:258`
+
+```python
+impersonate: str = "chrome"        # → TLS 层 = 最新 Chrome (131+)
+"User-Agent": "...Chrome/120.0.0.0..."   # → 应用层 = Chrome 120
+```
+
+**问题**：TLS ClientHello 的指纹对应 Chrome 131+，但 UA 声称 Chrome 120。
+
+**修复**：建立 BrowserProfile 工厂，绑定 `impersonate` 版本与 UA/sec-ch-ua：
+
+```python
+_CHROME_PROFILES = [
+    {"impersonate": "chrome120", "major": 120, "build": 6099,
+     "sec_ch_ua": '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"'},
+    {"impersonate": "chrome131", "major": 131, "build": 6778,
+     "sec_ch_ua": '"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"'},
+    # 按需扩展
+]
+```
+
+**工时**：1 小时
+
+---
+
+#### P0-5. 所有请求缺少 sec-ch-ua 三件套
+
+**代码位置**：整个 `src/` 目录 — 零个 `sec-ch-ua`
+
+Chrome 从 2021 年起**每个 HTTPS 请求默认发送**：
+
+```
+sec-ch-ua: "Chromium";v="120", "Google Chrome";v="120", "Not_A Brand";v="8"
+sec-ch-ua-mobile: ?0
+sec-ch-ua-platform: "Windows"
+```
+
+你的 7 个请求阶段全部缺失。声称是 Chrome 但不发 Chrome 默认 headers = 最基本的检测信号。
+
+**修复**：包含在 P0-4 的 BrowserProfile 中。
+
+**工时**：含在 P0-4 中
+
+---
+
+#### P0-6. 注册流程零延迟，全链路 < 2 秒完成
+
+**代码位置**：`register.py` 全流程
+
+7 个 HTTP 请求之间没有任何 `time.sleep()`，请求背靠背发出。真实用户从打开注册页到完成至少 30-120 秒。
+
+**修复**：在关键步骤间加入正态分布延迟：
+
+```python
+import random, time
+
+def _human_delay(mean=3.0, std=1.0, minimum=1.0):
+    delay = max(random.gauss(mean, std), minimum)
+    time.sleep(delay)
+```
+
+- `_get_device_id` → `_check_sentinel`：延迟 1-3秒
+- `_submit_auth_start` → `_submit_login_password`：延迟 2-5秒（"用户在输密码"）
+- `_validate_verification_code`：延迟 5-15秒（"用户在等验证码邮件"）
+- `_create_user_account`：延迟 2-4秒（"用户在填姓名和生日"）
+
+**工时**：30 分钟
+
+---
+
+#### P0-7. 阶段 ④⑤⑥ 的 headers 风格与 ③ 不一致
+
+**代码位置**：`register.py:459`、`register.py:2195`、`register.py:2283`
+
+`password_verify`、`validate_otp`、`create_account` 只有 3 行最小 headers（referer + accept + content-type），缺少：
+- `origin`
+- `oai-device-id`
+- `sec-ch-ua` 三件套
+- `sec-fetch-*` 三件套
+
+同一会话中 ③ 带了 sentinel 和更多 headers，④⑤⑥ 突然"简化" = header 风格突变。
+
+**修复**：统一使用 `profile.json_request_headers(referer)` 构建，至少加 `origin` 和 `sec-fetch-*`。
+
+**工时**：30 分钟
+
+---
+
+### 🟡 P1 — 建议修复（降低检测风险、提高耐久性）
+
+---
+
+#### P1-1. traceparent 与 x-datadog-trace-id 值不一致
+
+**代码位置**：`register.py:279-288`
+
+`traceparent` 用 `uuid4().hex` 做 trace-id，`x-datadog-trace-id` 用另一个随机十进制数。两者必须对应同一个 trace。当前实现比不发更糟糕。
+
+**修复**：**推荐直接移除**这些 headers。如需保留，从同一 trace-id 派生：
+
+```python
+trace_id_hex = uuid.uuid4().hex
+dd_trace_id = int(trace_id_hex[16:], 16)  # 低64位转十进制
+```
+
+**工时**：15 分钟
+
+---
+
+#### P1-2. 密码无特殊字符，批量可指纹
+
+**代码位置**：`constants.py:179`
+
+```python
+PASSWORD_CHARSET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+# → 所有账号密码 = [a-zA-Z0-9]{12}，无特殊字符
+```
+
+同一 IP 注册的所有账号密码都是相同字符集和长度，统计可识别。
+
+**修复**：
+
+```python
+PASSWORD_CHARSET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%&*"
+DEFAULT_PASSWORD_LENGTH = random.randint(12, 16)
+# 确保至少包含 1 特殊字符
+```
+
+**工时**：10 分钟
+
+---
+
+#### P1-3. Name 只有名没有姓
+
+**代码位置**：`constants.py:201`
+
+```python
+name = random.choice(FIRST_NAMES)  # → "James"（无姓）
+```
+
+OpenAI about-you 页面要的是 Full Name，只有一个词极罕见。
+
+**修复**：加 LAST_NAMES 列表，生成 `"James Smith"` 格式。
+
+**工时**：10 分钟
+
+---
+
+#### P1-4. 首请求（_get_device_id）无浏览器导航 headers
+
+**代码位置**：`register.py:248`
+
+```python
+response = self.session.get(self.oauth_start.auth_url, timeout=20)
+# ← 没有 Accept, 没有 Upgrade-Insecure-Requests, 没有 sec-fetch-*
+```
+
+真实浏览器导航到页面时的 headers：
+
+```
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+Upgrade-Insecure-Requests: 1
+Sec-Fetch-Dest: document
+Sec-Fetch-Mode: navigate
+Sec-Fetch-Site: none
+Sec-Fetch-User: ?1
+```
+
+**修复**：补上导航请求标准 headers。
+
+**工时**：10 分钟
+
+---
+
+#### P1-5. Sentinel navigator/window 属性池太小
+
+**代码位置**：`sentinel.py:19-20`
+
+```python
+_NAVIGATOR_KEYS = ("location", "ontransitionend", "onprogress")  # 3 个
+_WINDOW_KEYS = ("window", "document", "navigator")                # 3 个
+```
+
+codex-suite-win 有 21 个 navigator 属性、6 个 window 属性。你的 3 个会导致多次注册中频繁重复。
+
+**修复**：扩展到至少 15+ 个真实 Chrome navigator 属性。
+
+**工时**：15 分钟
+
+---
+
+#### P1-6. Sentinel 请求缺 sec-ch-ua 和 sec-fetch-*
+
+**代码位置**：`http_client.py:376-380`
+
+Sentinel 请求只有 origin/referer/content-type，缺少浏览器标准 headers。
+
+**修复**：补 `sec-ch-ua` 三件套 + `sec-fetch-dest: empty` + `sec-fetch-mode: cors` + `sec-fetch-site: cross-site`。
+
+**工时**：10 分钟
+
+---
+
+#### P1-7. Sentinel PoW 哈希算法可能不匹配当前版本
+
+**代码位置**：`sentinel.py:82`
+
+你用 SHA3-512，codex-suite-win 用 FNV-1a。这是两种不同的 challenge 协议。需要验证当前 OpenAI 注册链路使用的是哪个版本。
+
+**修复**：抓包确认 sentinel/req 响应中的 challenge 格式。如果 OpenAI 已升级，需要更新哈希算法。
+
+**工时**：1-2 小时（含调研）
+
+---
+
+#### P1-8. 注册入口跳过 chatgpt.com 前端
+
+你的流程直接 GET `auth.openai.com/oauth/authorize`，跳过了真实用户的路径：`chatgpt.com → CSRF → signin/openai → 跳转到 auth`。
+
+**修复**：模拟 chatgpt.com 入口流，注入 `ext-oai-did` + `auth_session_logging_id`。
+
+**工时**：2-3 小时
+
+---
+
+### ⚪ P2 — 灰度验证（长期增强）
+
+---
+
+#### P2-1. 跨账号统计关联
+
+同一 IP 批量注册时，所有账号共享：单一 Chrome 版本、相同密码字符集/长度、相同名字池、相同 TLS 指纹、相同注册耗时。
+
+**修复**：通过 P0-4（多版本 Profile 池）+ P1-2（密码多样化）+ P1-3（名字多样化）+ P0-6（延迟随机化）综合缓解。
+
+---
+
+#### P2-2. OAuth token exchange 使用独立会话
+
+`oauth.py:160` 使用 `cffi_requests.post` 而非 `self.session.post`，不携带前面的 cookies。
+
+**修复**：改为使用主会话发送 token exchange 请求。
+
+**工时**：30 分钟
+
+---
+
+#### P2-3. 出生年份均匀分布
+
+```python
+birth_year = random.randint(current_year - 45, current_year - 18)
+# → 均匀分布，但真人年龄是正态分布
+```
+
+**修复**：改为正态分布 `int(random.gauss(28, 6))`，限制在 18-45 岁。
+
+**工时**：10 分钟
+
+---
+
+#### P2-4. ext-oai-did / auth_session_logging_id
+
+codex-suite-win 在 signin 时注入这两个参数，你的项目没有。
+
+**修复**：在 OAuth 入口流中补充。
+
+**工时**：含在 P1-8 中
+
+---
+
+## 修复依赖图与落地顺序
+
+```mermaid
+graph TD
+    A["P0-4 BrowserProfile 工厂"] --> B["P0-5 sec-ch-ua 全覆盖"]
+    A --> C["P0-7 统一 header 构建"]
+    A --> D["P1-6 Sentinel 补 headers"]
+    A --> G["P1-4 首请求导航 headers"]
+    
+    E["P0-1 PoW 语言签名"] --> |独立| E
+    F["P0-2 PoW 时区"] --> |独立| F
+    H["P0-3 PoW 屏幕分辨率"] --> |独立| H
+    I["P0-6 步骤间延迟"] --> |独立| I
+    
+    C --> J["P1-1 移除 traceparent"]
+    
+    K["P1-2 密码特殊字符"] --> |独立| K
+    L["P1-3 Name 加姓"] --> |独立| L
+```
+
+### 推荐执行顺序
+
+| 批次 | 内容 | 总工时 | 效果 |
+|---|---|---|---|
+| **第 1 批** | P0-1 + P0-2 + P0-3（PoW 内部 3 个矛盾） | 15 分钟 | 消除 PoW 载荷的内部自相矛盾 |
+| **第 2 批** | P0-6（加延迟） + P1-2（密码）+ P1-3（姓名） | 50 分钟 | 消除行为层最明显的批量特征 |
+| **第 3 批** | P0-4 + P0-5（BrowserProfile + sec-ch-ua） | 1 小时 | 消除 TLS/UA 分裂和 Client Hints 缺失 |
+| **第 4 批** | P0-7 + P1-4 + P1-6（统一 headers） | 50 分钟 | 消除 header 风格突变 |
+| **第 5 批** | P1-1 + P1-5 + P1-7 | 2.5 小时 | 清理 traceparent / 扩展 PoW 属性池 / 确认哈希算法 |
+| **第 6 批** | P1-8 + P2-*（入口流 + 灰度项） | 3-4 小时 | 流量形状对齐 |
+
+---
+
+## 修复后的覆盖率预估
+
+| 侦察维度 | 修复前 | 第 1-2 批后 | 第 3-4 批后 | 全部完成后 |
+|---|---|---|---|---|
+| TLS/HTTP2 指纹 | ⚠️ 版本不匹配 | ⚠️ | ✅ | ✅ |
+| HTTP headers 一致性 | ❌ 3 个裸端点 | ❌ | ✅ | ✅ |
+| Client Hints | ❌ 零个 | ❌ | ✅ | ✅ |
+| Datadog 追踪头 | ❌ 值矛盾 | ❌ | ❌ | ✅ |
+| 请求时序/节奏 | ❌ 零延迟 | ✅ | ✅ | ✅ |
+| 流量入口形状 | ❌ 跳过前端 | ❌ | ❌ | ✅ |
+| 账号数据统计模式 | ❌ 批量可指纹 | ✅ | ✅ | ✅ |
+| 首请求导航特征 | ❌ 无 headers | ❌ | ✅ | ✅ |
+| PoW 内部环境一致性 | ❌ 3 处矛盾 | ✅ | ✅ | ✅ |
+| 跨账号统计关联 | ❌ 单一 profile | ⚠️ | ✅ | ✅ |

docs/external-api-examples.md

@@ -0,0 +1,524 @@
+# External API 调用示例
+
+本文档提供外部注册 API 的最常用调用示例，便于脚本、面板或第三方系统直接接入。
+
+相关主说明见：
+
+- [Temp Mail 域名池与外部注册 API 说明](temp-mail-external-api.md)
+
+---
+
+## 1. 基本约定
+
+假设你的服务地址为：
+
+```text
+http://127.0.0.1:8000/api
+```
+
+假设外部 API Key 为：
+
+```text
+your_api_key
+```
+
+所有请求都需要带：
+
+```http
+X-API-Key: your_api_key
+```
+
+这个值的来源是项目管理员在系统配置里设置的 `external_api_key`。  
+当前版本没有开放“申请/查询 API Key”接口，第三方只能由管理员直接发放。
+
+---
+
+## 2. 查询能力
+
+### curl
+
+```bash
+curl -X GET "http://127.0.0.1:8000/api/external/capabilities" \
+  -H "X-API-Key: your_api_key"
+```
+
+### Python
+
+```python
+import requests
+
+resp = requests.get(
+    "http://127.0.0.1:8000/api/external/capabilities",
+    headers={"X-API-Key": "your_api_key"},
+    timeout=30,
+)
+print(resp.status_code)
+print(resp.json())
+```
+
+假设返回里有：
+
+```json
+{
+  "email_types": [
+    {
+      "type": "temp_mail",
+      "services": [
+        {"id": 3, "name": "Worker temp mail A"},
+        {"id": 7, "name": "Worker temp mail B"}
+      ]
+    }
+  ],
+  "upload_providers": [
+    {
+      "provider": "sub2api",
+      "services": [
+        {"id": 1, "name": "sub2-main"},
+        {"id": 4, "name": "sub2-backup"}
+      ]
+    }
+  ]
+}
+```
+
+那么：
+
+- `email.service_id=3` 就是 `Worker temp mail A`
+- `email.service_id=7` 就是 `Worker temp mail B`
+- `upload.service_id=1` 就是 `sub2-main`
+- `upload.service_id=4` 就是 `sub2-backup`
+
+不要自己猜数字含义，始终以 `capabilities` 返回结果为准。
+
+---
+
+## 3. 创建注册批次
+
+### 3.1 使用 temp_mail，不上传
+
+#### curl
+
+```bash
+curl -X POST "http://127.0.0.1:8000/api/external/registration/batches" \
+  -H "Content-Type: application/json" \
+  -H "X-API-Key: your_api_key" \
+  -d '{
+    "count": 3,
+    "email": {
+      "type": "temp_mail"
+    },
+    "upload": {
+      "enabled": false
+    },
+    "execution": {
+      "mode": "pipeline",
+      "concurrency": 1,
+      "interval_min": 5,
+      "interval_max": 10
+    }
+  }'
+```
+
+#### Python
+
+```python
+import requests
+
+payload = {
+    "count": 3,
+    "email": {"type": "temp_mail"},
+    "upload": {"enabled": False},
+    "execution": {
+        "mode": "pipeline",
+        "concurrency": 1,
+        "interval_min": 5,
+        "interval_max": 10,
+    },
+}
+
+resp = requests.post(
+    "http://127.0.0.1:8000/api/external/registration/batches",
+    headers={
+        "X-API-Key": "your_api_key",
+        "Content-Type": "application/json",
+    },
+    json=payload,
+    timeout=30,
+)
+
+print(resp.status_code)
+print(resp.json())
+```
+
+---
+
+### 3.2 指定某个邮箱服务并自动上传到 sub2api
+
+#### curl
+
+```bash
+curl -X POST "http://127.0.0.1:8000/api/external/registration/batches" \
+  -H "Content-Type: application/json" \
+  -H "X-API-Key: your_api_key" \
+  -d '{
+    "count": 5,
+    "idempotency_key": "batch-demo-001",
+    "email": {
+      "type": "temp_mail",
+      "service_id": 1
+    },
+    "upload": {
+      "enabled": true,
+      "provider": "sub2api",
+      "service_id": 1
+    },
+    "execution": {
+      "mode": "parallel",
+      "concurrency": 3,
+      "interval_min": 0,
+      "interval_max": 0
+    }
+  }'
+```
+
+#### Python
+
+```python
+import requests
+
+payload = {
+    "count": 5,
+    "idempotency_key": "batch-demo-001",
+    "email": {
+        "type": "temp_mail",
+        "service_id": 1,
+    },
+    "upload": {
+        "enabled": True,
+        "provider": "sub2api",
+        "service_id": 1,
+    },
+    "execution": {
+        "mode": "parallel",
+        "concurrency": 3,
+        "interval_min": 0,
+        "interval_max": 0,
+    },
+}
+
+resp = requests.post(
+    "http://127.0.0.1:8000/api/external/registration/batches",
+    headers={
+        "X-API-Key": "your_api_key",
+        "Content-Type": "application/json",
+    },
+    json=payload,
+    timeout=30,
+)
+
+data = resp.json()
+print(resp.status_code, data)
+batch_uuid = data["batch_uuid"]
+```
+
+> 说明：
+>
+> - 首次创建一般返回 `202`
+> - 如果 `idempotency_key` 命中历史批次，返回 `200`
+
+---
+
+### 3.3 不指定 service_id，交给系统自动选择
+
+```python
+import requests
+
+payload = {
+    "count": 2,
+    "email": {
+        "type": "temp_mail"
+    },
+    "upload": {
+        "enabled": True,
+        "provider": "sub2api"
+    },
+    "execution": {
+        "mode": "pipeline",
+        "concurrency": 1,
+        "interval_min": 0,
+        "interval_max": 0
+    }
+}
+
+resp = requests.post(
+    "http://127.0.0.1:8000/api/external/registration/batches",
+    headers={
+        "X-API-Key": "your_api_key",
+        "Content-Type": "application/json",
+    },
+    json=payload,
+    timeout=30,
+)
+
+print(resp.status_code)
+print(resp.json())
+```
+
+适用场景：
+
+- 你不关心固定某个邮箱服务
+- 你不关心固定某个上传目标
+- 只希望系统按当前可用配置自动兜底选择
+
+---
+
+## 附：`failure_category` 示例
+
+`failure_category` 是给程序消费的稳定字段，允许值只有：
+
+- `config`
+- `business`
+- `transient`
+- `null`
+
+### 示例 1：未失败批次
+
+```json
+{
+  "batch_uuid": "0f8fad5b-d9cb-469f-a165-70867728950e",
+  "status": "pending",
+  "requested_count": 3,
+  "completed_count": 0,
+  "success_count": 0,
+  "failed_count": 0,
+  "upload_success_count": 0,
+  "upload_failed_count": 0,
+  "failure_reason": null,
+  "failure_category": null,
+  "recent_errors": [],
+  "idempotent_replay": false
+}
+```
+
+### 示例 2：可重试失败
+
+```json
+{
+  "batch_uuid": "0f8fad5b-d9cb-469f-a165-70867728950e",
+  "status": "failed",
+  "requested_count": 3,
+  "completed_count": 1,
+  "success_count": 0,
+  "failed_count": 1,
+  "upload_success_count": 0,
+  "upload_failed_count": 0,
+  "failure_reason": "upstream timeout",
+  "failure_category": "transient",
+  "recent_errors": [
+    "provider timeout"
+  ],
+  "idempotent_replay": false
+}
+```
+
+### 示例 3：配置问题失败
+
+```json
+{
+  "batch_uuid": "0f8fad5b-d9cb-469f-a165-70867728950e",
+  "status": "failed",
+  "requested_count": 3,
+  "completed_count": 0,
+  "success_count": 0,
+  "failed_count": 0,
+  "upload_success_count": 0,
+  "upload_failed_count": 0,
+  "failure_reason": "upload service not configured",
+  "failure_category": "config",
+  "recent_errors": [
+    "upload provider sub2api has no configured service"
+  ],
+  "idempotent_replay": false
+}
+```
+
+### 示例 4：cancel 响应
+
+`POST /api/external/registration/batches/{batch_uuid}/cancel` 也可能返回 `failure_category`，只是为了和其他批次响应保持一致：
+
+```json
+{
+  "batch_uuid": "0f8fad5b-d9cb-469f-a165-70867728950e",
+  "status": "cancelled",
+  "failure_reason": null,
+  "failure_category": null
+}
+```
+
+---
+
+## 4. 查询批次状态
+
+### curl
+
+```bash
+curl -X GET "http://127.0.0.1:8000/api/external/registration/batches/<batch_uuid>" \
+  -H "X-API-Key: your_api_key"
+```
+
+### Python
+
+```python
+import requests
+import time
+
+batch_uuid = "replace-with-real-batch-uuid"
+
+while True:
+    resp = requests.get(
+        f"http://127.0.0.1:8000/api/external/registration/batches/{batch_uuid}",
+        headers={"X-API-Key": "your_api_key"},
+        timeout=30,
+    )
+    data = resp.json()
+    print(data)
+
+    if data["status"] in {"completed", "completed_partial", "failed", "cancelled"}:
+        break
+
+    time.sleep(5)
+```
+
+---
+
+## 5. 取消批次
+
+### curl
+
+```bash
+curl -X POST "http://127.0.0.1:8000/api/external/registration/batches/<batch_uuid>/cancel" \
+  -H "X-API-Key: your_api_key"
+```
+
+### Python
+
+```python
+import requests
+
+batch_uuid = "replace-with-real-batch-uuid"
+
+resp = requests.post(
+    f"http://127.0.0.1:8000/api/external/registration/batches/{batch_uuid}/cancel",
+    headers={"X-API-Key": "your_api_key"},
+    timeout=30,
+)
+
+print(resp.status_code)
+print(resp.json())
+```
+
+---
+
+## 6. 常见返回示例
+
+### 6.1 创建成功
+
+```json
+{
+  "batch_uuid": "0f8fad5b-d9cb-469f-a165-70867728950e",
+  "status": "pending",
+  "requested_count": 3,
+  "completed_count": 0,
+  "success_count": 0,
+  "failed_count": 0,
+  "upload_success_count": 0,
+  "upload_failed_count": 0,
+  "failure_reason": null,
+  "created_at": "2026-03-27T12:00:00",
+  "started_at": null,
+  "completed_at": null,
+  "recent_errors": [],
+  "idempotent_replay": false
+}
+```
+
+### 6.2 参数错误
+
+```json
+{
+  "detail": [
+    {
+      "type": "value_error",
+      "loc": ["body"],
+      "msg": "Value error, upload.provider is required when upload.enabled is true",
+      "input": {}
+    }
+  ]
+}
+```
+
+### 6.3 批次不存在
+
+```json
+{
+  "detail": "batch_not_found"
+}
+```
+
+---
+
+## 7. 最简 Python 封装示例
+
+```python
+import time
+import requests
+
+
+class ExternalRegisterClient:
+    def __init__(self, base_url: str, api_key: str):
+        self.base_url = base_url.rstrip("/")
+        self.session = requests.Session()
+        self.session.headers.update({"X-API-Key": api_key})
+
+    def capabilities(self):
+        return self.session.get(f"{self.base_url}/external/capabilities", timeout=30).json()
+
+    def create_batch(self, payload: dict):
+        return self.session.post(
+            f"{self.base_url}/external/registration/batches",
+            json=payload,
+            timeout=30,
+        ).json()
+
+    def get_batch(self, batch_uuid: str):
+        return self.session.get(
+            f"{self.base_url}/external/registration/batches/{batch_uuid}",
+            timeout=30,
+        ).json()
+
+    def cancel_batch(self, batch_uuid: str):
+        return self.session.post(
+            f"{self.base_url}/external/registration/batches/{batch_uuid}/cancel",
+            timeout=30,
+        ).json()
+
+    def wait_batch(self, batch_uuid: str, interval: int = 5):
+        while True:
+            data = self.get_batch(batch_uuid)
+            if data["status"] in {"completed", "completed_partial", "failed", "cancelled"}:
+                return data
+            time.sleep(interval)
+
+
+client = ExternalRegisterClient("http://127.0.0.1:8000/api", "your_api_key")
+
+batch = client.create_batch({
+    "count": 2,
+    "email": {"type": "temp_mail"},
+    "upload": {"enabled": False},
+    "execution": {"mode": "pipeline", "concurrency": 1, "interval_min": 0, "interval_max": 0},
+})
+
+result = client.wait_batch(batch["batch_uuid"])
+print(result)
+```

docs/external-api-quickstart.md

@@ -0,0 +1,309 @@
+# External API 第三方对接速览
+
+如果你是第三方调用方，只需要记住下面这套最小流程。
+
+详细字段说明见：
+
+- [Temp Mail 域名池与外部注册 API 说明](temp-mail-external-api.md)
+- [External API 调用示例](external-api-examples.md)
+
+---
+
+## 1. 先查能力
+
+调用：
+
+```http
+GET /api/external/capabilities
+```
+
+目的：
+
+- 看当前支持哪些邮箱类型
+- 看有哪些上传目标可用
+- 看 `temp_mail` 是否有可用服务
+
+你要重点关注返回中的：
+
+- `email_types[].type`
+- `email_types[].services[].id`
+- `email_types[].services[].name`
+- `upload_providers[].provider`
+- `upload_providers[].services[].id`
+- `upload_providers[].services[].name`
+
+示例：
+
+```json
+{
+  "email_types": [
+    {
+      "type": "temp_mail",
+      "available": true,
+      "services": [
+        {"id": 3, "name": "Worker temp mail A", "priority": 0},
+        {"id": 7, "name": "Worker temp mail B", "priority": 0}
+      ]
+    }
+  ],
+  "upload_providers": [
+    {
+      "provider": "sub2api",
+      "available": true,
+      "services": [
+        {"id": 1, "name": "sub2-main", "priority": 0},
+        {"id": 4, "name": "sub2-backup", "priority": 10}
+      ]
+    }
+  ]
+}
+```
+
+这时：
+
+- `email.service_id=3` 表示选 `Worker temp mail A`
+- `email.service_id=7` 表示选 `Worker temp mail B`
+- `upload.service_id=1` 表示选 `sub2-main`
+- `upload.service_id=4` 表示选 `sub2-backup`
+
+> 不是 0/1 猜出来的，而是以 `capabilities` 当前返回的 `id + name` 为准。
+
+---
+
+## 2. 再创建批次
+
+调用：
+
+```http
+POST /api/external/registration/batches
+```
+
+你只需要决定 4 件事：
+
+1. 要注册多少个：`count`
+2. 用哪种邮箱：`email.type`
+3. 是否上传：`upload.enabled`
+4. 怎么执行：`execution.mode`
+
+最小示例：
+
+```json
+{
+  "count": 10,
+  "email": {
+    "type": "temp_mail"
+  },
+  "upload": {
+    "enabled": false
+  },
+  "execution": {
+    "mode": "pipeline",
+    "concurrency": 1,
+    "interval_min": 0,
+    "interval_max": 0
+  }
+}
+```
+
+如果你不传：
+
+- `email.service_id`
+- `upload.service_id`
+
+则系统会自动选择当前可用服务。
+
+如果你想固定某一个邮箱服务或上传目标，就必须先通过 `capabilities` 拿到对应 `id`。
+
+---
+
+## 3. 保存 `batch_uuid`
+
+创建成功后，响应里会返回：
+
+```json
+{
+  "batch_uuid": "..."
+}
+```
+
+后续所有查询和取消都依赖这个值。
+
+---
+
+## 4. 轮询状态
+
+调用：
+
+```http
+GET /api/external/registration/batches/{batch_uuid}
+```
+
+你只需要关注：
+
+- `status`
+- `requested_count`
+- `completed_count`
+- `success_count`
+- `failed_count`
+- `upload_success_count`
+- `upload_failed_count`
+- `recent_errors`
+
+终态只有这几个：
+
+- `completed`
+- `completed_partial`
+- `failed`
+- `cancelled`
+
+---
+
+## 5. 如需终止就取消
+
+调用：
+
+```http
+POST /api/external/registration/batches/{batch_uuid}/cancel
+```
+
+仅 `pending` / `running` 批次可以取消。
+
+---
+
+## 6. 推荐调用策略
+
+### 推荐 1：始终传 `idempotency_key`
+
+这样你的上游系统在重试创建请求时，不会重复创建同一批任务。
+
+### 推荐 2：先看 `capabilities`，再决定参数
+
+不要写死：
+
+- 邮箱类型
+- 上传 provider
+- service_id
+
+否则后台一改配置，你的调用方就会直接打空。
+
+尤其不要假设：
+
+- `1` 永远是某个邮箱
+- `1` 永远是某个上传渠道
+
+`service_id` 的意义完全取决于当前环境里的实际配置。
+
+### 推荐 3：把“成功标准”定义成批次维度
+
+不要要求“必须全部成功”。
+
+更合理的是读取：
+
+- `success_count`
+- `failed_count`
+
+再由你的系统决定是否接受这次结果。
+
+---
+
+## 7. 常见错误处理
+
+| 状态码 | 含义 | 建议处理 |
+| --- | --- | --- |
+| `401` | API Key 错误 | 检查请求头 |
+| `403` | 外部 API 未启用 | 联系后台启用 |
+| `404` | 批次不存在 | 检查 `batch_uuid` |
+| `422` | 请求体格式不合法 | 修正参数结构 |
+| `400` | 业务参数非法 | 修正业务参数 |
+| `503` | 服务暂时不可用 | 稍后重试 |
+
+---
+
+## 8. 第三方最小接入步骤
+
+建议接入顺序：
+
+1. 接入 `GET /capabilities`
+2. 接入 `POST /batches`
+3. 接入 `GET /batches/{batch_uuid}`
+4. 最后再接 `POST /cancel`
+
+这样最快能形成闭环。
+
+---
+
+## 9. 一句话理解
+
+外部调用方只负责：
+
+- 下发批次
+- 轮询状态
+- 读取成功/失败统计
+
+系统内部负责：
+
+- 选邮箱
+- 真正执行注册
+- 上传账号
+- 失败回收与重启恢复
+
+---
+
+## 10. API Key 从哪里拿
+
+外部调用方使用的：
+
+```http
+X-API-Key: 你的APIKey
+```
+
+这个值不是通过接口获取的，而是由系统管理员在本项目配置里设置后，直接发给对接方。
+
+---
+
+## 11. `failure_category` 字段
+
+批次响应现在会额外返回：
+
+```json
+"failure_category": null
+```
+
+或：
+
+```json
+"failure_category": "config"
+```
+
+允许值只有四种：
+
+- `config`
+- `business`
+- `transient`
+- `null`
+
+推荐按下面方式消费：
+
+- `transient`：可按你的策略做退避重试
+- `config`：不要自动重试，先人工检查配置
+- `business`：不要自动重试，先人工检查业务约束
+- `null`：当前批次还没有失败分类，通常表示批次未失败
+
+说明：
+
+- `failure_reason` 继续保留，主要给人看
+- `failure_category` 主要给程序判断
+- `POST /api/external/registration/batches/{batch_uuid}/cancel` 的响应也可能带上该字段；这是为了和其他批次响应保持一致，不需要时可直接忽略
+
+### 返回规则
+
+- `pending` / `running` / `completed` / `completed_partial` / `cancelled`
+  - `failure_category = null`
+- `failed`
+  - `failure_category` 一定是 `config | business | transient` 之一
+
+也就是说：
+
+- 对接方自己拿不到
+- 必须由项目维护者提供
+- 如果项目维护者修改了 Key，对接方也要同步更新请求头

