Release v1.0.6

Author: AuuCoder

CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 1.0.6 - 2026-07-20
+
++ [新增] macOS 本地 Captcha Solver 支持 Docker/Xvfb 运行有头 Chromium，浏览器不再弹到桌面，并提供 Compose、缓存持久化和一键启动脚本。
++ [优化] Turnstile 从全局单锁升级为共享动态并发限制器；注册中心可配置注册解题并发、单次解题超时、排队超时和本地尝试次数。
++ [优化] 浏览器上下文和 CloakBrowser 进程在成功、失败与超时后统一释放，降低批量注册时的内存、PID 和残留 Chromium 数量。
++ [修复] Grok Device Code OAuth 复用注册任务的真实代理，并将代理继续透传给登录 Turnstile，修复 OAuth `sign-in` 实际走直连导致的 `600010` 和持续无 token。
++ [变更] Grok 注册成功后立即进入单线程 OAuth 上传队列，不再等待整批注册结束；注册运行时自动预留一个额外 solver 槽位，注册线程与上传互不串行。
++ [优化] OAuth 的 Turnstile、登录、consent 和 token 等瞬时失败自动有限重试；授权队列保持单线程，避免多个 OAuth `sign-in` 同时争抢浏览器资源。
++ [新增] NovaApi 与 CPA 在 OAuth 完成后按启用配置并行即时投递，分别记录成功、失败或跳过状态，并在注册日志中显示明确终态。
++ [文档] 更新 README、macOS/Ubuntu 从零部署、NovaApi/CPA 自动上传和日志排错教程，说明 Docker/Xvfb、即时上传、额外 OAuth 槽位及内存调优方式。
+
 ## 1.0.5 - 2026-07-19
 
 + [修复] OpenAI 注册默认切回 `PlatformRegistrar`，对齐上游最新 authorize/passwordless signup 链路，保留传统密码流程作为显式回退。

README.md

@@ -23,10 +23,10 @@ GPTGrok2API 是一个自托管的 GPT 与 Grok 统一网关，将已接入的订
 | iCloud 定时创建 | 按 Apple 账号定时创建邮箱；新接口每小时最多 20 个、旧接口每小时最多 5 个，每账号累计 750 个后自动停止。sidecar 使用 Compose 内部网络，不需要独立账号或宿主机端口。 |
 | 邮箱平台标签 | 同一邮箱可分别标记 GPT 和 Grok；GPT 标签为绿色、Grok 标签为蓝色，两个标签同时存在才算已使用，注册领取按目标平台隔离。 |
 | 注册中心 | 支持 OpenAI 与 Grok 注册任务，整合临时邮箱、GPTMail、Outlook Token、Microsoft Alias 和 iCloud Privacy Mail；内置 iCloud provider 不需要填写域名、API Base 或 API Key。 |
-| 本地 Captcha Solver | 源码内置于 `captcha-solver/`，使用 CloakBrowser/Chromium 处理 Grok Turnstile 实页校验，支持注册代理按请求透传，不需要额外克隆第二个仓库。 |
+| 本地 Captcha Solver | 源码内置于 `captcha-solver/`，使用 Docker/Xvfb 中的有头 CloakBrowser/Chromium 处理 Grok Turnstile，支持动态并发、代理透传和浏览器资源回收，不需要额外克隆第二个仓库。 |
 | Checkout 提链 | 注册 Checkout 仅保留 UPI 最终支付链接提取；IN Checkout、Provider、Approve 共享同一 sticky 出口，VN Promotion 使用独立代理持续轮换重试。 |
 | 代理与稳定出口 | 支持全局代理、账号代理、代理配置、代理组、节点并发限制、故障反馈、备用出口、WARP、Privoxy、FlareSolverr 和 Clearance 刷新。 |
-| 外部系统接入 | 支持从 Sub2API、远程 CPA、本地 CPA 和 Access Token 导入账号；OpenAI/Grok 注册后可自动投递 NovaApi 和 CPA；服务器部署提供 `gptgrok2api` Docker 网络别名。 |
+| 外部系统接入 | 支持从 Sub2API、远程 CPA、本地 CPA 和 Access Token 导入账号；Grok 注册成功后立即顺序完成 OAuth，并按配置并行投递 NovaApi 与 CPA；服务器部署提供 `gptgrok2api` Docker 网络别名。 |