docs/external-api-webui-management-plan.md

@@ -0,0 +1,413 @@
+# External API 网站内管理与 API Key 生成方案
+
+本文档是**内部实现方案文档**，用于后续开发“在网站设置页直接启用/关闭 External API，并生成/管理 API Key”功能。
+
+这不是给第三方调用方看的文档。  
+第三方对接请看：
+
+- [第三方技术对接文档](third-party-integration-guide.md)
+- [External API 调用示例](external-api-examples.md)
+- [Temp Mail 域名池与外部注册 API 说明](temp-mail-external-api.md)
+
+---
+
+## 1. 目标
+
+在网站设置页中直接提供一块 **External API 管理区域**，让管理员可以：
+
+- 启用 / 关闭 External API
+- 查看当前是否已配置 API Key
+- 一键生成新的 API Key
+- 手动设置自定义 API Key
+- 复制对接所需的 Base URL / Header / 文案
+
+目标结果是：
+
+1. 管理员不需要手动改数据库或配置文件
+2. 第三方对接信息可以直接从网站界面获得
+3. API Key 的展示与重置行为可控，不泄漏旧 Key
+
+---
+
+## 2. 当前基础
+
+项目当前已经具备以下底座能力：
+
+### 2.1 配置项已存在
+
+系统配置中已经有：
+
+- `external_api_enabled`
+- `external_api_key`
+
+### 2.2 外部鉴权已存在
+
+当前 External API 鉴权已经生效，固定使用：
+
+```http
+X-API-Key: <api_key>
+```
+
+并读取 `external_api_enabled`、`external_api_key` 进行校验。
+
+### 2.3 设置页架构已存在
+
+当前设置页已经采用成熟的三层模式：
+
+- `templates/settings.html`
+- `static/js/settings.js`
+- `src/web/routes/settings.py`
+
+因此本次不是重做设置系统，而是在现有模式上新增一个“外部 API”分区。
+
+---
+
+## 3. 页面设计
+
+### 3.1 新增标签页
+
+在设置页 tabs 中新增一个标签：
+
+- `外部 API`
+
+该标签页内新增一张独立卡片，用于配置和展示 External API 状态。
+
+### 3.2 页面展示内容
+
+页面需要展示：
+
+- `启用 External API` 开关
+- 当前状态：
+  - 未启用
+  - 已启用但未配置 Key
+  - 已启用且已配置 Key
+- Base URL
+- Auth Header
+- 当前 Key 状态（仅掩码）
+- 操作按钮
+
+### 3.3 页面按钮
+
+页面提供以下按钮：
+
+- `保存设置`
+- `生成新 API Key`
+- `复制当前 Key`
+- `复制对接信息`
+
+说明：
+
+- `复制当前 Key` 仅在“本次刚生成 / 本次刚手动保存新 Key”后可用
+- 页面刷新后只保留掩码，不长期展示完整旧 Key
+
+### 3.4 页面固定文案
+
+页面上必须明确展示：
+
+- `Base URL: ${location.origin}/api`
+- `Auth Header: X-API-Key`
+- “重新生成后旧 Key 立即失效”
+- “第三方应先调用 /api/external/capabilities 获取 service_id 对应关系”
+
+---
+
+## 4. 后端接口设计
+
+在 `src/web/routes/settings.py` 中新增一组专用接口：
+
+- `GET /api/settings/external-api`
+- `POST /api/settings/external-api`
+- `POST /api/settings/external-api/generate`
+
+### 4.1 GET /api/settings/external-api
+
+作用：
+
+- 返回当前 External API 状态与展示信息
+
+返回字段：
+
+```json
+{
+  "enabled": true,
+  "has_api_key": true,
+  "api_key_masked": "sk_live_****abcd",
+  "api_key_header": "X-API-Key",
+  "base_url": "http://example.com/api"
+}
+```
+
+规则：
+
+- 不返回完整旧 Key
+- `base_url` 可后端返回，也可前端覆盖展示为 `${location.origin}/api`
+- `api_key_header` 固定为 `X-API-Key`
+
+### 4.2 POST /api/settings/external-api
+
+作用：
+
+- 保存启用状态
+- 可选手动设置新的 API Key
+
+请求体：
+
+```json
+{
+  "enabled": true,
+  "api_key": "custom_key_optional"
+}
+```
+
+规则：
+
+- `enabled` 必填
+- `api_key` 可选
+- 若 `api_key` 未传或为空字符串，则保持原值不变
+- 若 `api_key` 有值，则覆盖旧 Key
+
+返回体：
+
+```json
+{
+  "success": true,
+  "message": "External API settings updated",
+  "generated_api_key": "only_when_new_key_is_set",
+  "api_key_masked": "sk_live_****abcd"
+}
+```
+
+规则：
+
+- 只有本次确实设置了新 Key 时，才返回一次性明文
+- 否则只返回掩码
+
+### 4.3 POST /api/settings/external-api/generate
+
+作用：
+
+- 一键生成新 API Key
+
+生成策略固定为：
+
+```python
+secrets.token_urlsafe(32)
+```
+
+返回体：
+
+```json
+{
+  "success": true,
+  "message": "External API key regenerated",
+  "generated_api_key": "new_generated_key",
+  "api_key_masked": "new_****mask"
+}
+```
+
+规则：
+
+- 新 Key 生成后立即覆盖旧 Key
+- 旧 Key 立即失效
+- 完整明文只在本次响应里返回一次
+
+---
+
+## 5. 前端交互规则
+
+在 `static/js/settings.js` 中新增一组 External API 专用逻辑。
+
+### 5.1 页面加载
+
+设置页加载时：
+
+1. 请求 `GET /api/settings/external-api`
+2. 渲染启用状态
+3. 渲染 `has_api_key`
+4. 渲染掩码值
+5. 渲染 Base URL / Header
+
+### 5.2 保存行为
+
+点击“保存设置”时：
+
+- 如果 Key 输入框为空：
+  - 仅保存 `enabled`
+  - 不修改现有 Key
+- 如果 Key 输入框非空：
+  - 将该值作为新 Key ���存
+  - 成功后前端显示本次返回的明文 Key
+
+### 5.3 生成行为
+
+点击“生成新 API Key”时：
+
+1. 弹确认提示
+2. 调用 `POST /api/settings/external-api/generate`
+3. 成功后显示：
+   - 新生成的完整 Key
+   - 复制按钮
+   - “旧 Key 已失效”提示
+
+### 5.4 复制行为
+
+#### 复制当前 Key
+
+仅当页面内存中存在“本次刚生成 / 刚保存”的完整 Key 时启用。
+
+#### 复制对接信息
+
+自动拼接一段文本，包含：
+
+- Base URL
+- `X-API-Key`
+- 4 个 external API 接口
+- `service_id` 来自 capabilities 的说明
+
+建议复制内容固定为：
+
+```text
+Base URL:
+http://your-domain:8000/api
+
+Auth Header:
+X-API-Key: your_api_key
+
+Available Endpoints:
+GET /external/capabilities
+POST /external/registration/batches
+GET /external/registration/batches/{batch_uuid}
+POST /external/registration/batches/{batch_uuid}/cancel
+
+注意：
+service_id 不要猜，必须来自 GET /external/capabilities 返回的 id。
+```
+
+### 5.5 Base URL 显示规则
+
+前端展示统一使用：
+
+```js
+`${location.origin}/api`
+```
+
+这样可以兼容：
+
+- 直接 IP 访问
+- 域名访问
+- 反向代理
+
+---
+
+## 6. 安全策略
+
+本期实现固定采用以下策略：
+
+### 6.1 不返回完整旧 Key
+
+- `GET /api/settings/external-api` 不允许返回完整旧 Key
+- 页面刷新后只显示掩码
+
+### 6.2 一次性明文展示
+
+完整明文只允许在以下场景返回一次：
+
+- 手动设置了新 Key
+- 点击生成了新 Key
+
+### 6.3 重新生成立即失效
+
+- 新 Key 生效后旧 Key 立即作废
+- 不支持新旧 Key 并存
+
+### 6.4 本期不做项
+
+本期明确不做：
+
+- 多 Key 并存
+- Key 历史记录
+- Key 过期时间
+- Key 权限分级
+- Key 审计日志
+- 第三方自助申请 Key
+
+---
+
+## 7. 测试与验收
+
+### 7.1 后端测试
+
+至少覆盖以下场景：
+
+- `GET /api/settings/external-api`
+  - 未启用、未配置 Key
+  - 已启用、已配置 Key
+- `POST /api/settings/external-api`
+  - 仅更新 `enabled`
+  - 手动设置新 Key
+- `POST /api/settings/external-api/generate`
+  - 成功生成新 Key
+- 鉴权联动
+  - 新 Key 可用
+  - 旧 Key 失效
+  - External API 关闭后统一返回 `403`
+
+### 7.2 前端测试
+
+至少覆盖：
+
+- 设置页新增“外部 API”标签
+- 区块成功渲染
+- 能展示 Base URL / Header / 掩码状态
+- 能显示生成按钮、保存按钮、复制按钮
+
+### 7.3 集成验收
+
+手工验收闭环：
+
+1. 在设置页启用 External API
+2. 点击生成新 Key
+3. 用新 Key 调 `/api/external/capabilities` 成功
+4. 用旧 Key 调用返回 `401`
+5. 关闭 External API 后调用返回 `403`
+
+---
+
+## 8. 实施范围与不做项
+
+### 本次实施范围
+
+- 网站设置页内管理 External API 开关
+- 网站内生成 / 手动设置 API Key
+- 网站内复制对接信息
+- 与现有 External API 鉴权打通
+
+### 本次不做
+
+- 对接方账号体系
+- 多租户 API Key
+- Key 权限模型
+- 调用次数限流
+- WebHook / 回调机制
+- API 文档自动生成页面
+
+---
+
+## 9. 实施结论
+
+这是一个 **中低复杂度** 的增强项。
+
+原因：
+
+- 配置项已经存在
+- 鉴权已经存在
+- 设置页框架已经存在
+- 不需要数据库迁移
+
+因此实现重点不在底层，而在：
+
+- 设置接口补全
+- 设置页交互补全
+- Key 展示与重置策略收口
+
+按当前代码结构，适合直接在现有 settings 模块内增量实现。

docs/http-only-device-fingerprint-hardening.md

@@ -0,0 +1,305 @@
+# HTTP-Only 设备指纹补强建议
+
+本文档汇总三类信息后的统一结论，用于指导当前项目在**不引入真实浏览器兜底**前提下，继续补强 OpenAI 注册链路的稳定性：
+
+1. 当前项目现状（`register_198.py`、`src_23_extracted/*`）
+2. `F:\MyTools` 中可借鉴的实现
+3. 联网查到的公开资料、官方说明与公开逆向项目
+
+---
+
+## 1. 范围与目标
+
+本方案只讨论 **HTTP-only 注册链路**，不讨论：
+
+- AdsPower / 外部浏览器
+- Playwright / Selenium 真实浏览器兜底
+- 完整 JS 浏览器指纹复刻
+
+目标是：
+
+- 提高注册链路的一致性
+- 降低 401 / challenge / callback 异常概率
+- 在现有 `curl_cffi` + OpenAI 专用挑战框架上继续增强
+
+---
+
+## 2. 统一结论
+
+### 2.1 当前项目已经做对的部分
+
+当前项目已经具备以下基础能力：
+
+- `curl_cffi impersonate` 的浏览器网络栈拟态
+- 基础 Chrome 风格请求头
+- 先获取 `oai-did`
+- Sentinel PoW 求解
+- `openai-sentinel-token`
+- 部分 OAuth JSON 请求里的 `oai-device-id`
+- 部分链路里的 `traceparent` / `x-datadog-*`
+- 会话内尽量复用已有 `oai-did`
+
+结论：当前项目不是裸接口脚本，已经具备继续补强的基础。
+
+### 2.2 官方与公开资料给出的方向
+
+- `curl_cffi` 适合做 **TLS / HTTP2 / JA3 / 浏览器网络层拟态**
+- 但 `curl_cffi` **不能解决 JS 浏览器指纹**
+- OpenAI 官方网络建议明确涉及：
+  - `auth.openai.com`
+  - `chatgpt.com`
+  - `challenges.cloudflare.com`
+  - `rum.browser-intake-datadoghq.com`
+- 公开逆向项目显示，实际链路可能还会涉及：
+  - `chat-requirements`
+  - turnstile / challenge
+  - 前端行为 / 埋点一致性
+
+结论：既然不走真实浏览器，就必须把 **HTTP-only 的一致性** 做到尽量完整。
+
+### 2.3 `F:\MyTools` 最值得借鉴的点
+
+`F:\MyTools` 中真正高价值的不是“更多随机”，而是：
+
+1. **整套浏览器指纹绑定为统一 profile**
+   - `impersonate`
+   - `User-Agent`
+   - `sec-ch-ua`
+   - `sec-ch-ua-full-version`
+   - platform/version 类字段
+
+2. **`oai-did` 同步到 `chatgpt.com` 与 `auth.openai.com`**
+
+3. **Sentinel 按 flow 生成**
+   - `authorize_continue`
+   - `password_verify`
+
+4. **Sentinel 请求本身补充 client hints**
+
+5. **OAuth 阶段附带更完整的前端语义参数**
+   - `ext-oai-did`
+   - `auth_session_logging_id`
+
+结论：最该借鉴的是 **一致性设计**，不是整包搬代码。
+
+---
+
+## 3. 应优先补什么
+
+以下按优先级排序。
+
+### P0：必须补
+
+#### 3.1 统一 session 级浏览器 profile
+
+为每个注册任务固定一份浏览器 profile，至少统一以下字段：
+
+- `impersonate`
+- `User-Agent`
+- `Accept-Language`
+- `sec-ch-ua`
+- `sec-ch-ua-mobile`
+- `sec-ch-ua-platform`
+- `sec-ch-ua-full-version`
+- `sec-ch-ua-platform-version`
+
+要求：
+
+- 同一次注册任务从头到尾固定
+- 所有关键请求共用，不允许不同阶段各自拼装
+
+原因：
+
+- 当前最大的风险之一不是“缺 header”，而是**同一会话像多个不同浏览器**
+
+#### 3.2 `oai-did` 跨域同步
+
+原则：
+
+- 优先使用服务端返回的 `oai-did`
+- 将同一个 did 同步到：
+  - `chatgpt.com`
+  - `.auth.openai.com`
+  - `auth.openai.com`
+
+原因：
+
+- 注册链路天然跨域
+- did 只存在单一域时，容易出现链路不一致
+
+#### 3.3 Sentinel 改为按 flow 生成
+
+至少区分以下 flow：
+
+- `authorize_continue`
+- `password_verify`
+
+必要时再扩展后续 flow。
+
+原因：
+
+- `F:\MyTools` 与公开实现都表明，不同认证阶段不应简单复用同一类 sentinel 语义
+
+#### 3.4 给 Sentinel 请求补 client hints
+
+Sentinel 请求应与本次任务 profile 保持一致，至少补：
+
+- `sec-ch-ua`
+- `sec-ch-ua-mobile`
+- `sec-ch-ua-platform`
+
+原因：
+
+- 当前项目的 sentinel 请求仍偏简化
+- 这一步最像“浏览器前端发出的挑战请求”
+
+---
+
+### P1：建议补
+
+#### 3.5 统一 auth JSON 请求 header builder
+
+把以下内容统一注入到所有关键 auth JSON 请求：
+
+- `oai-device-id`
+- `traceparent`
+- `tracestate`
+- `x-datadog-*`
+
+不要只在部分接口补，建议统一覆盖：
+
+- authorize / continue
+- password verify
+- workspace select
+- organization select
+- 其他关键 auth.openai.com JSON 接口
+
+#### 3.6 灰度评估 `ext-oai-did` / `auth_session_logging_id`
+
+建议：
+
+- 先做可开关的灰度支持
+- 不作为硬依赖
+- 通过日志观察引入后是否改善成功率
+
+原因：
+
+- 这两个参数更像“前端语义拟真增强”
+- 有价值，但存在随上游前端变动而漂移的风险
+
+#### 3.7 降低“本地伪造 did”权重
+
+原则：
+
+- 服务端 did 为主
+- 本地生成 did 只做最后 fallback
+- fallback 后整条链路也必须固定复用同一个 did
+
+---
+
+### P2：运维层同样重要
+
+#### 3.8 把网络环境视为指纹系统的一部分
+
+建���：
+
+- 避免 TLS 解密代理
+- 优先稳定、干净的出口
+- 同一次注册链路尽量固定一个代理出口
+- 尽量避免频繁切换 IP
+
+原因：
+
+- HTTP-only 模式下，网络环境本身就是风控输入
+
+---
+
+## 4. 当前不建议做什么
+
+### 4.1 不建议继续堆“随机”
+
+例如：
+
+- 随机 UA 但不绑定 `sec-ch-*`
+- 随机 Chrome 版本但 `impersonate` 不匹配
+- 请求头在不同阶段各自手搓
+
+这些通常会让链路更不像一个真实浏览器。
+
+### 4.2 不建议整包照搬 `F:\MyTools` vendor 注册器
+
+原因：
+
+- vendor 代码混有特定时期的 endpoint / 参数假设
+- 当前项目已有自己修好的流程
+- 直接搬迁容易回归
+
+正确方式：
+
+- 抽取机制
+- 按模块吸收
+
+### 4.3 不建议走半吊子的“浏览器仿真”
+
+既然本方案明确不引入真实浏览器，就不要把目标设成完整 JS 指纹复刻。
+
+正确目标应是：
+
+- 最大化 HTTP-only 一致性
+- 尽量贴近同一浏览器会话发出的请求
+
+---
+
+## 5. 推荐的落地顺序
+
+建议按以下顺序推进：
+
+### 第一批
+
+1. 统一 session 级浏览器 profile
+2. `oai-did` 跨域同步
+3. `password_verify` 增加 flow-specific sentinel
+4. sentinel 请求补 `sec-ch-*`
+
+### 第二批
+
+5. 统一 auth JSON 请求 header builder
+6. 扩大 `oai-device-id + trace/datadog` 覆盖范围
+7. 灰度引入 `ext-oai-did` / `auth_session_logging_id`
+
+### 第三批
+
+8. 结合线上日志做结果回归：
+   - 401 发生在哪一步
+   - callback 失败集中在哪一步
+   - did fallback 是否明显更容易失败
+   - 哪类代理出口成功率更高
+
+---
+
+## 6. 当前最推荐优先讨论的补齐项
+
+如果只选最值得先做的几项，我建议优先讨论：
+
+1. **统一 session 级浏览器 profile**
+2. **did 跨 `chatgpt.com / auth.openai.com` 同步**
+3. **`password_verify` 增加 flow-specific sentinel**
+4. **sentinel 请求补 client hints**
+5. **统一 auth JSON 请求 header builder**
+
+---
+
+## 7. 参考来源
+
+- `curl_cffi` impersonate 文档  
+  https://curl-cffi.readthedocs.io/en/v0.11.4/impersonate.html
+
+- OpenAI 官方网络建议  
+  https://help.openai.com/en/articles/9247338-network-recommendations-for-chatgpt-errors-on-web-and-apps
+
+- 公开逆向参考  
+  https://github.com/realasfngl/ChatGPT
+
+- 本地对照项目  
+  `F:\MyTools`
+

docs/register_simplification_analysis.md

@@ -0,0 +1,114 @@
+# register.py 精简分析报告
+
+## 概况
+
+| 指标 | 数值 |
+|------|------|
+| 总行数 | 4282 |
+| 方法总数 | 103 |
+| 100+ 行巨型方法 | 8 个 |
+| >50 行方法 | 15 个 |
+| <10 行微型方法 | 12 个 |
+
+## 功能分区与行数占比
+
+| 区域 | 行范围 | 行数 | 占比 | 说明 |
+|------|--------|------|------|------|
+| 核心注册流程 | L93-L556 | 464 | 11% | 初始化、OAuth、登录、密码提交 |
+| **Token 交换** | L557-L827 | **271** | **6%** | `_complete_token_exchange` 一个方法 |
+| 登录重启 | L828-L881 | 54 | 1% | `_restart_login_flow` |
+| **Cookie/Session 处理** | L882-L978 | 97 | 2% | 提取 session_token、Cookie 工具 |
+| **chatgpt.com 会话桥接** | L979-L1591 | **613** | **14%** | 会话捕获、重定向跟踪、桥接登录、Outlook 特化 |
+| 密码注册 + 邮箱标记 | L1592-L1689 | 98 | 2% | |
+| OTP 验证 + 日志 | L1690-L1873 | 184 | 4% | stage 管理、验证码获取、debug 日志 |
+| **日志/调试工具** | L1874-L2136 | 263 | 6% | Cookie debug、账号创建、域名黑名单 |
+| **导航/载荷解析** | L2137-L2659 | **523** | **12%** | JSON 解码、文本提取、URL 分类、导航候选 |
+| **Consent/Script 资产检查** | L2659-L2956 | **298** | **7%** | Script 资产解析、embedded payload 提取 |
+| **Workspace 选择** | L2957-L3368 | **412** | **10%** | workspace/org 获取、选择、callback 探测 |
+| **恢复/重试路径** | L3369-L3940 | **572** | **13%** | consent 恢复、重定向跟踪、Outlook 恢复、会话内重登 |
+| 主入口 + 保存 | L3941-L4282 | 342 | 8% | authorize replay、run、save_to_database | 
+
+## 精简建议
+
+### 1. 导航/载荷解析提取为独立模块（省 ~520 行）
+
+**区域**: L2137-L2659，共 **523 行、15 个方法**
+
+这些方法全部是纯工具函数，与 `RegistrationEngine` 状态无关：
+- `_decode_auth_cookie_json_segments`、`_decode_cookie_json_payloads`
+- `_collect_interesting_text_fragments_from_data`
+- `_extract_app_router_push_payloads_from_text`
+- `_extract_json_payload_candidates_from_fragment`
+- `_sanitize_url_for_log`
+- `_remember_resume_candidate`、`_remember_navigation_candidate` 等
+
+> **操作**：提取到 `src/core/navigation_parser.py`，RegistrationEngine 调用即可。
+
+---
+
+### 2. Consent/Script 资产检查合并（省 ~100 行）
+
+**区域**: L2659-L2956，共 **298 行**
+
+包含：
+- `_inspect_consent_script_assets` (74行) — 下载并解析 JS 脚本
+- `_extract_embedded_payloads_from_text` (47行)
+- `_extract_navigation_candidates_from_text` (37行)
+- `_normalize_response_text` (17行)
+- 多个小型解析方法
+
+> **操作**：与"导航解析"合并移到同一个工具模块中。
+
+---
+
+### 3. chatgpt.com 会话桥接提取为独立模块（省 ~600 行）
+
+**区域**: L879-L1591，共 **613 行**
+
+标明 `# chatgpt.com 会话桥接方法 (从 dou-jiang/codex-console 移植)`。 
+
+包含：
+- `_capture_auth_session_tokens` (125行)
+- `_follow_chatgpt_auth_redirects` (77行)
+- `_bootstrap_chatgpt_signin_for_session` (119行)
+- `_bridge_login_for_session_token` (180行)
+- `_complete_token_exchange_outlook` (103行)
+
+> **操作**：提取到 `src/core/chatgpt_bridge.py`，作为独立类或 mixin。
+
+---
+
+### 4. `_complete_token_exchange` 拆分（当前 271 行）
+
+这是最大的单个方法，包含多层嵌套的条件分支（about-you 处理、user_exists 检测、authorize replay、consent fallback 等）。
+
+> **操作**：将 about-you 分支、user_exists 恢复逻辑各提取为子方法，可减 100+ 行。
+
+---
+
+### 5. 恢复/重试路径整理（省 ~200 行）
+
+**区域**: L3369-L3940
+
+- `_attempt_session_bound_reauth` (130行) — 已经很独立
+- `_follow_redirects` (128行) — 通用重定向跟踪
+- `_persist_recoverable_outlook_account` (74行) — Outlook 专用
+
+> **操作**：`_follow_redirects` 是通用 HTTP 工具，可移到 `http_client.py`。Outlook 恢复逻辑可移到单独模块。
+
+---
+
+## 精简预估
+
+| 策略 | 预估节省 | 操作复杂度 |
+|------|----------|-----------|
+| 导航/载荷解析 → `navigation_parser.py` | ~520 行 | 低（纯提取） |
+| chatgpt 桥接 → `chatgpt_bridge.py` | ~600 行 | 中（需处理状态依赖） |
+| Consent/Script → 合并到导航解析 | ~100 行 | 低 |
+| `_complete_token_exchange` 拆分 | ~100 行 | 中 |
+| `_follow_redirects` → `http_client.py` | ~130 行 | 低 |
+
+**总计可精简约 1450 行**，register.py 预计从 4282 行降到 ~2800 行。
+
+> [!IMPORTANT]
+> 所有精简操作都是**代码搬迁和拆分**，不删除任何功能，只是让 register.py 更聚焦于核心注册编排逻辑。

docs/superpowers/plans/2026-03-27-external-failure-category.md

@@ -0,0 +1,98 @@
+# External Registration Failure Category Implementation Plan
+
+> **For agentic workers:** REQUIRED: Use superpowers:subagent-driven-development (if subagents available) or superpowers:executing-plans to implement this plan. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a stable `failure_category` field to external registration batch responses and persist it at batch level for SQLite-backed deployments.
+
+**Architecture:** Persist one new batch-level column, compute it centrally when a batch reaches terminal state, and expose it through the shared serializer so create/get/cancel/idempotent replay all stay consistent. Keep the implementation minimal: no item-level schema changes, no route-layer inference, no PostgreSQL migration work.
+
+**Tech Stack:** Python, FastAPI, Pydantic, SQLAlchemy, SQLite, pytest
+
+---
+
+## Chunk 1: Workspace and baseline
+
+### Task 1: Safe isolated workspace
+
+**Files:**
+- Create: `docs/superpowers/plans/2026-03-27-external-failure-category.md`
+
+- [x] **Step 1: Create a dedicated worktree and branch**
+- [x] **Step 2: Run baseline tests in the worktree**
+- [x] **Step 3: Record the plan in this file before code changes**
+
+## Chunk 2: Tests first
+
+### Task 2: Route and documentation-facing tests
+
+**Files:**
+- Modify: `tests/test_external_api_routes.py`
+- Modify: `docs/external-api-quickstart.md`
+- Modify: `docs/external-api-examples.md`
+
+- [x] **Step 1: Write failing route tests for `failure_category` presence on create/get/cancel/idempotent replay**
+- [x] **Step 2: Run the route test subset and confirm the new assertions fail for the expected reason**
+- [x] **Step 3: Update external API docs after implementation is stable**
+
+### Task 3: Service and migration tests
+
+**Files:**
+- Modify: `tests/test_external_batch_service.py`
+
+- [x] **Step 1: Write failing tests for summary classification, recovery classification, unknown fallback, and non-failed null behavior**
+- [x] **Step 2: Include a SQLite migration coverage test for adding the new column to an existing DB**
+- [x] **Step 3: Run the service test subset and confirm the new assertions fail for the expected reason**
+
+## Chunk 3: Minimal production changes
+
+### Task 4: Persist and compute `failure_category`
+
+**Files:**
+- Modify: `src/database/models.py`
+- Modify: `src/database/session.py`
+- Modify: `src/core/external_batches/service.py`
+- Modify: `src/core/external_batches/recovery.py`
+
+- [x] **Step 1: Add `failure_category` to `ExternalRegistrationBatch`**
+- [x] **Step 2: Add SQLite auto-migration support for the new column**
+- [x] **Step 3: Add a single classification helper in the batch service**
+- [x] **Step 4: Update summary recomputation to set category on `failed` and clear it otherwise**
+- [x] **Step 5: Update recovery logic to persist `transient` for `service_restarted`**
+- [x] **Step 6: Update the shared serializer to return `failure_category`**
+
+## Chunk 4: Verification and review closure
+
+### Task 5: Verification
+
+**Files:**
+- Verify: `tests/test_external_api_routes.py`
+- Verify: `tests/test_external_batch_service.py`
+
+- [x] **Step 1: Run focused tests until green**
+- [x] **Step 2: Run the combined external test suite**
+- [x] **Step 3: Inspect diffs and confirm only intended files changed**
+
+### Task 6: Review loop
+
+**Files:**
+- Review: all changed files
+
+- [x] **Step 1: Run spec-compliance review**
+- [x] **Step 2: Fix any findings and re-run spec review until zero issues**
+- [x] **Step 3: Run code-quality review**
+- [x] **Step 4: Fix any findings and re-run quality review until zero issues**
+- [x] **Step 5: Run final whole-change review and close only when zero issues remain**
+
+## Locked behavior
+
+- Batch response adds `failure_category: "config" | "business" | "transient" | null`
+- `POST /api/external/registration/batches`, `GET /api/external/registration/batches/{batch_uuid}`, and `POST /api/external/registration/batches/{batch_uuid}/cancel` all return it
+- Non-`failed` statuses always serialize `failure_category = null`
+- `failed` batches must serialize one of `config | business | transient`
+- Idempotent replay returns the originally persisted category
+- Classification mapping:
+  - `service_restarted` -> `transient`
+  - upload/email service missing, disabled, wrong type/provider, unsupported provider, no enabled services -> `config`
+  - `outlook requested_service_id cannot be reused when count > 1` -> `business`
+  - `no_available_email_service` -> `transient`
+  - `registration_failed` and unknown reasons -> `transient`

docs/temp-mail-external-api.md

@@ -0,0 +1,416 @@
+# Temp Mail 域名池与外部注册 API 说明
+
+本文档说明本项目最近新增/补强的两部分能力：
+
+1. `temp_mail` 邮箱服务支持域名池与 Worker 域名 API
+2. 外部调用方可通过 HTTP API 创建注册批次、查询状态、取消任务
+
+配套文档：
+
+- [External API 调用示例](external-api-examples.md)
+- [External API 第三方对接速览](external-api-quickstart.md)
+- [External API 网站内管理与 API Key 生成方案](external-api-webui-management-plan.md)
+
+---
+
+## 1. Temp Mail 域名池
+
+### 1.1 适用场景
+
+项目内新增了 `temp_mail` 邮箱类型，用于接入你自建的临时邮箱服务，例如：
+
+- `https://apmail.889110.xyz/`
+
+服务端支持通过管理接口返回当前可用域名池，例如：
+
+- `GET /admin/domains`
+
+请求头：
+
+- `x-admin-auth: <admin_password>`
+
+### 1.2 支持的配置项
+
+`temp_mail` 服务配置支持以下字段：
+
+| 字段 | 必填 | 说明 |
+| --- | --- | --- |
+| `base_url` | 是 | 临时邮箱服务地址，如 `https://apmail.889110.xyz` |
+| `admin_password` | 是 | 管理接口密码，对应请求头 `x-admin-auth` |
+| `domains` | 否 | 域名池，数组或逗号分隔字符串，优先级最高 |
+| `domain` | 否 | 单个回退域名 |
+| `enable_prefix` | 否 | 是否保留旧版 `tmp` 前缀，默认 `false` |
+| `timeout` | 否 | 请求超时，默认 `30` |
+| `max_retries` | 否 | 请求重试次数，默认 `3` |
+
+### 1.3 域名解析优先级
+
+创建邮箱时，域名来源按以下优先级解析：
+
+1. `config.domains`
+2. Worker `GET /admin/domains`
+3. `config.domain`
+
+如果三者都拿不到可用域名，则创建邮箱失败。
+
+### 1.4 随机邮箱生成规则
+
+- 默认生成**纯随机**本地名，不再强制 `tmp` 前缀
+- 如果配置 `enable_prefix=true`，则继续使用旧版 `tmpxxxxx` 风格
+- 最终会从当前可用域名池中随机选择一个域名拼接地址
+
+### 1.5 可用服务展示
+
+以下两个接口会展示 `temp_mail` 的域名摘要：
+
+- Web UI: `GET /api/registration/available-services`
+- 外部 API: `GET /api/external/capabilities`
+
+返回中会包含：
+
+- `domain_count`
+- `domains_preview`
+- `domain_source`
+
+其中 `domain_source` 可能为：
+
+- `config_domains`
+- `worker_api`
+- `config_fallback`
+- `none`
+
+> 注意：接口只暴露安全摘要，不会把 `admin_password` 等敏感信息返回给前端或外部调用方。
+
+---
+
+## 2. 外部注册 API
+
+### 2.1 功能概览
+
+外部 API 允许调用方不直接操作 Web UI，而是通过 HTTP 请求：
+
+- 查询当前可用邮箱类型与上传目标
+- 创建异步注册批次
+- 查询批次状态
+- 取消批次
+
+### 2.2 鉴权方式
+
+需要在系统设置中启用：
+
+- `external_api_enabled`
+- `external_api_key`
+
+请求头使用：
+
+```http
+X-API-Key: <your_api_key>
+```
+
+未启用时返回 `403`；密钥错误时返回 `401`。
+
+### 2.2.1 API Key 从哪里来
+
+当前项目里，外部 API Key 不是“调用方自己申请”的，也不是接口动态下发的。
+
+它来自系统管理员在项目配置中设置的：
+
+- `external_api_enabled`
+- `external_api_key`
+
+也就是说：
+
+1. 管理员先在系统里启用外部 API
+2. 管理员在系统里填写一个 `external_api_key`
+3. 再把这个值发给第三方调用方
+
+第三方真正拿到的就是这个管理员配置的值，然后放到：
+
+```http
+X-API-Key: 你拿到的那个值
+```
+
+> 当前版本没有单独的“获取 API Key / 轮换 API Key”开放接口。  
+> 如果要换 Key，需要由系统管理员修改配置后，再重新发给对接方。
+
+### 2.3 能力查询
+
+接口：
+
+```http
+GET /api/external/capabilities
+```
+
+用于返回：
+
+- 支持的邮箱类型
+- 当前可用邮箱服务
+- 当前可用上传目标
+- 外部 API 是否启用
+
+其中邮箱类型包含数据库内启用的：
+
+- `outlook` / `moe_mail` / `temp_mail` / `duck_mail` / `freemail` / `imap_mail`
+
+其中临时邮箱能力在外部 API 中统一使用 `temp_mail` 枚举，不再暴露旧的 `tempmail` 占位。
+
+能力接口返回的每个可选服务，都会带：
+
+- `id`
+- `name`
+- `priority`
+
+对于 `temp_mail`，还会带：
+
+- `domain_count`
+- `domains_preview`
+- `domain_source`
+
+### 2.3.1 service_id 不是 0/1 猜出来的
+
+第三方在创建批次时看到的：
+
+- `email.service_id`
+- `upload.service_id`
+
+都不是让你自己猜 “0 代表哪个、1 代表哪个”。
+
+正确方式是：
+
+1. 先调 `GET /api/external/capabilities`
+2. 读取返回里的服务列表
+3. 按 `name` 找到你想用的服务
+4. 把该服务对应的 `id` 填回创建请求里的 `service_id`
+
+也就是说，真正的映射关系来自 `capabilities` 返回值，而不是文档里写死。
+
+例如能力返回里可能是：
+
+```json
+{
+  "email_types": [
+    {
+      "type": "temp_mail",
+      "services": [
+        {"id": 3, "name": "Worker temp mail A"},
+        {"id": 7, "name": "Worker temp mail B"}
+      ]
+    }
+  ],
+  "upload_providers": [
+    {
+      "provider": "sub2api",
+      "services": [
+        {"id": 1, "name": "sub2-main"},
+        {"id": 4, "name": "sub2-backup"}
+      ]
+    }
+  ]
+}
+```
+
+那你在创建批次时：
+
+- 传 `email.service_id=3`，表示使用 `Worker temp mail A`
+- 传 `upload.service_id=4`，表示上传到 `sub2-backup`
+
+> 结论：`service_id` 只认 `capabilities` 当前返回的 `id`，不要手写猜测，也不要假设某个数字永远对应某个服务。
+
+### 2.4 创建注册批次
+
+接口：
+
+```http
+POST /api/external/registration/batches
+```
+
+请求体示例：
+
+```json
+{
+  "count": 5,
+  "idempotency_key": "demo-batch-001",
+  "email": {
+    "type": "temp_mail",
+    "service_id": 1
+  },
+  "upload": {
+    "enabled": true,
+    "provider": "sub2api",
+    "service_id": 1
+  },
+  "execution": {
+    "mode": "pipeline",
+    "concurrency": 1,
+    "interval_min": 5,
+    "interval_max": 15
+  }
+}
+```
+
+字段约束：
+
+- `count`: `1 ~ 100`
+- `email.type`: 必填
+- `email.service_id`: 可选
+- `upload.provider`: 仅在 `upload.enabled=true` 时必填
+- `upload.provider`: 仅支持 `sub2api` / `cpa` / `tm`
+- `execution.mode`: `pipeline` 或 `parallel`
+- `execution.concurrency`: `1 ~ 50`
+- `execution.interval_max >= execution.interval_min`
+
+关于 `service_id` 的默认行为：
+
+- `email.service_id` 不传：系统按该邮箱类型的当前可用规则自动选
+- `upload.service_id` 不传：系统按该上传 provider 当前启用且优先级最高的服务自动选
+
+返回规则：
+
+- 首次创建成功：HTTP `202`
+- 如果 `idempotency_key` 命中历史批次：HTTP `200`
+
+### 2.5 查询批次状态
+
+接口：
+
+```http
+GET /api/external/registration/batches/{batch_uuid}
+```
+
+返回字段包含：
+
+- `batch_uuid`
+- `status`
+- `requested_count`
+- `completed_count`
+- `success_count`
+- `failed_count`
+- `upload_success_count`
+- `upload_failed_count`
+- `failure_reason`
+- `recent_errors`
+
+状态可能包括：
+
+- `pending`
+- `running`
+- `completed`
+- `completed_partial`
+- `failed`
+- `cancelled`
+
+### 2.6 取消批次
+
+接口：
+
+```http
+POST /api/external/registration/batches/{batch_uuid}/cancel
+```
+
+规则：
+
+- `pending` / `running` 可取消
+- 已结束批次不可重复取消，返回 `400`
+- 批次不存在返回 `404`
+
+### 2.7 错误码约定
+
+| 场景 | 状态码 |
+| --- | --- |
+| API 未启用 | `403` |
+| API Key 错误 | `401` |
+| 请求体验证失败 | `422` |
+| 批次不存在 | `404` |
+| 业务参数不合法 | `400` |
+| 外部批次服务不可用 | `503` |
+
+---
+
+## 3. 外部批次执行行为
+
+### 3.1 持久化
+
+外部批次及其子项会持久化到数据库：
+
+- `external_registration_batches`
+- `external_registration_batch_items`
+
+同时为每个子项生成独立 `registration_task_uuid`，便于复用现有注册执行链路。
+
+### 3.2 幂等
+
+如果创建批次时传入 `idempotency_key`，系统会优先复用已有批次，避免重复创建。
+
+### 3.3 重启恢复
+
+服务启动时会尝试恢复中断批次：
+
+- `pending` / `running` 的外部批次会被标记为失败
+- 失败原因记为 `service_restarted`
+
+这样可以避免系统重启后外部调用方看到“永远卡在运行中”的脏状态。
+
+### 3.4 上传行为
+
+如果启用了上传：
+
+- 注册成功后才会执行上传
+- 会优先按注册结果里的 `email` 查账号
+- 如找不到，再按 `account_id` 回退查找
+- 上传结果会分别统计成功数和失败数
+
+---
+
+## 4. 当前测试覆盖
+
+本轮功能已补充并验证以下覆盖：
+
+- `temp_mail` 本地名生成与域名随机选择
+- `temp_mail` 域名解析优先级与回退逻辑
+- Worker 域名 API 集成路径
+- `available-services` / `capabilities` 的域名摘要展示
+- 外部 API 鉴权、参数校验、错误码映射
+- 外部批次创建、幂等、状态汇总、取消、重启恢复
+- 外部批次执行中的预失败项、上传成功/失败、`account_id` 回退查找
+- 服务选择的拒绝分支与边界约束
+
+全量测试验证结果：
+
+- `134 passed`
+
+---
+
+## 5. 使用建议
+
+### 5.1 如果你想让 `temp_mail` 自动从多个域名中随机取
+
+建议只配置：
+
+- `base_url`
+- `admin_password`
+- `domain`（仅作回退）
+
+然后由 Worker `GET /admin/domains` 统一返回真实域名池。
+
+### 5.2 如果你想固定只用部分域名
+
+直接在该邮箱服务配置中填写：
+
+```json
+{
+  "domains": ["a.example.com", "b.example.com"]
+}
+```
+
+此时系统会优先使用配置内域名池，而不会再请求 Worker 域名接口。
+
+### 5.3 如果你要给第三方系统对接
+
+优先使用：
+
+- `GET /api/external/capabilities`
+- `POST /api/external/registration/batches`
+- `GET /api/external/registration/batches/{batch_uuid}`
+- `POST /api/external/registration/batches/{batch_uuid}/cancel`
+
+这样调用方只负责“下发任务”和“查结果”，实际邮箱、上传、执行模式等策略仍由系统内配置统一兜底。

docs/third-party-integration-guide.md

@@ -0,0 +1,455 @@
+# 第三方技术对接文档
+
+这份文档是给第三方技术人员直接对接用的。  
+按本文档接入即可完成：
+
+- 查询当前可用邮箱/上传服务
+- 创建注册批次
+- 查询批次状态
+- 取消批次
+
+如需更详细字段说明，可再参考：
+
+- [Temp Mail 域名池与外部注册 API 说明](temp-mail-external-api.md)
+- [External API 调用示例](external-api-examples.md)
+- [External API 网站内管理与 API Key 生成方案](external-api-webui-management-plan.md)
+
+---
+
+## 1. 对接方会拿到什么
+
+项目方需要提供给第三方以下信息：
+
+### 1.1 Base URL
+
+例如：
+
+```text
+http://your-domain:8000/api
+```
+
+### 1.2 鉴权请求头
+
+```http
+X-API-Key: your_api_key
+```
+
+### 1.3 API Key 从哪里来
+
+这个 `your_api_key` 不是第三方自己申请的，也不是通过接口获取的。
+
+它来自项目管理员在系统中配置的：
+
+- `external_api_enabled`
+- `external_api_key`
+
+然后由项目方把这个 Key 发给第三方使用。
+
+> 当前版本没有开放“获取 API Key / 轮换 API Key”接口。  
+> 如果更换了 Key，项目方需要重新通知第三方同步更新。
+
+---
+
+## 2. 对接流程总览
+
+第三方只需要实现这 4 个接口：
+
+1. `GET /external/capabilities`
+2. `POST /external/registration/batches`
+3. `GET /external/registration/batches/{batch_uuid}`
+4. `POST /external/registration/batches/{batch_uuid}/cancel`
+
+推荐接入顺序：
+
+1. 先接 `capabilities`
+2. 再接 `create batch`
+3. 再接 `get batch status`
+4. 最后接 `cancel batch`
+
+---
+
+## 3. 查询当前可用能力
+
+### 3.1 请求
+
+```http
+GET /api/external/capabilities
+X-API-Key: your_api_key
+```
+
+### 3.2 作用
+
+这个接口用于告诉第三方当前环境里：
+
+- 支持哪些邮箱类型
+- 各邮箱类型下有哪些具体服务
+- 支持哪些上传 provider
+- 每个 provider 下有哪些具体服务
+
+### 3.3 典型返回示例
+
+```json
+{
+  "email_types": [
+    {
+      "type": "temp_mail",
+      "available": true,
+      "count": 2,
+      "services": [
+        {
+          "id": 3,
+          "name": "Worker temp mail A",
+          "type": "temp_mail",
+          "priority": 0,
+          "domain_count": 2,
+          "domains_preview": ["a.example.com", "b.example.com"],
+          "domain_source": "worker_api"
+        },
+        {
+          "id": 7,
+          "name": "Worker temp mail B",
+          "type": "temp_mail",
+          "priority": 0,
+          "domain_count": 1,
+          "domains_preview": ["c.example.com"],
+          "domain_source": "config_domains"
+        }
+      ]
+    }
+  ],
+  "upload_providers": [
+    {
+      "provider": "sub2api",
+      "available": true,
+      "count": 2,
+      "services": [
+        {"id": 1, "name": "sub2-main", "priority": 0},
+        {"id": 4, "name": "sub2-backup", "priority": 10}
+      ]
+    },
+    {
+      "provider": "cpa",
+      "available": true,
+      "count": 1,
+      "services": [
+        {"id": 2, "name": "cpa-main", "priority": 0}
+      ]
+    }
+  ],
+  "settings": {
+    "external_api_enabled": true
+  }
+}
+```
+
+---
+
+## 4. `service_id` 怎么识别
+
+这是第三方最容易误解的地方。
+
+### 4.1 不是靠猜 0 / 1 / 2
+
+`service_id` 不是固定编号，也不是文档里写死的顺序编号。  
+它必须以当前环境里 `capabilities` 返回的实际 `id` 为准。
+
+例如上面的返回里：
+
+- `email.service_id = 3` 表示 `Worker temp mail A`
+- `email.service_id = 7` 表示 `Worker temp mail B`
+- `upload.service_id = 1` 表示 `sub2-main`
+- `upload.service_id = 4` 表示 `sub2-backup`
+
+### 4.2 正确使用方式
+
+第三方应始终：
+
+1. 先请求 `GET /external/capabilities`
+2. 按 `type/provider + name` 找到目标服务
+3. 读取对应的 `id`
+4. 创建批次时把该 `id` 传给 `service_id`
+
+### 4.3 不传 `service_id` 会怎样
+
+如果不传 `service_id`：
+
+- `email.service_id` 不传：系统自动选该邮箱类型当前可用服务
+- `upload.service_id` 不传：系统自动选该上传 provider 当前启用且优先级最高的服务
+
+如果第三方不需要固定某个具体服务，建议直接不传。
+
+---
+
+## 5. 创建注册批次
+
+### 5.1 请求
+
+```http
+POST /api/external/registration/batches
+Content-Type: application/json
+X-API-Key: your_api_key
+```
+
+### 5.2 请求体示例：最简版本
+
+```json
+{
+  "count": 10,
+  "email": {
+    "type": "temp_mail"
+  },
+  "upload": {
+    "enabled": false
+  },
+  "execution": {
+    "mode": "pipeline",
+    "concurrency": 1,
+    "interval_min": 0,
+    "interval_max": 0
+  }
+}
+```
+
+### 5.3 请求体示例：指定邮箱服务并上传
+
+```json
+{
+  "count": 20,
+  "idempotency_key": "batch-20260327-001",
+  "email": {
+    "type": "temp_mail",
+    "service_id": 3
+  },
+  "upload": {
+    "enabled": true,
+    "provider": "sub2api",
+    "service_id": 1
+  },
+  "execution": {
+    "mode": "parallel",
+    "concurrency": 5,
+    "interval_min": 0,
+    "interval_max": 0
+  }
+}
+```
+
+### 5.4 字段说明
+
+| 字段 | 必填 | 说明 |
+| --- | --- | --- |
+| `count` | 是 | 注册数量，范围 `1 ~ 100` |
+| `idempotency_key` | 否 | 幂等键，建议传 |
+| `email.type` | 是 | 邮箱类型，如 `temp_mail` / `outlook` |
+| `email.service_id` | 否 | 指定某个邮箱服务，来源于 `capabilities` |
+| `upload.enabled` | 是 | 是否上传 |
+| `upload.provider` | 条件必填 | `upload.enabled=true` 时必填，支持 `sub2api` / `cpa` / `tm` |
+| `upload.service_id` | 否 | 指定某个上传服务，来源于 `capabilities` |
+| `execution.mode` | 否 | `pipeline` 或 `parallel` |
+| `execution.concurrency` | 否 | 并发数，范围 `1 ~ 50` |
+| `execution.interval_min` | 否 | 最小间隔秒数 |
+| `execution.interval_max` | 否 | 最大间隔秒数，必须 `>= interval_min` |
+
+### 5.5 返回说明
+
+- 首次成功创建：HTTP `202`
+- 如果 `idempotency_key` 命中已有批次：HTTP `200`
+
+返回里会带：
+
+```json
+{
+  "batch_uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+  "status": "pending",
+  "requested_count": 20,
+  "completed_count": 0,
+  "success_count": 0,
+  "failed_count": 0,
+  "upload_success_count": 0,
+  "upload_failed_count": 0,
+  "failure_reason": null,
+  "created_at": "2026-03-27T12:00:00",
+  "started_at": null,
+  "completed_at": null,
+  "recent_errors": [],
+  "idempotent_replay": false
+}
+```
+
+第三方需要保存：
+
+- `batch_uuid`
+
+后续查询和取消都要用它。
+
+---
+
+## 6. 查询批次状态
+
+### 6.1 请求
+
+```http
+GET /api/external/registration/batches/{batch_uuid}
+X-API-Key: your_api_key
+```
+
+### 6.2 第三方重点关注字段
+
+- `status`
+- `requested_count`
+- `completed_count`
+- `success_count`
+- `failed_count`
+- `upload_success_count`
+- `upload_failed_count`
+- `failure_reason`
+- `recent_errors`
+
+### 6.3 终态定义
+
+以下状态视为任务结束：
+
+- `completed`
+- `completed_partial`
+- `failed`
+- `cancelled`
+
+建议第三方以这几个状态作为轮询终止条件。
+
+### 6.4 推荐理解方式
+
+如果请求注册 20 个账号：
+
+- `success_count=20`：全部成功
+- `success_count=17, failed_count=3`：部分成功
+- `success_count=0, failed_count=20`：全部失败
+
+不要要求系统必须 100% 成功；应根据成功数和失败数做业务判断。
+
+---
+
+## 7. 取消批次
+
+### 7.1 请求
+
+```http
+POST /api/external/registration/batches/{batch_uuid}/cancel
+X-API-Key: your_api_key
+```
+
+### 7.2 规则
+
+- `pending` / `running` 可取消
+- 已结束批次再次取消会返回 `400`
+- 批次不存在返回 `404`
+
+---
+
+## 8. 错误码说明
+
+| 状态码 | 含义 | 建议处理 |
+| --- | --- | --- |
+| `401` | API Key 错误 | 检查 `X-API-Key` |
+| `403` | 外部 API 未启用 / Key 未配置 | 联系项目方 |
+| `404` | 批次不存在 | 检查 `batch_uuid` |
+| `422` | 请求体校验失败 | 修正 JSON 结构 |
+| `400` | 业务参数错误 | 检查 `service_id` / provider / 状态 |
+| `503` | 服务暂时不可用 | 稍后重试 |
+
+---
+
+## 9. 第三方最小实现建议
+
+第三方系统至少实现以下逻辑：
+
+### 9.1 初始化
+
+- 保存 `Base URL`
+- 保存 `X-API-Key`
+
+### 9.2 下发任务前
+
+- 调一次 `GET /external/capabilities`
+- 读取当前可用邮箱类型
+- 如需固定服务，读取对应 `service_id`
+
+### 9.3 创建任务
+
+- 调 `POST /external/registration/batches`
+- 保存返回的 `batch_uuid`
+
+### 9.4 查询任务
+
+- 周期轮询 `GET /external/registration/batches/{batch_uuid}`
+- 直到进入终态
+
+### 9.5 终态处理
+
+- `completed`：当作成功
+- `completed_partial`：按成功数/失败数决定业务处理
+- `failed`：整体失败
+- `cancelled`：任务已取消
+
+---
+
+## 10. 推荐对接原则
+
+### 原则 1：永远先读 `capabilities`
+
+不要在第三方代码里写死：
+
+- 邮箱类型
+- 上传 provider
+- `service_id`
+
+### 原则 2：建议总是传 `idempotency_key`
+
+这样上游超时重试时，不会重复创建同一批次。
+
+### 原则 3：如果不关心具体服务，就不要传 `service_id`
+
+直接让系统自动选，能减少耦合。
+
+### 原则 4：把结果当作“批次结果”处理
+
+第三方调用的是批次任务，不是单账号实时接口。  
+请以批次维度读取：
+
+- 请求数量
+- 成功数量
+- 失败数量
+- 上传成功/失败数量
+
+---
+
+## 11. 一段可以直接发给技术对接方的话
+
+你可以直接把下面这段发给对方：
+
+```text
+对接地址：
+http://your-domain:8000/api
+
+认证方式：
+请求头增加：
+X-API-Key: your_api_key
+
+先调用：
+GET /external/capabilities
+用来获取当前可用邮箱类型、上传 provider，以及每个服务对应的 service_id 和 name。
+
+再调用：
+POST /external/registration/batches
+创建注册批次。
+
+查询状态：
+GET /external/registration/batches/{batch_uuid}
+
+取消任务：
+POST /external/registration/batches/{batch_uuid}/cancel
+
+注意：
+1. service_id 不要猜，必须来自 capabilities 返回
+2. 如果不指定 service_id，系统会自动选择可用服务
+3. API Key 由项目方提供，不是通过接口申请
+```

pyproject.toml

@@ -0,0 +1,43 @@
+[project]
+name = "codex-console"
+version = "1.0.4"
+description = "OpenAI account management console"
+requires-python = ">=3.10"
+dependencies = [
+    "curl-cffi>=0.14.0",
+    "fastapi>=0.100.0",
+    "uvicorn>=0.23.0",
+    "jinja2>=3.1.0",
+    "python-multipart>=0.0.6",
+    "pydantic>=2.0.0",
+    "pydantic-settings>=2.0.0",
+    "sqlalchemy>=2.0.0",
+    "aiosqlite>=0.19.0",
+    "psycopg[binary]>=3.1.18",
+    "websockets>=16.0",
+    "path>=17.1.1",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=7.0.0",
+    "httpx>=0.24.0",
+]
+payment = [
+    "playwright>=1.40.0",
+]
+
+[project.scripts]
+codex-console = "webui:main"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src"]
+
+[dependency-groups]
+dev = [
+    "pyinstaller>=6.19.0",
+]

requirements.txt

@@ -0,0 +1,15 @@
+certifi>=2024.0.0
+cffi>=1.16.0
+curl_cffi>=0.14.0
+pycparser>=1.21
+pydantic>=2.0.0
+pydantic-settings>=2.0.0
+fastapi>=0.100.0
+uvicorn[standard]>=0.23.0
+jinja2>=3.1.0
+python-multipart>=0.0.6
+sqlalchemy>=2.0.0
+aiosqlite>=0.19.0
+psycopg[binary]>=3.1.18
+# 可选：无痕打开支付页需要 playwright（pip install playwright && playwright install chromium）
+# playwright>=1.40.0

src/__init__.py

@@ -0,0 +1,24 @@
+"""
+OpenAI/Codex CLI 自动注册系统
+"""
+
+from .config import get_settings, EmailServiceType
+from .database import get_db, Account, EmailService, RegistrationTask
+from .core import RegistrationEngine, RegistrationResult
+from .services import EmailServiceFactory, BaseEmailService
+
+__version__ = "2.0.0"
+__author__ = "Yasal"
+
+__all__ = [
+    'get_settings',
+    'EmailServiceType',
+    'get_db',
+    'Account',
+    'EmailService',
+    'RegistrationTask',
+    'RegistrationEngine',
+    'RegistrationResult',
+    'EmailServiceFactory',
+    'BaseEmailService',
+]

src/config/__init__.py

@@ -0,0 +1,53 @@
+"""
+配置模块
+"""
+
+from .settings import (
+    Settings,
+    get_settings,
+    update_settings,
+    get_database_url,
+    init_default_settings,
+    get_setting_definition,
+    get_all_setting_definitions,
+    SETTING_DEFINITIONS,
+    SettingCategory,
+    SettingDefinition,
+)
+from .constants import (
+    AccountStatus,
+    TaskStatus,
+    EmailServiceType,
+    APP_NAME,
+    APP_VERSION,
+    OTP_CODE_PATTERN,
+    DEFAULT_PASSWORD_LENGTH,
+    PASSWORD_CHARSET,
+    DEFAULT_USER_INFO,
+    generate_random_user_info,
+    OPENAI_API_ENDPOINTS,
+)
+
+__all__ = [
+    'Settings',
+    'get_settings',
+    'update_settings',
+    'get_database_url',
+    'init_default_settings',
+    'get_setting_definition',
+    'get_all_setting_definitions',
+    'SETTING_DEFINITIONS',
+    'SettingCategory',
+    'SettingDefinition',
+    'AccountStatus',
+    'TaskStatus',
+    'EmailServiceType',
+    'APP_NAME',
+    'APP_VERSION',
+    'OTP_CODE_PATTERN',
+    'DEFAULT_PASSWORD_LENGTH',
+    'PASSWORD_CHARSET',
+    'DEFAULT_USER_INFO',
+    'generate_random_user_info',
+    'OPENAI_API_ENDPOINTS',
+]