 | 管理控制台 | 提供概览、GPT/Grok 账号管理、Grok Runtime、iCloud 邮箱、注册任务、Checkout 任务、代理管理、日志、实时监控、图片管理、调试中心和系统设置。 |
 | 存储与备份 | 账号数据支持 JSON、SQLite、PostgreSQL 和 Git 后端；图片支持本地与 WebDAV；备份支持本地归档和 R2。 |
 | 运维与发布 | 支持 Docker Compose、WARP 编排、内置 sidecar、Nginx HTTPS、运行日志、指标趋势、健康检查和 GitHub Releases 更新源。 |
@@ -59,7 +59,7 @@ uv venv --python 3.13 .venv
 uv pip install --python .venv/bin/python -r requirements.txt
 ```
 
-macOS 使用 `deploy/launchd/com.chatgpt2api.captcha-solver.plist.example`，Ubuntu/Linux 使用 `deploy/systemd/captcha-solver.service.example`。两份模板都默认从 `<项目目录>/captcha-solver` 启动，详细步骤见 macOS/Ubuntu 新手手册。
+macOS 需要“有头但不弹窗”时，推荐使用 `deploy/docker-compose.captcha-solver.yml` 在 Docker/Xvfb 中运行；原生 LaunchAgent 会显示 Chromium 窗口。Ubuntu/Linux 使用 `deploy/systemd/captcha-solver.service.example`。详细步骤见 macOS/Ubuntu 新手手册。
 
 ## 系统结构
 
@@ -114,6 +114,7 @@ curl https://pro.muyuai.top/v1/chat/completions \
 服务模板：
 
 - macOS：[主程序 LaunchAgent](deploy/launchd/com.chatgpt2api.app.plist.example) / [Captcha Solver LaunchAgent](deploy/launchd/com.chatgpt2api.captcha-solver.plist.example)
+- macOS 隐藏有头浏览器：[Captcha Solver Docker/Xvfb Compose](deploy/docker-compose.captcha-solver.yml)
 - Ubuntu：[主程序 systemd unit](deploy/systemd/chatgpt2api.service.example) / [Captcha Solver systemd unit](deploy/systemd/captcha-solver.service.example)
 
 ## Docker 部署

VERSION

@@ -1 +1 @@
-1.0.5
+1.0.6

captcha-solver/.dockerignore

@@ -0,0 +1,6 @@
+.venv/
+__pycache__/
+*.pyc
+*.pyo
+*.log
+.DS_Store

captcha-solver/Dockerfile

@@ -0,0 +1,23 @@
+FROM mcr.microsoft.com/playwright/python:v1.61.0-noble
+
+ENV PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    TURNSTILE_HEADLESS=0 \
+    SOLVER_ALLOW_PRIVATE=1 \
+    TURNSTILE_CONCURRENCY=2 \
+    SOLVER_LOOPBACK_PROXY_HOST=host.docker.internal
+
+WORKDIR /app
+
+COPY requirements.txt ./requirements.txt
+RUN python -m pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+RUN chmod +x ./run-docker.sh
+
+EXPOSE 8877
+
+HEALTHCHECK --interval=15s --timeout=5s --start-period=30s --retries=4 \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8877/health', timeout=3)"
+
+CMD ["./run-docker.sh"]

captcha-solver/README.md

@@ -121,8 +121,32 @@ browser.