src/config/constants.py

@@ -0,0 +1,413 @@
+"""
+常量定义
+"""
+
+import random
+from datetime import datetime
+from enum import Enum
+from typing import Dict, List, Tuple
+
+
+# ============================================================================
+# 枚举类型
+# ============================================================================
+
+class AccountStatus(str, Enum):
+    """账户状态"""
+    ACTIVE = "active"
+    EXPIRED = "expired"
+    BANNED = "banned"
+    FAILED = "failed"
+
+
+class TaskStatus(str, Enum):
+    """任务状态"""
+    PENDING = "pending"
+    RUNNING = "running"
+    COMPLETED = "completed"
+    FAILED = "failed"
+    CANCELLED = "cancelled"
+
+
+class EmailServiceType(str, Enum):
+    """邮箱服务类型"""
+    TEMPMAIL = "tempmail"
+    OUTLOOK = "outlook"
+    MOE_MAIL = "moe_mail"
+    TEMP_MAIL = "temp_mail"
+    DUCK_MAIL = "duck_mail"
+    FREEMAIL = "freemail"
+    IMAP_MAIL = "imap_mail"
+
+
+# ============================================================================
+# 应用常量
+# ============================================================================
+
+APP_NAME = "OpenAI/Codex CLI 自动注册系统"
+APP_VERSION = "2.0.0"
+APP_DESCRIPTION = "自动注册 OpenAI/Codex CLI 账号的系统"
+
+# ============================================================================
+# OpenAI OAuth 相关常量
+# ============================================================================
+
+# OAuth 参数
+OAUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
+OAUTH_AUTH_URL = "https://auth.openai.com/oauth/authorize"
+OAUTH_TOKEN_URL = "https://auth.openai.com/oauth/token"
+OAUTH_REDIRECT_URI = "http://localhost:1455/auth/callback"
+OAUTH_SCOPE = "openid email profile offline_access"
+
+# OpenAI API 端点
+OPENAI_API_ENDPOINTS = {
+    "sentinel": "https://sentinel.openai.com/backend-api/sentinel/req",
+    "signup": "https://auth.openai.com/api/accounts/authorize/continue",
+    "register": "https://auth.openai.com/api/accounts/user/register",
+    "password_verify": "https://auth.openai.com/api/accounts/password/verify",
+    "send_otp": "https://auth.openai.com/api/accounts/email-otp/send",
+    "validate_otp": "https://auth.openai.com/api/accounts/email-otp/validate",
+    "create_account": "https://auth.openai.com/api/accounts/create_account",
+    "select_workspace": "https://auth.openai.com/api/accounts/workspace/select",
+}
+
+# OpenAI 页面类型（用于判断账号状态）
+OPENAI_PAGE_TYPES = {
+    "EMAIL_OTP_VERIFICATION": "email_otp_verification",  # 已注册账号，需要 OTP 验证
+    "PASSWORD_REGISTRATION": "create_account_password",  # 新账号，需要设置密码
+    "LOGIN_PASSWORD": "login_password",  # 登录流程，需要输入密码
+}
+
+# ============================================================================
+# 邮箱服务相关常量
+# ============================================================================
+
+# Tempmail.lol API 端点
+TEMPMAIL_API_ENDPOINTS = {
+    "create_inbox": "/inbox/create",
+    "get_inbox": "/inbox",
+}
+
+# 自定义域名邮箱 API 端点
+CUSTOM_DOMAIN_API_ENDPOINTS = {
+    "get_config": "/api/config",
+    "create_email": "/api/emails/generate",
+    "list_emails": "/api/emails",
+    "get_email_messages": "/api/emails/{emailId}",
+    "delete_email": "/api/emails/{emailId}",
+    "get_message": "/api/emails/{emailId}/{messageId}",
+}
+
+# 邮箱服务默认配置
+EMAIL_SERVICE_DEFAULTS = {
+    "tempmail": {
+        "base_url": "https://api.tempmail.lol/v2",
+        "timeout": 30,
+        "max_retries": 3,
+    },
+    "outlook": {
+        "imap_server": "outlook.office365.com",
+        "imap_port": 993,
+        "smtp_server": "smtp.office365.com",
+        "smtp_port": 587,
+        "timeout": 30,
+    },
+    "moe_mail": {
+        "base_url": "",  # 需要用户配置
+        "api_key_header": "X-API-Key",
+        "timeout": 30,
+        "max_retries": 3,
+    },
+    "duck_mail": {
+        "base_url": "",
+        "default_domain": "",
+        "password_length": 12,
+        "timeout": 30,
+        "max_retries": 3,
+    },
+    "freemail": {
+        "base_url": "",
+        "admin_token": "",
+        "domain": "",
+        "timeout": 30,
+        "max_retries": 3,
+    },
+    "imap_mail": {
+        "host": "",
+        "port": 993,
+        "use_ssl": True,
+        "email": "",
+        "password": "",
+        "timeout": 30,
+        "max_retries": 3,
+    }
+}
+
+# ============================================================================
+# 注册流程相关常量
+# ============================================================================
+
+# 验证码相关
+OTP_CODE_PATTERN = r"(?<!\d)(\d{6})(?!\d)"
+OTP_MAX_ATTEMPTS = 40  # 最大轮询次数
+
+# 验证码提取正则（增强版）
+# 简单匹配：任意 6 位数字
+OTP_CODE_SIMPLE_PATTERN = r"(?<!\d)(\d{6})(?!\d)"
+# 语义匹配：带上下文的验证码（如 "code is 123456", "验证码 123456"）
+OTP_CODE_SEMANTIC_PATTERN = r'(?:code\s+is|验证码[是为]?\s*[:：]?\s*)(\d{6})'
+
+# OpenAI 验证邮件发件��
+OPENAI_EMAIL_SENDERS = [
+    "noreply@openai.com",
+    "no-reply@openai.com",
+    "@openai.com",     # 精确域名匹配
+    ".openai.com",     # 子域名匹配（如 otp@tm1.openai.com）
+]
+
+# OpenAI 验证邮件关键词
+OPENAI_VERIFICATION_KEYWORDS = [
+    "verify your email",
+    "verification code",
+    "验证码",
+    "your openai code",
+    "code is",
+    "one-time code",
+]
+
+# 密码生成
+PASSWORD_CHARSET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%&*"
+PASSWORD_SPECIAL = "!@#$%&*"
+DEFAULT_PASSWORD_LENGTH = 12
+PASSWORD_MIN_LENGTH = 12
+PASSWORD_MAX_LENGTH = 16
+
+# 用户信息生成（用于注册）
+
+FIRST_NAMES = [
+    "James", "John", "Robert", "Michael", "William", "David", "Richard", "Joseph",
+    "Daniel", "Matthew", "Andrew", "Joshua", "Christopher", "Anthony", "Kevin", "Brian",
+    "Emma", "Olivia", "Ava", "Isabella", "Sophia", "Mia", "Charlotte", "Amelia",
+    "Harper", "Evelyn", "Abigail", "Emily", "Elizabeth", "Natalie", "Victoria", "Samantha",
+    "Liam", "Noah", "Ethan", "Lucas", "Mason", "Oliver", "Elijah", "Aiden",
+    "Henry", "Sebastian", "Jack", "Benjamin", "Logan", "Alexander", "Nathan", "Ryan",
+    "Grace", "Lily", "Chloe", "Zoey", "Nora", "Aria", "Hazel", "Aurora",
+]
+
+LAST_NAMES = [
+    "Smith", "Johnson", "Brown", "Davis", "Wilson", "Moore", "Taylor", "Clark",
+    "Hall", "Young", "Anderson", "Thomas", "Jackson", "White", "Harris", "Martin",
+    "Thompson", "Garcia", "Robinson", "Lewis", "Walker", "Allen", "King", "Wright",
+    "Scott", "Green", "Baker", "Adams", "Nelson", "Carter", "Mitchell", "Roberts",
+    "Turner", "Phillips", "Campbell", "Parker", "Evans", "Edwards", "Collins", "Stewart",
+]
+
+def generate_random_user_info() -> dict:
+    """
+    生成随机用户信息
+
+    Returns:
+        包含 name 和 birthdate 的字典
+    """
+    # 随机选择名字（First + Last）
+    first_name = random.choice(FIRST_NAMES)
+    last_name = random.choice(LAST_NAMES)
+    name = f"{first_name} {last_name}"
+
+    # 生成随机生日（18-45岁）
+    current_year = datetime.now().year
+    birth_year = random.randint(current_year - 45, current_year - 18)
+    birth_month = random.randint(1, 12)
+    # 根据月份确定天数
+    if birth_month in [1, 3, 5, 7, 8, 10, 12]:
+        birth_day = random.randint(1, 31)
+    elif birth_month in [4, 6, 9, 11]:
+        birth_day = random.randint(1, 30)
+    else:
+        # 2月，简化处理
+        birth_day = random.randint(1, 28)
+
+    birthdate = f"{birth_year}-{birth_month:02d}-{birth_day:02d}"
+
+    return {
+        "name": name,
+        "birthdate": birthdate
+    }
+
+# 保留默认值供兼容
+DEFAULT_USER_INFO = {
+    "name": "Neo",
+    "birthdate": "2000-02-20",
+}
+
+# ============================================================================
+# 代理相关常量
+# ============================================================================
+
+PROXY_TYPES = ["http", "socks5", "socks5h"]
+DEFAULT_PROXY_CONFIG = {
+    "enabled": False,
+    "type": "http",
+    "host": "127.0.0.1",
+    "port": 7890,
+}
+
+# ============================================================================
+# 数据库相关常量
+# ============================================================================
+
+# 数据库表名
+DB_TABLE_NAMES = {
+    "accounts": "accounts",
+    "email_services": "email_services",
+    "registration_tasks": "registration_tasks",
+    "settings": "settings",
+}
+
+# 默认设置
+DEFAULT_SETTINGS = [
+    # (key, value, description, category)
+    ("system.name", APP_NAME, "系统名称", "general"),
+    ("system.version", APP_VERSION, "系统版本", "general"),
+    ("logs.retention_days", "30", "日志保留天数", "general"),
+    ("openai.client_id", OAUTH_CLIENT_ID, "OpenAI OAuth Client ID", "openai"),
+    ("openai.auth_url", OAUTH_AUTH_URL, "OpenAI 认证地址", "openai"),
+    ("openai.token_url", OAUTH_TOKEN_URL, "OpenAI Token 地址", "openai"),
+    ("openai.redirect_uri", OAUTH_REDIRECT_URI, "OpenAI 回调地址", "openai"),
+    ("openai.scope", OAUTH_SCOPE, "OpenAI 权限范围", "openai"),
+    ("proxy.enabled", "false", "是否启用代理", "proxy"),
+    ("proxy.type", "http", "代理类型 (http/socks5)", "proxy"),
+    ("proxy.host", "127.0.0.1", "代理主机", "proxy"),
+    ("proxy.port", "7890", "代理端口", "proxy"),
+    ("registration.max_retries", "3", "最大重试次数", "registration"),
+    ("registration.timeout", "120", "超时时间（秒）", "registration"),
+    ("registration.default_password_length", "12", "默认密码长度", "registration"),
+    ("webui.host", "0.0.0.0", "Web UI 监听主机", "webui"),
+    ("webui.port", "8000", "Web UI 监听端口", "webui"),
+    ("webui.debug", "true", "调试模式", "webui"),
+]
+
+# ============================================================================
+# Web UI 相关常量
+# ============================================================================
+
+# WebSocket 事件
+WEBSOCKET_EVENTS = {
+    "CONNECT": "connect",
+    "DISCONNECT": "disconnect",
+    "LOG": "log",
+    "STATUS": "status",
+    "ERROR": "error",
+    "COMPLETE": "complete",
+}
+
+# API 响应状态码
+API_STATUS_CODES = {
+    "SUCCESS": 200,
+    "CREATED": 201,
+    "BAD_REQUEST": 400,
+    "UNAUTHORIZED": 401,
+    "FORBIDDEN": 403,
+    "NOT_FOUND": 404,
+    "CONFLICT": 409,
+    "INTERNAL_ERROR": 500,
+}
+
+# 分页
+DEFAULT_PAGE_SIZE = 20
+MAX_PAGE_SIZE = 100
+
+# ============================================================================
+# 错误消息
+# ============================================================================
+
+ERROR_MESSAGES = {
+    # 通用错误
+    "DATABASE_ERROR": "数据库操作失败",
+    "CONFIG_ERROR": "配置错误",
+    "NETWORK_ERROR": "网络连接失败",
+    "TIMEOUT": "操作超时",
+    "VALIDATION_ERROR": "参数验证失败",
+
+    # 邮箱服务错误
+    "EMAIL_SERVICE_UNAVAILABLE": "邮箱服务不可用",
+    "EMAIL_CREATION_FAILED": "创建邮箱失败",
+    "OTP_NOT_RECEIVED": "未收到验证码",
+    "OTP_INVALID": "验证码无效",
+
+    # OpenAI 相关错误
+    "OPENAI_AUTH_FAILED": "OpenAI 认证失败",
+    "OPENAI_RATE_LIMIT": "OpenAI 接口限流",
+    "OPENAI_CAPTCHA": "遇到验证码",
+
+    # 代理错误
+    "PROXY_FAILED": "代理连接失败",
+    "PROXY_AUTH_FAILED": "代理认证失败",
+
+    # 账户错误
+    "ACCOUNT_NOT_FOUND": "账户不存在",
+    "ACCOUNT_ALREADY_EXISTS": "账户已存在",
+    "ACCOUNT_INVALID": "账户无效",
+
+    # 任务错误
+    "TASK_NOT_FOUND": "任务不存在",
+    "TASK_ALREADY_RUNNING": "任务已在运行中",
+    "TASK_CANCELLED": "任务已取消",
+}
+
+# ============================================================================
+# 正则表达式
+# ============================================================================
+
+REGEX_PATTERNS = {
+    "EMAIL": r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$",
+    "URL": r"https?://(?:[-\w.]|(?:%[\da-fA-F]{2}))+",
+    "IP_ADDRESS": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
+    "OTP_CODE": OTP_CODE_PATTERN,
+}
+
+# ============================================================================
+# 时间常量
+# ============================================================================
+
+TIME_CONSTANTS = {
+    "SECOND": 1,
+    "MINUTE": 60,
+    "HOUR": 3600,
+    "DAY": 86400,
+    "WEEK": 604800,
+}
+
+
+# ============================================================================
+# Microsoft/Outlook 相关常量
+# ============================================================================
+
+# Microsoft OAuth2 Token 端点
+MICROSOFT_TOKEN_ENDPOINTS = {
+    # 旧版 IMAP 使用的端点
+    "LIVE": "https://login.live.com/oauth20_token.srf",
+    # 新版 IMAP 使用的端点（需要特定 scope）
+    "CONSUMERS": "https://login.microsoftonline.com/consumers/oauth2/v2.0/token",
+    # Graph API 使用的端点
+    "COMMON": "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+}
+
+# IMAP 服务器配置
+OUTLOOK_IMAP_SERVERS = {
+    "OLD": "outlook.office365.com",  # 旧版 IMAP
+    "NEW": "outlook.live.com",       # 新版 IMAP
+}
+
+# Microsoft OAuth2 Scopes
+MICROSOFT_SCOPES = {
+    # 旧版 IMAP 不需要特定 scope
+    "IMAP_OLD": "",
+    # 新版 IMAP 需要的 scope
+    "IMAP_NEW": "https://outlook.office.com/IMAP.AccessAsUser.All offline_access",
+    # Graph API 需要的 scope
+    "GRAPH_API": "https://graph.microsoft.com/.default",
+}
+
+# Outlook 提供者默认优先级
+OUTLOOK_PROVIDER_PRIORITY = ["imap_new", "imap_old", "graph_api"]

src/config/settings.py

@@ -0,0 +1,790 @@
+"""
+配置管理 - 完全基于数据库存储
+所有配置都从数据库读取，不再使用环境变量或 .env 文件
+"""
+
+import os
+from typing import Optional, Dict, Any, Type, List
+from enum import Enum
+from pydantic import BaseModel, field_validator
+from pydantic.types import SecretStr
+from dataclasses import dataclass
+
+
+class SettingCategory(str, Enum):
+    """设置分类"""
+    GENERAL = "general"
+    DATABASE = "database"
+    WEBUI = "webui"
+    LOG = "log"
+    OPENAI = "openai"
+    PROXY = "proxy"
+    REGISTRATION = "registration"
+    EMAIL = "email"
+    TEMPMAIL = "tempmail"
+    CUSTOM_DOMAIN = "moe_mail"
+    SECURITY = "security"
+    CPA = "cpa"
+
+
+@dataclass
+class SettingDefinition:
+    """设置定义"""
+    db_key: str
+    default_value: Any
+    category: SettingCategory
+    description: str = ""
+    is_secret: bool = False
+
+
+# 所有配置项定义（包含数据库键名、默认值、分类、描述）
+SETTING_DEFINITIONS: Dict[str, SettingDefinition] = {
+    # 应用信息
+    "app_name": SettingDefinition(
+        db_key="app.name",
+        default_value="OpenAI/Codex CLI 自动注册系统",
+        category=SettingCategory.GENERAL,
+        description="应用名称"
+    ),
+    "app_version": SettingDefinition(
+        db_key="app.version",
+        default_value="2.0.0",
+        category=SettingCategory.GENERAL,
+        description="应用版本"
+    ),
+    "debug": SettingDefinition(
+        db_key="app.debug",
+        default_value=False,
+        category=SettingCategory.GENERAL,
+        description="调试模式"
+    ),
+
+    # 数据库配置
+    "database_url": SettingDefinition(
+        db_key="database.url",
+        default_value="data/database.db",
+        category=SettingCategory.DATABASE,
+        description="数据库路径或连接字符串"
+    ),
+
+    # Web UI 配置
+    "webui_host": SettingDefinition(
+        db_key="webui.host",
+        default_value="0.0.0.0",
+        category=SettingCategory.WEBUI,
+        description="Web UI 监听地址"
+    ),
+    "webui_port": SettingDefinition(
+        db_key="webui.port",
+        default_value=8000,
+        category=SettingCategory.WEBUI,
+        description="Web UI 监听端口"
+    ),
+    "webui_secret_key": SettingDefinition(
+        db_key="webui.secret_key",
+        default_value="your-secret-key-change-in-production",
+        category=SettingCategory.WEBUI,
+        description="Web UI 密钥",
+        is_secret=True
+    ),
+    "webui_access_password": SettingDefinition(
+        db_key="webui.access_password",
+        default_value="admin123",
+        category=SettingCategory.WEBUI,
+        description="Web UI 访问密码",
+        is_secret=True
+    ),
+    "external_api_enabled": SettingDefinition(
+        db_key="external_api.enabled",
+        default_value=False,
+        category=SettingCategory.GENERAL,
+        description="是否启用外部 API"
+    ),
+    "external_api_key": SettingDefinition(
+        db_key="external_api.key",
+        default_value="",
+        category=SettingCategory.GENERAL,
+        description="外部 API Key",
+        is_secret=True
+    ),
+
+    # 日志配置
+    "log_level": SettingDefinition(
+        db_key="log.level",
+        default_value="INFO",
+        category=SettingCategory.LOG,
+        description="日志级别"
+    ),
+    "log_file": SettingDefinition(
+        db_key="log.file",
+        default_value="logs/app.log",
+        category=SettingCategory.LOG,
+        description="日志文件路径"
+    ),
+    "log_retention_days": SettingDefinition(
+        db_key="log.retention_days",
+        default_value=30,
+        category=SettingCategory.LOG,
+        description="日志保留天数"
+    ),
+
+    # OpenAI 配置
+    "openai_client_id": SettingDefinition(
+        db_key="openai.client_id",
+        default_value="app_EMoamEEZ73f0CkXaXp7hrann",
+        category=SettingCategory.OPENAI,
+        description="OpenAI OAuth 客户端 ID"
+    ),
+    "openai_auth_url": SettingDefinition(
+        db_key="openai.auth_url",
+        default_value="https://auth.openai.com/oauth/authorize",
+        category=SettingCategory.OPENAI,
+        description="OpenAI OAuth 授权 URL"
+    ),
+    "openai_token_url": SettingDefinition(
+        db_key="openai.token_url",
+        default_value="https://auth.openai.com/oauth/token",
+        category=SettingCategory.OPENAI,
+        description="OpenAI OAuth Token URL"
+    ),
+    "openai_redirect_uri": SettingDefinition(
+        db_key="openai.redirect_uri",
+        default_value="http://localhost:1455/auth/callback",
+        category=SettingCategory.OPENAI,
+        description="OpenAI OAuth 回调 URI"
+    ),
+    "openai_scope": SettingDefinition(
+        db_key="openai.scope",
+        default_value="openid email profile offline_access",
+        category=SettingCategory.OPENAI,
+        description="OpenAI OAuth 权限范围"
+    ),
+
+    # 代理配置
+    "proxy_enabled": SettingDefinition(
+        db_key="proxy.enabled",
+        default_value=False,
+        category=SettingCategory.PROXY,
+        description="是否启用代理"
+    ),
+    "proxy_type": SettingDefinition(
+        db_key="proxy.type",
+        default_value="http",
+        category=SettingCategory.PROXY,
+        description="代理类型 (http/socks5)"
+    ),
+    "proxy_host": SettingDefinition(
+        db_key="proxy.host",
+        default_value="127.0.0.1",
+        category=SettingCategory.PROXY,
+        description="代理服务器地址"
+    ),
+    "proxy_port": SettingDefinition(
+        db_key="proxy.port",
+        default_value=7890,
+        category=SettingCategory.PROXY,
+        description="代理服务器端口"
+    ),
+    "proxy_username": SettingDefinition(
+        db_key="proxy.username",
+        default_value="",
+        category=SettingCategory.PROXY,
+        description="代理用户名"
+    ),
+    "proxy_password": SettingDefinition(
+        db_key="proxy.password",
+        default_value="",
+        category=SettingCategory.PROXY,
+        description="代理密码",
+        is_secret=True
+    ),
+    "proxy_dynamic_enabled": SettingDefinition(
+        db_key="proxy.dynamic_enabled",
+        default_value=False,
+        category=SettingCategory.PROXY,
+        description="是否启用动态代理"
+    ),
+    "proxy_dynamic_api_url": SettingDefinition(
+        db_key="proxy.dynamic_api_url",
+        default_value="",
+        category=SettingCategory.PROXY,
+        description="动态代理 API 地址，返回代理 URL 字符串"
+    ),
+    "proxy_dynamic_api_key": SettingDefinition(
+        db_key="proxy.dynamic_api_key",
+        default_value="",
+        category=SettingCategory.PROXY,
+        description="动态代理 API 密钥（可选）",
+        is_secret=True
+    ),
+    "proxy_dynamic_api_key_header": SettingDefinition(
+        db_key="proxy.dynamic_api_key_header",
+        default_value="X-API-Key",
+        category=SettingCategory.PROXY,
+        description="动态代理 API 密钥请求头名称"
+    ),
+    "proxy_dynamic_result_field": SettingDefinition(
+        db_key="proxy.dynamic_result_field",
+        default_value="",
+        category=SettingCategory.PROXY,
+        description="从 JSON 响应中提取代理 URL 的字段路径（留空则使用响应原文）"
+    ),
+
+    # 注册配置
+    "registration_max_retries": SettingDefinition(
+        db_key="registration.max_retries",
+        default_value=3,
+        category=SettingCategory.REGISTRATION,
+        description="注册最大重试次数"
+    ),
+    "registration_timeout": SettingDefinition(
+        db_key="registration.timeout",
+        default_value=120,
+        category=SettingCategory.REGISTRATION,
+        description="注册超时时间（秒）"
+    ),
+    "registration_default_password_length": SettingDefinition(
+        db_key="registration.default_password_length",
+        default_value=12,
+        category=SettingCategory.REGISTRATION,
+        description="默认密码长度"
+    ),
+    "registration_sleep_min": SettingDefinition(
+        db_key="registration.sleep_min",
+        default_value=5,
+        category=SettingCategory.REGISTRATION,
+        description="注册间隔最小值（秒）"
+    ),
+    "registration_sleep_max": SettingDefinition(
+        db_key="registration.sleep_max",
+        default_value=30,
+        category=SettingCategory.REGISTRATION,
+        description="注册间隔最大值（秒）"
+    ),
+
+    # 邮箱服务配置
+    "email_service_priority": SettingDefinition(
+        db_key="email.service_priority",
+        default_value={"tempmail": 0, "outlook": 1, "moe_mail": 2},
+        category=SettingCategory.EMAIL,
+        description="邮箱服务优先级"
+    ),
+
+    # Tempmail.lol 配置
+    "tempmail_base_url": SettingDefinition(
+        db_key="tempmail.base_url",
+        default_value="https://api.tempmail.lol/v2",
+        category=SettingCategory.TEMPMAIL,
+        description="Tempmail API 地址"
+    ),
+    "tempmail_timeout": SettingDefinition(
+        db_key="tempmail.timeout",
+        default_value=30,
+        category=SettingCategory.TEMPMAIL,
+        description="Tempmail 超时时间（秒）"
+    ),
+    "tempmail_max_retries": SettingDefinition(
+        db_key="tempmail.max_retries",
+        default_value=3,
+        category=SettingCategory.TEMPMAIL,
+        description="Tempmail 最大重试次数"
+    ),
+
+    # 自定义域名邮箱配置
+    "custom_domain_base_url": SettingDefinition(
+        db_key="custom_domain.base_url",
+        default_value="",
+        category=SettingCategory.CUSTOM_DOMAIN,
+        description="自定义域名 API 地址"
+    ),
+    "custom_domain_api_key": SettingDefinition(
+        db_key="custom_domain.api_key",
+        default_value="",
+        category=SettingCategory.CUSTOM_DOMAIN,
+        description="自定义域名 API 密钥",
+        is_secret=True
+    ),
+
+    # 安全配置
+    "encryption_key": SettingDefinition(
+        db_key="security.encryption_key",
+        default_value="your-encryption-key-change-in-production",
+        category=SettingCategory.SECURITY,
+        description="加密密钥",
+        is_secret=True
+    ),
+
+    # Team Manager 配置
+    "tm_enabled": SettingDefinition(
+        db_key="tm.enabled",
+        default_value=False,
+        category=SettingCategory.GENERAL,
+        description="是否启用 Team Manager 上传"
+    ),
+    "tm_api_url": SettingDefinition(
+        db_key="tm.api_url",
+        default_value="",
+        category=SettingCategory.GENERAL,
+        description="Team Manager API 地址"
+    ),
+    "tm_api_key": SettingDefinition(
+        db_key="tm.api_key",
+        default_value="",
+        category=SettingCategory.GENERAL,
+        description="Team Manager API Key",
+        is_secret=True
+    ),
+
+    # CPA 上传配置
+    "cpa_enabled": SettingDefinition(
+        db_key="cpa.enabled",
+        default_value=False,
+        category=SettingCategory.CPA,
+        description="是否启用 CPA 上传"
+    ),
+    "cpa_api_url": SettingDefinition(
+        db_key="cpa.api_url",
+        default_value="",
+        category=SettingCategory.CPA,
+        description="CPA API 地址"
+    ),
+    "cpa_api_token": SettingDefinition(
+        db_key="cpa.api_token",
+        default_value="",
+        category=SettingCategory.CPA,
+        description="CPA API Token",
+        is_secret=True
+    ),
+
+    # 验证码配置
+    "email_code_timeout": SettingDefinition(
+        db_key="email_code.timeout",
+        default_value=120,
+        category=SettingCategory.EMAIL,
+        description="验证码等待超时时间（秒）"
+    ),
+    "email_code_poll_interval": SettingDefinition(
+        db_key="email_code.poll_interval",
+        default_value=3,
+        category=SettingCategory.EMAIL,
+        description="验证码轮询间隔（秒）"
+    ),
+
+    # Outlook 配置
+    "outlook_provider_priority": SettingDefinition(
+        db_key="outlook.provider_priority",
+        default_value=["imap_old", "imap_new", "graph_api"],
+        category=SettingCategory.EMAIL,
+        description="Outlook 提供者优先级"
+    ),
+    "outlook_health_failure_threshold": SettingDefinition(
+        db_key="outlook.health_failure_threshold",
+        default_value=5,
+        category=SettingCategory.EMAIL,
+        description="Outlook 提供者连续失败次数阈值"
+    ),
+    "outlook_health_disable_duration": SettingDefinition(
+        db_key="outlook.health_disable_duration",
+        default_value=60,
+        category=SettingCategory.EMAIL,
+        description="Outlook 提供者禁用时长（秒）"
+    ),
+    "outlook_default_client_id": SettingDefinition(
+        db_key="outlook.default_client_id",
+        default_value="24d9a0ed-8787-4584-883c-2fd79308940a",
+        category=SettingCategory.EMAIL,
+        description="Outlook OAuth 默认 Client ID"
+    ),
+}
+
+# 属性名到数据库键名的映射（用于向后兼容）
+DB_SETTING_KEYS = {name: defn.db_key for name, defn in SETTING_DEFINITIONS.items()}
+
+# 类型定义映射
+SETTING_TYPES: Dict[str, Type] = {
+    "debug": bool,
+    "webui_port": int,
+    "external_api_enabled": bool,
+    "log_retention_days": int,
+    "proxy_enabled": bool,
+    "proxy_port": int,
+    "proxy_dynamic_enabled": bool,
+    "registration_max_retries": int,
+    "registration_timeout": int,
+    "registration_default_password_length": int,
+    "registration_sleep_min": int,
+    "registration_sleep_max": int,
+    "email_service_priority": dict,
+    "tempmail_timeout": int,
+    "tempmail_max_retries": int,
+    "tm_enabled": bool,
+    "cpa_enabled": bool,
+    "email_code_timeout": int,
+    "email_code_poll_interval": int,
+    "outlook_provider_priority": list,
+    "outlook_health_failure_threshold": int,
+    "outlook_health_disable_duration": int,
+}
+
+# 需要作为 SecretStr 处理的字段
+SECRET_FIELDS = {name for name, defn in SETTING_DEFINITIONS.items() if defn.is_secret}
+
+
+def _convert_value(attr_name: str, value: str) -> Any:
+    """将数据库字符串值转换为正确的类型"""
+    if attr_name in SECRET_FIELDS:
+        return SecretStr(value) if value else SecretStr("")
+
+    target_type = SETTING_TYPES.get(attr_name, str)
+
+    if target_type == bool:
+        if isinstance(value, bool):
+            return value
+        return str(value).lower() in ("true", "1", "yes", "on")
+    elif target_type == int:
+        if isinstance(value, int):
+            return value
+        return int(value) if value else 0
+    elif target_type == dict:
+        if isinstance(value, dict):
+            return value
+        if not value:
+            return {}
+        import json
+        import ast
+        try:
+            return json.loads(value)
+        except (json.JSONDecodeError, ValueError):
+            try:
+                return ast.literal_eval(value)
+            except Exception:
+                return {}
+    elif target_type == list:
+        if isinstance(value, list):
+            return value
+        if not value:
+            return []
+        import json
+        import ast
+        try:
+            return json.loads(value)
+        except (json.JSONDecodeError, ValueError):
+            try:
+                return ast.literal_eval(value)
+            except Exception:
+                return []
+    else:
+        return value
+
+
+def _normalize_database_url(url: str) -> str:
+    if url.startswith("postgres://"):
+        return "postgresql+psycopg://" + url[len("postgres://"):]
+    if url.startswith("postgresql://"):
+        return "postgresql+psycopg://" + url[len("postgresql://"):]
+    return url
+
+
+def _value_to_string(value: Any) -> str:
+    """将值转换为数据库存储的字符串"""
+    if isinstance(value, SecretStr):
+        return value.get_secret_value()
+    elif isinstance(value, bool):
+        return "true" if value else "false"
+    elif isinstance(value, (dict, list)):
+        import json
+        return json.dumps(value)
+    elif value is None:
+        return ""
+    else:
+        return str(value)
+
+
+def init_default_settings() -> None:
+    """
+    初始化数据库中的默认设置
+    如果设置项不存在，则创建并设置默认值
+    """
+    try:
+        from ..database.session import get_db
+        from ..database.crud import get_setting, set_setting
+
+        with get_db() as db:
+            for attr_name, defn in SETTING_DEFINITIONS.items():
+                existing = get_setting(db, defn.db_key)
+                if not existing:
+                    default_value = defn.default_value
+                    if attr_name == "database_url":
+                        env_url = os.environ.get("APP_DATABASE_URL") or os.environ.get("DATABASE_URL")
+                        if env_url:
+                            default_value = _normalize_database_url(env_url)
+                    default_value = _value_to_string(default_value)
+                    set_setting(
+                        db,
+                        defn.db_key,
+                        default_value,
+                        category=defn.category.value,
+                        description=defn.description
+                    )
+                    print(f"[Settings] 初始化默认设置: {defn.db_key} = {default_value if not defn.is_secret else '***'}")
+    except Exception as e:
+        if "未初始化" not in str(e):
+            print(f"[Settings] 初始化默认设置失败: {e}")
+
+
+def _load_settings_from_db() -> Dict[str, Any]:
+    """从数据库加载所有设置"""
+    try:
+        from ..database.session import get_db
+        from ..database.crud import get_setting
+
+        settings_dict = {}
+        with get_db() as db:
+            for attr_name, defn in SETTING_DEFINITIONS.items():
+                db_setting = get_setting(db, defn.db_key)
+                if db_setting:
+                    settings_dict[attr_name] = _convert_value(attr_name, db_setting.value)
+                else:
+                    # 数据库中没有此设置，使用默认值
+                    settings_dict[attr_name] = _convert_value(attr_name, _value_to_string(defn.default_value))
+            env_url = os.environ.get("APP_DATABASE_URL") or os.environ.get("DATABASE_URL")
+            if env_url:
+                settings_dict["database_url"] = _normalize_database_url(env_url)
+            env_host = os.environ.get("WEBUI_HOST") or os.environ.get("APP_HOST")
+            if env_host:
+                settings_dict["webui_host"] = env_host
+            env_port = os.environ.get("PORT") or os.environ.get("WEBUI_PORT") or os.environ.get("APP_PORT")
+            if env_port:
+                try:
+                    settings_dict["webui_port"] = int(env_port)
+                except ValueError:
+                    pass
+            env_password = os.environ.get("WEBUI_ACCESS_PASSWORD") or os.environ.get("APP_ACCESS_PASSWORD")
+            if env_password:
+                settings_dict["webui_access_password"] = env_password
+        return settings_dict
+    except Exception as e:
+        if "未初始化" not in str(e):
+            print(f"[Settings] 从数据库加载设置失败: {e}，使用默认值")
+        return {name: defn.default_value for name, defn in SETTING_DEFINITIONS.items()}
+
+
+def _save_settings_to_db(**kwargs) -> None:
+    """保存设置到数据库"""
+    try:
+        from ..database.session import get_db
+        from ..database.crud import set_setting
+
+        with get_db() as db:
+            for attr_name, value in kwargs.items():
+                if attr_name in SETTING_DEFINITIONS:
+                    defn = SETTING_DEFINITIONS[attr_name]
+                    str_value = _value_to_string(value)
+                    set_setting(
+                        db,
+                        defn.db_key,
+                        str_value,
+                        category=defn.category.value,
+                        description=defn.description
+                    )
+    except Exception as e:
+        if "未初始化" not in str(e):
+            print(f"[Settings] 保存设置到数据库失败: {e}")
+
+
+class Settings(BaseModel):
+    """
+    应用配置 - 完全基于数据库存储
+    """
+
+    # 应用信息
+    app_name: str = "OpenAI/Codex CLI 自动注册系统"
+    app_version: str = "2.0.0"
+    debug: bool = False
+
+    # 数据库配置
+    database_url: str = "data/database.db"
+
+    @field_validator('database_url', mode='before')
+    @classmethod
+    def validate_database_url(cls, v):
+        if isinstance(v, str):
+            if v.startswith(("postgres://", "postgresql://")):
+                return _normalize_database_url(v)
+            if v.startswith(("postgresql+psycopg://", "postgresql+psycopg2://")):
+                return v
+        if isinstance(v, str) and v.startswith("sqlite:///"):
+            return v
+        if isinstance(v, str) and not v.startswith(("sqlite:///", "postgresql://", "postgresql+psycopg://", "postgresql+psycopg2://", "mysql://")):
+            # 如果是文件路径，转换为 SQLite URL
+            if os.path.isabs(v) or ":/" not in v:
+                return f"sqlite:///{v}"
+        return v
+
+    # Web UI 配置
+    webui_host: str = "0.0.0.0"
+    webui_port: int = 8000
+    webui_secret_key: SecretStr = SecretStr("your-secret-key-change-in-production")
+    webui_access_password: SecretStr = SecretStr("admin123")
+    external_api_enabled: bool = False
+    external_api_key: SecretStr = SecretStr("")
+
+    # 日志配置
+    log_level: str = "INFO"
+    log_file: str = "logs/app.log"
+    log_retention_days: int = 30
+
+    # OpenAI 配置
+    openai_client_id: str = "app_EMoamEEZ73f0CkXaXp7hrann"
+    openai_auth_url: str = "https://auth.openai.com/oauth/authorize"
+    openai_token_url: str = "https://auth.openai.com/oauth/token"
+    openai_redirect_uri: str = "http://localhost:1455/auth/callback"
+    openai_scope: str = "openid email profile offline_access"
+
+    # 代理配置
+    proxy_enabled: bool = False
+    proxy_type: str = "http"
+    proxy_host: str = "127.0.0.1"
+    proxy_port: int = 7890
+    proxy_username: Optional[str] = None
+    proxy_password: Optional[SecretStr] = None
+    proxy_dynamic_enabled: bool = False
+    proxy_dynamic_api_url: str = ""
+    proxy_dynamic_api_key: Optional[SecretStr] = None
+    proxy_dynamic_api_key_header: str = "X-API-Key"
+    proxy_dynamic_result_field: str = ""
+
+    @property
+    def proxy_url(self) -> Optional[str]:
+        """获取完整的代理 URL"""
+        if not self.proxy_enabled:
+            return None
+
+        if self.proxy_type == "http":
+            scheme = "http"
+        elif self.proxy_type == "socks5":
+            scheme = "socks5"
+        else:
+            return None
+
+        auth = ""
+        if self.proxy_username and self.proxy_password:
+            auth = f"{self.proxy_username}:{self.proxy_password.get_secret_value()}@"
+
+        return f"{scheme}://{auth}{self.proxy_host}:{self.proxy_port}"
+
+    # 注册配置
+    registration_max_retries: int = 3
+    registration_timeout: int = 120
+    registration_default_password_length: int = 12
+    registration_sleep_min: int = 5
+    registration_sleep_max: int = 30
+
+    # 邮箱服务配置
+    email_service_priority: Dict[str, int] = {"tempmail": 0, "outlook": 1, "moe_mail": 2}
+
+    # Tempmail.lol 配置
+    tempmail_base_url: str = "https://api.tempmail.lol/v2"
+    tempmail_timeout: int = 30
+    tempmail_max_retries: int = 3
+
+    # 自定义域名邮箱配置
+    custom_domain_base_url: str = ""
+    custom_domain_api_key: Optional[SecretStr] = None
+
+    # 安全配置
+    encryption_key: SecretStr = SecretStr("your-encryption-key-change-in-production")
+
+    # Team Manager 配置
+    tm_enabled: bool = False
+    tm_api_url: str = ""
+    tm_api_key: Optional[SecretStr] = None
+
+    # CPA 上传配置
+    cpa_enabled: bool = False
+    cpa_api_url: str = ""
+    cpa_api_token: SecretStr = SecretStr("")
+
+    # 验证码配置
+    email_code_timeout: int = 120
+    email_code_poll_interval: int = 3
+
+    # Outlook 配置
+    outlook_provider_priority: List[str] = ["imap_old", "imap_new", "graph_api"]
+    outlook_health_failure_threshold: int = 5
+    outlook_health_disable_duration: int = 60
+    outlook_default_client_id: str = "24d9a0ed-8787-4584-883c-2fd79308940a"
+
+
+# 全局配置实例
+_settings: Optional[Settings] = None
+
+
+def get_settings() -> Settings:
+    """
+    获取全局配置实例（单例模式）
+    完全从数据库加载配置
+    """
+    global _settings
+    if _settings is None:
+        # 先初始化默认设置（如果数据库中没有的话）
+        init_default_settings()
+        # 从数据库加载所有设置
+        settings_dict = _load_settings_from_db()
+        _settings = Settings(**settings_dict)
+    return _settings
+
+
+def update_settings(**kwargs) -> Settings:
+    """
+    更新配置并保存到数据库
+    """
+    global _settings
+    if _settings is None:
+        _settings = get_settings()
+
+    # 创建新的配置实例
+    updated_data = _settings.model_dump()
+    updated_data.update(kwargs)
+    _settings = Settings(**updated_data)
+
+    # 保存到数据库
+    _save_settings_to_db(**kwargs)
+
+    return _settings
+
+
+def reload_settings() -> Settings:
+    """清空缓存并从数据库重新加载配置。"""
+    global _settings
+    _settings = None
+    return get_settings()
+
+
+def get_database_url() -> str:
+    """
+    获取数据库 URL（处理相对路径）
+    """
+    settings = get_settings()
+    url = settings.database_url
+
+    # 如果 URL 是相对路径，转换为绝对路径
+    if url.startswith("sqlite:///"):
+        path = url[10:]  # 移除 "sqlite:///"
+        if not os.path.isabs(path):
+            # 转换为相对于项目根目录的路径
+            project_root = os.path.dirname(os.path.dirname(os.path.dirname(__file__)))
+            abs_path = os.path.join(project_root, path)
+            return f"sqlite:///{abs_path}"
+
+    return url
+
+
+def get_setting_definition(attr_name: str) -> Optional[SettingDefinition]:
+    """获取设置项的定义信息"""
+    return SETTING_DEFINITIONS.get(attr_name)
+
+
+def get_all_setting_definitions() -> Dict[str, SettingDefinition]:
+    """获取所有设置项的定义"""
+    return SETTING_DEFINITIONS.copy()