 | ----------------------- | ------- | ------------------------------------------- |
 | `PORT`                  | `8877`  | Listen port                                 |
 | `TURNSTILE_HEADLESS`    | `1`     | `0` = run Turnstile headed                  |
+| `TURNSTILE_HIDE_WINDOW` | unset   | `1` = request an off-screen headed window (window managers may clamp it back on-screen) |
+| `SOLVER_LOOPBACK_PROXY_HOST` | unset | Rewrite `127.0.0.1`/`localhost` in per-request proxies, normally `host.docker.internal` inside Docker Desktop |
+
+For a 16 GB Mac, start Grok registration at 3 worker threads and local
+concurrency 3. The tuned defaults use a 45-second active solve budget, a
+separate 60-second queue budget, and up to 3 browser attempts. Queue waiting no
+longer consumes the active browser solve deadline.
+
+### macOS: headed mode without desktop windows
+
+macOS clamps native Chromium windows back onto a visible display. For a truly
+background headed browser, run the solver in Docker Desktop with Linux Xvfb:
+
+```bash
+docker compose -f deploy/docker-compose.captcha-solver.yml build
+docker compose -f deploy/docker-compose.captcha-solver.yml up -d
+curl http://127.0.0.1:8877/health
+```
+
+The browser remains headed inside the container's virtual display. The Compose
+service persists CloakBrowser downloads in a named volume and rewrites a
+per-request proxy such as `http://127.0.0.1:40080` to
+`http://host.docker.internal:40080`, so it can still reach a proxy on the Mac.
 | `TURNSTILE_PROXY`       | unset   | Proxy URL for Turnstile browser             |
 | `TURNSTILE_GEOIP`       | unset   | `1` = align browser timezone/locale/WebGL to the proxy exit IP (shared by Turnstile + cloudflare + awswaf) |
+| `TURNSTILE_CONCURRENCY` | `2`     | Default simultaneous Turnstile browser attempts; Grok requests override it dynamically, including one reserved OAuth slot during immediate upload |
 | `RECAPTCHA_HEADLESS`    | `0`     | `1` = run reCAPTCHA headless                |
 | `RECAPTCHA_PROXY`       | unset   | Proxy URL for reCAPTCHA browser             |
 | `RECAPTCHA_GEOIP`       | unset   | `1` = same geo alignment for the reCAPTCHA browser |

captcha-solver/common/browser.py

@@ -9,6 +9,7 @@
 import logging
 import os
 import re
+from urllib.parse import urlsplit, urlunsplit
 
 log = logging.getLogger(__name__)
 
@@ -24,6 +25,25 @@
 )
 
 
+def _rewrite_loopback_proxy(proxy: str) -> str:
+    """Map a host-loopback proxy to Docker Desktop's host gateway when requested."""
+    replacement = str(os.getenv("SOLVER_LOOPBACK_PROXY_HOST") or "").strip()
+    if not proxy or not replacement:
+        return proxy
+
+    try:
+        parts = urlsplit(proxy)
+    except ValueError:
+        return proxy
+    if parts.hostname not in {"127.0.0.1", "localhost", "::1"}:
+        return proxy
+
+    userinfo = parts.netloc.rsplit("@", 1)[0] + "@" if "@" in parts.netloc else ""
+    host = f"[{replacement}]" if ":" in replacement and not replacement.startswith("[") else replacement
+    port = f":{parts.port}" if parts.port is not None else ""
+    return urlunsplit((parts.scheme, f"{userinfo}{host}{port}", parts.path, parts.query, parts.fragment))
+
+
 async def resolve_selector(page, selector: str, timeout: int = 10000):
     """Resolve a selector string to a Playwright locator.
 
@@ -86,12 +106,15 @@ def browser_kwargs(prefix: str, proxy: str = None) -> dict:
     the interactive-checkbox solvers (recaptcha/hcaptcha) default headless=0.