src/core/__init__.py

@@ -0,0 +1,32 @@
+"""
+核心功能模块
+"""
+
+from .openai.oauth import OAuthManager, OAuthStart, generate_oauth_url, submit_callback_url
+from .http_client import (
+    OpenAIHTTPClient,
+    HTTPClient,
+    HTTPClientError,
+    RequestConfig,
+    create_http_client,
+    create_openai_client,
+)
+from .register import RegistrationEngine, RegistrationResult
+from .utils import setup_logging, get_data_dir
+
+__all__ = [
+    'OAuthManager',
+    'OAuthStart',
+    'generate_oauth_url',
+    'submit_callback_url',
+    'OpenAIHTTPClient',
+    'HTTPClient',
+    'HTTPClientError',
+    'RequestConfig',
+    'create_http_client',
+    'create_openai_client',
+    'RegistrationEngine',
+    'RegistrationResult',
+    'setup_logging',
+    'get_data_dir',
+]

src/core/dynamic_proxy.py

@@ -0,0 +1,118 @@
+"""
+动态代理获取模块
+支持通过外部 API 获取动态代理 URL
+"""
+
+import logging
+import re
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+
+
+def fetch_dynamic_proxy(api_url: str, api_key: str = "", api_key_header: str = "X-API-Key", result_field: str = "") -> Optional[str]:
+    """
+    从代理 API 获取代理 URL
+
+    Args:
+        api_url: 代理 API 地址，响应应为代理 URL 字符串或含代理 URL 的 JSON
+        api_key: API 密钥（可选）
+        api_key_header: API 密钥请求头名称
+        result_field: 从 JSON 响应中提取代理 URL 的字段路径，支持点号分隔（如 "data.proxy"），留空则使用响应原文
+
+    Returns:
+        代理 URL 字符串（如 http://user:pass@host:port），失败返回 None
+    """
+    try:
+        from curl_cffi import requests as cffi_requests
+
+        headers = {}
+        if api_key:
+            headers[api_key_header] = api_key
+
+        response = cffi_requests.get(
+            api_url,
+            headers=headers,
+            timeout=10,
+            impersonate="chrome110"
+        )
+
+        if response.status_code != 200:
+            logger.warning(f"动态代理 API 返回错误状态码: {response.status_code}")
+            return None
+
+        text = response.text.strip()
+
+        # 尝试解析 JSON
+        if result_field or text.startswith("{") or text.startswith("["):
+            try:
+                import json
+                data = json.loads(text)
+                if result_field:
+                    # 按点号路径逐层提取
+                    for key in result_field.split("."):
+                        if isinstance(data, dict):
+                            data = data.get(key)
+                        elif isinstance(data, list) and key.isdigit():
+                            data = data[int(key)]
+                        else:
+                            data = None
+                        if data is None:
+                            break
+                    proxy_url = str(data).strip() if data is not None else None
+                else:
+                    # 无指定字段，尝试常见键名
+                    for key in ("proxy", "url", "proxy_url", "data", "ip"):
+                        val = data.get(key) if isinstance(data, dict) else None
+                        if val:
+                            proxy_url = str(val).strip()
+                            break
+                    else:
+                        proxy_url = text
+            except (ValueError, AttributeError):
+                proxy_url = text
+        else:
+            proxy_url = text
+
+        if not proxy_url:
+            logger.warning("动态代理 API 返回空代理 URL")
+            return None
+
+        # 若未包含协议头，默认加 http://
+        if not re.match(r'^(http|socks5)://', proxy_url):
+            proxy_url = "http://" + proxy_url
+
+        logger.info(f"动态代理获取成功: {proxy_url[:40]}..." if len(proxy_url) > 40 else f"动态代理获取成功: {proxy_url}")
+        return proxy_url
+
+    except Exception as e:
+        logger.error(f"获取动态代理失败: {e}")
+        return None
+
+
+def get_proxy_url_for_task() -> Optional[str]:
+    """
+    为注册任务获取代理 URL。
+    优先使用动态代理（若启用），否则使用静态代理配置。
+
+    Returns:
+        代理 URL 或 None
+    """
+    from ..config.settings import get_settings
+    settings = get_settings()
+
+    # 优先使用动态代理
+    if settings.proxy_dynamic_enabled and settings.proxy_dynamic_api_url:
+        api_key = settings.proxy_dynamic_api_key.get_secret_value() if settings.proxy_dynamic_api_key else ""
+        proxy_url = fetch_dynamic_proxy(
+            api_url=settings.proxy_dynamic_api_url,
+            api_key=api_key,
+            api_key_header=settings.proxy_dynamic_api_key_header,
+            result_field=settings.proxy_dynamic_result_field,
+        )
+        if proxy_url:
+            return proxy_url
+        logger.warning("动态代理获取失败，回退到静态代理")
+
+    # 使用静态代理
+    return settings.proxy_url

src/core/email_service_catalog.py

@@ -0,0 +1,152 @@
+"""Helpers to build email-service catalog payloads in a reusable way."""
+
+from __future__ import annotations
+
+from typing import Any, Callable, Dict, Iterable, Optional
+
+from ..config.settings import get_settings
+from ..database import crud
+from ..database.session import get_db
+from ..services.temp_mail import TempMailService
+from ..services.temp_mail_domain_provider import summarize_temp_mail_domains
+
+
+DomainFetcher = Callable[[], Any]
+_TEMP_MAIL_ORDER = ["outlook", "moe_mail", "temp_mail", "duck_mail", "freemail", "imap_mail"]
+
+
+def build_temp_mail_service_entry(
+    service: Any,
+    *,
+    fetch_domains: Optional[DomainFetcher] = None,
+    preview_limit: int = 3,
+) -> Dict[str, Any]:
+    """Build one temp_mail service item with safe domain summary."""
+    config = getattr(service, "config", None) or {}
+    summary = summarize_temp_mail_domains(
+        config,
+        fetch_domains=fetch_domains,
+        preview_limit=preview_limit,
+    )
+    summary.pop("domains", None)
+
+    return {
+        "id": getattr(service, "id", None),
+        "name": getattr(service, "name", None),
+        "type": "temp_mail",
+        "priority": getattr(service, "priority", 0),
+        **summary,
+    }
+
+
+def build_temp_mail_catalog(
+    services: Iterable[Any],
+    *,
+    fetch_domains_by_service: Optional[Callable[[Any], Optional[DomainFetcher]]] = None,
+    preview_limit: int = 3,
+) -> Dict[str, Any]:
+    """Build a compact temp_mail catalog block for capabilities APIs."""
+    entries = []
+    for service in services:
+        fetcher = fetch_domains_by_service(service) if fetch_domains_by_service else None
+        entries.append(
+            build_temp_mail_service_entry(
+                service,
+                fetch_domains=fetcher,
+                preview_limit=preview_limit,
+            )
+        )
+
+    return {
+        "available": len(entries) > 0,
+        "count": len(entries),
+        "services": entries,
+    }
+
+
+def _safe_temp_mail_fetcher(service: Any) -> Optional[DomainFetcher]:
+    config = (getattr(service, "config", None) or {}).copy()
+    try:
+        temp_mail = TempMailService(config=config, name=getattr(service, "name", None))
+    except Exception:
+        return None
+
+    def _fetch() -> Any:
+        return temp_mail._fetch_domains_from_worker()  # noqa: SLF001 - internal reuse for summary
+
+    return _fetch
+
+
+def _generic_email_service_entry(service: Any) -> Dict[str, Any]:
+    return {
+        "id": getattr(service, "id", None),
+        "name": getattr(service, "name", None),
+        "type": getattr(service, "service_type", None),
+        "priority": getattr(service, "priority", 0),
+    }
+
+
+def _provider_payload(provider: str, services: Iterable[Any]) -> Dict[str, Any]:
+    items = [
+        {"id": svc.id, "name": svc.name, "priority": svc.priority}
+        for svc in services
+    ]
+    return {
+        "provider": provider,
+        "available": len(items) > 0,
+        "count": len(items),
+        "services": items,
+    }
+
+
+def build_external_capabilities() -> Dict[str, Any]:
+    """Build external API capabilities payload from current DB/settings state."""
+    settings = get_settings()
+
+    with get_db() as db:
+        enabled_email_services = crud.get_email_services(db, enabled=True, limit=1000)
+        grouped: Dict[str, list[Any]] = {}
+        for service in enabled_email_services:
+            grouped.setdefault(service.service_type, []).append(service)
+
+        email_types = []
+
+        ordered_types = [service_type for service_type in _TEMP_MAIL_ORDER if service_type in grouped]
+        remaining_types = sorted(service_type for service_type in grouped.keys() if service_type not in _TEMP_MAIL_ORDER)
+
+        for service_type in [*ordered_types, *remaining_types]:
+            services = grouped.get(service_type, [])
+            if service_type == "temp_mail":
+                email_types.append(
+                    {
+                        "type": service_type,
+                        **build_temp_mail_catalog(
+                            services,
+                            fetch_domains_by_service=_safe_temp_mail_fetcher,
+                        ),
+                    }
+                )
+            else:
+                entries = [_generic_email_service_entry(svc) for svc in services]
+                email_types.append(
+                    {
+                        "type": service_type,
+                        "available": len(entries) > 0,
+                        "count": len(entries),
+                        "services": entries,
+                    }
+                )
+
+        upload_providers = [
+            _provider_payload("cpa", crud.get_cpa_services(db, enabled=True)),
+            _provider_payload("sub2api", crud.get_sub2api_services(db, enabled=True)),
+            _provider_payload("tm", crud.get_tm_services(db, enabled=True)),
+        ]
+
+    return {
+        "email_types": email_types,
+        "upload_providers": upload_providers,
+        "settings": {
+            "external_api_enabled": getattr(settings, "external_api_enabled", False),
+        },
+    }

src/core/external_batches/__init__.py

@@ -0,0 +1,9 @@
+
+from .service import ExternalBatchCreateRequest, ExternalBatchService
+from .recovery import recover_interrupted_external_batches
+
+__all__ = [
+    'ExternalBatchCreateRequest',
+    'ExternalBatchService',
+    'recover_interrupted_external_batches',
+]

src/core/external_batches/recovery.py

@@ -0,0 +1,40 @@
+
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy.orm import Session
+
+from ...database import crud, external_batch_crud
+
+
+def recover_interrupted_external_batches(db: Session) -> int:
+    recovered = 0
+    for batch in external_batch_crud.list_recoverable_batches(db):
+        items = external_batch_crud.list_batch_items(db, batch.batch_uuid)
+        for item in items:
+            if item.status in {'pending', 'running'}:
+                external_batch_crud.update_batch_item(
+                    db,
+                    item.id,
+                    status='failed',
+                    failure_reason='service_restarted',
+                    upload_status='failed' if item.upload_status == 'pending' else item.upload_status,
+                    completed_at=datetime.utcnow(),
+                )
+            task = crud.get_registration_task_by_uuid(db, item.registration_task_uuid) if item.registration_task_uuid else None
+            if task and task.status in {'pending', 'running'}:
+                task.status = 'failed'
+                task.error_message = 'service_restarted'
+                task.completed_at = datetime.utcnow()
+        external_batch_crud.update_batch(
+            db,
+            batch.batch_uuid,
+            status='failed',
+            failure_reason='service_restarted',
+            failure_category='transient',
+            completed_at=datetime.utcnow(),
+        )
+        recovered += 1
+    db.commit()
+    return recovered

src/core/external_batches/service.py

@@ -0,0 +1,448 @@
+
+from __future__ import annotations
+
+import asyncio
+from dataclasses import asdict
+from datetime import datetime
+from typing import Optional
+from uuid import uuid4
+
+from pydantic import BaseModel
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.orm import Session
+
+from ...database import crud, external_batch_crud
+from ...database.models import Account, ExternalRegistrationBatchItem, RegistrationTask
+from ..registration_upload import upload_registered_account
+from ..service_selection import UploadTarget, build_email_item_assignments, resolve_upload_target
+
+
+TERMINAL_ITEM_STATUSES = {'completed', 'failed', 'cancelled'}
+CONFIG_FAILURE_PREFIXES = (
+    'unsupported upload provider:',
+    'no enabled upload services for provider ',
+    'no enabled email services for type ',
+)
+BUSINESS_FAILURE_REASONS = {
+    'outlook requested_service_id cannot be reused when count > 1',
+}
+TRANSIENT_FAILURE_REASONS = {
+    'service_restarted',
+    'no_available_email_service',
+    'registration_failed',
+}
+
+
+class ExternalBatchCreateRequest(BaseModel):
+    count: int
+    idempotency_key: Optional[str] = None
+    email_type: str
+    email_service_id: Optional[int] = None
+    upload_enabled: bool = False
+    upload_provider: Optional[str] = None
+    upload_service_id: Optional[int] = None
+    mode: str = 'pipeline'
+    concurrency: int = 1
+    interval_min: int = 5
+    interval_max: int = 30
+
+
+class ExternalBatchService:
+    @staticmethod
+    def _mark_idempotent_replay(batch):
+        if batch is not None:
+            setattr(batch, '_idempotent_replay', True)
+        return batch
+
+    @staticmethod
+    def _detach_batch(db: Session, batch):
+        if batch is None:
+            return None
+        db.refresh(batch)
+        db.expunge(batch)
+        return batch
+
+    def create_batch(self, db: Session, request: ExternalBatchCreateRequest):
+        if request.idempotency_key:
+            existing = external_batch_crud.get_batch_by_idempotency_key(db, request.idempotency_key)
+            if existing:
+                return self._mark_idempotent_replay(self._detach_batch(db, existing))
+
+        upload_target = None
+        if request.upload_enabled:
+            upload_target = resolve_upload_target(
+                db,
+                provider=request.upload_provider or '',
+                requested_service_id=request.upload_service_id,
+            )
+
+        assignments = build_email_item_assignments(
+            db,
+            email_type=request.email_type,
+            count=request.count,
+            requested_service_id=request.email_service_id,
+        )
+
+        batch_uuid = str(uuid4())
+        batch = external_batch_crud.create_batch(
+            db,
+            batch_uuid=batch_uuid,
+            idempotency_key=request.idempotency_key,
+            status='pending',
+            email_service_type=request.email_type,
+            upload_enabled=request.upload_enabled,
+            upload_provider=upload_target.provider if upload_target else None,
+            requested_count=request.count,
+            request_payload=request.model_dump(),
+            runtime_snapshot={
+                'email_assignments': [asdict(assignment) for assignment in assignments],
+                'upload_target': asdict(upload_target) if upload_target else None,
+            },
+            recent_errors=[],
+        )
+
+        for assignment in assignments:
+            task_uuid = str(uuid4())
+            db.add(
+                RegistrationTask(
+                    task_uuid=task_uuid,
+                    status='pending',
+                    email_service_id=assignment.service_id,
+                )
+            )
+            db.flush()
+            external_batch_crud.create_batch_item(
+                db,
+                batch_id=batch.id,
+                item_index=assignment.item_index,
+                status='pending',
+                failure_reason=assignment.failure_reason,
+                registration_task_uuid=task_uuid,
+                selected_email_service_id=assignment.service_id,
+                upload_status='pending' if request.upload_enabled and not assignment.failure_reason else ('not_enabled' if not request.upload_enabled else 'skipped'),
+            )
+
+        try:
+            db.commit()
+        except IntegrityError:
+            db.rollback()
+            if request.idempotency_key:
+                existing = external_batch_crud.get_batch_by_idempotency_key(db, request.idempotency_key)
+                if existing:
+                    return self._mark_idempotent_replay(self._detach_batch(db, existing))
+            raise
+
+        return self._detach_batch(db, external_batch_crud.get_batch_by_uuid(db, batch_uuid))
+
+    @staticmethod
+    def _classify_failure_category(failure_reason: Optional[str]) -> str:
+        reason = (failure_reason or '').strip().lower()
+        if not reason:
+            return 'transient'
+        if reason in BUSINESS_FAILURE_REASONS:
+            return 'business'
+        if reason in TRANSIENT_FAILURE_REASONS:
+            return 'transient'
+        if reason.startswith(CONFIG_FAILURE_PREFIXES):
+            return 'config'
+        if reason.startswith('upload service ') and (
+            ' not found' in reason
+            or ' is disabled' in reason
+            or ' does not belong to provider ' in reason
+        ):
+            return 'config'
+        if reason.startswith('email service ') and (
+            ' not found' in reason
+            or ' is disabled' in reason
+            or ' does not belong to type ' in reason
+        ):
+            return 'config'
+        return 'transient'
+
+    @staticmethod
+    def _select_failure_reason(batch, items) -> Optional[str]:
+        if batch.failure_reason:
+            return batch.failure_reason
+        for item in items:
+            if item.failure_reason:
+                return item.failure_reason
+        for item in items:
+            if item.upload_status == 'failed' and item.upload_error:
+                return item.upload_error
+        return None
+
+    def recompute_summary(self, db: Session, batch_uuid: str):
+        batch = external_batch_crud.get_batch_by_uuid(db, batch_uuid)
+        if not batch:
+            raise ValueError(f'batch not found: {batch_uuid}')
+
+        items = external_batch_crud.list_batch_items(db, batch_uuid)
+        completed_count = sum(1 for item in items if item.status in TERMINAL_ITEM_STATUSES)
+        success_count = sum(1 for item in items if item.status == 'completed')
+        failed_count = sum(1 for item in items if item.status == 'failed')
+        cancelled_count = sum(1 for item in items if item.status == 'cancelled')
+        upload_success_count = sum(1 for item in items if item.upload_status == 'success')
+        upload_failed_count = sum(1 for item in items if item.upload_status == 'failed')
+
+        recent_errors = []
+        for item in items:
+            if item.failure_reason:
+                recent_errors.append({'item_index': item.item_index, 'reason': item.failure_reason})
+            elif item.upload_status == 'failed' and item.upload_error:
+                recent_errors.append({'item_index': item.item_index, 'reason': item.upload_error})
+
+        if completed_count < batch.requested_count:
+            status = 'running' if batch.started_at else 'pending'
+            completed_at = None
+        elif batch.cancel_requested or cancelled_count:
+            status = 'cancelled'
+            completed_at = datetime.utcnow()
+        elif batch.failure_reason == 'service_restarted':
+            status = 'failed'
+            completed_at = datetime.utcnow()
+        elif success_count == batch.requested_count and failed_count == 0:
+            status = 'completed'
+            completed_at = datetime.utcnow()
+        elif success_count > 0:
+            status = 'completed_partial'
+            completed_at = datetime.utcnow()
+        else:
+            status = 'failed'
+            completed_at = datetime.utcnow()
+
+        failure_category = None
+        if status == 'failed':
+            failure_category = self._classify_failure_category(self._select_failure_reason(batch, items))
+
+        updated = external_batch_crud.update_batch(
+            db,
+            batch_uuid,
+            status=status,
+            completed_count=completed_count,
+            success_count=success_count,
+            failed_count=failed_count,
+            upload_success_count=upload_success_count,
+            upload_failed_count=upload_failed_count,
+            recent_errors=recent_errors[-20:],
+            completed_at=completed_at,
+            failure_category=failure_category,
+        )
+        db.commit()
+        return self._detach_batch(db, updated)
+
+    def ensure_failure_category(self, db: Session, batch):
+        if batch is None:
+            return None
+        if batch.status != 'failed' or batch.failure_category:
+            return batch
+        items = external_batch_crud.list_batch_items(db, batch.batch_uuid)
+        updated = external_batch_crud.update_batch(
+            db,
+            batch.batch_uuid,
+            failure_category=self._classify_failure_category(self._select_failure_reason(batch, items)),
+        )
+        db.commit()
+        return self._detach_batch(db, updated)
+
+    async def run_batch(self, batch_uuid: str):
+        from ...database.session import get_db
+        from ...web.routes.registration import run_registration_task
+
+        with get_db() as db:
+            batch = external_batch_crud.update_batch(db, batch_uuid, status='running', started_at=datetime.utcnow())
+            db.commit()
+            runtime_snapshot = (batch.runtime_snapshot or {}).copy()
+            upload_target_data = runtime_snapshot.get('upload_target')
+            request_payload = batch.request_payload or {}
+            mode = request_payload.get('mode', 'pipeline')
+            concurrency = int(request_payload.get('concurrency', 1) or 1)
+            items = external_batch_crud.list_batch_items(db, batch_uuid)
+            email_service_type = batch.email_service_type
+
+        upload_target = UploadTarget(**upload_target_data) if upload_target_data else None
+
+        async def execute_item(item_id: int):
+            with get_db() as db:
+                item = db.query(ExternalRegistrationBatchItem).filter(ExternalRegistrationBatchItem.id == item_id).first()
+                batch = external_batch_crud.get_batch_by_uuid(db, batch_uuid)
+                if not item or not batch:
+                    return
+                if batch.cancel_requested:
+                    external_batch_crud.update_batch_item(db, item.id, status='cancelled', upload_status='skipped', completed_at=datetime.utcnow())
+                    task = crud.get_registration_task_by_uuid(db, item.registration_task_uuid)
+                    if task:
+                        task.status = 'cancelled'
+                        task.completed_at = datetime.utcnow()
+                    db.commit()
+                    self.recompute_summary(db, batch_uuid)
+                    return
+                if item.failure_reason:
+                    external_batch_crud.update_batch_item(db, item.id, status='failed', completed_at=datetime.utcnow())
+                    task = crud.get_registration_task_by_uuid(db, item.registration_task_uuid)
+                    if task:
+                        task.status = 'failed'
+                        task.error_message = item.failure_reason
+                        task.completed_at = datetime.utcnow()
+                    db.commit()
+                    self.recompute_summary(db, batch_uuid)
+                    return
+
+                external_batch_crud.update_batch_item(db, item.id, status='running', started_at=datetime.utcnow())
+                selected_service_id = item.selected_email_service_id
+                db.commit()
+
+            await run_registration_task(
+                item.registration_task_uuid,
+                email_service_type,
+                None,
+                None,
+                selected_service_id,
+                '[external]',
+                batch_uuid,
+                False,
+                [],
+                False,
+                [],
+                False,
+                [],
+            )
+
+            with get_db() as db:
+                item = db.query(ExternalRegistrationBatchItem).filter(ExternalRegistrationBatchItem.id == item_id).first()
+                task = crud.get_registration_task_by_uuid(db, item.registration_task_uuid)
+                item_status = 'completed' if task and task.status == 'completed' else ('cancelled' if task and task.status == 'cancelled' else 'failed')
+                update_kwargs = {'status': item_status, 'completed_at': datetime.utcnow()}
+                if item_status == 'failed':
+                    update_kwargs['failure_reason'] = (task.error_message if task and task.error_message else 'registration_failed')
+                external_batch_crud.update_batch_item(db, item.id, **update_kwargs)
+
+                if item_status == 'completed' and upload_target is not None:
+                    email = task.result.get('email') if task and task.result else None
+                    account = None
+                    if email:
+                        account = db.query(Account).filter(Account.email == email).order_by(Account.id.desc()).first()
+                    if account is None and task and task.result:
+                        account = db.query(Account).filter(Account.account_id == task.result.get('account_id')).order_by(Account.id.desc()).first()
+                    upload_result = upload_registered_account(account, upload_target)
+                    external_batch_crud.update_batch_item(
+                        db,
+                        item.id,
+                        upload_status='success' if upload_result.success else 'failed',
+                        upload_error=None if upload_result.success else upload_result.message,
+                    )
+                db.commit()
+                self.recompute_summary(db, batch_uuid)
+
+        if mode == 'parallel':
+            semaphore = asyncio.Semaphore(max(1, concurrency))
+
+            async def guarded(item_id: int):
+                async with semaphore:
+                    await execute_item(item_id)
+
+            await asyncio.gather(*(guarded(item.id) for item in items))
+        else:
+            for item in items:
+                await execute_item(item.id)
+
+        with get_db() as db:
+            batch = external_batch_crud.get_batch_by_uuid(db, batch_uuid)
+            if batch and batch.cancel_requested:
+                external_batch_crud.update_batch(db, batch_uuid, status='cancelled', completed_at=datetime.utcnow())
+                db.commit()
+            self.recompute_summary(db, batch_uuid)
+
+    def request_cancel(self, db: Session, batch_uuid: str):
+        batch = external_batch_crud.get_batch_by_uuid(db, batch_uuid)
+        if not batch:
+            return None
+        if batch.status not in {'pending', 'running'}:
+            raise ValueError('batch is already finished')
+        updated = external_batch_crud.update_batch(db, batch_uuid, cancel_requested=True)
+        db.commit()
+        return self._detach_batch(db, updated)
+
+
+def _serialize_batch(batch) -> dict:
+    return {
+        'batch_uuid': batch.batch_uuid,
+        'status': batch.status,
+        'requested_count': batch.requested_count,
+        'completed_count': batch.completed_count,
+        'success_count': batch.success_count,
+        'failed_count': batch.failed_count,
+        'upload_success_count': batch.upload_success_count,
+        'upload_failed_count': batch.upload_failed_count,
+        'failure_reason': batch.failure_reason,
+        'failure_category': batch.failure_category,
+        'created_at': batch.created_at.isoformat() if batch.created_at else None,
+        'started_at': batch.started_at.isoformat() if batch.started_at else None,
+        'completed_at': batch.completed_at.isoformat() if batch.completed_at else None,
+        'recent_errors': batch.recent_errors or [],
+    }
+
+
+def _request_from_payload(payload: dict) -> ExternalBatchCreateRequest:
+    email = payload.get('email') or {}
+    upload = payload.get('upload') or {}
+    execution = payload.get('execution') or {}
+    return ExternalBatchCreateRequest(
+        count=payload['count'],
+        idempotency_key=payload.get('idempotency_key'),
+        email_type=email.get('type'),
+        email_service_id=email.get('service_id'),
+        upload_enabled=bool(upload.get('enabled')),
+        upload_provider=upload.get('provider'),
+        upload_service_id=upload.get('service_id'),
+        mode=execution.get('mode', 'pipeline'),
+        concurrency=execution.get('concurrency', 1),
+        interval_min=execution.get('interval_min', 5),
+        interval_max=execution.get('interval_max', 30),
+    )
+
+
+def create_external_registration_batch(payload: dict, background_tasks=None) -> dict:
+    from ...database.session import get_db
+
+    request = _request_from_payload(payload)
+    service = ExternalBatchService()
+    is_replay = False
+    with get_db() as db:
+        existing = external_batch_crud.get_batch_by_idempotency_key(db, request.idempotency_key) if request.idempotency_key else None
+        if existing is not None:
+            existing = service.ensure_failure_category(db, existing)
+            response = _serialize_batch(existing)
+            response['idempotent_replay'] = True
+            return response
+        batch = service.create_batch(db, request)
+        is_replay = bool(getattr(batch, '_idempotent_replay', False))
+        if is_replay:
+            batch = service.ensure_failure_category(db, batch)
+    if background_tasks is not None:
+        background_tasks.add_task(service.run_batch, batch.batch_uuid)
+    response = _serialize_batch(batch)
+    response['idempotent_replay'] = is_replay
+    return response
+
+
+def get_external_registration_batch_status(batch_uuid: str) -> dict:
+    from ...database.session import get_db
+
+    service = ExternalBatchService()
+    with get_db() as db:
+        batch = external_batch_crud.get_batch_by_uuid(db, batch_uuid)
+        if batch is None:
+            raise ValueError('batch_not_found')
+        batch = service.ensure_failure_category(db, batch)
+        return _serialize_batch(batch)
+
+
+def cancel_external_registration_batch(batch_uuid: str) -> dict:
+    from ...database.session import get_db
+
+    service = ExternalBatchService()
+    with get_db() as db:
+        batch = service.request_cancel(db, batch_uuid)
+        if batch is None:
+            raise ValueError('batch_not_found')
+        return _serialize_batch(batch)

src/core/fetch_logs.py

@@ -0,0 +1,33 @@
+import paramiko
+import sys
+
+def fetch_logs(ip, password, lines=1000):
+    print(f"\n--- Fetching logs from {ip} ---")
+    try:
+        ssh = paramiko.SSHClient()
+        ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
+        ssh.connect(ip, username='root', password=password, timeout=10)
+        
+        # Get the current time on the server to provide context
+        stdin, stdout, stderr = ssh.exec_command('date')
+        print(f"Server Time: {stdout.read().decode('utf-8').strip()}")
+        
+        # Fetch docker logs
+        cmd = f"docker logs --tail {lines} codex-console-webui-1 2>&1 | grep -E 'WARN|ERROR|注册|about-you|login_flow_failed|cookie|token|callback'"
+        stdin, stdout, stderr = ssh.exec_command(cmd)
+        out = stdout.read().decode('utf-8').strip()
+        
+        if out:
+            filename = f"logs_{ip}.txt"
+            with open(filename, "w", encoding="utf-8") as f:
+                f.write(out)
+            print(f"Saved {len(out.splitlines())} lines to {filename}")
+        else:
+            print("No matching logs found.")
+        
+        ssh.close()
+    except Exception as e:
+        print(f"Error checking {ip}: {e}")
+
+fetch_logs('198.46.152.138', 's3IEn8ClaxA4H99Zv7', 5000)
+fetch_logs('23.140.140.70', '33nKDS80L6ipmedJ3y0j', 5000)

src/core/http_client.py

@@ -0,0 +1,436 @@
+"""
+HTTP 客户端封装
+基于 curl_cffi 的 HTTP 请求封装，支持代理和错误处理
+"""
+
+import time
+import json
+from typing import Optional, Dict, Any, Union, Tuple
+from dataclasses import dataclass
+import logging
+
+from curl_cffi import requests as cffi_requests
+from curl_cffi.requests import Session, Response
+
+from ..config.constants import ERROR_MESSAGES
+from ..config.settings import get_settings
+from .openai.sentinel import SentinelPOWError, build_sentinel_pow_token
+from .openai.browser_profile import BrowserProfile, get_random_profile
+
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class RequestConfig:
+    """HTTP 请求配置"""
+    timeout: int = 30
+    max_retries: int = 3
+    retry_delay: float = 1.0
+    impersonate: str = "chrome"
+    verify_ssl: bool = True
+    follow_redirects: bool = True
+
+
+class HTTPClientError(Exception):
+    """HTTP 客户端异常"""
+    pass
+
+
+class HTTPClient:
+    """
+    HTTP 客户端封装
+    支持代理、重试、错误处理和会话管理
+    """
+
+    def __init__(
+        self,
+        proxy_url: Optional[str] = None,
+        config: Optional[RequestConfig] = None,
+        session: Optional[Session] = None
+    ):
+        """
+        初始化 HTTP 客户端
+
+        Args:
+            proxy_url: 代理 URL，如 "http://127.0.0.1:7890"
+            config: 请求配置
+            session: 可重用的会话对象
+        """
+        self.proxy_url = proxy_url
+        self.config = config or RequestConfig()
+        self._session = session
+
+    @property
+    def proxies(self) -> Optional[Dict[str, str]]:
+        """获取代理配置"""
+        if not self.proxy_url:
+            return None
+        return {
+            "http": self.proxy_url,
+            "https": self.proxy_url,
+        }
+
+    @property
+    def session(self) -> Session:
+        """获取会话对象（单例）"""
+        if self._session is None:
+            self._session = Session(
+                proxies=self.proxies,
+                impersonate=self.config.impersonate,
+                verify=self.config.verify_ssl,
+                timeout=self.config.timeout
+            )
+        return self._session
+
+    def request(
+        self,
+        method: str,
+        url: str,
+        **kwargs
+    ) -> Response:
+        """
+        发送 HTTP 请求
+
+        Args:
+            method: HTTP 方法 (GET, POST, PUT, DELETE, etc.)
+            url: 请求 URL
+            **kwargs: 其他请求参数
+
+        Returns:
+            Response 对象
+
+        Raises:
+            HTTPClientError: 请求失败
+        """
+        # 设置默认参数
+        kwargs.setdefault("timeout", self.config.timeout)
+        kwargs.setdefault("allow_redirects", self.config.follow_redirects)
+
+        # 添加代理配置
+        if self.proxies and "proxies" not in kwargs:
+            kwargs["proxies"] = self.proxies
+
+        last_exception = None
+        for attempt in range(self.config.max_retries):
+            try:
+                response = self.session.request(method, url, **kwargs)
+
+                # 检查响应状态码
+                if response.status_code >= 400:
+                    logger.warning(
+                        f"HTTP {response.status_code} for {method} {url}"
+                        f" (attempt {attempt + 1}/{self.config.max_retries})"
+                    )
+
+                    # 如果是服务器错误，重试
+                    if response.status_code >= 500 and attempt < self.config.max_retries - 1:
+                        time.sleep(self.config.retry_delay * (attempt + 1))
+                        continue
+
+                return response
+
+            except (cffi_requests.RequestsError, ConnectionError, TimeoutError) as e:
+                last_exception = e
+                logger.warning(
+                    f"请求失败: {method} {url} (attempt {attempt + 1}/{self.config.max_retries}): {e}"
+                )
+
+                if attempt < self.config.max_retries - 1:
+                    time.sleep(self.config.retry_delay * (attempt + 1))
+                else:
+                    break
+
+        raise HTTPClientError(
+            f"请求失败，最大重试次数已达: {method} {url} - {last_exception}"
+        )
+
+    def get(self, url: str, **kwargs) -> Response:
+        """发送 GET 请求"""
+        return self.request("GET", url, **kwargs)
+
+    def post(self, url: str, data: Any = None, json: Any = None, **kwargs) -> Response:
+        """发送 POST 请求"""
+        return self.request("POST", url, data=data, json=json, **kwargs)
+
+    def put(self, url: str, data: Any = None, json: Any = None, **kwargs) -> Response:
+        """发送 PUT 请求"""
+        return self.request("PUT", url, data=data, json=json, **kwargs)
+
+    def delete(self, url: str, **kwargs) -> Response:
+        """发送 DELETE 请求"""
+        return self.request("DELETE", url, **kwargs)
+
+    def head(self, url: str, **kwargs) -> Response:
+        """发送 HEAD 请求"""
+        return self.request("HEAD", url, **kwargs)
+
+    def options(self, url: str, **kwargs) -> Response:
+        """发送 OPTIONS 请求"""
+        return self.request("OPTIONS", url, **kwargs)
+
+    def patch(self, url: str, data: Any = None, json: Any = None, **kwargs) -> Response:
+        """发送 PATCH 请求"""
+        return self.request("PATCH", url, data=data, json=json, **kwargs)
+
+    def download_file(self, url: str, filepath: str, chunk_size: int = 8192) -> None:
+        """
+        下载文件
+
+        Args:
+            url: 文件 URL
+            filepath: 保存路径
+            chunk_size: 块大小
+
+        Raises:
+            HTTPClientError: 下载失败
+        """
+        try:
+            response = self.get(url, stream=True)
+            response.raise_for_status()
+
+            with open(filepath, 'wb') as f:
+                for chunk in response.iter_content(chunk_size=chunk_size):
+                    if chunk:
+                        f.write(chunk)
+
+        except Exception as e:
+            raise HTTPClientError(f"下载文件失败: {url} - {e}")
+
+    def check_proxy(self, test_url: str = "https://httpbin.org/ip") -> bool:
+        """
+        检查代理是否可用
+
+        Args:
+            test_url: 测试 URL
+
+        Returns:
+            bool: 代理是否可用
+        """
+        if not self.proxy_url:
+            return False
+
+        try:
+            response = self.get(test_url, timeout=10)
+            return response.status_code == 200
+        except Exception:
+            return False
+
+    def close(self):
+        """关闭会话"""
+        if self._session:
+            self._session.close()
+            self._session = None
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        self.close()
+
+
+class OpenAIHTTPClient(HTTPClient):
+    """
+    OpenAI 专用 HTTP 客户端
+    包含 OpenAI API 特定的请求方法
+    """
+
+    def __init__(
+        self,
+        proxy_url: Optional[str] = None,
+        config: Optional[RequestConfig] = None,
+        profile: Optional[BrowserProfile] = None,
+    ):
+        """
+        初始化 OpenAI HTTP 客户端
+
+        Args:
+            proxy_url: 代理 URL
+            config: 请求配置
+            profile: 浏览器指纹 Profile，不传则随机生成
+        """
+        super().__init__(proxy_url, config)
+
+        # 浏览器指纹 Profile
+        self.profile = profile or get_random_profile()
+
+        # 用 Profile 的 impersonate 覆盖默认值
+        self.config.impersonate = self.profile.impersonate
+
+        # OpenAI 特定的默认配置
+        if config is None:
+            self.config.timeout = 30
+            self.config.max_retries = 3
+
+        # 默认请求头（从 Profile 取值，保证一致性）
+        self.default_headers = {
+            "User-Agent": self.profile.user_agent,
+            "Accept": "application/json",
+            "Accept-Language": "en-US,en;q=0.9",
+            "Accept-Encoding": "gzip, deflate, br",
+            "Connection": "keep-alive",
+            "sec-ch-ua": self.profile.sec_ch_ua,
+            "sec-ch-ua-mobile": self.profile.sec_ch_ua_mobile,
+            "sec-ch-ua-platform": self.profile.sec_ch_ua_platform,
+            "Sec-Fetch-Dest": "empty",
+            "Sec-Fetch-Mode": "cors",
+            "Sec-Fetch-Site": "same-site",
+        }
+
+    def check_ip_location(self) -> Tuple[bool, Optional[str]]:
+        """
+        检查 IP 地理位置
+
+        Returns:
+            Tuple[是否支持, 位置信息]
+        """
+        try:
+            response = self.get("https://cloudflare.com/cdn-cgi/trace", timeout=10)
+            trace_text = response.text
+
+            # 解析位置信息
+            import re
+            loc_match = re.search(r"loc=([A-Z]+)", trace_text)
+            loc = loc_match.group(1) if loc_match else None
+
+            # 检查是否支持
+            if loc in ["CN", "HK", "MO", "TW"]:
+                return False, loc
+            return True, loc
+
+        except Exception as e:
+            logger.error(f"检查 IP 地理位置失败: {e}")
+            return False, None
+
+    def send_openai_request(
+        self,
+        endpoint: str,
+        method: str = "POST",
+        data: Optional[Dict[str, Any]] = None,
+        json_data: Optional[Dict[str, Any]] = None,
+        headers: Optional[Dict[str, str]] = None,
+        **kwargs
+    ) -> Dict[str, Any]:
+        """
+        发送 OpenAI API 请求
+
+        Args:
+            endpoint: API 端点
+            method: HTTP 方法
+            data: 表单数据
+            json_data: JSON 数据
+            headers: 请求头
+            **kwargs: 其他参数
+
+        Returns:
+            响应 JSON 数据
+
+        Raises:
+            HTTPClientError: 请求失败
+        """
+        # 合并请求头
+        request_headers = self.default_headers.copy()
+        if headers:
+            request_headers.update(headers)
+
+        # 设置 Content-Type
+        if json_data is not None and "Content-Type" not in request_headers:
+            request_headers["Content-Type"] = "application/json"
+        elif data is not None and "Content-Type" not in request_headers:
+            request_headers["Content-Type"] = "application/x-www-form-urlencoded"
+
+        try:
+            response = self.request(
+                method,
+                endpoint,
+                data=data,
+                json=json_data,
+                headers=request_headers,
+                **kwargs
+            )
+
+            # 检查响应状态码
+            response.raise_for_status()
+
+            # 尝试解析 JSON
+            try:
+                return response.json()
+            except json.JSONDecodeError:
+                return {"raw_response": response.text}
+
+        except cffi_requests.RequestsError as e:
+            raise HTTPClientError(f"OpenAI 请求失败: {endpoint} - {e}")
+
+    def check_sentinel(self, did: str, proxies: Optional[Dict] = None) -> Optional[str]:
+        """
+        检查 Sentinel 拦截
+
+        Args:
+            did: Device ID
+            proxies: 代理配置
+
+        Returns:
+            Sentinel token 或 None
+        """
+        from ..config.constants import OPENAI_API_ENDPOINTS
+
+        try:
+            pow_token = build_sentinel_pow_token(self.profile.user_agent)
+            sen_req_body = json.dumps({
+                "p": pow_token,
+                "id": did,
+                "flow": "authorize_continue",
+            }, separators=(",", ":"))
+
+            response = self.post(
+                OPENAI_API_ENDPOINTS["sentinel"],
+                headers=self.profile.sentinel_headers(),
+                data=sen_req_body,
+            )
+
+            if response.status_code == 200:
+                return response.json().get("token")
+            else:
+                logger.warning(f"Sentinel 检查失败: {response.status_code}")
+                return None
+
+        except SentinelPOWError as e:
+            logger.error(f"Sentinel POW 求解失败: {e}")
+            return None
+        except Exception as e:
+            logger.error(f"Sentinel 检查异常: {e}")
+            return None
+
+
+def create_http_client(
+    proxy_url: Optional[str] = None,
+    config: Optional[RequestConfig] = None
+) -> HTTPClient:
+    """
+    创建 HTTP 客户端工厂函数
+
+    Args:
+        proxy_url: 代理 URL
+        config: 请求配置
+
+    Returns:
+        HTTPClient 实例
+    """
+    return HTTPClient(proxy_url, config)
+
+
+def create_openai_client(
+    proxy_url: Optional[str] = None,
+    config: Optional[RequestConfig] = None
+) -> OpenAIHTTPClient:
+    """
+    创建 OpenAI HTTP 客户端工厂函数
+
+    Args:
+        proxy_url: 代理 URL
+        config: 请求配置
+
+    Returns:
+        OpenAIHTTPClient 实例
+    """
+    return OpenAIHTTPClient(proxy_url, config)

src/core/openai/__init__.py

@@ -0,0 +1,3 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+# @Time : 2026/3/18 19:55

src/core/openai/browser_profile.py

@@ -0,0 +1,146 @@
+"""
+浏览器指纹 Profile 工厂
+
+提供多版本 Chrome 浏览器指纹配置，确保 TLS impersonate、User-Agent、
+sec-ch-ua 三者版本一致，消除反检测信号。
+"""
+
+import random
+from dataclasses import dataclass, field
+from typing import Dict, Optional
+
+
+# Chrome 版本指纹池 — impersonate 标识必须与 curl_cffi 支持的版本匹配
+_CHROME_PROFILES = [
+    {
+        "major": 131, "impersonate": "chrome131",
+        "build": 6778, "patch_range": (69, 205),
+        "sec_ch_ua": '"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"',
+    },
+    {
+        "major": 133, "impersonate": "chrome133a",
+        "build": 6943, "patch_range": (33, 153),
+        "sec_ch_ua": '"Not(A:Brand";v="99", "Google Chrome";v="133", "Chromium";v="133"',
+    },
+    {
+        "major": 136, "impersonate": "chrome136",
+        "build": 7103, "patch_range": (48, 175),
+        "sec_ch_ua": '"Chromium";v="136", "Google Chrome";v="136", "Not.A/Brand";v="99"',
+    },
+]
+
+
+@dataclass(frozen=True)
+class BrowserProfile:
+    """单次会话绑定的浏览器指纹 Profile"""
+
+    impersonate: str
+    major: int
+    full_version: str
+    user_agent: str
+    sec_ch_ua: str
+    sec_ch_ua_mobile: str = "?0"
+    sec_ch_ua_platform: str = '"Windows"'
+
+    # ---- 通用 sec-ch-ua 三件套 ----
+
+    def _ch_ua_headers(self) -> Dict[str, str]:
+        """返回 sec-ch-ua 三件套，Chrome 每个 HTTPS 请求默认发送。"""
+        return {
+            "sec-ch-ua": self.sec_ch_ua,
+            "sec-ch-ua-mobile": self.sec_ch_ua_mobile,
+            "sec-ch-ua-platform": self.sec_ch_ua_platform,
+        }
+
+    # ---- 页面导航请求 headers（GET HTML 页面）----
+
+    def navigation_headers(self, referer: Optional[str] = None) -> Dict[str, str]:
+        """
+        浏览器导航到页面时的 headers（如 GET auth.openai.com/oauth/authorize）。
+        对应 Sec-Fetch-Mode: navigate。
+        """
+        headers: Dict[str, str] = {
+            "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8",
+            "accept-language": "en-US,en;q=0.9",
+            "upgrade-insecure-requests": "1",
+            "sec-fetch-dest": "document",
+            "sec-fetch-mode": "navigate",
+            "sec-fetch-user": "?1",
+            "user-agent": self.user_agent,
+        }
+        headers.update(self._ch_ua_headers())
+
+        if referer:
+            headers["referer"] = referer
+            headers["sec-fetch-site"] = "cross-site"
+        else:
+            headers["sec-fetch-site"] = "none"
+
+        return headers
+
+    # ---- JSON API 请求 headers（POST auth.openai.com/api/*）----
+
+    def json_api_headers(
+        self,
+        referer: str,
+        origin: str = "https://auth.openai.com",
+        oai_did: Optional[str] = None,
+    ) -> Dict[str, str]:
+        """
+        JSON API 请求的统一 headers（如 signup、password_verify、validate_otp、create_account）。
+        对应 Sec-Fetch-Mode: cors。
+        """
+        headers: Dict[str, str] = {
+            "accept": "application/json",
+            "content-type": "application/json",
+            "origin": origin,
+            "referer": referer,
+            "sec-fetch-dest": "empty",
+            "sec-fetch-mode": "cors",
+            "sec-fetch-site": "same-origin",
+        }
+        headers.update(self._ch_ua_headers())
+
+        if oai_did:
+            headers["oai-device-id"] = oai_did
+
+        return headers
+
+    # ---- Sentinel 请求 headers ----
+
+    def sentinel_headers(self) -> Dict[str, str]:
+        """
+        Sentinel PoW 请求的 headers（POST sentinel.openai.com）。
+        对应跨域 CORS 请求。
+        """
+        headers: Dict[str, str] = {
+            "origin": "https://sentinel.openai.com",
+            "referer": "https://sentinel.openai.com/backend-api/sentinel/frame.html?sv=20260219f9f6",
+            "content-type": "text/plain;charset=UTF-8",
+            "sec-fetch-dest": "empty",
+            "sec-fetch-mode": "cors",
+            "sec-fetch-site": "same-origin",
+        }
+        headers.update(self._ch_ua_headers())
+        return headers
+
+
+def get_random_profile() -> BrowserProfile:
+    """从 Chrome 版本池中随机选择一个 Profile，整个注册会话内保持一致。"""
+    cfg = random.choice(_CHROME_PROFILES)
+    major = cfg["major"]
+    build = cfg["build"]
+    patch = random.randint(*cfg["patch_range"])
+    full_ver = f"{major}.0.{build}.{patch}"
+    ua = (
+        f"Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
+        f"AppleWebKit/537.36 (KHTML, like Gecko) "
+        f"Chrome/{full_ver} Safari/537.36"
+    )
+    return BrowserProfile(
+        impersonate=cfg["impersonate"],
+        major=major,
+        full_version=full_ver,
+        user_agent=ua,
+        sec_ch_ua=cfg["sec_ch_ua"],
+    )