     """
     default_headless = "1" if prefix == "TURNSTILE" else "0"
-    kw = {"humanize": True,
-          "headless": os.getenv(f"{prefix}_HEADLESS", default_headless) != "0"}
+    headless = os.getenv(f"{prefix}_HEADLESS", default_headless) != "0"
+    kw = {"humanize": True, "headless": headless}
+    if not headless and os.getenv(f"{prefix}_HIDE_WINDOW") == "1":
+        kw["args"] = ["--window-position=-32000,-32000", "--window-size=1280,900"]
+        kw["_suppress_maximize"] = True
     configured_proxy = str(proxy or os.getenv(f"{prefix}_PROXY") or "").strip()
     if configured_proxy:
-        kw["proxy"] = configured_proxy
-    if os.getenv(f"{prefix}_GEOIP") == "1":
+        kw["proxy"] = _rewrite_loopback_proxy(configured_proxy)
+    if configured_proxy and os.getenv(f"{prefix}_GEOIP") == "1":
         kw["geoip"] = True
     return kw
 

captcha-solver/common/browser_test.py

@@ -0,0 +1,61 @@
+import os
+import unittest
+from unittest.mock import patch
+
+from common.browser import browser_kwargs
+
+
+class BrowserKwargsTest(unittest.TestCase):
+    def test_hidden_headed_mode_uses_offscreen_window(self):
+        with patch.dict(
+            os.environ,
+            {"TURNSTILE_HEADLESS": "0", "TURNSTILE_HIDE_WINDOW": "1"},
+            clear=False,
+        ):
+            kwargs = browser_kwargs("TURNSTILE")
+
+        self.assertFalse(kwargs["headless"])
+        self.assertIn("--window-position=-32000,-32000", kwargs["args"])
+        self.assertIn("--window-size=1280,900", kwargs["args"])
+        self.assertTrue(kwargs["_suppress_maximize"])
+
+    def test_headless_mode_does_not_add_window_args(self):
+        with patch.dict(
+            os.environ,
+            {"TURNSTILE_HEADLESS": "1", "TURNSTILE_HIDE_WINDOW": "1"},
+            clear=False,
+        ):
+            kwargs = browser_kwargs("TURNSTILE")
+
+        self.assertTrue(kwargs["headless"])
+        self.assertNotIn("args", kwargs)
+        self.assertNotIn("_suppress_maximize", kwargs)
+
+    def test_docker_rewrites_loopback_proxy_to_host_gateway(self):
+        with (
+            patch.dict(
+                os.environ,
+                {"SOLVER_LOOPBACK_PROXY_HOST": "host.docker.internal"},
+                clear=False,
+            ),
+        ):
+            kwargs = browser_kwargs("TURNSTILE", "http://user:pass@127.0.0.1:40080")
+
+        self.assertEqual(
+            kwargs["proxy"],
+            "http://user:pass@host.docker.internal:40080",
+        )
+
+    def test_docker_keeps_non_loopback_proxy_unchanged(self):
+        with patch.dict(
+            os.environ,
+            {"SOLVER_LOOPBACK_PROXY_HOST": "host.docker.internal"},
+            clear=False,
+        ):
+            kwargs = browser_kwargs("TURNSTILE", "http://10.0.0.8:8080")
+
+        self.assertEqual(kwargs["proxy"], "http://10.0.0.8:8080")
+
+
+if __name__ == "__main__":
+    unittest.main()

captcha-solver/requirements.txt

@@ -2,8 +2,9 @@
 # (run.sh sources it); this file documents the runtime deps, it is not auto-installed.
 fastapi
 uvicorn
+websockets
 pydantic
-cloakbrowser
+cloakbrowser[geoip]
 pillow
 # Note: whisper/curl are NOT required — the audio-challenge path was removed
 # (it was dead code and reliably IP-blocked). reCAPTCHA/hCaptcha image challenges

captcha-solver/run-docker.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+set -eu
+
+python -c 'import cloakbrowser; cloakbrowser.ensure_binary()'
+Xvfb :99 -screen 0 1920x1080x24 -ac -nolisten tcp &
+export DISPLAY=:99
+
+exec python -m uvicorn server:app --host 0.0.0.0 --port 8877