src/core/openai/oauth.py

@@ -0,0 +1,410 @@
+"""
+OpenAI OAuth 授权模块
+从 main.py 中提取的 OAuth 相关函数
+"""
+
+import base64
+import hashlib
+import json
+import secrets
+import time
+import urllib.parse
+from dataclasses import dataclass
+from typing import Any, Dict, Optional
+
+from curl_cffi import requests as cffi_requests
+
+from ...config.constants import (
+    OAUTH_CLIENT_ID,
+    OAUTH_AUTH_URL,
+    OAUTH_TOKEN_URL,
+    OAUTH_REDIRECT_URI,
+    OAUTH_SCOPE,
+)
+
+
+def _b64url_no_pad(raw: bytes) -> str:
+    """Base64 URL 编码（无填充）"""
+    return base64.urlsafe_b64encode(raw).decode("ascii").rstrip("=")
+
+
+def _sha256_b64url_no_pad(s: str) -> str:
+    """SHA256 哈希后 Base64 URL 编码"""
+    return _b64url_no_pad(hashlib.sha256(s.encode("ascii")).digest())
+
+
+def _random_state(nbytes: int = 16) -> str:
+    """生成随机 state"""
+    return secrets.token_urlsafe(nbytes)
+
+
+def _pkce_verifier() -> str:
+    """生成 PKCE code_verifier"""
+    return secrets.token_urlsafe(64)
+
+
+def _parse_callback_url(callback_url: str) -> Dict[str, str]:
+    """解析回调 URL"""
+    candidate = callback_url.strip()
+    if not candidate:
+        return {"code": "", "state": "", "error": "", "error_description": ""}
+
+    if "://" not in candidate:
+        if candidate.startswith("?"):
+            candidate = f"http://localhost{candidate}"
+        elif any(ch in candidate for ch in "/?#") or ":" in candidate:
+            candidate = f"http://{candidate}"
+        elif "=" in candidate:
+            candidate = f"http://localhost/?{candidate}"
+
+    parsed = urllib.parse.urlparse(candidate)
+    query = urllib.parse.parse_qs(parsed.query, keep_blank_values=True)
+    fragment = urllib.parse.parse_qs(parsed.fragment, keep_blank_values=True)
+
+    for key, values in fragment.items():
+        if key not in query or not query[key] or not (query[key][0] or "").strip():
+            query[key] = values
+
+    def get1(k: str) -> str:
+        v = query.get(k, [""])
+        return (v[0] or "").strip()
+
+    code = get1("code")
+    state = get1("state")
+    error = get1("error")
+    error_description = get1("error_description")
+
+    if code and not state and "#" in code:
+        code, state = code.split("#", 1)
+
+    if not error and error_description:
+        error, error_description = error_description, ""
+
+    return {
+        "code": code,
+        "state": state,
+        "error": error,
+        "error_description": error_description,
+    }
+
+
+def _jwt_claims_no_verify(id_token: str) -> Dict[str, Any]:
+    """解析 JWT ID Token（不验证签名）"""
+    if not id_token or id_token.count(".") < 2:
+        return {}
+    payload_b64 = id_token.split(".")[1]
+    pad = "=" * ((4 - (len(payload_b64) % 4)) % 4)
+    try:
+        payload = base64.urlsafe_b64decode((payload_b64 + pad).encode("ascii"))
+        return json.loads(payload.decode("utf-8"))
+    except Exception:
+        return {}
+
+
+def _decode_jwt_segment(seg: str) -> Dict[str, Any]:
+    """解码 JWT 片段"""
+    raw = (seg or "").strip()
+    if not raw:
+        return {}
+    pad = "=" * ((4 - (len(raw) % 4)) % 4)
+    try:
+        decoded = base64.urlsafe_b64decode((raw + pad).encode("ascii"))
+        return json.loads(decoded.decode("utf-8"))
+    except Exception:
+        return {}
+
+
+def _to_int(v: Any) -> int:
+    """转换为整数"""
+    try:
+        return int(v)
+    except (TypeError, ValueError):
+        return 0
+
+
+def _post_form(
+    url: str,
+    data: Dict[str, str],
+    timeout: int = 30,
+    proxy_url: Optional[str] = None
+) -> Dict[str, Any]:
+    """
+    发送 POST 表单请求
+
+    Args:
+        url: 请求 URL
+        data: 表单数据
+        timeout: 超时时间
+        proxy_url: 代理 URL
+
+    Returns:
+        响应 JSON 数据
+    """
+    # 构建代理配置
+    proxies = None
+    if proxy_url:
+        proxies = {
+            "http": proxy_url,
+            "https": proxy_url,
+        }
+
+    headers = {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "Accept": "application/json",
+        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 "
+                     "(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+    }
+
+    try:
+        # 使用 curl_cffi 发送请求，支持代理和浏览器指纹
+        response = cffi_requests.post(
+            url,
+            data=data,
+            headers=headers,
+            timeout=timeout,
+            proxies=proxies,
+            impersonate="chrome"
+        )
+
+        if response.status_code != 200:
+            raise RuntimeError(
+                f"token exchange failed: {response.status_code}: {response.text}"
+            )
+
+        return response.json()
+
+    except cffi_requests.RequestsError as e:
+        raise RuntimeError(f"token exchange failed: network error: {e}") from e
+
+
+@dataclass(frozen=True)
+class OAuthStart:
+    """OAuth 开始信息"""
+    auth_url: str
+    state: str
+    code_verifier: str
+    redirect_uri: str
+
+
+def generate_oauth_url(
+    *,
+    redirect_uri: str = OAUTH_REDIRECT_URI,
+    scope: str = OAUTH_SCOPE,
+    client_id: str = OAUTH_CLIENT_ID
+) -> OAuthStart:
+    """
+    生成 OAuth 授权 URL
+
+    Args:
+        redirect_uri: 回调地址
+        scope: 权限范围
+        client_id: OpenAI Client ID
+
+    Returns:
+        OAuthStart 对象，包含授权 URL 和必要参数
+    """
+    state = _random_state()
+    code_verifier = _pkce_verifier()
+    code_challenge = _sha256_b64url_no_pad(code_verifier)
+
+    params = {
+        "client_id": client_id,
+        "response_type": "code",
+        "redirect_uri": redirect_uri,
+        "scope": scope,
+        "state": state,
+        "code_challenge": code_challenge,
+        "code_challenge_method": "S256",
+        "prompt": "login",
+        "id_token_add_organizations": "true",
+        "codex_cli_simplified_flow": "true",
+    }
+    auth_url = f"{OAUTH_AUTH_URL}?{urllib.parse.urlencode(params)}"
+    return OAuthStart(
+        auth_url=auth_url,
+        state=state,
+        code_verifier=code_verifier,
+        redirect_uri=redirect_uri,
+    )
+
+
+def generate_oauth_url_no_prompt(
+    *,
+    redirect_uri: str = OAUTH_REDIRECT_URI,
+    scope: str = OAUTH_SCOPE,
+    client_id: str = OAUTH_CLIENT_ID,
+    login_hint: Optional[str] = None
+) -> OAuthStart:
+    """
+    生成 OAuth 授权 URL（不带 prompt=login）
+
+    用于 Outlook 重登后已持有 auth cookie 的场景，
+    让 OpenAI 直接复用当前登录态而不强制重新登录。
+    """
+    state = _random_state()
+    code_verifier = _pkce_verifier()
+    code_challenge = _sha256_b64url_no_pad(code_verifier)
+
+    params = {
+        "client_id": client_id,
+        "response_type": "code",
+        "redirect_uri": redirect_uri,
+        "scope": scope,
+        "state": state,
+        "code_challenge": code_challenge,
+        "code_challenge_method": "S256",
+        "id_token_add_organizations": "true",
+        "codex_cli_simplified_flow": "true",
+        "prompt": "none",
+    }
+    if login_hint:
+        params["login_hint"] = login_hint
+    auth_url = f"{OAUTH_AUTH_URL}?{urllib.parse.urlencode(params)}"
+    return OAuthStart(
+        auth_url=auth_url,
+        state=state,
+        code_verifier=code_verifier,
+        redirect_uri=redirect_uri,
+    )
+
+
+def submit_callback_url(
+    *,
+    callback_url: str,
+    expected_state: str,
+    code_verifier: str,
+    redirect_uri: str = OAUTH_REDIRECT_URI,
+    client_id: str = OAUTH_CLIENT_ID,
+    token_url: str = OAUTH_TOKEN_URL,
+    proxy_url: Optional[str] = None
+) -> str:
+    """
+    处理 OAuth 回调 URL，获取访问令牌
+
+    Args:
+        callback_url: 回调 URL
+        expected_state: 预期的 state 值
+        code_verifier: PKCE code_verifier
+        redirect_uri: 回调地址
+        client_id: OpenAI Client ID
+        token_url: Token 交换地址
+        proxy_url: 代理 URL
+
+    Returns:
+        包含访问令牌等信息的 JSON 字符串
+
+    Raises:
+        RuntimeError: OAuth 错误
+        ValueError: 缺少必要参数或 state 不匹配
+    """
+    cb = _parse_callback_url(callback_url)
+    if cb["error"]:
+        desc = cb["error_description"]
+        raise RuntimeError(f"oauth error: {cb['error']}: {desc}".strip())
+
+    if not cb["code"]:
+        raise ValueError("callback url missing ?code=")
+    if not cb["state"]:
+        raise ValueError("callback url missing ?state=")
+    if cb["state"] != expected_state:
+        raise ValueError("state mismatch")
+
+    token_resp = _post_form(
+        token_url,
+        {
+            "grant_type": "authorization_code",
+            "client_id": client_id,
+            "code": cb["code"],
+            "redirect_uri": redirect_uri,
+            "code_verifier": code_verifier,
+        },
+        proxy_url=proxy_url
+    )
+
+    access_token = (token_resp.get("access_token") or "").strip()
+    refresh_token = (token_resp.get("refresh_token") or "").strip()
+    id_token = (token_resp.get("id_token") or "").strip()
+    expires_in = _to_int(token_resp.get("expires_in"))
+
+    claims = _jwt_claims_no_verify(id_token)
+    email = str(claims.get("email") or "").strip()
+    auth_claims = claims.get("https://api.openai.com/auth") or {}
+    account_id = str(auth_claims.get("chatgpt_account_id") or "").strip()
+
+    now = int(time.time())
+    expired_rfc3339 = time.strftime(
+        "%Y-%m-%dT%H:%M:%SZ", time.gmtime(now + max(expires_in, 0))
+    )
+    now_rfc3339 = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(now))
+
+    config = {
+        "id_token": id_token,
+        "access_token": access_token,
+        "refresh_token": refresh_token,
+        "account_id": account_id,
+        "last_refresh": now_rfc3339,
+        "email": email,
+        "type": "codex",
+        "expired": expired_rfc3339,
+    }
+
+    return json.dumps(config, ensure_ascii=False, separators=(",", ":"))
+
+
+class OAuthManager:
+    """OAuth 管理器"""
+
+    def __init__(
+        self,
+        client_id: str = OAUTH_CLIENT_ID,
+        auth_url: str = OAUTH_AUTH_URL,
+        token_url: str = OAUTH_TOKEN_URL,
+        redirect_uri: str = OAUTH_REDIRECT_URI,
+        scope: str = OAUTH_SCOPE,
+        proxy_url: Optional[str] = None
+    ):
+        self.client_id = client_id
+        self.auth_url = auth_url
+        self.token_url = token_url
+        self.redirect_uri = redirect_uri
+        self.scope = scope
+        self.proxy_url = proxy_url
+
+    def start_oauth(self) -> OAuthStart:
+        """开始 OAuth 流程"""
+        return generate_oauth_url(
+            redirect_uri=self.redirect_uri,
+            scope=self.scope,
+            client_id=self.client_id
+        )
+
+    def handle_callback(
+        self,
+        callback_url: str,
+        expected_state: str,
+        code_verifier: str
+    ) -> Dict[str, Any]:
+        """处理 OAuth 回调"""
+        result_json = submit_callback_url(
+            callback_url=callback_url,
+            expected_state=expected_state,
+            code_verifier=code_verifier,
+            redirect_uri=self.redirect_uri,
+            client_id=self.client_id,
+            token_url=self.token_url,
+            proxy_url=self.proxy_url
+        )
+        return json.loads(result_json)
+
+    def extract_account_info(self, id_token: str) -> Dict[str, Any]:
+        """从 ID Token 中提取账户信息"""
+        claims = _jwt_claims_no_verify(id_token)
+        email = str(claims.get("email") or "").strip()
+        auth_claims = claims.get("https://api.openai.com/auth") or {}
+        account_id = str(auth_claims.get("chatgpt_account_id") or "").strip()
+
+        return {
+            "email": email,
+            "account_id": account_id,
+            "claims": claims
+        }

src/core/openai/payment.py

@@ -0,0 +1,261 @@
+"""
+支付核心逻辑 — 生成 Plus/Team 支付链接、无痕打开浏览器、检测订阅状态
+"""
+
+import logging
+import subprocess
+import sys
+from typing import Optional
+
+from curl_cffi import requests as cffi_requests
+
+from ...database.models import Account
+
+logger = logging.getLogger(__name__)
+
+PAYMENT_CHECKOUT_URL = "https://chatgpt.com/backend-api/payments/checkout"
+TEAM_CHECKOUT_BASE_URL = "https://chatgpt.com/checkout/openai_llc/"
+
+
+def _build_proxies(proxy: Optional[str]) -> Optional[dict]:
+    if proxy:
+        return {"http": proxy, "https": proxy}
+    return None
+
+
+_COUNTRY_CURRENCY_MAP = {
+    "SG": "SGD",
+    "US": "USD",
+    "TR": "TRY",
+    "JP": "JPY",
+    "HK": "HKD",
+    "GB": "GBP",
+    "EU": "EUR",
+    "AU": "AUD",
+    "CA": "CAD",
+    "IN": "INR",
+    "BR": "BRL",
+    "MX": "MXN",
+}
+
+
+def _extract_oai_did(cookies_str: str) -> Optional[str]:
+    """从 cookie 字符串中提取 oai-device-id"""
+    for part in cookies_str.split(";"):
+        part = part.strip()
+        if part.startswith("oai-did="):
+            return part[len("oai-did="):].strip()
+    return None
+
+
+def _parse_cookie_str(cookies_str: str, domain: str) -> list:
+    """将 'key=val; key2=val2' 格式解析为 Playwright cookie 列表"""
+    cookies = []
+    for part in cookies_str.split(";"):
+        part = part.strip()
+        if "=" not in part:
+            continue
+        name, _, value = part.partition("=")
+        cookies.append({
+            "name": name.strip(),
+            "value": value.strip(),
+            "domain": domain,
+            "path": "/",
+        })
+    return cookies
+
+
+def _open_url_system_browser(url: str) -> bool:
+    """回退方案：调用系统浏览器以无痕模式打开"""
+    platform = sys.platform
+    try:
+        if platform == "win32":
+            for browser, flag in [("chrome", "--incognito"), ("msedge", "--inprivate")]:
+                try:
+                    subprocess.Popen(f'start {browser} {flag} "{url}"', shell=True)
+                    return True
+                except Exception:
+                    continue
+        elif platform == "darwin":
+            subprocess.Popen(["open", "-a", "Google Chrome", "--args", "--incognito", url])
+            return True
+        else:
+            for binary in ["google-chrome", "chromium-browser", "chromium"]:
+                try:
+                    subprocess.Popen([binary, "--incognito", url])
+                    return True
+                except FileNotFoundError:
+                    continue
+    except Exception as e:
+        logger.warning(f"系统浏览器无痕打开失败: {e}")
+    return False
+
+
+def generate_plus_link(
+    account: Account,
+    proxy: Optional[str] = None,
+    country: str = "SG",
+) -> str:
+    """生成 Plus 支付链接（后端携带账号 cookie 发请求）"""
+    if not account.access_token:
+        raise ValueError("账号缺少 access_token")
+
+    currency = _COUNTRY_CURRENCY_MAP.get(country, "USD")
+    headers = {
+        "Authorization": f"Bearer {account.access_token}",
+        "Content-Type": "application/json",
+        "oai-language": "zh-CN",
+    }
+    if account.cookies:
+        headers["cookie"] = account.cookies
+        oai_did = _extract_oai_did(account.cookies)
+        if oai_did:
+            headers["oai-device-id"] = oai_did
+
+    payload = {
+        "plan_name": "chatgptplusplan",
+        "billing_details": {"country": country, "currency": currency},
+        "promo_campaign": {
+            "promo_campaign_id": "plus-1-month-free",
+            "is_coupon_from_query_param": False,
+        },
+        "checkout_ui_mode": "custom",
+    }
+
+    resp = cffi_requests.post(
+        PAYMENT_CHECKOUT_URL,
+        headers=headers,
+        json=payload,
+        proxies=_build_proxies(proxy),
+        timeout=30,
+        impersonate="chrome110",
+    )
+    resp.raise_for_status()
+    data = resp.json()
+    if "checkout_session_id" in data:
+        return TEAM_CHECKOUT_BASE_URL + data["checkout_session_id"]
+    raise ValueError(data.get("detail", "API 未返回 checkout_session_id"))
+
+
+def generate_team_link(
+    account: Account,
+    workspace_name: str = "MyTeam",
+    price_interval: str = "month",
+    seat_quantity: int = 5,
+    proxy: Optional[str] = None,
+    country: str = "SG",
+) -> str:
+    """生成 Team 支付链接（后端携带账号 cookie 发请求）"""
+    if not account.access_token:
+        raise ValueError("账号缺少 access_token")
+
+    currency = _COUNTRY_CURRENCY_MAP.get(country, "USD")
+    headers = {
+        "Authorization": f"Bearer {account.access_token}",
+        "Content-Type": "application/json",
+        "oai-language": "zh-CN",
+    }
+    if account.cookies:
+        headers["cookie"] = account.cookies
+        oai_did = _extract_oai_did(account.cookies)
+        if oai_did:
+            headers["oai-device-id"] = oai_did
+
+    payload = {
+        "plan_name": "chatgptteamplan",
+        "team_plan_data": {
+            "workspace_name": workspace_name,
+            "price_interval": price_interval,
+            "seat_quantity": seat_quantity,
+        },
+        "billing_details": {"country": country, "currency": currency},
+        "promo_campaign": {
+            "promo_campaign_id": "team-1-month-free",
+            "is_coupon_from_query_param": True,
+        },
+        "cancel_url": "https://chatgpt.com/#pricing",
+        "checkout_ui_mode": "custom",
+    }
+
+    resp = cffi_requests.post(
+        PAYMENT_CHECKOUT_URL,
+        headers=headers,
+        json=payload,
+        proxies=_build_proxies(proxy),
+        timeout=30,
+        impersonate="chrome110",
+    )
+    resp.raise_for_status()
+    data = resp.json()
+    if "checkout_session_id" in data:
+        return TEAM_CHECKOUT_BASE_URL + data["checkout_session_id"]
+    raise ValueError(data.get("detail", "API 未返回 checkout_session_id"))
+
+
+def open_url_incognito(url: str, cookies_str: Optional[str] = None) -> bool:
+    """用 Playwright 以无痕模式打开 URL，可注入 cookie"""
+    import threading
+    try:
+        from playwright.sync_api import sync_playwright
+    except ImportError:
+        logger.warning("playwright 未安装，回退到系统浏览器")
+        return _open_url_system_browser(url)
+
+    def _launch():
+        try:
+            with sync_playwright() as p:
+                browser = p.chromium.launch(headless=False, args=["--incognito"])
+                ctx = browser.new_context()
+                if cookies_str:
+                    ctx.add_cookies(_parse_cookie_str(cookies_str, "chatgpt.com"))
+                page = ctx.new_page()
+                page.goto(url)
+                # 保持窗口打开直到用户关闭
+                page.wait_for_timeout(300_000)  # 最多等待 5 分钟
+        except Exception as e:
+            logger.warning(f"Playwright 无痕打开失败: {e}")
+
+    threading.Thread(target=_launch, daemon=True).start()
+    return True
+
+
+def check_subscription_status(account: Account, proxy: Optional[str] = None) -> str:
+    """
+    检测账号当前订阅状态。
+
+    Returns:
+        'free' / 'plus' / 'team'
+    """
+    if not account.access_token:
+        raise ValueError("账号缺少 access_token")
+
+    headers = {
+        "Authorization": f"Bearer {account.access_token}",
+        "Content-Type": "application/json",
+    }
+
+    resp = cffi_requests.get(
+        "https://chatgpt.com/backend-api/me",
+        headers=headers,
+        proxies=_build_proxies(proxy),
+        timeout=20,
+        impersonate="chrome110",
+    )
+    resp.raise_for_status()
+    data = resp.json()
+
+    # 解析订阅类型
+    plan = data.get("plan_type") or ""
+    if "team" in plan.lower():
+        return "team"
+    if "plus" in plan.lower():
+        return "plus"
+
+    # 尝试从 orgs 或 workspace 信息判断
+    orgs = data.get("orgs", {}).get("data", [])
+    for org in orgs:
+        settings_ = org.get("settings", {})
+        if settings_.get("workspace_plan_type") in ("team", "enterprise"):
+            return "team"
+
+    return "free"

src/core/openai/sentinel.py

@@ -0,0 +1,108 @@
+"""Helpers for OpenAI Sentinel proof-of-work tokens."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import random
+import time
+import uuid
+from datetime import datetime, timedelta, timezone
+from typing import Sequence
+
+
+DEFAULT_SENTINEL_DIFF = "0fffff"
+DEFAULT_MAX_ITERATIONS = 500_000
+_SCREEN_SIGNATURES = ("1920x1080", "2560x1440", "1366x768", "1536x864", "1440x900")
+_LANGUAGE_SIGNATURE = "en-US,en"
+_NAVIGATOR_KEYS = (
+    "vendorSub", "productSub", "vendor", "maxTouchPoints",
+    "scheduling", "userActivation", "doNotTrack", "geolocation",
+    "connection", "plugins", "mimeTypes", "pdfViewerEnabled",
+    "webkitTemporaryStorage", "webkitPersistentStorage",
+    "hardwareConcurrency", "cookieEnabled", "credentials",
+    "mediaDevices", "permissions", "locks", "ink",
+)
+_WINDOW_KEYS = (
+    "Object", "Function", "Array", "Number", "parseFloat",
+    "undefined", "window", "document", "navigator",
+)
+
+
+class SentinelPOWError(RuntimeError):
+    """Raised when a Sentinel proof-of-work token cannot be solved."""
+
+
+def _format_browser_time() -> str:
+    """Match the browser-style timestamp used by public Sentinel solvers."""
+    browser_now = datetime.now(timezone.utc)
+    return browser_now.strftime("%a %b %d %Y %H:%M:%S") + " GMT+0000 (Coordinated Universal Time)"
+
+
+def build_sentinel_config(user_agent: str) -> list:
+    """Build a browser-like fingerprint payload for the Sentinel PoW solver."""
+    perf_ms = time.perf_counter() * 1000
+    epoch_ms = (time.time() * 1000) - perf_ms
+    return [
+        random.choice(_SCREEN_SIGNATURES),
+        _format_browser_time(),
+        4294705152,
+        0,
+        user_agent,
+        "",
+        "",
+        "en-US",
+        _LANGUAGE_SIGNATURE,
+        0,
+        random.choice(_NAVIGATOR_KEYS),
+        "location",
+        random.choice(_WINDOW_KEYS),
+        perf_ms,
+        str(uuid.uuid4()),
+        "",
+        8,
+        epoch_ms,
+    ]
+
+
+def _encode_pow_payload(config: Sequence[object], nonce: int) -> bytes:
+    prefix = (json.dumps(config[:3], separators=(",", ":"), ensure_ascii=False)[:-1] + ",").encode("utf-8")
+    middle = (
+        "," + json.dumps(config[4:9], separators=(",", ":"), ensure_ascii=False)[1:-1] + ","
+    ).encode("utf-8")
+    suffix = ("," + json.dumps(config[10:], separators=(",", ":"), ensure_ascii=False)[1:]).encode("utf-8")
+    body = prefix + str(nonce).encode("ascii") + middle + str(nonce >> 1).encode("ascii") + suffix
+    return base64.b64encode(body)
+
+
+def solve_sentinel_pow(
+    seed: str,
+    difficulty: str,
+    config: Sequence[object],
+    max_iterations: int = DEFAULT_MAX_ITERATIONS,
+) -> str:
+    """Solve the Sentinel PoW challenge and return the base64 payload."""
+    seed_bytes = seed.encode("utf-8")
+    target = bytes.fromhex(difficulty)
+    prefix_length = len(target)
+
+    for nonce in range(max_iterations):
+        encoded = _encode_pow_payload(config, nonce)
+        digest = hashlib.sha3_512(seed_bytes + encoded).digest()
+        if digest[:prefix_length] <= target:
+            return encoded.decode("ascii")
+
+    raise SentinelPOWError(f"failed to solve sentinel pow after {max_iterations} attempts")
+
+
+def build_sentinel_pow_token(
+    user_agent: str,
+    difficulty: str = DEFAULT_SENTINEL_DIFF,
+    max_iterations: int = DEFAULT_MAX_ITERATIONS,
+) -> str:
+    """Build the `p` token required by the Sentinel request endpoint."""
+    config = build_sentinel_config(user_agent)
+    seed = format(random.random())
+    solution = solve_sentinel_pow(seed, difficulty, config, max_iterations=max_iterations)
+    return f"gAAAAAC{solution}"

src/core/openai/token_refresh.py

@@ -0,0 +1,332 @@
+"""
+Token 刷新模块
+支持 Session Token 和 OAuth Refresh Token 两种刷新方式
+"""
+
+import logging
+import json
+import time
+from typing import Optional, Dict, Any, Tuple
+from dataclasses import dataclass
+from datetime import datetime, timedelta
+
+from curl_cffi import requests as cffi_requests
+
+from ...config.settings import get_settings
+from ...database.session import get_db
+from ...database import crud
+from ...database.models import Account
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class TokenRefreshResult:
+    """Token 刷新结果"""
+    success: bool
+    access_token: str = ""
+    refresh_token: str = ""
+    expires_at: Optional[datetime] = None
+    error_message: str = ""
+
+
+class TokenRefreshManager:
+    """
+    Token 刷新管理器
+    支持两种刷新方式：
+    1. Session Token 刷新（优先）
+    2. OAuth Refresh Token 刷新
+    """
+
+    # OpenAI OAuth 端点
+    SESSION_URL = "https://chatgpt.com/api/auth/session"
+    TOKEN_URL = "https://auth.openai.com/oauth/token"
+
+    def __init__(self, proxy_url: Optional[str] = None):
+        """
+        初始化 Token 刷新管理器
+
+        Args:
+            proxy_url: 代理 URL
+        """
+        self.proxy_url = proxy_url
+        self.settings = get_settings()
+
+    def _create_session(self) -> cffi_requests.Session:
+        """创建 HTTP 会话"""
+        session = cffi_requests.Session(impersonate="chrome120", proxy=self.proxy_url)
+        return session
+
+    def refresh_by_session_token(self, session_token: str) -> TokenRefreshResult:
+        """
+        使用 Session Token 刷新
+
+        Args:
+            session_token: 会话令牌
+
+        Returns:
+            TokenRefreshResult: 刷新结果
+        """
+        result = TokenRefreshResult(success=False)
+
+        try:
+            session = self._create_session()
+
+            # 设置会话 Cookie
+            session.cookies.set(
+                "__Secure-next-auth.session-token",
+                session_token,
+                domain=".chatgpt.com",
+                path="/"
+            )
+
+            # 请求会话端点
+            response = session.get(
+                self.SESSION_URL,
+                headers={
+                    "accept": "application/json",
+                    "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
+                },
+                timeout=30
+            )
+
+            if response.status_code != 200:
+                result.error_message = f"Session token 刷新失败: HTTP {response.status_code}"
+                logger.warning(result.error_message)
+                return result
+
+            data = response.json()
+
+            # 提取 access_token
+            access_token = data.get("accessToken")
+            if not access_token:
+                result.error_message = "Session token 刷新失败: 未找到 accessToken"
+                logger.warning(result.error_message)
+                return result
+
+            # 提取过期时间
+            expires_at = None
+            expires_str = data.get("expires")
+            if expires_str:
+                try:
+                    expires_at = datetime.fromisoformat(expires_str.replace("Z", "+00:00"))
+                except:
+                    pass
+
+            result.success = True
+            result.access_token = access_token
+            result.expires_at = expires_at
+
+            logger.info(f"Session token 刷新成功，过期时间: {expires_at}")
+            return result
+
+        except Exception as e:
+            result.error_message = f"Session token 刷新异常: {str(e)}"
+            logger.error(result.error_message)
+            return result
+
+    def refresh_by_oauth_token(
+        self,
+        refresh_token: str,
+        client_id: Optional[str] = None
+    ) -> TokenRefreshResult:
+        """
+        使用 OAuth Refresh Token 刷新
+
+        Args:
+            refresh_token: OAuth 刷新令牌
+            client_id: OAuth Client ID
+
+        Returns:
+            TokenRefreshResult: 刷新结果
+        """
+        result = TokenRefreshResult(success=False)
+
+        try:
+            session = self._create_session()
+
+            # 使用配置的 client_id 或默认值
+            client_id = client_id or self.settings.openai_client_id
+
+            # 构建请求体
+            token_data = {
+                "client_id": client_id,
+                "grant_type": "refresh_token",
+                "refresh_token": refresh_token,
+                "redirect_uri": self.settings.openai_redirect_uri
+            }
+
+            response = session.post(
+                self.TOKEN_URL,
+                headers={
+                    "content-type": "application/x-www-form-urlencoded",
+                    "accept": "application/json"
+                },
+                data=token_data,
+                timeout=30
+            )
+
+            if response.status_code != 200:
+                result.error_message = f"OAuth token 刷新失败: HTTP {response.status_code}"
+                logger.warning(f"{result.error_message}, 响应: {response.text[:200]}")
+                return result
+
+            data = response.json()
+
+            # 提取令牌
+            access_token = data.get("access_token")
+            new_refresh_token = data.get("refresh_token", refresh_token)
+            expires_in = data.get("expires_in", 3600)
+
+            if not access_token:
+                result.error_message = "OAuth token 刷新失败: 未找到 access_token"
+                logger.warning(result.error_message)
+                return result
+
+            # 计算过期时间
+            expires_at = datetime.utcnow() + timedelta(seconds=expires_in)
+
+            result.success = True
+            result.access_token = access_token
+            result.refresh_token = new_refresh_token
+            result.expires_at = expires_at
+
+            logger.info(f"OAuth token 刷新成功，过期时间: {expires_at}")
+            return result
+
+        except Exception as e:
+            result.error_message = f"OAuth token 刷新异常: {str(e)}"
+            logger.error(result.error_message)
+            return result
+
+    def refresh_account(self, account: Account) -> TokenRefreshResult:
+        """
+        刷新账号的 Token
+
+        优先级：
+        1. Session Token 刷新
+        2. OAuth Refresh Token 刷新
+
+        Args:
+            account: 账号对象
+
+        Returns:
+            TokenRefreshResult: 刷新结果
+        """
+        # 优先尝试 Session Token
+        if account.session_token:
+            logger.info(f"尝试使用 Session Token 刷新账号 {account.email}")
+            result = self.refresh_by_session_token(account.session_token)
+            if result.success:
+                return result
+            logger.warning(f"Session Token 刷新失败，尝试 OAuth 刷新")
+
+        # 尝试 OAuth Refresh Token
+        if account.refresh_token:
+            logger.info(f"尝试使用 OAuth Refresh Token 刷新账号 {account.email}")
+            result = self.refresh_by_oauth_token(
+                refresh_token=account.refresh_token,
+                client_id=account.client_id
+            )
+            return result
+
+        # 无可用刷新方式
+        return TokenRefreshResult(
+            success=False,
+            error_message="账号没有可用的刷新方式（缺少 session_token 和 refresh_token）"
+        )
+
+    def validate_token(self, access_token: str) -> Tuple[bool, Optional[str]]:
+        """
+        验证 Access Token 是否有效
+
+        Args:
+            access_token: 访问令牌
+
+        Returns:
+            Tuple[bool, Optional[str]]: (是否有效, 错误信息)
+        """
+        try:
+            session = self._create_session()
+
+            # 调用 OpenAI API 验证 token
+            response = session.get(
+                "https://chatgpt.com/backend-api/me",
+                headers={
+                    "authorization": f"Bearer {access_token}",
+                    "accept": "application/json"
+                },
+                timeout=30
+            )
+
+            if response.status_code == 200:
+                return True, None
+            elif response.status_code == 401:
+                return False, "Token 无效或已过期"
+            elif response.status_code == 403:
+                return False, "账号可能被封禁"
+            else:
+                return False, f"验证失败: HTTP {response.status_code}"
+
+        except Exception as e:
+            return False, f"验证异常: {str(e)}"
+
+
+def refresh_account_token(account_id: int, proxy_url: Optional[str] = None) -> TokenRefreshResult:
+    """
+    刷新指定账号的 Token 并更新数据库
+
+    Args:
+        account_id: 账号 ID
+        proxy_url: 代理 URL
+
+    Returns:
+        TokenRefreshResult: 刷新结果
+    """
+    with get_db() as db:
+        account = crud.get_account_by_id(db, account_id)
+        if not account:
+            return TokenRefreshResult(success=False, error_message="账号不存在")
+
+        manager = TokenRefreshManager(proxy_url=proxy_url)
+        result = manager.refresh_account(account)
+
+        if result.success:
+            # 更新数据库
+            update_data = {
+                "access_token": result.access_token,
+                "last_refresh": datetime.utcnow()
+            }
+
+            if result.refresh_token:
+                update_data["refresh_token"] = result.refresh_token
+
+            if result.expires_at:
+                update_data["expires_at"] = result.expires_at
+
+            crud.update_account(db, account_id, **update_data)
+
+        return result
+
+
+def validate_account_token(account_id: int, proxy_url: Optional[str] = None) -> Tuple[bool, Optional[str]]:
+    """
+    验证指定账号的 Token 是否有效
+
+    Args:
+        account_id: 账号 ID
+        proxy_url: ���理 URL
+
+    Returns:
+        Tuple[bool, Optional[str]]: (是否有效, 错误信息)
+    """
+    with get_db() as db:
+        account = crud.get_account_by_id(db, account_id)
+        if not account:
+            return False, "账号不存在"
+
+        if not account.access_token:
+            return False, "账号没有 access_token"
+
+        manager = TokenRefreshManager(proxy_url=proxy_url)
+        return manager.validate_token(account.access_token)

src/core/registration_post_create.py

@@ -0,0 +1,137 @@
+from __future__ import annotations
+
+from typing import Any, Callable, Dict, Optional
+
+
+POST_CREATE_RESUME_SOURCE = "post_create_continue"
+POST_CREATE_REENTERED_LOGIN_SOURCE = "post_create_continue_reentered_login"
+
+
+def is_post_create_continue_url(url: Optional[str]) -> bool:
+    candidate = str(url or "").strip().lower()
+    if not candidate:
+        return False
+    return any(
+        token in candidate
+        for token in (
+            "/add-phone",
+            "/sign-in-with-chatgpt/",
+            "/consent",
+            "/workspace/select",
+            "/organization/select",
+        )
+    )
+
+
+def extract_post_create_continue_url(data: Any) -> Optional[str]:
+    if isinstance(data, dict):
+        for key, value in data.items():
+            if isinstance(value, str):
+                candidate = value.strip()
+                key_text = str(key).strip().lower()
+                if key_text == "type" and candidate.lower() in {"add_phone", "add-phone"}:
+                    return "https://auth.openai.com/add-phone"
+                if key_text in {"continue_url", "url", "location", "redirect_url"} and is_post_create_continue_url(candidate):
+                    return candidate
+                if is_post_create_continue_url(candidate):
+                    return candidate
+            candidate = extract_post_create_continue_url(value)
+            if candidate:
+                return candidate
+    elif isinstance(data, list):
+        for item in data:
+            candidate = extract_post_create_continue_url(item)
+            if candidate:
+                return candidate
+    return None
+
+
+def get_locked_post_create_continue_url(workspace_context: Dict[str, Any]) -> str:
+    return str(workspace_context.get("post_create_continue_url") or "").strip()
+
+
+def lock_post_create_continue_url(
+    workspace_context: Dict[str, Any],
+    candidate: Optional[str],
+    *,
+    source_name: str,
+    log_fn: Callable[[str], None],
+    sanitize_url: Callable[[Optional[str]], str],
+) -> bool:
+    candidate_text = str(candidate or "").strip()
+    if not is_post_create_continue_url(candidate_text):
+        return False
+
+    current_locked = get_locked_post_create_continue_url(workspace_context)
+    current_resume = str(workspace_context.get("resume_url") or "").strip()
+
+    if current_locked == candidate_text and current_resume == candidate_text:
+        workspace_context["post_create_continue_source"] = source_name
+        return True
+
+    if current_resume and current_resume != candidate_text:
+        log_fn(
+            "post_create_continue_overrode_cached_resume: "
+            f"current={sanitize_url(current_resume) or '-'}; "
+            f"new={sanitize_url(candidate_text)}"
+        )
+
+    if current_locked and current_locked != candidate_text:
+        log_fn(
+            "post_create_continue_upgraded: "
+            f"current={sanitize_url(current_locked)}; "
+            f"new={sanitize_url(candidate_text)}"
+        )
+    else:
+        log_fn(f"post_create_continue_locked: {sanitize_url(candidate_text)}")
+
+    workspace_context["post_create_continue_url"] = candidate_text
+    workspace_context["post_create_continue_source"] = source_name
+    workspace_context["continue_url"] = candidate_text
+    workspace_context["resume_url"] = candidate_text
+    workspace_context["resume_source"] = POST_CREATE_RESUME_SOURCE
+    return True
+
+
+def should_preserve_locked_post_create_continue(
+    workspace_context: Dict[str, Any],
+    candidate: Optional[str],
+) -> bool:
+    current_locked = get_locked_post_create_continue_url(workspace_context)
+    if not current_locked:
+        return False
+
+    current_resume = str(workspace_context.get("resume_url") or "").strip()
+    candidate_text = str(candidate or "").strip()
+    if not candidate_text or candidate_text == current_resume:
+        return False
+
+    if current_resume != current_locked:
+        return False
+
+    return not is_post_create_continue_url(candidate_text)
+
+
+def build_post_create_failure_details(
+    *,
+    locked_url: Optional[str],
+    terminal_url: Optional[str],
+    resolution_error: Optional[str],
+    reentered_login: bool,
+) -> Dict[str, Optional[str]]:
+    if reentered_login:
+        error_message = "账号已创建，但 post-create 续跑重新进入登录页"
+        summary_reason = POST_CREATE_REENTERED_LOGIN_SOURCE
+    else:
+        error_message = "账号已创建，但 post-create 续跑失败"
+        summary_reason = "post_create_continue_failed"
+
+    return {
+        "error_message": error_message,
+        "resume_source": summary_reason,
+        "summary_reason": summary_reason,
+        "workspace_resolution_source": POST_CREATE_RESUME_SOURCE,
+        "locked_url": str(locked_url or "").strip() or None,
+        "terminal_url": str(terminal_url or "").strip() or None,
+        "resolution_error": str(resolution_error or "").strip() or None,
+    }

src/core/registration_upload.py

@@ -0,0 +1,48 @@
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from ..database.models import Account
+from .service_selection import UploadTarget
+from .upload.cpa_upload import generate_token_json, upload_to_cpa
+from .upload.sub2api_upload import upload_to_sub2api
+from .upload.team_manager_upload import upload_to_team_manager
+
+
+@dataclass
+class UploadExecutionResult:
+    success: bool
+    provider: str
+    service_id: int
+    message: str
+
+
+def upload_registered_account(account: Account, target: UploadTarget) -> UploadExecutionResult:
+    if account is None:
+        return UploadExecutionResult(False, target.provider, target.service_id, 'account_not_found')
+    if not account.access_token:
+        return UploadExecutionResult(False, target.provider, target.service_id, 'missing_access_token')
+
+    if target.provider == 'cpa':
+        ok, message = upload_to_cpa(
+            generate_token_json(account),
+            api_url=target.config_snapshot['api_url'],
+            api_token=target.config_snapshot['api_token'],
+        )
+    elif target.provider == 'sub2api':
+        ok, message = upload_to_sub2api(
+            [account],
+            target.config_snapshot['api_url'],
+            target.config_snapshot['api_key'],
+        )
+    elif target.provider == 'tm':
+        ok, message = upload_to_team_manager(
+            account,
+            target.config_snapshot['api_url'],
+            target.config_snapshot['api_key'],
+        )
+    else:
+        return UploadExecutionResult(False, target.provider, target.service_id, 'unsupported_provider')
+
+    return UploadExecutionResult(ok, target.provider, target.service_id, message)

src/core/service_selection.py

@@ -0,0 +1,163 @@
+
+from __future__ import annotations
+
+import random
+from dataclasses import dataclass
+from typing import Any, Optional
+
+from sqlalchemy.orm import Session
+
+from ..database import crud
+
+
+@dataclass
+class EmailItemAssignment:
+    item_index: int
+    service_id: Optional[int]
+    service_type: str
+    failure_reason: Optional[str] = None
+    config_snapshot: Optional[dict[str, Any]] = None
+
+
+@dataclass
+class UploadTarget:
+    provider: str
+    service_id: int
+    service_name: str
+    config_snapshot: dict[str, Any]
+
+
+def _get_enabled_email_services(db: Session, email_type: str):
+    return crud.get_email_services(db, service_type=email_type, enabled=True)
+
+
+def _get_email_service_or_raise(db: Session, email_type: str, requested_service_id: int):
+    service = crud.get_email_service_by_id(db, requested_service_id)
+    if not service:
+        raise ValueError(f"email service {requested_service_id} not found")
+    if not service.enabled:
+        raise ValueError(f"email service {requested_service_id} is disabled")
+    if service.service_type != email_type:
+        raise ValueError(f"email service {requested_service_id} does not belong to type {email_type}")
+    return service
+
+
+def build_email_item_assignments(
+    db: Session,
+    *,
+    email_type: str,
+    count: int,
+    requested_service_id: Optional[int] = None,
+) -> list[EmailItemAssignment]:
+    if count < 1:
+        raise ValueError('count must be >= 1')
+
+    if requested_service_id is not None:
+        service = _get_email_service_or_raise(db, email_type, requested_service_id)
+        if email_type == 'outlook' and count > 1:
+            raise ValueError('outlook requested_service_id cannot be reused when count > 1')
+        return [
+            EmailItemAssignment(
+                item_index=index,
+                service_id=service.id,
+                service_type=email_type,
+                config_snapshot=(service.config or {}).copy(),
+            )
+            for index in range(count)
+        ]
+
+    services = _get_enabled_email_services(db, email_type)
+    if not services:
+        raise ValueError(f'no enabled email services for type {email_type}')
+
+    if email_type == 'outlook':
+        assignments: list[EmailItemAssignment] = []
+        for index in range(count):
+            if index < len(services):
+                service = services[index]
+                assignments.append(
+                    EmailItemAssignment(
+                        item_index=index,
+                        service_id=service.id,
+                        service_type=email_type,
+                        config_snapshot=(service.config or {}).copy(),
+                    )
+                )
+            else:
+                assignments.append(
+                    EmailItemAssignment(
+                        item_index=index,
+                        service_id=None,
+                        service_type=email_type,
+                        failure_reason='no_available_email_service',
+                    )
+                )
+        return assignments
+
+    if email_type == 'temp_mail':
+        min_priority = min(service.priority for service in services)
+        pool = [service for service in services if service.priority == min_priority]
+        return [
+            EmailItemAssignment(
+                item_index=index,
+                service_id=(selected := random.choice(pool)).id,
+                service_type=email_type,
+                config_snapshot=(selected.config or {}).copy(),
+            )
+            for index in range(count)
+        ]
+
+    service = services[0]
+    return [
+        EmailItemAssignment(
+            item_index=index,
+            service_id=service.id,
+            service_type=email_type,
+            config_snapshot=(service.config or {}).copy(),
+        )
+        for index in range(count)
+    ]
+
+
+def resolve_upload_target(db: Session, *, provider: str, requested_service_id: Optional[int] = None) -> UploadTarget:
+    provider = (provider or '').strip().lower()
+    provider_to_crud = {
+        'cpa': (crud.get_cpa_service_by_id, lambda session: crud.get_cpa_services(session, enabled=True)),
+        'sub2api': (crud.get_sub2api_service_by_id, lambda session: crud.get_sub2api_services(session, enabled=True)),
+        'tm': (crud.get_tm_service_by_id, lambda session: crud.get_tm_services(session, enabled=True)),
+    }
+    if provider not in provider_to_crud:
+        raise ValueError(f'unsupported upload provider: {provider}')
+
+    get_one, list_enabled = provider_to_crud[provider]
+    if requested_service_id is not None:
+        service = get_one(db, requested_service_id)
+        if not service:
+            for other_provider, (other_get_one, _) in provider_to_crud.items():
+                if other_provider == provider:
+                    continue
+                if other_get_one(db, requested_service_id):
+                    raise ValueError(f'upload service {requested_service_id} does not belong to provider {provider}')
+            raise ValueError(f'upload service {requested_service_id} not found')
+        if not getattr(service, 'enabled', False):
+            raise ValueError(f'upload service {requested_service_id} is disabled')
+        service_pool = {svc.id for svc in list_enabled(db)}
+        if service.id not in service_pool:
+            raise ValueError(f'upload service {requested_service_id} does not belong to provider {provider}')
+    else:
+        services = list_enabled(db)
+        if not services:
+            raise ValueError(f'no enabled upload services for provider {provider}')
+        service = services[0]
+
+    if provider == 'cpa':
+        config_snapshot = {'api_url': service.api_url, 'api_token': service.api_token}
+    else:
+        config_snapshot = {'api_url': service.api_url, 'api_key': service.api_key}
+
+    return UploadTarget(
+        provider=provider,
+        service_id=service.id,
+        service_name=service.name,
+        config_snapshot=config_snapshot,
+    )

src/core/upload/__init__.py

@@ -0,0 +1,3 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+# @Time : 2026/3/18 19:54

src/core/upload/cpa_upload.py

@@ -0,0 +1,312 @@
+"""
+CPA (Codex Protocol API) 上传功能
+"""
+
+import json
+import logging
+from typing import List, Dict, Any, Tuple, Optional
+from datetime import datetime
+from urllib.parse import quote
+
+from curl_cffi import requests as cffi_requests
+from curl_cffi import CurlMime
+
+from ...database.session import get_db
+from ...database.models import Account
+from ...config.settings import get_settings
+
+logger = logging.getLogger(__name__)
+
+
+def _normalize_cpa_auth_files_url(api_url: str) -> str:
+    """将用户填写的 CPA 地址规范化为 auth-files 接口地址。"""
+    normalized = (api_url or "").strip().rstrip("/")
+    lower_url = normalized.lower()
+
+    if not normalized:
+        return ""
+
+    if lower_url.endswith("/auth-files"):
+        return normalized
+
+    if lower_url.endswith("/v0/management") or lower_url.endswith("/management"):
+        return f"{normalized}/auth-files"
+
+    if lower_url.endswith("/v0"):
+        return f"{normalized}/management/auth-files"
+
+    return f"{normalized}/v0/management/auth-files"
+
+
+def _build_cpa_headers(api_token: str, content_type: Optional[str] = None) -> dict:
+    headers = {
+        "Authorization": f"Bearer {api_token}",
+    }
+    if content_type:
+        headers["Content-Type"] = content_type
+    return headers
+
+
+def _extract_cpa_error(response) -> str:
+    error_msg = f"上传失败: HTTP {response.status_code}"
+    try:
+        error_detail = response.json()
+        if isinstance(error_detail, dict):
+            error_msg = error_detail.get("message", error_msg)
+    except Exception:
+        error_msg = f"{error_msg} - {response.text[:200]}"
+    return error_msg
+
+
+def _post_cpa_auth_file_multipart(upload_url: str, filename: str, file_content: bytes, api_token: str):
+    mime = CurlMime()
+    mime.addpart(
+        name="file",
+        data=file_content,
+        filename=filename,
+        content_type="application/json",
+    )
+
+    return cffi_requests.post(
+        upload_url,
+        multipart=mime,
+        headers=_build_cpa_headers(api_token),
+        proxies=None,
+        timeout=30,
+        impersonate="chrome110",
+    )
+
+
+def _post_cpa_auth_file_raw_json(upload_url: str, filename: str, file_content: bytes, api_token: str):
+    raw_upload_url = f"{upload_url}?name={quote(filename)}"
+    return cffi_requests.post(
+        raw_upload_url,
+        data=file_content,
+        headers=_build_cpa_headers(api_token, content_type="application/json"),
+        proxies=None,
+        timeout=30,
+        impersonate="chrome110",
+    )
+
+
+def generate_token_json(account: Account) -> dict:
+    """
+    生成 CPA 格式的 Token JSON
+
+    Args:
+        account: 账号模型实例
+
+    Returns:
+        CPA 格式的 Token 字典
+    """
+    return {
+        "type": "codex",
+        "email": account.email,
+        "expired": account.expires_at.strftime("%Y-%m-%dT%H:%M:%S+08:00") if account.expires_at else "",
+        "id_token": account.id_token or "",
+        "account_id": account.account_id or "",
+        "access_token": account.access_token or "",
+        "last_refresh": account.last_refresh.strftime("%Y-%m-%dT%H:%M:%S+08:00") if account.last_refresh else "",
+        "refresh_token": account.refresh_token or "",
+    }
+
+
+def upload_to_cpa(
+    token_data: dict,
+    proxy: str = None,
+    api_url: str = None,
+    api_token: str = None,
+) -> Tuple[bool, str]:
+    """
+    上传单个账号到 CPA 管理平台（不走代理）
+
+    Args:
+        token_data: Token JSON 数据
+        proxy: 保留参数，不使用（CPA 上传始终直连）
+        api_url: 指定 CPA API URL（优先于全局配置）
+        api_token: 指定 CPA API Token（优先于全局配置）
+
+    Returns:
+        (成功标志, 消息或错误信息)
+    """
+    settings = get_settings()
+
+    # 优先使用传入的参数，否则退回全局配置
+    effective_url = api_url or settings.cpa_api_url
+    effective_token = api_token or (settings.cpa_api_token.get_secret_value() if settings.cpa_api_token else "")
+
+    # 仅当未指定服务时才检查全局启用开关
+    if not api_url and not settings.cpa_enabled:
+        return False, "CPA 上传未启用"
+
+    if not effective_url:
+        return False, "CPA API URL 未配置"
+
+    if not effective_token:
+        return False, "CPA API Token 未配置"
+
+    upload_url = _normalize_cpa_auth_files_url(effective_url)
+
+    filename = f"{token_data['email']}.json"
+    file_content = json.dumps(token_data, ensure_ascii=False, indent=2).encode("utf-8")
+
+    try:
+        response = _post_cpa_auth_file_multipart(
+            upload_url,
+            filename,
+            file_content,
+            effective_token,
+        )
+
+        if response.status_code in (200, 201):
+            return True, "上传成功"
+
+        if response.status_code in (404, 405, 415):
+            logger.warning("CPA multipart 上传失败，尝试原始 JSON 回退: %s", response.status_code)
+            fallback_response = _post_cpa_auth_file_raw_json(
+                upload_url,
+                filename,
+                file_content,
+                effective_token,
+            )
+            if fallback_response.status_code in (200, 201):
+                return True, "上传成功"
+            response = fallback_response
+
+        return False, _extract_cpa_error(response)
+
+    except Exception as e:
+        logger.error(f"CPA 上传异常: {e}")
+        return False, f"上传异常: {str(e)}"
+
+
+def batch_upload_to_cpa(
+    account_ids: List[int],
+    proxy: str = None,
+    api_url: str = None,
+    api_token: str = None,
+) -> dict:
+    """
+    批量上传账号到 CPA 管理平台
+
+    Args:
+        account_ids: 账号 ID 列表
+        proxy: 可选的代理 URL
+        api_url: 指定 CPA API URL（优先于全局配置）
+        api_token: 指定 CPA API Token（优先于全局配置）
+
+    Returns:
+        包含成功/失败统计和详情的字典
+    """
+    results = {
+        "success_count": 0,
+        "failed_count": 0,
+        "skipped_count": 0,
+        "details": []
+    }
+
+    with get_db() as db:
+        for account_id in account_ids:
+            account = db.query(Account).filter(Account.id == account_id).first()
+
+            if not account:
+                results["failed_count"] += 1
+                results["details"].append({
+                    "id": account_id,
+                    "email": None,
+                    "success": False,
+                    "error": "账号不存在"
+                })
+                continue
+
+            # 检查是否已有 Token
+            if not account.access_token:
+                results["skipped_count"] += 1
+                results["details"].append({
+                    "id": account_id,
+                    "email": account.email,
+                    "success": False,
+                    "error": "缺少 Token"
+                })
+                continue
+
+            # 生成 Token JSON
+            token_data = generate_token_json(account)
+
+            # 上传
+            success, message = upload_to_cpa(token_data, proxy, api_url=api_url, api_token=api_token)
+
+            if success:
+                # 更新数据库状态
+                account.cpa_uploaded = True
+                account.cpa_uploaded_at = datetime.utcnow()
+                db.commit()
+
+                results["success_count"] += 1
+                results["details"].append({
+                    "id": account_id,
+                    "email": account.email,
+                    "success": True,
+                    "message": message
+                })
+            else:
+                results["failed_count"] += 1
+                results["details"].append({
+                    "id": account_id,
+                    "email": account.email,
+                    "success": False,
+                    "error": message
+                })
+
+    return results
+
+
+def test_cpa_connection(api_url: str, api_token: str, proxy: str = None) -> Tuple[bool, str]:
+    """
+    测试 CPA 连接（不走代理）
+
+    Args:
+        api_url: CPA API URL
+        api_token: CPA API Token
+        proxy: 保留参数，不使用（CPA 始终直连）
+
+    Returns:
+        (成功标志, 消息)
+    """
+    if not api_url:
+        return False, "API URL 不能为空"
+
+    if not api_token:
+        return False, "API Token 不能为空"
+
+    test_url = _normalize_cpa_auth_files_url(api_url)
+    headers = _build_cpa_headers(api_token)
+
+    try:
+        response = cffi_requests.get(
+            test_url,
+            headers=headers,
+            proxies=None,
+            timeout=10,
+            impersonate="chrome110",
+        )
+
+        if response.status_code == 200:
+            return True, "CPA 连接测试成功"
+        if response.status_code == 401:
+            return False, "连接成功，但 API Token 无效"
+        if response.status_code == 403:
+            return False, "连接成功，但服务端未启用远程管理或当前 Token 无权限"
+        if response.status_code == 404:
+            return False, "未找到 CPA auth-files 接口，请检查 API URL 是否填写为根地址、/v0/management 或完整 auth-files 地址"
+        if response.status_code == 503:
+            return False, "连接成功，但服务端认证管理器不可用"
+
+        return False, f"服务器返回异常状态码: {response.status_code}"
+
+    except cffi_requests.exceptions.ConnectionError as e:
+        return False, f"无法连接到服务器: {str(e)}"
+    except cffi_requests.exceptions.Timeout:
+        return False, "连接超时，请检查网络配置"
+    except Exception as e:
+        return False, f"连接测试失败: {str(e)}"

src/core/upload/sub2api_upload.py

@@ -0,0 +1,224 @@
+"""
+Sub2API 账号上传功能
+将账号以 sub2api-data 格式批量导入到 Sub2API 平台
+"""
+
+import json
+import logging
+from datetime import datetime, timezone
+from typing import List, Tuple, Optional
+
+from curl_cffi import requests as cffi_requests
+
+from ...database.session import get_db
+from ...database.models import Account
+
+logger = logging.getLogger(__name__)
+
+
+def upload_to_sub2api(
+    accounts: List[Account],
+    api_url: str,
+    api_key: str,
+    concurrency: int = 3,
+    priority: int = 50,
+) -> Tuple[bool, str]:
+    """
+    上传账号列表到 Sub2API 平台（不走代理）
+
+    Args:
+        accounts: 账号模型实例列表
+        api_url: Sub2API 地址，如 http://host
+        api_key: Admin API Key（x-api-key header）
+        concurrency: 账号并发数，默认 3
+        priority: 账号优先级，默认 50
+
+    Returns:
+        (成功标志, 消息)
+    """
+    if not accounts:
+        return False, "无可上传的账号"
+
+    if not api_url:
+        return False, "Sub2API URL 未配置"
+
+    if not api_key:
+        return False, "Sub2API API Key 未配置"
+
+    exported_at = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+    account_items = []
+    for acc in accounts:
+        if not acc.access_token:
+            continue
+        expires_at = int(acc.expires_at.timestamp()) if acc.expires_at else 0
+        account_items.append({
+            "name": acc.email,
+            "platform": "openai",
+            "type": "oauth",
+            "credentials": {
+                "access_token": acc.access_token,
+                "chatgpt_account_id": acc.account_id or "",
+                "chatgpt_user_id": "",
+                "client_id": acc.client_id or "",
+                "expires_at": expires_at,
+                "expires_in": 863999,
+                "model_mapping": {
+                    "gpt-5.1": "gpt-5.1",
+                    "gpt-5.1-codex": "gpt-5.1-codex",
+                    "gpt-5.1-codex-max": "gpt-5.1-codex-max",
+                    "gpt-5.1-codex-mini": "gpt-5.1-codex-mini",
+                    "gpt-5.2": "gpt-5.2",
+                    "gpt-5.2-codex": "gpt-5.2-codex",
+                    "gpt-5.3": "gpt-5.3",
+                    "gpt-5.3-codex": "gpt-5.3-codex",
+                    "gpt-5.4": "gpt-5.4"
+                },
+                "organization_id": acc.workspace_id or "",
+                "refresh_token": acc.refresh_token or "",
+            },
+            "extra": {},
+            "concurrency": concurrency,
+            "priority": priority,
+            "rate_multiplier": 1,
+            "auto_pause_on_expired": True,
+        })
+
+    if not account_items:
+        return False, "所有账号均缺少 access_token，无法上传"
+
+    payload = {
+        "data": {
+            "type": "sub2api-data",
+            "version": 1,
+            "exported_at": exported_at,
+            "proxies": [],
+            "accounts": account_items,
+        },
+        "skip_default_group_bind": True,
+    }
+
+    url = api_url.rstrip("/") + "/api/v1/admin/accounts/data"
+    headers = {
+        "Content-Type": "application/json",
+        "x-api-key": api_key,
+        "Idempotency-Key": f"import-{exported_at}",
+    }
+
+    try:
+        response = cffi_requests.post(
+            url,
+            json=payload,
+            headers=headers,
+            proxies=None,
+            timeout=30,
+            impersonate="chrome110",
+        )
+
+        if response.status_code in (200, 201):
+            return True, f"成功上传 {len(account_items)} 个账号"
+
+        error_msg = f"上传失败: HTTP {response.status_code}"
+        try:
+            detail = response.json()
+            if isinstance(detail, dict):
+                error_msg = detail.get("message", error_msg)
+        except Exception:
+            error_msg = f"{error_msg} - {response.text[:200]}"
+        return False, error_msg
+
+    except Exception as e:
+        logger.error(f"Sub2API 上传异常: {e}")
+        return False, f"上传异常: {str(e)}"
+
+
+def batch_upload_to_sub2api(
+    account_ids: List[int],
+    api_url: str,
+    api_key: str,
+    concurrency: int = 3,
+    priority: int = 50,
+) -> dict:
+    """
+    批量上传指定 ID 的账号到 Sub2API 平台
+
+    Returns:
+        包含成功/失败/跳过统计和详情的字典
+    """
+    results = {
+        "success_count": 0,
+        "failed_count": 0,
+        "skipped_count": 0,
+        "details": []
+    }
+
+    with get_db() as db:
+        accounts = []
+        for account_id in account_ids:
+            acc = db.query(Account).filter(Account.id == account_id).first()
+            if not acc:
+                results["failed_count"] += 1
+                results["details"].append({"id": account_id, "email": None, "success": False, "error": "账号不存在"})
+                continue
+            if not acc.access_token:
+                results["skipped_count"] += 1
+                results["details"].append({"id": account_id, "email": acc.email, "success": False, "error": "缺少 access_token"})
+                continue
+            accounts.append(acc)
+
+        if not accounts:
+            return results
+
+        success, message = upload_to_sub2api(accounts, api_url, api_key, concurrency, priority)
+
+        if success:
+            for acc in accounts:
+                results["success_count"] += 1
+                results["details"].append({"id": acc.id, "email": acc.email, "success": True, "message": message})
+        else:
+            for acc in accounts:
+                results["failed_count"] += 1
+                results["details"].append({"id": acc.id, "email": acc.email, "success": False, "error": message})
+
+    return results
+
+
+def test_sub2api_connection(api_url: str, api_key: str) -> Tuple[bool, str]:
+    """
+    测试 Sub2API 连接（GET /api/v1/admin/accounts/data 探活）
+
+    Returns:
+        (成功标志, 消息)
+    """
+    if not api_url:
+        return False, "API URL 不能为空"
+    if not api_key:
+        return False, "API Key 不能为空"
+
+    url = api_url.rstrip("/") + "/api/v1/admin/accounts/data"
+    headers = {"x-api-key": api_key}
+
+    try:
+        response = cffi_requests.get(
+            url,
+            headers=headers,
+            proxies=None,
+            timeout=10,
+            impersonate="chrome110",
+        )
+
+        if response.status_code in (200, 201, 204, 405):
+            return True, "Sub2API 连接测试成功"
+        if response.status_code == 401:
+            return False, "连接成功，但 API Key 无效"
+        if response.status_code == 403:
+            return False, "连接成功，但权限不足"
+
+        return False, f"服务器返回异常状态码: {response.status_code}"
+
+    except cffi_requests.exceptions.ConnectionError as e:
+        return False, f"无法连接到服务器: {str(e)}"
+    except cffi_requests.exceptions.Timeout:
+        return False, "连接超时，请检查网络配置"
+    except Exception as e:
+        return False, f"连接测试失败: {str(e)}"